Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1 | /** |
Chris Jones | 84a773f | 2021-03-05 18:38:47 +0000 | [diff] [blame] | 2 | * \file ssl_misc.h |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 3 | * |
| 4 | * \brief Internal functions shared by the SSL modules |
Darryl Green | a40a101 | 2018-01-05 15:33:17 +0000 | [diff] [blame] | 5 | */ |
| 6 | /* |
Bence Szépkúti | 1e14827 | 2020-08-07 13:07:28 +0200 | [diff] [blame] | 7 | * Copyright The Mbed TLS Contributors |
Dave Rodgman | 16799db | 2023-11-02 19:47:20 +0000 | [diff] [blame] | 8 | * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 9 | */ |
Chris Jones | 84a773f | 2021-03-05 18:38:47 +0000 | [diff] [blame] | 10 | #ifndef MBEDTLS_SSL_MISC_H |
| 11 | #define MBEDTLS_SSL_MISC_H |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 12 | |
Bence Szépkúti | 27125ce | 2025-07-18 19:10:04 +0200 | [diff] [blame] | 13 | #include "tf_psa_crypto_common.h" |
Ronald Cron | 51f228c | 2024-11-06 14:32:52 +0100 | [diff] [blame] | 14 | #include "mbedtls/build_info.h" |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 15 | |
Manuel Pégourié-Gonnard | d55d66f | 2023-06-20 10:14:58 +0200 | [diff] [blame] | 16 | #include "mbedtls/error.h" |
| 17 | |
Jaeden Amero | 6609aef | 2019-07-04 20:01:14 +0100 | [diff] [blame] | 18 | #include "mbedtls/ssl.h" |
Gilles Peskine | c67befe | 2025-03-07 20:45:29 +0100 | [diff] [blame] | 19 | #include "mbedtls/debug.h" |
| 20 | #include "debug_internal.h" |
| 21 | |
Anton Matkin | bc48725 | 2025-06-16 13:37:03 +0200 | [diff] [blame] | 22 | #include "mbedtls/private/cipher.h" |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 23 | |
Andrzej Kurek | eb34224 | 2019-01-29 09:14:33 -0500 | [diff] [blame] | 24 | #include "psa/crypto.h" |
Manuel Pégourié-Gonnard | 2be8c63 | 2023-06-07 13:07:21 +0200 | [diff] [blame] | 25 | #include "psa_util_internal.h" |
Harry Ramsey | 2547ae9 | 2025-01-20 10:04:53 +0000 | [diff] [blame] | 26 | extern const mbedtls_error_pair_t psa_to_ssl_errors[7]; |
Andrzej Kurek | eb34224 | 2019-01-29 09:14:33 -0500 | [diff] [blame] | 27 | |
Elena Uziunaite | b66a991 | 2024-05-10 14:25:58 +0100 | [diff] [blame] | 28 | #if defined(PSA_WANT_ALG_MD5) |
Anton Matkin | bc48725 | 2025-06-16 13:37:03 +0200 | [diff] [blame] | 29 | #include "mbedtls/private/md5.h" |
Manuel Pégourié-Gonnard | 56273da | 2015-05-26 12:19:45 +0200 | [diff] [blame] | 30 | #endif |
| 31 | |
Elena Uziunaite | 9fc5be0 | 2024-09-04 18:12:59 +0100 | [diff] [blame] | 32 | #if defined(PSA_WANT_ALG_SHA_1) |
Anton Matkin | bc48725 | 2025-06-16 13:37:03 +0200 | [diff] [blame] | 33 | #include "mbedtls/private/sha1.h" |
Manuel Pégourié-Gonnard | 56273da | 2015-05-26 12:19:45 +0200 | [diff] [blame] | 34 | #endif |
| 35 | |
Elena Uziunaite | 0916cd7 | 2024-05-23 17:01:07 +0100 | [diff] [blame] | 36 | #if defined(PSA_WANT_ALG_SHA_256) |
Anton Matkin | bc48725 | 2025-06-16 13:37:03 +0200 | [diff] [blame] | 37 | #include "mbedtls/private/sha256.h" |
Manuel Pégourié-Gonnard | 56273da | 2015-05-26 12:19:45 +0200 | [diff] [blame] | 38 | #endif |
| 39 | |
Gabor Mezei | c15ef93 | 2024-06-13 12:53:54 +0200 | [diff] [blame] | 40 | #if defined(PSA_WANT_ALG_SHA_512) |
Anton Matkin | bc48725 | 2025-06-16 13:37:03 +0200 | [diff] [blame] | 41 | #include "mbedtls/private/sha512.h" |
Manuel Pégourié-Gonnard | 56273da | 2015-05-26 12:19:45 +0200 | [diff] [blame] | 42 | #endif |
| 43 | |
Valerio Setti | 2f1d967 | 2023-03-07 18:14:34 +0100 | [diff] [blame] | 44 | #include "mbedtls/pk.h" |
Ben Taylor | 1030f80 | 2025-07-15 14:55:41 +0100 | [diff] [blame] | 45 | #if defined(MBEDTLS_PK_HAVE_PRIVATE_HEADER) |
| 46 | #include <mbedtls/private/pk_private.h> |
| 47 | #endif /* MBEDTLS_PK_HAVE_PRIVATE_HEADER */ |
Valerio Setti | d929106 | 2024-01-17 09:48:06 +0100 | [diff] [blame] | 48 | #include "ssl_ciphersuites_internal.h" |
Valerio Setti | 25b282e | 2024-01-17 10:55:32 +0100 | [diff] [blame] | 49 | #include "x509_internal.h" |
Valerio Setti | 3f00b84 | 2023-05-15 12:57:06 +0200 | [diff] [blame] | 50 | #include "pk_internal.h" |
Jerry Yu | 1bab301 | 2022-01-19 17:43:22 +0800 | [diff] [blame] | 51 | |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 52 | /* Shorthand for restartable ECC */ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 53 | #if defined(MBEDTLS_ECP_RESTARTABLE) && \ |
| 54 | defined(MBEDTLS_SSL_CLI_C) && \ |
| 55 | defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
| 56 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 57 | #define MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 58 | #endif |
| 59 | |
Gilles Peskine | 434016e | 2025-02-20 18:49:59 +0100 | [diff] [blame] | 60 | /** Flag values for mbedtls_ssl_context::flags. */ |
| 61 | typedef enum { |
| 62 | /** Set if mbedtls_ssl_set_hostname() has been called. */ |
| 63 | MBEDTLS_SSL_CONTEXT_FLAG_HOSTNAME_SET = 1, |
| 64 | } mbedtls_ssl_context_flags_t; |
| 65 | |
Gilles Peskine | fd89acc | 2025-02-24 18:45:49 +0100 | [diff] [blame] | 66 | /** Flags from ::mbedtls_ssl_context_flags_t to keep in |
| 67 | * mbedtls_ssl_session_reset(). |
| 68 | * |
| 69 | * The flags that are in this list are kept until explicitly updated or |
| 70 | * until mbedtls_ssl_free(). The flags that are not listed here are |
| 71 | * reset to 0 in mbedtls_ssl_session_reset(). |
| 72 | */ |
| 73 | #define MBEDTLS_SSL_CONTEXT_FLAGS_KEEP_AT_SESSION \ |
| 74 | (MBEDTLS_SSL_CONTEXT_FLAG_HOSTNAME_SET) |
| 75 | |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 76 | #define MBEDTLS_SSL_INITIAL_HANDSHAKE 0 |
| 77 | #define MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS 1 /* In progress */ |
| 78 | #define MBEDTLS_SSL_RENEGOTIATION_DONE 2 /* Done or aborted */ |
| 79 | #define MBEDTLS_SSL_RENEGOTIATION_PENDING 3 /* Requested (server only) */ |
| 80 | |
Jerry Yu | d25cab0 | 2022-10-31 12:48:30 +0800 | [diff] [blame] | 81 | /* Faked handshake message identity for HelloRetryRequest. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 82 | #define MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST (-MBEDTLS_SSL_HS_SERVER_HELLO) |
Jerry Yu | d25cab0 | 2022-10-31 12:48:30 +0800 | [diff] [blame] | 83 | |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 84 | /* |
Jerry Yu | ea52ed9 | 2022-11-08 21:01:17 +0800 | [diff] [blame] | 85 | * Internal identity of handshake extensions |
Jerry Yu | 8e7ca04 | 2021-08-26 15:31:37 +0800 | [diff] [blame] | 86 | */ |
Jerry Yu | 7a485c1 | 2022-10-31 13:08:18 +0800 | [diff] [blame] | 87 | #define MBEDTLS_SSL_EXT_ID_UNRECOGNIZED 0 |
| 88 | #define MBEDTLS_SSL_EXT_ID_SERVERNAME 1 |
| 89 | #define MBEDTLS_SSL_EXT_ID_SERVERNAME_HOSTNAME 1 |
| 90 | #define MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH 2 |
| 91 | #define MBEDTLS_SSL_EXT_ID_STATUS_REQUEST 3 |
| 92 | #define MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS 4 |
| 93 | #define MBEDTLS_SSL_EXT_ID_SUPPORTED_ELLIPTIC_CURVES 4 |
| 94 | #define MBEDTLS_SSL_EXT_ID_SIG_ALG 5 |
| 95 | #define MBEDTLS_SSL_EXT_ID_USE_SRTP 6 |
| 96 | #define MBEDTLS_SSL_EXT_ID_HEARTBEAT 7 |
| 97 | #define MBEDTLS_SSL_EXT_ID_ALPN 8 |
| 98 | #define MBEDTLS_SSL_EXT_ID_SCT 9 |
| 99 | #define MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE 10 |
| 100 | #define MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE 11 |
| 101 | #define MBEDTLS_SSL_EXT_ID_PADDING 12 |
| 102 | #define MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY 13 |
| 103 | #define MBEDTLS_SSL_EXT_ID_EARLY_DATA 14 |
| 104 | #define MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS 15 |
| 105 | #define MBEDTLS_SSL_EXT_ID_COOKIE 16 |
| 106 | #define MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES 17 |
| 107 | #define MBEDTLS_SSL_EXT_ID_CERT_AUTH 18 |
| 108 | #define MBEDTLS_SSL_EXT_ID_OID_FILTERS 19 |
| 109 | #define MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH 20 |
| 110 | #define MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT 21 |
| 111 | #define MBEDTLS_SSL_EXT_ID_KEY_SHARE 22 |
| 112 | #define MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC 23 |
| 113 | #define MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS 24 |
| 114 | #define MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC 25 |
| 115 | #define MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET 26 |
| 116 | #define MBEDTLS_SSL_EXT_ID_SESSION_TICKET 27 |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 117 | #define MBEDTLS_SSL_EXT_ID_RECORD_SIZE_LIMIT 28 |
Jerry Yu | 8e7ca04 | 2021-08-26 15:31:37 +0800 | [diff] [blame] | 118 | |
Jerry Yu | 7a485c1 | 2022-10-31 13:08:18 +0800 | [diff] [blame] | 119 | /* Utility for translating IANA extension type. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 120 | uint32_t mbedtls_ssl_get_extension_id(unsigned int extension_type); |
| 121 | uint32_t mbedtls_ssl_get_extension_mask(unsigned int extension_type); |
Jerry Yu | 7a485c1 | 2022-10-31 13:08:18 +0800 | [diff] [blame] | 122 | /* Macros used to define mask constants */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 123 | #define MBEDTLS_SSL_EXT_MASK(id) (1ULL << (MBEDTLS_SSL_EXT_ID_##id)) |
Jerry Yu | 7a485c1 | 2022-10-31 13:08:18 +0800 | [diff] [blame] | 124 | /* Reset value of extension mask */ |
| 125 | #define MBEDTLS_SSL_EXT_MASK_NONE 0 |
Jerry Yu | 93bcd61 | 2021-08-18 12:47:24 +0800 | [diff] [blame] | 126 | |
Jerry Yu | c4bf5d6 | 2022-10-29 09:08:47 +0800 | [diff] [blame] | 127 | /* In messages containing extension requests, we should ignore unrecognized |
| 128 | * extensions. In messages containing extension responses, unrecognized |
| 129 | * extensions should result in handshake abortion. Messages containing |
| 130 | * extension requests include ClientHello, CertificateRequest and |
| 131 | * NewSessionTicket. Messages containing extension responses include |
| 132 | * ServerHello, HelloRetryRequest, EncryptedExtensions and Certificate. |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 133 | * |
Jerry Yu | d15992d | 2022-08-29 10:58:31 +0800 | [diff] [blame] | 134 | * RFC 8446 section 4.1.3 |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 135 | * |
| 136 | * The ServerHello MUST only include extensions which are required to establish |
| 137 | * the cryptographic context and negotiate the protocol version. |
| 138 | * |
Jerry Yu | d15992d | 2022-08-29 10:58:31 +0800 | [diff] [blame] | 139 | * RFC 8446 section 4.2 |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 140 | * |
| 141 | * If an implementation receives an extension which it recognizes and which is |
| 142 | * not specified for the message in which it appears, it MUST abort the handshake |
| 143 | * with an "illegal_parameter" alert. |
| 144 | */ |
Jerry Yu | df0ad65 | 2022-10-31 13:20:57 +0800 | [diff] [blame] | 145 | |
Jerry Yu | ea52ed9 | 2022-11-08 21:01:17 +0800 | [diff] [blame] | 146 | /* Extensions that are not recognized by TLS 1.3 */ |
| 147 | #define MBEDTLS_SSL_TLS1_3_EXT_MASK_UNRECOGNIZED \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 148 | (MBEDTLS_SSL_EXT_MASK(SUPPORTED_POINT_FORMATS) | \ |
| 149 | MBEDTLS_SSL_EXT_MASK(ENCRYPT_THEN_MAC) | \ |
| 150 | MBEDTLS_SSL_EXT_MASK(EXTENDED_MASTER_SECRET) | \ |
| 151 | MBEDTLS_SSL_EXT_MASK(SESSION_TICKET) | \ |
| 152 | MBEDTLS_SSL_EXT_MASK(TRUNCATED_HMAC) | \ |
| 153 | MBEDTLS_SSL_EXT_MASK(UNRECOGNIZED)) |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 154 | |
Tom Cosgrove | 1797b05 | 2022-12-04 17:19:59 +0000 | [diff] [blame] | 155 | /* RFC 8446 section 4.2. Allowed extensions for ClientHello */ |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 156 | #define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CH \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 157 | (MBEDTLS_SSL_EXT_MASK(SERVERNAME) | \ |
| 158 | MBEDTLS_SSL_EXT_MASK(MAX_FRAGMENT_LENGTH) | \ |
| 159 | MBEDTLS_SSL_EXT_MASK(STATUS_REQUEST) | \ |
| 160 | MBEDTLS_SSL_EXT_MASK(SUPPORTED_GROUPS) | \ |
| 161 | MBEDTLS_SSL_EXT_MASK(SIG_ALG) | \ |
| 162 | MBEDTLS_SSL_EXT_MASK(USE_SRTP) | \ |
| 163 | MBEDTLS_SSL_EXT_MASK(HEARTBEAT) | \ |
| 164 | MBEDTLS_SSL_EXT_MASK(ALPN) | \ |
| 165 | MBEDTLS_SSL_EXT_MASK(SCT) | \ |
| 166 | MBEDTLS_SSL_EXT_MASK(CLI_CERT_TYPE) | \ |
| 167 | MBEDTLS_SSL_EXT_MASK(SERV_CERT_TYPE) | \ |
| 168 | MBEDTLS_SSL_EXT_MASK(PADDING) | \ |
| 169 | MBEDTLS_SSL_EXT_MASK(KEY_SHARE) | \ |
| 170 | MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY) | \ |
| 171 | MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES) | \ |
| 172 | MBEDTLS_SSL_EXT_MASK(EARLY_DATA) | \ |
| 173 | MBEDTLS_SSL_EXT_MASK(COOKIE) | \ |
| 174 | MBEDTLS_SSL_EXT_MASK(SUPPORTED_VERSIONS) | \ |
| 175 | MBEDTLS_SSL_EXT_MASK(CERT_AUTH) | \ |
| 176 | MBEDTLS_SSL_EXT_MASK(POST_HANDSHAKE_AUTH) | \ |
| 177 | MBEDTLS_SSL_EXT_MASK(SIG_ALG_CERT) | \ |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 178 | MBEDTLS_SSL_EXT_MASK(RECORD_SIZE_LIMIT) | \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 179 | MBEDTLS_SSL_TLS1_3_EXT_MASK_UNRECOGNIZED) |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 180 | |
Jerry Yu | d15992d | 2022-08-29 10:58:31 +0800 | [diff] [blame] | 181 | /* RFC 8446 section 4.2. Allowed extensions for EncryptedExtensions */ |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 182 | #define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_EE \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 183 | (MBEDTLS_SSL_EXT_MASK(SERVERNAME) | \ |
| 184 | MBEDTLS_SSL_EXT_MASK(MAX_FRAGMENT_LENGTH) | \ |
| 185 | MBEDTLS_SSL_EXT_MASK(SUPPORTED_GROUPS) | \ |
| 186 | MBEDTLS_SSL_EXT_MASK(USE_SRTP) | \ |
| 187 | MBEDTLS_SSL_EXT_MASK(HEARTBEAT) | \ |
| 188 | MBEDTLS_SSL_EXT_MASK(ALPN) | \ |
| 189 | MBEDTLS_SSL_EXT_MASK(CLI_CERT_TYPE) | \ |
| 190 | MBEDTLS_SSL_EXT_MASK(SERV_CERT_TYPE) | \ |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 191 | MBEDTLS_SSL_EXT_MASK(EARLY_DATA) | \ |
| 192 | MBEDTLS_SSL_EXT_MASK(RECORD_SIZE_LIMIT)) |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 193 | |
Jerry Yu | d15992d | 2022-08-29 10:58:31 +0800 | [diff] [blame] | 194 | /* RFC 8446 section 4.2. Allowed extensions for CertificateRequest */ |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 195 | #define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CR \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 196 | (MBEDTLS_SSL_EXT_MASK(STATUS_REQUEST) | \ |
| 197 | MBEDTLS_SSL_EXT_MASK(SIG_ALG) | \ |
| 198 | MBEDTLS_SSL_EXT_MASK(SCT) | \ |
| 199 | MBEDTLS_SSL_EXT_MASK(CERT_AUTH) | \ |
| 200 | MBEDTLS_SSL_EXT_MASK(OID_FILTERS) | \ |
| 201 | MBEDTLS_SSL_EXT_MASK(SIG_ALG_CERT) | \ |
| 202 | MBEDTLS_SSL_TLS1_3_EXT_MASK_UNRECOGNIZED) |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 203 | |
Jerry Yu | d15992d | 2022-08-29 10:58:31 +0800 | [diff] [blame] | 204 | /* RFC 8446 section 4.2. Allowed extensions for Certificate */ |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 205 | #define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CT \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 206 | (MBEDTLS_SSL_EXT_MASK(STATUS_REQUEST) | \ |
| 207 | MBEDTLS_SSL_EXT_MASK(SCT)) |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 208 | |
Jerry Yu | d15992d | 2022-08-29 10:58:31 +0800 | [diff] [blame] | 209 | /* RFC 8446 section 4.2. Allowed extensions for ServerHello */ |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 210 | #define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_SH \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 211 | (MBEDTLS_SSL_EXT_MASK(KEY_SHARE) | \ |
| 212 | MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY) | \ |
| 213 | MBEDTLS_SSL_EXT_MASK(SUPPORTED_VERSIONS)) |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 214 | |
Jerry Yu | d15992d | 2022-08-29 10:58:31 +0800 | [diff] [blame] | 215 | /* RFC 8446 section 4.2. Allowed extensions for HelloRetryRequest */ |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 216 | #define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_HRR \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 217 | (MBEDTLS_SSL_EXT_MASK(KEY_SHARE) | \ |
| 218 | MBEDTLS_SSL_EXT_MASK(COOKIE) | \ |
| 219 | MBEDTLS_SSL_EXT_MASK(SUPPORTED_VERSIONS)) |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 220 | |
Jerry Yu | d15992d | 2022-08-29 10:58:31 +0800 | [diff] [blame] | 221 | /* RFC 8446 section 4.2. Allowed extensions for NewSessionTicket */ |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 222 | #define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_NST \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 223 | (MBEDTLS_SSL_EXT_MASK(EARLY_DATA) | \ |
| 224 | MBEDTLS_SSL_TLS1_3_EXT_MASK_UNRECOGNIZED) |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 225 | |
Jerry Yu | 5cc8f0a | 2021-08-27 17:21:44 +0800 | [diff] [blame] | 226 | /* |
Jerry Yu | 8c02bb4 | 2021-09-03 21:09:22 +0800 | [diff] [blame] | 227 | * Helper macros for function call with return check. |
Jerry Yu | 5cc8f0a | 2021-08-27 17:21:44 +0800 | [diff] [blame] | 228 | */ |
Jerry Yu | 5cc8f0a | 2021-08-27 17:21:44 +0800 | [diff] [blame] | 229 | /* |
Jerry Yu | 8c02bb4 | 2021-09-03 21:09:22 +0800 | [diff] [blame] | 230 | * Exit when return non-zero value |
Jerry Yu | 5cc8f0a | 2021-08-27 17:21:44 +0800 | [diff] [blame] | 231 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 232 | #define MBEDTLS_SSL_PROC_CHK(f) \ |
Jerry Yu | 65dd2cc | 2021-08-18 16:38:40 +0800 | [diff] [blame] | 233 | do { \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 234 | ret = (f); \ |
| 235 | if (ret != 0) \ |
Jerry Yu | 65dd2cc | 2021-08-18 16:38:40 +0800 | [diff] [blame] | 236 | { \ |
Jerry Yu | 65dd2cc | 2021-08-18 16:38:40 +0800 | [diff] [blame] | 237 | goto cleanup; \ |
| 238 | } \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 239 | } while (0) |
Jerry Yu | 5cc8f0a | 2021-08-27 17:21:44 +0800 | [diff] [blame] | 240 | /* |
Jerry Yu | 8c02bb4 | 2021-09-03 21:09:22 +0800 | [diff] [blame] | 241 | * Exit when return negative value |
Jerry Yu | 5cc8f0a | 2021-08-27 17:21:44 +0800 | [diff] [blame] | 242 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 243 | #define MBEDTLS_SSL_PROC_CHK_NEG(f) \ |
Jerry Yu | 65dd2cc | 2021-08-18 16:38:40 +0800 | [diff] [blame] | 244 | do { \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 245 | ret = (f); \ |
| 246 | if (ret < 0) \ |
Jerry Yu | 65dd2cc | 2021-08-18 16:38:40 +0800 | [diff] [blame] | 247 | { \ |
Jerry Yu | 65dd2cc | 2021-08-18 16:38:40 +0800 | [diff] [blame] | 248 | goto cleanup; \ |
| 249 | } \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 250 | } while (0) |
Jerry Yu | 65dd2cc | 2021-08-18 16:38:40 +0800 | [diff] [blame] | 251 | |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 252 | /* |
| 253 | * DTLS retransmission states, see RFC 6347 4.2.4 |
| 254 | * |
| 255 | * The SENDING state is merged in PREPARING for initial sends, |
| 256 | * but is distinct for resends. |
| 257 | * |
| 258 | * Note: initial state is wrong for server, but is not used anyway. |
| 259 | */ |
| 260 | #define MBEDTLS_SSL_RETRANS_PREPARING 0 |
| 261 | #define MBEDTLS_SSL_RETRANS_SENDING 1 |
| 262 | #define MBEDTLS_SSL_RETRANS_WAITING 2 |
| 263 | #define MBEDTLS_SSL_RETRANS_FINISHED 3 |
| 264 | |
| 265 | /* |
| 266 | * Allow extra bytes for record, authentication and encryption overhead: |
Mateusz Starzyk | a3a9984 | 2021-02-19 14:27:22 +0100 | [diff] [blame] | 267 | * counter (8) + header (5) + IV(16) + MAC (16-48) + padding (0-256). |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 268 | */ |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 269 | |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 270 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Hanno Becker | 0cc4661 | 2020-11-30 08:56:52 +0000 | [diff] [blame] | 271 | |
Manuel Pégourié-Gonnard | 05579c4 | 2020-07-31 12:53:39 +0200 | [diff] [blame] | 272 | /* This macro determines whether CBC is supported. */ |
Elena Uziunaite | 74342c7 | 2024-07-05 11:31:29 +0100 | [diff] [blame] | 273 | #if defined(PSA_WANT_ALG_CBC_NO_PADDING) && \ |
Elena Uziunaite | 6121a34 | 2024-07-05 11:16:53 +0100 | [diff] [blame] | 274 | (defined(PSA_WANT_KEY_TYPE_AES) || \ |
Elena Uziunaite | da41b60 | 2024-07-05 11:27:21 +0100 | [diff] [blame] | 275 | defined(PSA_WANT_KEY_TYPE_CAMELLIA) || \ |
Elena Uziunaite | 51c85a0 | 2024-07-05 11:20:17 +0100 | [diff] [blame] | 276 | defined(PSA_WANT_KEY_TYPE_ARIA)) |
Manuel Pégourié-Gonnard | 2df1f1f | 2020-07-09 12:11:39 +0200 | [diff] [blame] | 277 | #define MBEDTLS_SSL_SOME_SUITES_USE_CBC |
| 278 | #endif |
| 279 | |
Hanno Becker | 0cc4661 | 2020-11-30 08:56:52 +0000 | [diff] [blame] | 280 | /* This macro determines whether a ciphersuite using a |
| 281 | * stream cipher can be used. */ |
Ronald Cron | 0dd31fe | 2025-09-10 09:37:46 +0200 | [diff] [blame] | 282 | #if defined(MBEDTLS_SSL_NULL_CIPHERSUITES) |
Hanno Becker | 0cc4661 | 2020-11-30 08:56:52 +0000 | [diff] [blame] | 283 | #define MBEDTLS_SSL_SOME_SUITES_USE_STREAM |
| 284 | #endif |
| 285 | |
TRodziewicz | 0f82ec6 | 2021-05-12 17:49:18 +0200 | [diff] [blame] | 286 | /* This macro determines whether the CBC construct used in TLS 1.2 is supported. */ |
Manuel Pégourié-Gonnard | ed0e864 | 2020-07-21 11:20:30 +0200 | [diff] [blame] | 287 | #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) && \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 288 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Manuel Pégourié-Gonnard | ed0e864 | 2020-07-21 11:20:30 +0200 | [diff] [blame] | 289 | #define MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC |
| 290 | #endif |
| 291 | |
Hanno Becker | 31351ce | 2021-03-22 11:05:58 +0000 | [diff] [blame] | 292 | #if defined(MBEDTLS_SSL_SOME_SUITES_USE_STREAM) || \ |
Manuel Pégourié-Gonnard | 2df1f1f | 2020-07-09 12:11:39 +0200 | [diff] [blame] | 293 | defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) |
Hanno Becker | fd86ca8 | 2020-11-30 08:54:23 +0000 | [diff] [blame] | 294 | #define MBEDTLS_SSL_SOME_SUITES_USE_MAC |
Hanno Becker | 52344c2 | 2018-01-03 15:24:20 +0000 | [diff] [blame] | 295 | #endif |
| 296 | |
Neil Armstrong | f2c82f0 | 2022-04-05 11:16:53 +0200 | [diff] [blame] | 297 | /* This macro determines whether a ciphersuite uses Encrypt-then-MAC with CBC */ |
| 298 | #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) && \ |
| 299 | defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
| 300 | #define MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM |
| 301 | #endif |
| 302 | |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 303 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
Hanno Becker | 0cc4661 | 2020-11-30 08:56:52 +0000 | [diff] [blame] | 304 | |
Hanno Becker | fd86ca8 | 2020-11-30 08:54:23 +0000 | [diff] [blame] | 305 | #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 306 | /* Ciphersuites using HMAC */ |
Elena Uziunaite | b476d4b | 2024-05-23 15:33:41 +0100 | [diff] [blame] | 307 | #if defined(PSA_WANT_ALG_SHA_384) |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 308 | #define MBEDTLS_SSL_MAC_ADD 48 /* SHA-384 used for HMAC */ |
Elena Uziunaite | 0916cd7 | 2024-05-23 17:01:07 +0100 | [diff] [blame] | 309 | #elif defined(PSA_WANT_ALG_SHA_256) |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 310 | #define MBEDTLS_SSL_MAC_ADD 32 /* SHA-256 used for HMAC */ |
| 311 | #else |
| 312 | #define MBEDTLS_SSL_MAC_ADD 20 /* SHA-1 used for HMAC */ |
| 313 | #endif |
Hanno Becker | fd86ca8 | 2020-11-30 08:54:23 +0000 | [diff] [blame] | 314 | #else /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */ |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 315 | /* AEAD ciphersuites: GCM and CCM use a 128 bits tag */ |
| 316 | #define MBEDTLS_SSL_MAC_ADD 16 |
| 317 | #endif |
| 318 | |
Elena Uziunaite | 74342c7 | 2024-07-05 11:31:29 +0100 | [diff] [blame] | 319 | #if defined(PSA_WANT_ALG_CBC_NO_PADDING) |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 320 | #define MBEDTLS_SSL_PADDING_ADD 256 |
| 321 | #else |
| 322 | #define MBEDTLS_SSL_PADDING_ADD 0 |
| 323 | #endif |
| 324 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 325 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
TRodziewicz | e8dd709 | 2021-05-12 14:19:11 +0200 | [diff] [blame] | 326 | #define MBEDTLS_SSL_MAX_CID_EXPANSION MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY |
Hanno Becker | 6cbad55 | 2019-05-08 15:40:11 +0100 | [diff] [blame] | 327 | #else |
| 328 | #define MBEDTLS_SSL_MAX_CID_EXPANSION 0 |
| 329 | #endif |
| 330 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 331 | #define MBEDTLS_SSL_PAYLOAD_OVERHEAD (MBEDTLS_MAX_IV_LENGTH + \ |
| 332 | MBEDTLS_SSL_MAC_ADD + \ |
| 333 | MBEDTLS_SSL_PADDING_ADD + \ |
| 334 | MBEDTLS_SSL_MAX_CID_EXPANSION \ |
| 335 | ) |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 336 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 337 | #define MBEDTLS_SSL_IN_PAYLOAD_LEN (MBEDTLS_SSL_PAYLOAD_OVERHEAD + \ |
| 338 | (MBEDTLS_SSL_IN_CONTENT_LEN)) |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 339 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 340 | #define MBEDTLS_SSL_OUT_PAYLOAD_LEN (MBEDTLS_SSL_PAYLOAD_OVERHEAD + \ |
| 341 | (MBEDTLS_SSL_OUT_CONTENT_LEN)) |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 342 | |
Hanno Becker | 0271f96 | 2018-08-16 13:23:47 +0100 | [diff] [blame] | 343 | /* The maximum number of buffered handshake messages. */ |
Hanno Becker | d488b9e | 2018-08-16 16:35:37 +0100 | [diff] [blame] | 344 | #define MBEDTLS_SSL_MAX_BUFFERED_HS 4 |
Hanno Becker | 0271f96 | 2018-08-16 13:23:47 +0100 | [diff] [blame] | 345 | |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 346 | /* Maximum length we can advertise as our max content length for |
| 347 | RFC 6066 max_fragment_length extension negotiation purposes |
| 348 | (the lesser of both sizes, if they are unequal.) |
| 349 | */ |
| 350 | #define MBEDTLS_TLS_EXT_ADV_CONTENT_LEN ( \ |
| 351 | (MBEDTLS_SSL_IN_CONTENT_LEN > MBEDTLS_SSL_OUT_CONTENT_LEN) \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 352 | ? (MBEDTLS_SSL_OUT_CONTENT_LEN) \ |
| 353 | : (MBEDTLS_SSL_IN_CONTENT_LEN) \ |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 354 | ) |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 355 | |
Jerry Yu | 4131ec1 | 2022-01-19 10:36:30 +0800 | [diff] [blame] | 356 | /* Maximum size in bytes of list in signature algorithms ext., RFC 5246/8446 */ |
| 357 | #define MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN 65534 |
| 358 | |
Jerry Yu | 8afd6e4 | 2022-01-20 15:54:26 +0800 | [diff] [blame] | 359 | /* Minimum size in bytes of list in signature algorithms ext., RFC 5246/8446 */ |
Jerry Yu | 4131ec1 | 2022-01-19 10:36:30 +0800 | [diff] [blame] | 360 | #define MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN 2 |
Hanno Becker | e131bfe | 2017-04-12 14:54:42 +0100 | [diff] [blame] | 361 | |
| 362 | /* Maximum size in bytes of list in supported elliptic curve ext., RFC 4492 */ |
| 363 | #define MBEDTLS_SSL_MAX_CURVE_LIST_LEN 65535 |
| 364 | |
Xiaofei Bai | f5b4d25 | 2022-01-28 06:37:15 +0000 | [diff] [blame] | 365 | #define MBEDTLS_RECEIVED_SIG_ALGS_SIZE 20 |
Xiaofei Bai | 82f0a9a | 2022-01-26 09:21:54 +0000 | [diff] [blame] | 366 | |
Ronald Cron | e68ab4f | 2022-10-05 12:46:29 +0200 | [diff] [blame] | 367 | #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) |
Gabor Mezei | 15b95a6 | 2022-05-09 16:37:58 +0200 | [diff] [blame] | 368 | |
Gabor Mezei | 24c7c2b | 2022-05-10 12:51:14 +0200 | [diff] [blame] | 369 | #define MBEDTLS_TLS_SIG_NONE MBEDTLS_TLS1_3_SIG_NONE |
| 370 | |
Gabor Mezei | 15b95a6 | 2022-05-09 16:37:58 +0200 | [diff] [blame] | 371 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 372 | #define MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(sig, hash) ((hash << 8) | sig) |
Gabor Mezei | 3631cf6 | 2022-05-10 12:59:00 +0200 | [diff] [blame] | 373 | #define MBEDTLS_SSL_TLS12_SIG_ALG_FROM_SIG_AND_HASH_ALG(alg) (alg & 0xFF) |
| 374 | #define MBEDTLS_SSL_TLS12_HASH_ALG_FROM_SIG_AND_HASH_ALG(alg) (alg >> 8) |
Gabor Mezei | 15b95a6 | 2022-05-09 16:37:58 +0200 | [diff] [blame] | 375 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
| 376 | |
Ronald Cron | e68ab4f | 2022-10-05 12:46:29 +0200 | [diff] [blame] | 377 | #endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */ |
Gabor Mezei | 15b95a6 | 2022-05-09 16:37:58 +0200 | [diff] [blame] | 378 | |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 379 | /* |
Hanno Becker | a8434e8 | 2017-09-18 10:54:39 +0100 | [diff] [blame] | 380 | * Check that we obey the standard's message size bounds |
| 381 | */ |
| 382 | |
David Horstmann | 95d516f | 2021-05-04 18:36:56 +0100 | [diff] [blame] | 383 | #if MBEDTLS_SSL_IN_CONTENT_LEN > 16384 |
| 384 | #error "Bad configuration - incoming record content too large." |
Hanno Becker | a8434e8 | 2017-09-18 10:54:39 +0100 | [diff] [blame] | 385 | #endif |
| 386 | |
David Horstmann | 95d516f | 2021-05-04 18:36:56 +0100 | [diff] [blame] | 387 | #if MBEDTLS_SSL_OUT_CONTENT_LEN > 16384 |
| 388 | #error "Bad configuration - outgoing record content too large." |
Hanno Becker | a8434e8 | 2017-09-18 10:54:39 +0100 | [diff] [blame] | 389 | #endif |
| 390 | |
David Horstmann | 95d516f | 2021-05-04 18:36:56 +0100 | [diff] [blame] | 391 | #if MBEDTLS_SSL_IN_PAYLOAD_LEN > MBEDTLS_SSL_IN_CONTENT_LEN + 2048 |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 392 | #error "Bad configuration - incoming protected record payload too large." |
| 393 | #endif |
| 394 | |
David Horstmann | 95d516f | 2021-05-04 18:36:56 +0100 | [diff] [blame] | 395 | #if MBEDTLS_SSL_OUT_PAYLOAD_LEN > MBEDTLS_SSL_OUT_CONTENT_LEN + 2048 |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 396 | #error "Bad configuration - outgoing protected record payload too large." |
| 397 | #endif |
| 398 | |
| 399 | /* Calculate buffer sizes */ |
| 400 | |
Hanno Becker | 25d6d1a | 2017-12-07 08:22:51 +0000 | [diff] [blame] | 401 | /* Note: Even though the TLS record header is only 5 bytes |
| 402 | long, we're internally using 8 bytes to store the |
| 403 | implicit sequence number. */ |
Hanno Becker | d25d444 | 2017-10-04 13:56:42 +0100 | [diff] [blame] | 404 | #define MBEDTLS_SSL_HEADER_LEN 13 |
Hanno Becker | a8434e8 | 2017-09-18 10:54:39 +0100 | [diff] [blame] | 405 | |
Andrzej Kurek | 033c42a | 2020-03-03 05:57:59 -0500 | [diff] [blame] | 406 | #if !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 407 | #define MBEDTLS_SSL_IN_BUFFER_LEN \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 408 | ((MBEDTLS_SSL_HEADER_LEN) + (MBEDTLS_SSL_IN_PAYLOAD_LEN)) |
Hanno Becker | 6cbad55 | 2019-05-08 15:40:11 +0100 | [diff] [blame] | 409 | #else |
| 410 | #define MBEDTLS_SSL_IN_BUFFER_LEN \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 411 | ((MBEDTLS_SSL_HEADER_LEN) + (MBEDTLS_SSL_IN_PAYLOAD_LEN) \ |
| 412 | + (MBEDTLS_SSL_CID_IN_LEN_MAX)) |
Hanno Becker | 6cbad55 | 2019-05-08 15:40:11 +0100 | [diff] [blame] | 413 | #endif |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 414 | |
Andrzej Kurek | 033c42a | 2020-03-03 05:57:59 -0500 | [diff] [blame] | 415 | #if !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 416 | #define MBEDTLS_SSL_OUT_BUFFER_LEN \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 417 | ((MBEDTLS_SSL_HEADER_LEN) + (MBEDTLS_SSL_OUT_PAYLOAD_LEN)) |
Hanno Becker | 6cbad55 | 2019-05-08 15:40:11 +0100 | [diff] [blame] | 418 | #else |
| 419 | #define MBEDTLS_SSL_OUT_BUFFER_LEN \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 420 | ((MBEDTLS_SSL_HEADER_LEN) + (MBEDTLS_SSL_OUT_PAYLOAD_LEN) \ |
| 421 | + (MBEDTLS_SSL_CID_OUT_LEN_MAX)) |
Hanno Becker | 6cbad55 | 2019-05-08 15:40:11 +0100 | [diff] [blame] | 422 | #endif |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 423 | |
Jerry Yu | e6d7e5c | 2021-10-26 10:44:32 +0800 | [diff] [blame] | 424 | #define MBEDTLS_CLIENT_HELLO_RANDOM_LEN 32 |
| 425 | #define MBEDTLS_SERVER_HELLO_RANDOM_LEN 32 |
| 426 | |
Hanno Becker | 9752aad | 2021-04-21 05:54:33 +0100 | [diff] [blame] | 427 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
| 428 | /** |
| 429 | * \brief Return the maximum fragment length (payload, in bytes) for |
| 430 | * the output buffer. For the client, this is the configured |
| 431 | * value. For the server, it is the minimum of two - the |
| 432 | * configured value and the negotiated one. |
| 433 | * |
| 434 | * \sa mbedtls_ssl_conf_max_frag_len() |
| 435 | * \sa mbedtls_ssl_get_max_out_record_payload() |
| 436 | * |
| 437 | * \param ssl SSL context |
| 438 | * |
| 439 | * \return Current maximum fragment length for the output buffer. |
| 440 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 441 | size_t mbedtls_ssl_get_output_max_frag_len(const mbedtls_ssl_context *ssl); |
Hanno Becker | 9752aad | 2021-04-21 05:54:33 +0100 | [diff] [blame] | 442 | |
| 443 | /** |
| 444 | * \brief Return the maximum fragment length (payload, in bytes) for |
| 445 | * the input buffer. This is the negotiated maximum fragment |
Hanno Becker | df3b863 | 2021-06-08 05:30:45 +0100 | [diff] [blame] | 446 | * length, or, if there is none, MBEDTLS_SSL_IN_CONTENT_LEN. |
Hanno Becker | 9752aad | 2021-04-21 05:54:33 +0100 | [diff] [blame] | 447 | * If it is not defined either, the value is 2^14. This function |
| 448 | * works as its predecessor, \c mbedtls_ssl_get_max_frag_len(). |
| 449 | * |
| 450 | * \sa mbedtls_ssl_conf_max_frag_len() |
| 451 | * \sa mbedtls_ssl_get_max_in_record_payload() |
| 452 | * |
| 453 | * \param ssl SSL context |
| 454 | * |
| 455 | * \return Current maximum fragment length for the output buffer. |
| 456 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 457 | size_t mbedtls_ssl_get_input_max_frag_len(const mbedtls_ssl_context *ssl); |
Hanno Becker | 9752aad | 2021-04-21 05:54:33 +0100 | [diff] [blame] | 458 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
| 459 | |
Jan Bruckner | f482dcc | 2023-03-15 09:09:06 +0100 | [diff] [blame] | 460 | #if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT) |
| 461 | /** |
Waleed-Ziad Maamoun-Elmelegy | e2d3db5 | 2024-01-05 14:19:16 +0000 | [diff] [blame] | 462 | * \brief Get the size limit in bytes for the protected outgoing records |
| 463 | * as defined in RFC 8449 |
Jan Bruckner | f482dcc | 2023-03-15 09:09:06 +0100 | [diff] [blame] | 464 | * |
| 465 | * \param ssl SSL context |
| 466 | * |
Waleed-Ziad Maamoun-Elmelegy | e2d3db5 | 2024-01-05 14:19:16 +0000 | [diff] [blame] | 467 | * \return The size limit in bytes for the protected outgoing |
| 468 | * records as defined in RFC 8449. |
Jan Bruckner | f482dcc | 2023-03-15 09:09:06 +0100 | [diff] [blame] | 469 | */ |
| 470 | size_t mbedtls_ssl_get_output_record_size_limit(const mbedtls_ssl_context *ssl); |
| 471 | #endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */ |
| 472 | |
Andrzej Kurek | 0afa2a1 | 2020-03-03 10:39:58 -0500 | [diff] [blame] | 473 | #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 474 | static inline size_t mbedtls_ssl_get_output_buflen(const mbedtls_ssl_context *ctx) |
Andrzej Kurek | 0afa2a1 | 2020-03-03 10:39:58 -0500 | [diff] [blame] | 475 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 476 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
| 477 | return mbedtls_ssl_get_output_max_frag_len(ctx) |
| 478 | + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD |
| 479 | + MBEDTLS_SSL_CID_OUT_LEN_MAX; |
Andrzej Kurek | 0afa2a1 | 2020-03-03 10:39:58 -0500 | [diff] [blame] | 480 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 481 | return mbedtls_ssl_get_output_max_frag_len(ctx) |
| 482 | + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD; |
Andrzej Kurek | 0afa2a1 | 2020-03-03 10:39:58 -0500 | [diff] [blame] | 483 | #endif |
| 484 | } |
| 485 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 486 | static inline size_t mbedtls_ssl_get_input_buflen(const mbedtls_ssl_context *ctx) |
Andrzej Kurek | 0afa2a1 | 2020-03-03 10:39:58 -0500 | [diff] [blame] | 487 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 488 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
| 489 | return mbedtls_ssl_get_input_max_frag_len(ctx) |
| 490 | + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD |
| 491 | + MBEDTLS_SSL_CID_IN_LEN_MAX; |
Andrzej Kurek | 0afa2a1 | 2020-03-03 10:39:58 -0500 | [diff] [blame] | 492 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 493 | return mbedtls_ssl_get_input_max_frag_len(ctx) |
| 494 | + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD; |
Andrzej Kurek | 0afa2a1 | 2020-03-03 10:39:58 -0500 | [diff] [blame] | 495 | #endif |
| 496 | } |
| 497 | #endif |
| 498 | |
Hanno Becker | a8434e8 | 2017-09-18 10:54:39 +0100 | [diff] [blame] | 499 | /* |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 500 | * TLS extension flags (for extensions with outgoing ServerHello content |
| 501 | * that need it (e.g. for RENEGOTIATION_INFO the server already knows because |
| 502 | * of state of the renegotiation flag, so no indicator is required) |
| 503 | */ |
| 504 | #define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT (1 << 0) |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 505 | #define MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK (1 << 1) |
Manuel Pégourié-Gonnard | 065122c | 2015-05-26 12:31:46 +0200 | [diff] [blame] | 506 | |
Hanno Becker | 51018aa | 2017-04-12 14:54:42 +0100 | [diff] [blame] | 507 | /** |
| 508 | * \brief This function checks if the remaining size in a buffer is |
| 509 | * greater or equal than a needed space. |
| 510 | * |
| 511 | * \param cur Pointer to the current position in the buffer. |
| 512 | * \param end Pointer to one past the end of the buffer. |
| 513 | * \param need Needed space in bytes. |
| 514 | * |
Ronald Cron | b7b35e1 | 2020-06-11 09:50:51 +0200 | [diff] [blame] | 515 | * \return Zero if the needed space is available in the buffer, non-zero |
Hanno Becker | 51018aa | 2017-04-12 14:54:42 +0100 | [diff] [blame] | 516 | * otherwise. |
| 517 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 518 | #if !defined(MBEDTLS_TEST_HOOKS) |
| 519 | static inline int mbedtls_ssl_chk_buf_ptr(const uint8_t *cur, |
| 520 | const uint8_t *end, size_t need) |
Hanno Becker | 51018aa | 2017-04-12 14:54:42 +0100 | [diff] [blame] | 521 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 522 | return (cur > end) || (need > (size_t) (end - cur)); |
Hanno Becker | 51018aa | 2017-04-12 14:54:42 +0100 | [diff] [blame] | 523 | } |
Ronald Cron | ad8c17b | 2022-06-10 17:18:09 +0200 | [diff] [blame] | 524 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 525 | typedef struct { |
Ronald Cron | ad8c17b | 2022-06-10 17:18:09 +0200 | [diff] [blame] | 526 | const uint8_t *cur; |
| 527 | const uint8_t *end; |
| 528 | size_t need; |
| 529 | } mbedtls_ssl_chk_buf_ptr_args; |
| 530 | |
| 531 | void mbedtls_ssl_set_chk_buf_ptr_fail_args( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 532 | const uint8_t *cur, const uint8_t *end, size_t need); |
| 533 | void mbedtls_ssl_reset_chk_buf_ptr_fail_args(void); |
Ronald Cron | ce7d76e | 2022-07-08 18:56:49 +0200 | [diff] [blame] | 534 | |
| 535 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 536 | int mbedtls_ssl_cmp_chk_buf_ptr_fail_args(mbedtls_ssl_chk_buf_ptr_args *args); |
Ronald Cron | ad8c17b | 2022-06-10 17:18:09 +0200 | [diff] [blame] | 537 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 538 | static inline int mbedtls_ssl_chk_buf_ptr(const uint8_t *cur, |
| 539 | const uint8_t *end, size_t need) |
Ronald Cron | ad8c17b | 2022-06-10 17:18:09 +0200 | [diff] [blame] | 540 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 541 | if ((cur > end) || (need > (size_t) (end - cur))) { |
| 542 | mbedtls_ssl_set_chk_buf_ptr_fail_args(cur, end, need); |
| 543 | return 1; |
Ronald Cron | ad8c17b | 2022-06-10 17:18:09 +0200 | [diff] [blame] | 544 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 545 | return 0; |
Ronald Cron | ad8c17b | 2022-06-10 17:18:09 +0200 | [diff] [blame] | 546 | } |
Ronald Cron | cf600bc | 2022-06-17 15:54:16 +0200 | [diff] [blame] | 547 | #endif /* MBEDTLS_TEST_HOOKS */ |
Hanno Becker | 51018aa | 2017-04-12 14:54:42 +0100 | [diff] [blame] | 548 | |
| 549 | /** |
| 550 | * \brief This macro checks if the remaining size in a buffer is |
| 551 | * greater or equal than a needed space. If it is not the case, |
| 552 | * it returns an SSL_BUFFER_TOO_SMALL error. |
| 553 | * |
| 554 | * \param cur Pointer to the current position in the buffer. |
| 555 | * \param end Pointer to one past the end of the buffer. |
| 556 | * \param need Needed space in bytes. |
| 557 | * |
| 558 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 559 | #define MBEDTLS_SSL_CHK_BUF_PTR(cur, end, need) \ |
Hanno Becker | 51018aa | 2017-04-12 14:54:42 +0100 | [diff] [blame] | 560 | do { \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 561 | if (mbedtls_ssl_chk_buf_ptr((cur), (end), (need)) != 0) \ |
Hanno Becker | 51018aa | 2017-04-12 14:54:42 +0100 | [diff] [blame] | 562 | { \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 563 | return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL; \ |
Hanno Becker | 51018aa | 2017-04-12 14:54:42 +0100 | [diff] [blame] | 564 | } \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 565 | } while (0) |
Hanno Becker | 51018aa | 2017-04-12 14:54:42 +0100 | [diff] [blame] | 566 | |
Jerry Yu | 34da372 | 2021-09-19 18:05:08 +0800 | [diff] [blame] | 567 | /** |
Jerry Yu | e15e665 | 2021-09-28 21:06:07 +0800 | [diff] [blame] | 568 | * \brief This macro checks if the remaining length in an input buffer is |
| 569 | * greater or equal than a needed length. If it is not the case, it |
Jerry Yu | 205fd82 | 2021-10-08 16:16:24 +0800 | [diff] [blame] | 570 | * returns #MBEDTLS_ERR_SSL_DECODE_ERROR error and pends a |
Jerry Yu | dca3d5d | 2021-10-08 14:19:29 +0800 | [diff] [blame] | 571 | * #MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR alert message. |
Jerry Yu | e4eefc7 | 2021-10-09 10:40:40 +0800 | [diff] [blame] | 572 | * |
| 573 | * This is a function-like macro. It is guaranteed to evaluate each |
| 574 | * argument exactly once. |
Jerry Yu | 34da372 | 2021-09-19 18:05:08 +0800 | [diff] [blame] | 575 | * |
| 576 | * \param cur Pointer to the current position in the buffer. |
| 577 | * \param end Pointer to one past the end of the buffer. |
Jerry Yu | e15e665 | 2021-09-28 21:06:07 +0800 | [diff] [blame] | 578 | * \param need Needed length in bytes. |
Jerry Yu | 34da372 | 2021-09-19 18:05:08 +0800 | [diff] [blame] | 579 | * |
| 580 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 581 | #define MBEDTLS_SSL_CHK_BUF_READ_PTR(cur, end, need) \ |
Jerry Yu | 34da372 | 2021-09-19 18:05:08 +0800 | [diff] [blame] | 582 | do { \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 583 | if (mbedtls_ssl_chk_buf_ptr((cur), (end), (need)) != 0) \ |
Jerry Yu | 34da372 | 2021-09-19 18:05:08 +0800 | [diff] [blame] | 584 | { \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 585 | MBEDTLS_SSL_DEBUG_MSG(1, \ |
| 586 | ("missing input data in %s", __func__)); \ |
| 587 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR, \ |
| 588 | MBEDTLS_ERR_SSL_DECODE_ERROR); \ |
| 589 | return MBEDTLS_ERR_SSL_DECODE_ERROR; \ |
Jerry Yu | 34da372 | 2021-09-19 18:05:08 +0800 | [diff] [blame] | 590 | } \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 591 | } while (0) |
Jerry Yu | 34da372 | 2021-09-19 18:05:08 +0800 | [diff] [blame] | 592 | |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 593 | #ifdef __cplusplus |
| 594 | extern "C" { |
| 595 | #endif |
| 596 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 597 | typedef int mbedtls_ssl_tls_prf_cb(const unsigned char *secret, size_t slen, |
| 598 | const char *label, |
| 599 | const unsigned char *random, size_t rlen, |
| 600 | unsigned char *dstbuf, size_t dlen); |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 601 | |
Hanno Becker | 61baae7 | 2020-09-16 09:24:14 +0100 | [diff] [blame] | 602 | /* cipher.h exports the maximum IV, key and block length from |
Hanno Becker | 1588983 | 2020-09-08 11:29:11 +0100 | [diff] [blame] | 603 | * all ciphers enabled in the config, regardless of whether those |
| 604 | * ciphers are actually usable in SSL/TLS. Notably, XTS is enabled |
| 605 | * in the default configuration and uses 64 Byte keys, but it is |
| 606 | * not used for record protection in SSL/TLS. |
| 607 | * |
| 608 | * In order to prevent unnecessary inflation of key structures, |
| 609 | * we introduce SSL-specific variants of the max-{key,block,IV} |
| 610 | * macros here which are meant to only take those ciphers into |
| 611 | * account which can be negotiated in SSL/TLS. |
| 612 | * |
| 613 | * Since the current definitions of MBEDTLS_MAX_{KEY|BLOCK|IV}_LENGTH |
| 614 | * in cipher.h are rough overapproximations of the real maxima, here |
Hanno Becker | 9a7a2ac | 2020-09-09 09:24:54 +0100 | [diff] [blame] | 615 | * we content ourselves with replicating those overapproximations |
Hanno Becker | 1588983 | 2020-09-08 11:29:11 +0100 | [diff] [blame] | 616 | * for the maximum block and IV length, and excluding XTS from the |
| 617 | * computation of the maximum key length. */ |
| 618 | #define MBEDTLS_SSL_MAX_BLOCK_LENGTH 16 |
| 619 | #define MBEDTLS_SSL_MAX_IV_LENGTH 16 |
| 620 | #define MBEDTLS_SSL_MAX_KEY_LENGTH 32 |
| 621 | |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 622 | /** |
| 623 | * \brief The data structure holding the cryptographic material (key and IV) |
| 624 | * used for record protection in TLS 1.3. |
| 625 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 626 | struct mbedtls_ssl_key_set { |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 627 | /*! The key for client->server records. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 628 | unsigned char client_write_key[MBEDTLS_SSL_MAX_KEY_LENGTH]; |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 629 | /*! The key for server->client records. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 630 | unsigned char server_write_key[MBEDTLS_SSL_MAX_KEY_LENGTH]; |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 631 | /*! The IV for client->server records. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 632 | unsigned char client_write_iv[MBEDTLS_SSL_MAX_IV_LENGTH]; |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 633 | /*! The IV for server->client records. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 634 | unsigned char server_write_iv[MBEDTLS_SSL_MAX_IV_LENGTH]; |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 635 | |
Hanno Becker | 493ea7f | 2020-09-08 11:01:00 +0100 | [diff] [blame] | 636 | size_t key_len; /*!< The length of client_write_key and |
| 637 | * server_write_key, in Bytes. */ |
| 638 | size_t iv_len; /*!< The length of client_write_iv and |
| 639 | * server_write_iv, in Bytes. */ |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 640 | }; |
| 641 | typedef struct mbedtls_ssl_key_set mbedtls_ssl_key_set; |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 642 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 643 | typedef struct { |
| 644 | unsigned char binder_key[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
| 645 | unsigned char client_early_traffic_secret[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
| 646 | unsigned char early_exporter_master_secret[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 647 | } mbedtls_ssl_tls13_early_secrets; |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 648 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 649 | typedef struct { |
| 650 | unsigned char client_handshake_traffic_secret[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
| 651 | unsigned char server_handshake_traffic_secret[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 652 | } mbedtls_ssl_tls13_handshake_secrets; |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 653 | |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 654 | /* |
| 655 | * This structure contains the parameters only needed during handshake. |
| 656 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 657 | struct mbedtls_ssl_handshake_params { |
Gilles Peskine | ec45c1e | 2021-11-29 12:18:09 +0100 | [diff] [blame] | 658 | /* Frequently-used boolean or byte fields (placed early to take |
| 659 | * advantage of smaller code size for indirect access on Arm Thumb) */ |
Gilles Peskine | ec45c1e | 2021-11-29 12:18:09 +0100 | [diff] [blame] | 660 | uint8_t resume; /*!< session resume indicator*/ |
| 661 | uint8_t cli_exts; /*!< client extension presence*/ |
| 662 | |
Glenn Strauss | bbdc83b | 2022-04-12 07:31:46 -0400 | [diff] [blame] | 663 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
| 664 | uint8_t sni_authmode; /*!< authmode from SNI callback */ |
| 665 | #endif |
| 666 | |
XiaokangQian | 189ded2 | 2022-05-10 08:12:17 +0000 | [diff] [blame] | 667 | #if defined(MBEDTLS_SSL_SRV_C) |
XiaokangQian | c3017f6 | 2022-05-13 05:55:41 +0000 | [diff] [blame] | 668 | /* Flag indicating if a CertificateRequest message has been sent |
| 669 | * to the client or not. */ |
XiaokangQian | 63e713e | 2022-05-15 04:26:57 +0000 | [diff] [blame] | 670 | uint8_t certificate_request_sent; |
Ronald Cron | 78a38f6 | 2024-02-01 18:30:31 +0100 | [diff] [blame] | 671 | #if defined(MBEDTLS_SSL_EARLY_DATA) |
| 672 | /* Flag indicating if the server has accepted early data or not. */ |
| 673 | uint8_t early_data_accepted; |
| 674 | #endif |
XiaokangQian | 189ded2 | 2022-05-10 08:12:17 +0000 | [diff] [blame] | 675 | #endif /* MBEDTLS_SSL_SRV_C */ |
| 676 | |
Glenn Strauss | bbdc83b | 2022-04-12 07:31:46 -0400 | [diff] [blame] | 677 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
| 678 | uint8_t new_session_ticket; /*!< use NewSessionTicket? */ |
| 679 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
| 680 | |
Ronald Cron | 82c785f | 2022-03-31 15:44:41 +0200 | [diff] [blame] | 681 | #if defined(MBEDTLS_SSL_CLI_C) |
Ronald Cron | 217d699 | 2022-04-04 10:23:22 +0200 | [diff] [blame] | 682 | /** Minimum TLS version to be negotiated. |
Ronald Cron | bdb4f58 | 2022-03-31 15:37:44 +0200 | [diff] [blame] | 683 | * |
Ronald Cron | b9a9b1f | 2024-02-14 11:28:05 +0100 | [diff] [blame] | 684 | * It is set up in the ClientHello writing preparation stage and used |
| 685 | * throughout the ClientHello writing. Not relevant anymore as soon as |
| 686 | * the protocol version has been negotiated thus as soon as the |
| 687 | * ServerHello is received. |
| 688 | * For a fresh handshake not linked to any previous handshake, it is |
| 689 | * equal to the configured minimum minor version to be negotiated. When |
| 690 | * renegotiating or resuming a session, it is equal to the previously |
| 691 | * negotiated minor version. |
Ronald Cron | bdb4f58 | 2022-03-31 15:37:44 +0200 | [diff] [blame] | 692 | * |
Ronald Cron | b9a9b1f | 2024-02-14 11:28:05 +0100 | [diff] [blame] | 693 | * There is no maximum TLS version field in this handshake context. |
| 694 | * From the start of the handshake, we need to define a current protocol |
| 695 | * version for the record layer which we define as the maximum TLS |
| 696 | * version to be negotiated. The `tls_version` field of the SSL context is |
| 697 | * used to store this maximum value until it contains the actual |
| 698 | * negotiated value. |
Ronald Cron | bdb4f58 | 2022-03-31 15:37:44 +0200 | [diff] [blame] | 699 | */ |
Glenn Strauss | bbdc83b | 2022-04-12 07:31:46 -0400 | [diff] [blame] | 700 | mbedtls_ssl_protocol_version min_tls_version; |
Ronald Cron | 82c785f | 2022-03-31 15:44:41 +0200 | [diff] [blame] | 701 | #endif |
Ronald Cron | 86a477f | 2022-02-18 17:45:10 +0100 | [diff] [blame] | 702 | |
Gilles Peskine | ec45c1e | 2021-11-29 12:18:09 +0100 | [diff] [blame] | 703 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
| 704 | uint8_t extended_ms; /*!< use Extended Master Secret? */ |
| 705 | #endif |
| 706 | |
| 707 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
| 708 | uint8_t async_in_progress; /*!< an asynchronous operation is in progress */ |
| 709 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
| 710 | |
| 711 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
| 712 | unsigned char retransmit_state; /*!< Retransmission state */ |
| 713 | #endif |
| 714 | |
| 715 | #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) |
| 716 | uint8_t ecrs_enabled; /*!< Handshake supports EC restart? */ |
Gilles Peskine | ec45c1e | 2021-11-29 12:18:09 +0100 | [diff] [blame] | 717 | enum { /* this complements ssl->state with info on intra-state operations */ |
| 718 | ssl_ecrs_none = 0, /*!< nothing going on (yet) */ |
| 719 | ssl_ecrs_crt_verify, /*!< Certificate: crt_verify() */ |
| 720 | ssl_ecrs_ske_start_processing, /*!< ServerKeyExchange: pk_verify() */ |
| 721 | ssl_ecrs_cke_ecdh_calc_secret, /*!< ClientKeyExchange: ECDH step 2 */ |
| 722 | ssl_ecrs_crt_vrfy_sign, /*!< CertificateVerify: pk_sign() */ |
| 723 | } ecrs_state; /*!< current (or last) operation */ |
| 724 | mbedtls_x509_crt *ecrs_peer_cert; /*!< The peer's CRT chain. */ |
| 725 | size_t ecrs_n; /*!< place for saving a length */ |
| 726 | #endif |
| 727 | |
Gilles Peskine | ec45c1e | 2021-11-29 12:18:09 +0100 | [diff] [blame] | 728 | mbedtls_ssl_ciphersuite_t const *ciphersuite_info; |
| 729 | |
Manuel Pégourié-Gonnard | b8b07aa | 2023-02-06 00:34:21 +0100 | [diff] [blame] | 730 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 226aa15 | 2023-02-05 09:46:59 +0100 | [diff] [blame] | 731 | int (*update_checksum)(mbedtls_ssl_context *, const unsigned char *, size_t); |
Manuel Pégourié-Gonnard | b8b07aa | 2023-02-06 00:34:21 +0100 | [diff] [blame] | 732 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 226aa15 | 2023-02-05 09:46:59 +0100 | [diff] [blame] | 733 | int (*calc_verify)(const mbedtls_ssl_context *, unsigned char *, size_t *); |
Manuel Pégourié-Gonnard | b8b07aa | 2023-02-06 00:34:21 +0100 | [diff] [blame] | 734 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 226aa15 | 2023-02-05 09:46:59 +0100 | [diff] [blame] | 735 | int (*calc_finished)(mbedtls_ssl_context *, unsigned char *, int); |
Gilles Peskine | ec45c1e | 2021-11-29 12:18:09 +0100 | [diff] [blame] | 736 | mbedtls_ssl_tls_prf_cb *tls_prf; |
| 737 | |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 738 | /* |
| 739 | * Handshake specific crypto variables |
| 740 | */ |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 741 | #if defined(MBEDTLS_SSL_PROTO_TLS1_3) |
Ronald Cron | 8538549 | 2022-07-20 16:44:00 +0200 | [diff] [blame] | 742 | uint8_t key_exchange_mode; /*!< Selected key exchange mode */ |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 743 | |
Ronald Cron | 5fbd270 | 2024-02-14 10:03:36 +0100 | [diff] [blame] | 744 | /** |
| 745 | * Flag indicating if, in the course of the current handshake, an |
| 746 | * HelloRetryRequest message has been sent by the server or received by |
| 747 | * the client (<> 0) or not (0). |
| 748 | */ |
| 749 | uint8_t hello_retry_request_flag; |
Ronald Cron | fe59ff7 | 2024-01-24 14:31:50 +0100 | [diff] [blame] | 750 | |
| 751 | #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE) |
| 752 | /** |
Ronald Cron | 5fbd270 | 2024-02-14 10:03:36 +0100 | [diff] [blame] | 753 | * Flag indicating if, in the course of the current handshake, a dummy |
| 754 | * change_cipher_spec (CCS) record has already been sent. Used to send only |
| 755 | * one CCS per handshake while not complicating the handshake state |
| 756 | * transitions for that purpose. |
Ronald Cron | fe59ff7 | 2024-01-24 14:31:50 +0100 | [diff] [blame] | 757 | */ |
Ronald Cron | 5fbd270 | 2024-02-14 10:03:36 +0100 | [diff] [blame] | 758 | uint8_t ccs_sent; |
Ronald Cron | fe59ff7 | 2024-01-24 14:31:50 +0100 | [diff] [blame] | 759 | #endif |
Ronald Cron | bc817ba | 2022-07-21 09:35:20 +0200 | [diff] [blame] | 760 | |
XiaokangQian | 0803755 | 2022-04-20 07:16:41 +0000 | [diff] [blame] | 761 | #if defined(MBEDTLS_SSL_SRV_C) |
Ronald Cron | 41a443a | 2022-10-04 16:38:25 +0200 | [diff] [blame] | 762 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED) |
Ronald Cron | bc817ba | 2022-07-21 09:35:20 +0200 | [diff] [blame] | 763 | uint8_t tls13_kex_modes; /*!< Key exchange modes supported by the client */ |
| 764 | #endif |
Ronald Cron | fe59ff7 | 2024-01-24 14:31:50 +0100 | [diff] [blame] | 765 | /** selected_group of key_share extension in HelloRetryRequest message. */ |
| 766 | uint16_t hrr_selected_group; |
Jerry Yu | d4e7500 | 2022-08-09 13:33:50 +0800 | [diff] [blame] | 767 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Jerry Yu | f3bdf9d | 2022-09-22 23:30:49 +0800 | [diff] [blame] | 768 | uint16_t new_session_tickets_count; /*!< number of session tickets */ |
Jerry Yu | d4e7500 | 2022-08-09 13:33:50 +0800 | [diff] [blame] | 769 | #endif |
XiaokangQian | 0803755 | 2022-04-20 07:16:41 +0000 | [diff] [blame] | 770 | #endif /* MBEDTLS_SSL_SRV_C */ |
Ronald Cron | bc817ba | 2022-07-21 09:35:20 +0200 | [diff] [blame] | 771 | |
Jerry Yu | 582dd06 | 2022-04-22 21:59:01 +0800 | [diff] [blame] | 772 | #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ |
XiaokangQian | 0803755 | 2022-04-20 07:16:41 +0000 | [diff] [blame] | 773 | |
Ronald Cron | e68ab4f | 2022-10-05 12:46:29 +0200 | [diff] [blame] | 774 | #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) |
Xiaofei Bai | f5b4d25 | 2022-01-28 06:37:15 +0000 | [diff] [blame] | 775 | uint16_t received_sig_algs[MBEDTLS_RECEIVED_SIG_ALGS_SIZE]; |
| 776 | #endif |
| 777 | |
Valerio Setti | ea59c43 | 2023-07-25 11:14:03 +0200 | [diff] [blame] | 778 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED) |
Przemek Stekiel | 7ac93be | 2023-07-04 10:02:38 +0200 | [diff] [blame] | 779 | psa_key_type_t xxdh_psa_type; |
Valerio Setti | ea59c43 | 2023-07-25 11:14:03 +0200 | [diff] [blame] | 780 | size_t xxdh_psa_bits; |
Przemek Stekiel | 7ac93be | 2023-07-04 10:02:38 +0200 | [diff] [blame] | 781 | mbedtls_svc_key_id_t xxdh_psa_privkey; |
| 782 | uint8_t xxdh_psa_privkey_is_external; |
Valerio Setti | da403b7 | 2023-07-10 14:31:39 +0200 | [diff] [blame] | 783 | unsigned char xxdh_psa_peerkey[PSA_EXPORT_PUBLIC_KEY_MAX_SIZE]; |
Przemek Stekiel | 7ac93be | 2023-07-04 10:02:38 +0200 | [diff] [blame] | 784 | size_t xxdh_psa_peerkey_len; |
Valerio Setti | ea59c43 | 2023-07-25 11:14:03 +0200 | [diff] [blame] | 785 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED */ |
Hanno Becker | df51dbe | 2019-02-18 16:41:55 +0000 | [diff] [blame] | 786 | |
Manuel Pégourié-Gonnard | eef142d | 2015-09-16 10:05:04 +0200 | [diff] [blame] | 787 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 788 | psa_pake_operation_t psa_pake_ctx; /*!< EC J-PAKE key exchange */ |
| 789 | mbedtls_svc_key_id_t psa_pake_password; |
| 790 | uint8_t psa_pake_ctx_is_ok; |
Manuel Pégourié-Gonnard | 77c0646 | 2015-09-17 13:59:49 +0200 | [diff] [blame] | 791 | #if defined(MBEDTLS_SSL_CLI_C) |
| 792 | unsigned char *ecjpake_cache; /*!< Cache for ClientHello ext */ |
| 793 | size_t ecjpake_cache_len; /*!< Length of cached data */ |
| 794 | #endif |
Hanno Becker | 1aa267c | 2017-04-28 17:08:27 +0100 | [diff] [blame] | 795 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Gilles Peskine | 8716f17 | 2021-11-16 15:21:44 +0100 | [diff] [blame] | 796 | |
Valerio Setti | c2232ea | 2023-07-05 18:57:52 +0200 | [diff] [blame] | 797 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED) || \ |
Valerio Setti | e9646ec | 2023-08-02 20:02:28 +0200 | [diff] [blame] | 798 | defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) || \ |
Manuel Pégourié-Gonnard | eef142d | 2015-09-16 10:05:04 +0200 | [diff] [blame] | 799 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Valerio Setti | 18c9fed | 2022-12-30 17:44:24 +0100 | [diff] [blame] | 800 | uint16_t *curves_tls_id; /*!< List of TLS IDs of supported elliptic curves */ |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 801 | #endif |
Gilles Peskine | 8716f17 | 2021-11-16 15:21:44 +0100 | [diff] [blame] | 802 | |
Ronald Cron | 73fe8df | 2022-10-05 14:31:43 +0200 | [diff] [blame] | 803 | #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED) |
Andrzej Kurek | 03e0146 | 2022-01-03 12:53:24 +0100 | [diff] [blame] | 804 | mbedtls_svc_key_id_t psk_opaque; /*!< Opaque PSK from the callback */ |
Neil Armstrong | 501c932 | 2022-05-03 09:35:09 +0200 | [diff] [blame] | 805 | uint8_t psk_opaque_is_internal; |
Jerry Yu | 96a2e36 | 2022-07-21 15:11:34 +0800 | [diff] [blame] | 806 | uint16_t selected_identity; |
Ronald Cron | 73fe8df | 2022-10-05 14:31:43 +0200 | [diff] [blame] | 807 | #endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */ |
Gilles Peskine | 8716f17 | 2021-11-16 15:21:44 +0100 | [diff] [blame] | 808 | |
Gilles Peskine | cfe74a3 | 2021-12-08 18:38:51 +0100 | [diff] [blame] | 809 | #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) |
| 810 | mbedtls_x509_crt_restart_ctx ecrs_ctx; /*!< restart context */ |
| 811 | #endif |
| 812 | |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 813 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 814 | mbedtls_ssl_key_cert *key_cert; /*!< chosen key/cert pair (server) */ |
| 815 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
| 816 | mbedtls_ssl_key_cert *sni_key_cert; /*!< key/cert list from SNI */ |
| 817 | mbedtls_x509_crt *sni_ca_chain; /*!< trusted CAs from SNI callback */ |
| 818 | mbedtls_x509_crl *sni_ca_crl; /*!< trusted CAs CRLs from SNI */ |
Hanno Becker | 1aa267c | 2017-04-28 17:08:27 +0100 | [diff] [blame] | 819 | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 820 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Gilles Peskine | 8716f17 | 2021-11-16 15:21:44 +0100 | [diff] [blame] | 821 | |
Gilles Peskine | 8716f17 | 2021-11-16 15:21:44 +0100 | [diff] [blame] | 822 | #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ |
Hanno Becker | 7517312 | 2019-02-06 16:18:31 +0000 | [diff] [blame] | 823 | !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) |
| 824 | mbedtls_pk_context peer_pubkey; /*!< The public key from the peer. */ |
| 825 | #endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
Hanno Becker | 2f28c10 | 2019-04-25 15:46:59 +0100 | [diff] [blame] | 826 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 827 | struct { |
Hanno Becker | e0b150f | 2018-08-21 15:51:03 +0100 | [diff] [blame] | 828 | size_t total_bytes_buffered; /*!< Cumulative size of heap allocated |
| 829 | * buffers used for message buffering. */ |
| 830 | |
Hanno Becker | d7f8ae2 | 2018-08-16 09:45:56 +0100 | [diff] [blame] | 831 | uint8_t seen_ccs; /*!< Indicates if a CCS message has |
Hanno Becker | 2ed6bcc | 2018-08-15 15:11:57 +0100 | [diff] [blame] | 832 | * been seen in the current flight. */ |
Hanno Becker | d7f8ae2 | 2018-08-16 09:45:56 +0100 | [diff] [blame] | 833 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 834 | struct mbedtls_ssl_hs_buffer { |
Hanno Becker | 98081a0 | 2018-08-22 13:32:50 +0100 | [diff] [blame] | 835 | unsigned is_valid : 1; |
| 836 | unsigned is_fragmented : 1; |
| 837 | unsigned is_complete : 1; |
Hanno Becker | 0271f96 | 2018-08-16 13:23:47 +0100 | [diff] [blame] | 838 | unsigned char *data; |
Hanno Becker | e0b150f | 2018-08-21 15:51:03 +0100 | [diff] [blame] | 839 | size_t data_len; |
Hanno Becker | 0271f96 | 2018-08-16 13:23:47 +0100 | [diff] [blame] | 840 | } hs[MBEDTLS_SSL_MAX_BUFFERED_HS]; |
| 841 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 842 | struct { |
Hanno Becker | 5f066e7 | 2018-08-16 14:56:31 +0100 | [diff] [blame] | 843 | unsigned char *data; |
| 844 | size_t len; |
| 845 | unsigned epoch; |
| 846 | } future_record; |
| 847 | |
Hanno Becker | d7f8ae2 | 2018-08-16 09:45:56 +0100 | [diff] [blame] | 848 | } buffering; |
Hanno Becker | 3546201 | 2018-08-22 10:25:40 +0100 | [diff] [blame] | 849 | |
XiaokangQian | 9b93c0d | 2022-02-09 06:02:25 +0000 | [diff] [blame] | 850 | #if defined(MBEDTLS_SSL_CLI_C) && \ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 851 | (defined(MBEDTLS_SSL_PROTO_DTLS) || \ |
| 852 | defined(MBEDTLS_SSL_PROTO_TLS1_3)) |
Jerry Yu | ac5ca5a | 2022-03-04 12:50:46 +0800 | [diff] [blame] | 853 | unsigned char *cookie; /*!< HelloVerifyRequest cookie for DTLS |
| 854 | * HelloRetryRequest cookie for TLS 1.3 */ |
| 855 | #if !defined(MBEDTLS_SSL_PROTO_TLS1_3) |
| 856 | /* RFC 6347 page 15 |
| 857 | ... |
| 858 | opaque cookie<0..2^8-1>; |
| 859 | ... |
| 860 | */ |
| 861 | uint8_t cookie_len; |
| 862 | #else |
| 863 | /* RFC 8446 page 39 |
| 864 | ... |
| 865 | opaque cookie<0..2^16-1>; |
| 866 | ... |
| 867 | If TLS1_3 is enabled, the max length is 2^16 - 1 |
| 868 | */ |
| 869 | uint16_t cookie_len; /*!< DTLS: HelloVerifyRequest cookie length |
| 870 | * TLS1_3: HelloRetryRequest cookie length */ |
| 871 | #endif |
XiaokangQian | 9b93c0d | 2022-02-09 06:02:25 +0000 | [diff] [blame] | 872 | #endif /* MBEDTLS_SSL_CLI_C && |
Jerry Yu | ac5ca5a | 2022-03-04 12:50:46 +0800 | [diff] [blame] | 873 | ( MBEDTLS_SSL_PROTO_DTLS || |
| 874 | MBEDTLS_SSL_PROTO_TLS1_3 ) */ |
| 875 | #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_DTLS) |
| 876 | unsigned char cookie_verify_result; /*!< Srv: flag for sending a cookie */ |
| 877 | #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_DTLS */ |
XiaokangQian | 52da558 | 2022-01-26 09:49:29 +0000 | [diff] [blame] | 878 | |
| 879 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
| 880 | unsigned int out_msg_seq; /*!< Outgoing handshake sequence number */ |
| 881 | unsigned int in_msg_seq; /*!< Incoming handshake sequence number */ |
Gilles Peskine | ec45c1e | 2021-11-29 12:18:09 +0100 | [diff] [blame] | 882 | |
| 883 | uint32_t retransmit_timeout; /*!< Current value of timeout */ |
| 884 | mbedtls_ssl_flight_item *flight; /*!< Current outgoing flight */ |
| 885 | mbedtls_ssl_flight_item *cur_msg; /*!< Current message in flight */ |
| 886 | unsigned char *cur_msg_p; /*!< Position in current message */ |
| 887 | unsigned int in_flight_start_seq; /*!< Minimum message sequence in the |
| 888 | flight being received */ |
| 889 | mbedtls_ssl_transform *alt_transform_out; /*!< Alternative transform for |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 890 | resending messages */ |
Gilles Peskine | ec45c1e | 2021-11-29 12:18:09 +0100 | [diff] [blame] | 891 | unsigned char alt_out_ctr[MBEDTLS_SSL_SEQUENCE_NUMBER_LEN]; /*!< Alternative record epoch/counter |
| 892 | for resending messages */ |
| 893 | |
| 894 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
| 895 | /* The state of CID configuration in this handshake. */ |
| 896 | |
| 897 | uint8_t cid_in_use; /*!< This indicates whether the use of the CID extension |
| 898 | * has been negotiated. Possible values are |
| 899 | * #MBEDTLS_SSL_CID_ENABLED and |
| 900 | * #MBEDTLS_SSL_CID_DISABLED. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 901 | unsigned char peer_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX]; /*! The peer's CID */ |
Gilles Peskine | ec45c1e | 2021-11-29 12:18:09 +0100 | [diff] [blame] | 902 | uint8_t peer_cid_len; /*!< The length of |
| 903 | * \c peer_cid. */ |
| 904 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
| 905 | |
Manuel Pégourié-Gonnard | f47a4af | 2018-08-22 10:38:52 +0200 | [diff] [blame] | 906 | uint16_t mtu; /*!< Handshake mtu, used to fragment outgoing messages */ |
Hanno Becker | 1aa267c | 2017-04-28 17:08:27 +0100 | [diff] [blame] | 907 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 908 | |
| 909 | /* |
| 910 | * Checksum contexts |
| 911 | */ |
Elena Uziunaite | 0916cd7 | 2024-05-23 17:01:07 +0100 | [diff] [blame] | 912 | #if defined(PSA_WANT_ALG_SHA_256) |
Andrzej Kurek | eb34224 | 2019-01-29 09:14:33 -0500 | [diff] [blame] | 913 | psa_hash_operation_t fin_sha256_psa; |
Andrzej Kurek | eb34224 | 2019-01-29 09:14:33 -0500 | [diff] [blame] | 914 | #endif |
Elena Uziunaite | b476d4b | 2024-05-23 15:33:41 +0100 | [diff] [blame] | 915 | #if defined(PSA_WANT_ALG_SHA_384) |
Andrzej Kurek | 972fba5 | 2019-01-30 03:29:12 -0500 | [diff] [blame] | 916 | psa_hash_operation_t fin_sha384_psa; |
Andrzej Kurek | eb34224 | 2019-01-29 09:14:33 -0500 | [diff] [blame] | 917 | #endif |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 918 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 919 | #if defined(MBEDTLS_SSL_PROTO_TLS1_3) |
Jerry Yu | 56fc07f | 2021-09-01 17:48:49 +0800 | [diff] [blame] | 920 | uint16_t offered_group_id; /* The NamedGroup value for the group |
| 921 | * that is being used for ephemeral |
| 922 | * key exchange. |
| 923 | * |
| 924 | * On the client: Defaults to the first |
| 925 | * entry in the client's group list, |
| 926 | * but can be overwritten by the HRR. */ |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 927 | #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ |
Jerry Yu | 56fc07f | 2021-09-01 17:48:49 +0800 | [diff] [blame] | 928 | |
Jerry Yu | fb28b88 | 2022-01-28 11:05:58 +0800 | [diff] [blame] | 929 | #if defined(MBEDTLS_SSL_CLI_C) |
Jerry Yu | 2d9a694 | 2022-02-08 21:07:10 +0800 | [diff] [blame] | 930 | uint8_t client_auth; /*!< used to check if CertificateRequest has been |
Jerry Yu | 5c7d1cc | 2022-02-08 21:08:29 +0800 | [diff] [blame] | 931 | received from server side. If CertificateRequest |
Jerry Yu | 0ff8ac8 | 2022-02-08 10:10:48 +0800 | [diff] [blame] | 932 | has been received, Certificate and CertificateVerify |
Jerry Yu | fb28b88 | 2022-01-28 11:05:58 +0800 | [diff] [blame] | 933 | should be sent to server */ |
| 934 | #endif /* MBEDTLS_SSL_CLI_C */ |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 935 | /* |
| 936 | * State-local variables used during the processing |
| 937 | * of a specific handshake state. |
| 938 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 939 | union { |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 940 | /* Outgoing Finished message */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 941 | struct { |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 942 | uint8_t preparation_done; |
| 943 | |
| 944 | /* Buffer holding digest of the handshake up to |
| 945 | * but excluding the outgoing finished message. */ |
XiaokangQian | c5c39d5 | 2021-11-09 11:55:10 +0000 | [diff] [blame] | 946 | unsigned char digest[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 947 | size_t digest_len; |
| 948 | } finished_out; |
| 949 | |
| 950 | /* Incoming Finished message */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 951 | struct { |
XiaokangQian | 57b2aff | 2021-11-10 03:12:11 +0000 | [diff] [blame] | 952 | uint8_t preparation_done; |
| 953 | |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 954 | /* Buffer holding digest of the handshake up to but |
| 955 | * excluding the peer's incoming finished message. */ |
XiaokangQian | c5c39d5 | 2021-11-09 11:55:10 +0000 | [diff] [blame] | 956 | unsigned char digest[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 957 | size_t digest_len; |
| 958 | } finished_in; |
| 959 | |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 960 | } state_local; |
| 961 | |
| 962 | /* End of state-local variables. */ |
| 963 | |
Jerry Yu | e6d7e5c | 2021-10-26 10:44:32 +0800 | [diff] [blame] | 964 | unsigned char randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN + |
| 965 | MBEDTLS_SERVER_HELLO_RANDOM_LEN]; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 966 | /*!< random bytes */ |
Ronald Cron | 3b05620 | 2022-10-05 17:20:21 +0200 | [diff] [blame] | 967 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 968 | unsigned char premaster[MBEDTLS_PREMASTER_SIZE]; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 969 | /*!< premaster secret */ |
Ronald Cron | 3b05620 | 2022-10-05 17:20:21 +0200 | [diff] [blame] | 970 | size_t pmslen; /*!< premaster length */ |
| 971 | #endif |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 972 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 973 | #if defined(MBEDTLS_SSL_PROTO_TLS1_3) |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 974 | uint32_t sent_extensions; /*!< extensions sent by endpoint */ |
| 975 | uint32_t received_extensions; /*!< extensions received by endpoint */ |
Jerry Yu | 89ea321 | 2021-09-09 14:31:24 +0800 | [diff] [blame] | 976 | |
Ronald Cron | e68ab4f | 2022-10-05 12:46:29 +0200 | [diff] [blame] | 977 | #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) |
Xiaofei Bai | a0ab777 | 2022-01-16 12:14:45 +0000 | [diff] [blame] | 978 | unsigned char certificate_request_context_len; |
| 979 | unsigned char *certificate_request_context; |
Xiaofei Bai | e1e3442 | 2021-12-23 12:09:05 +0000 | [diff] [blame] | 980 | #endif |
| 981 | |
Jerry Yu | 3d9b590 | 2022-11-04 14:07:25 +0800 | [diff] [blame] | 982 | /** TLS 1.3 transform for encrypted handshake messages. */ |
| 983 | mbedtls_ssl_transform *transform_handshake; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 984 | union { |
| 985 | unsigned char early[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
Jerry Yu | d1ab262 | 2021-10-08 15:36:57 +0800 | [diff] [blame] | 986 | unsigned char handshake[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 987 | unsigned char app[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 988 | } tls13_master_secrets; |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 989 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 990 | mbedtls_ssl_tls13_handshake_secrets tls13_hs_secrets; |
Jerry Yu | 3d9b590 | 2022-11-04 14:07:25 +0800 | [diff] [blame] | 991 | #if defined(MBEDTLS_SSL_EARLY_DATA) |
Jerry Yu | 3ce61ff | 2022-11-21 22:45:58 +0800 | [diff] [blame] | 992 | /** TLS 1.3 transform for early data and handshake messages. */ |
Jerry Yu | 3d9b590 | 2022-11-04 14:07:25 +0800 | [diff] [blame] | 993 | mbedtls_ssl_transform *transform_earlydata; |
| 994 | #endif |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 995 | #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 996 | |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 997 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
| 998 | /** Asynchronous operation context. This field is meant for use by the |
| 999 | * asynchronous operation callbacks (mbedtls_ssl_config::f_async_sign_start, |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 1000 | * mbedtls_ssl_config::f_async_resume, mbedtls_ssl_config::f_async_cancel). |
| 1001 | * The library does not use it internally. */ |
| 1002 | void *user_async_ctx; |
| 1003 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Glenn Strauss | 6989407 | 2022-01-24 12:58:00 -0500 | [diff] [blame] | 1004 | |
| 1005 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
| 1006 | const unsigned char *sni_name; /*!< raw SNI */ |
| 1007 | size_t sni_name_len; /*!< raw SNI len */ |
Glenn Strauss | 999ef70 | 2022-03-11 01:37:23 -0500 | [diff] [blame] | 1008 | #if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) |
| 1009 | const mbedtls_x509_crt *dn_hints; /*!< acceptable client cert issuers */ |
| 1010 | #endif |
Glenn Strauss | 6989407 | 2022-01-24 12:58:00 -0500 | [diff] [blame] | 1011 | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1012 | }; |
| 1013 | |
Hanno Becker | 0271f96 | 2018-08-16 13:23:47 +0100 | [diff] [blame] | 1014 | typedef struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer; |
| 1015 | |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1016 | /* |
Hanno Becker | d362dc5 | 2018-01-03 15:23:11 +0000 | [diff] [blame] | 1017 | * Representation of decryption/encryption transformations on records |
| 1018 | * |
| 1019 | * There are the following general types of record transformations: |
TRodziewicz | 2abf03c | 2021-06-25 14:40:09 +0200 | [diff] [blame] | 1020 | * - Stream transformations (TLS versions == 1.2 only) |
Hanno Becker | d362dc5 | 2018-01-03 15:23:11 +0000 | [diff] [blame] | 1021 | * Transformation adding a MAC and applying a stream-cipher |
| 1022 | * to the authenticated message. |
TRodziewicz | 2abf03c | 2021-06-25 14:40:09 +0200 | [diff] [blame] | 1023 | * - CBC block cipher transformations ([D]TLS versions == 1.2 only) |
| 1024 | * For TLS 1.2, no IV is generated at key extraction time, but every |
| 1025 | * encrypted record is explicitly prefixed by the IV with which it was |
| 1026 | * encrypted. |
| 1027 | * - AEAD transformations ([D]TLS versions == 1.2 only) |
Hanno Becker | d362dc5 | 2018-01-03 15:23:11 +0000 | [diff] [blame] | 1028 | * These come in two fundamentally different versions, the first one |
| 1029 | * used in TLS 1.2, excluding ChaChaPoly ciphersuites, and the second |
| 1030 | * one used for ChaChaPoly ciphersuites in TLS 1.2 as well as for TLS 1.3. |
| 1031 | * In the first transformation, the IV to be used for a record is obtained |
| 1032 | * as the concatenation of an explicit, static 4-byte IV and the 8-byte |
| 1033 | * record sequence number, and explicitly prepending this sequence number |
| 1034 | * to the encrypted record. In contrast, in the second transformation |
| 1035 | * the IV is obtained by XOR'ing a static IV obtained at key extraction |
| 1036 | * time with the 8-byte record sequence number, without prepending the |
| 1037 | * latter to the encrypted record. |
| 1038 | * |
Hanno Becker | 7d343ec | 2020-05-04 12:29:05 +0100 | [diff] [blame] | 1039 | * Additionally, DTLS 1.2 + CID as well as TLS 1.3 use an inner plaintext |
| 1040 | * which allows to add flexible length padding and to hide a record's true |
| 1041 | * content type. |
| 1042 | * |
Hanno Becker | d362dc5 | 2018-01-03 15:23:11 +0000 | [diff] [blame] | 1043 | * In addition to type and version, the following parameters are relevant: |
| 1044 | * - The symmetric cipher algorithm to be used. |
| 1045 | * - The (static) encryption/decryption keys for the cipher. |
| 1046 | * - For stream/CBC, the type of message digest to be used. |
| 1047 | * - For stream/CBC, (static) encryption/decryption keys for the digest. |
Hanno Becker | 0db7e0c | 2018-10-18 15:39:53 +0100 | [diff] [blame] | 1048 | * - For AEAD transformations, the size (potentially 0) of an explicit, |
| 1049 | * random initialization vector placed in encrypted records. |
TRodziewicz | 299510e | 2021-07-09 16:55:11 +0200 | [diff] [blame] | 1050 | * - For some transformations (currently AEAD) an implicit IV. It is static |
Hanno Becker | d362dc5 | 2018-01-03 15:23:11 +0000 | [diff] [blame] | 1051 | * and (if present) is combined with the explicit IV in a transformation- |
TRodziewicz | 299510e | 2021-07-09 16:55:11 +0200 | [diff] [blame] | 1052 | * -dependent way (e.g. appending in TLS 1.2 and XOR'ing in TLS 1.3). |
Hanno Becker | d362dc5 | 2018-01-03 15:23:11 +0000 | [diff] [blame] | 1053 | * - For stream/CBC, a flag determining the order of encryption and MAC. |
| 1054 | * - The details of the transformation depend on the SSL/TLS version. |
| 1055 | * - The length of the authentication tag. |
| 1056 | * |
| 1057 | * The struct below refines this abstract view as follows: |
| 1058 | * - The cipher underlying the transformation is managed in |
| 1059 | * cipher contexts cipher_ctx_{enc/dec}, which must have the |
| 1060 | * same cipher type. The mode of these cipher contexts determines |
| 1061 | * the type of the transformation in the sense above: e.g., if |
| 1062 | * the type is MBEDTLS_CIPHER_AES_256_CBC resp. MBEDTLS_CIPHER_AES_192_GCM |
| 1063 | * then the transformation has type CBC resp. AEAD. |
| 1064 | * - The cipher keys are never stored explicitly but |
| 1065 | * are maintained within cipher_ctx_{enc/dec}. |
| 1066 | * - For stream/CBC transformations, the message digest contexts |
| 1067 | * used for the MAC's are stored in md_ctx_{enc/dec}. These contexts |
| 1068 | * are unused for AEAD transformations. |
TRodziewicz | 2abf03c | 2021-06-25 14:40:09 +0200 | [diff] [blame] | 1069 | * - For stream/CBC transformations, the MAC keys are not stored explicitly |
| 1070 | * but maintained within md_ctx_{enc/dec}. |
| 1071 | * - The mac_enc and mac_dec fields are unused for EAD transformations. |
Hanno Becker | d362dc5 | 2018-01-03 15:23:11 +0000 | [diff] [blame] | 1072 | * - For transformations using an implicit IV maintained within |
| 1073 | * the transformation context, its contents are stored within |
| 1074 | * iv_{enc/dec}. |
| 1075 | * - The value of ivlen indicates the length of the IV. |
| 1076 | * This is redundant in case of stream/CBC transformations |
| 1077 | * which always use 0 resp. the cipher's block length as the |
| 1078 | * IV length, but is needed for AEAD ciphers and may be |
| 1079 | * different from the underlying cipher's block length |
| 1080 | * in this case. |
| 1081 | * - The field fixed_ivlen is nonzero for AEAD transformations only |
| 1082 | * and indicates the length of the static part of the IV which is |
| 1083 | * constant throughout the communication, and which is stored in |
| 1084 | * the first fixed_ivlen bytes of the iv_{enc/dec} arrays. |
Glenn Strauss | 07c6416 | 2022-03-14 12:34:51 -0400 | [diff] [blame] | 1085 | * - tls_version denotes the 2-byte TLS version |
Hanno Becker | d362dc5 | 2018-01-03 15:23:11 +0000 | [diff] [blame] | 1086 | * - For stream/CBC transformations, maclen denotes the length of the |
| 1087 | * authentication tag, while taglen is unused and 0. |
| 1088 | * - For AEAD transformations, taglen denotes the length of the |
| 1089 | * authentication tag, while maclen is unused and 0. |
| 1090 | * - For CBC transformations, encrypt_then_mac determines the |
| 1091 | * order of encryption and authentication. This field is unused |
| 1092 | * in other transformations. |
| 1093 | * |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1094 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1095 | struct mbedtls_ssl_transform { |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1096 | /* |
| 1097 | * Session specific crypto layer |
| 1098 | */ |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1099 | size_t minlen; /*!< min. ciphertext length */ |
| 1100 | size_t ivlen; /*!< IV length */ |
| 1101 | size_t fixed_ivlen; /*!< Fixed part of IV (AEAD) */ |
Hanno Becker | e694c3e | 2017-12-27 21:34:08 +0000 | [diff] [blame] | 1102 | size_t maclen; /*!< MAC(CBC) len */ |
| 1103 | size_t taglen; /*!< TAG(AEAD) len */ |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1104 | |
| 1105 | unsigned char iv_enc[16]; /*!< IV (encryption) */ |
| 1106 | unsigned char iv_dec[16]; /*!< IV (decryption) */ |
| 1107 | |
Hanno Becker | fd86ca8 | 2020-11-30 08:54:23 +0000 | [diff] [blame] | 1108 | #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) |
Hanno Becker | d56ed24 | 2018-01-03 15:32:51 +0000 | [diff] [blame] | 1109 | |
Neil Armstrong | 39b8e7d | 2022-02-23 09:24:45 +0100 | [diff] [blame] | 1110 | mbedtls_svc_key_id_t psa_mac_enc; /*!< MAC (encryption) */ |
| 1111 | mbedtls_svc_key_id_t psa_mac_dec; /*!< MAC (decryption) */ |
| 1112 | psa_algorithm_t psa_mac_alg; /*!< psa MAC algorithm */ |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1113 | |
Hanno Becker | 9eddaeb | 2017-12-27 21:37:21 +0000 | [diff] [blame] | 1114 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
| 1115 | int encrypt_then_mac; /*!< flag for EtM activation */ |
| 1116 | #endif |
| 1117 | |
Hanno Becker | fd86ca8 | 2020-11-30 08:54:23 +0000 | [diff] [blame] | 1118 | #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */ |
Hanno Becker | d56ed24 | 2018-01-03 15:32:51 +0000 | [diff] [blame] | 1119 | |
Glenn Strauss | 07c6416 | 2022-03-14 12:34:51 -0400 | [diff] [blame] | 1120 | mbedtls_ssl_protocol_version tls_version; |
Hanno Becker | 9eddaeb | 2017-12-27 21:37:21 +0000 | [diff] [blame] | 1121 | |
Przemyslaw Stekiel | 44187d7 | 2022-01-11 08:25:29 +0100 | [diff] [blame] | 1122 | mbedtls_svc_key_id_t psa_key_enc; /*!< psa encryption key */ |
| 1123 | mbedtls_svc_key_id_t psa_key_dec; /*!< psa decryption key */ |
| 1124 | psa_algorithm_t psa_alg; /*!< psa algorithm */ |
Przemyslaw Stekiel | 44187d7 | 2022-01-11 08:25:29 +0100 | [diff] [blame] | 1125 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 1126 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | 1327fa7 | 2019-04-25 15:54:02 +0100 | [diff] [blame] | 1127 | uint8_t in_cid_len; |
| 1128 | uint8_t out_cid_len; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1129 | unsigned char in_cid[MBEDTLS_SSL_CID_IN_LEN_MAX]; |
| 1130 | unsigned char out_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX]; |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 1131 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | 1327fa7 | 2019-04-25 15:54:02 +0100 | [diff] [blame] | 1132 | |
Max Fillinger | 2fe35f6 | 2024-10-25 00:52:24 +0200 | [diff] [blame] | 1133 | #if defined(MBEDTLS_SSL_KEEP_RANDBYTES) |
Manuel Pégourié-Gonnard | 96fb0ee | 2019-07-09 12:54:17 +0200 | [diff] [blame] | 1134 | /* We need the Hello random bytes in order to re-derive keys from the |
Max Fillinger | 2fe35f6 | 2024-10-25 00:52:24 +0200 | [diff] [blame] | 1135 | * Master Secret and other session info and for the keying material |
| 1136 | * exporter in TLS 1.2. |
| 1137 | * See ssl_tls12_populate_transform() */ |
Jerry Yu | e6d7e5c | 2021-10-26 10:44:32 +0800 | [diff] [blame] | 1138 | unsigned char randbytes[MBEDTLS_SERVER_HELLO_RANDOM_LEN + |
| 1139 | MBEDTLS_CLIENT_HELLO_RANDOM_LEN]; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1140 | /*!< ServerHello.random+ClientHello.random */ |
Max Fillinger | 0747388 | 2024-10-28 14:44:25 +0100 | [diff] [blame] | 1141 | #endif /* defined(MBEDTLS_SSL_KEEP_RANDBYTES) */ |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1142 | }; |
| 1143 | |
Hanno Becker | 12a3a86 | 2018-01-05 15:42:50 +0000 | [diff] [blame] | 1144 | /* |
Manuel Pégourié-Gonnard | 1aaf669 | 2019-07-10 14:14:05 +0200 | [diff] [blame] | 1145 | * Return 1 if the transform uses an AEAD cipher, 0 otherwise. |
| 1146 | * Equivalently, return 0 if a separate MAC is used, 1 otherwise. |
| 1147 | */ |
| 1148 | static inline int mbedtls_ssl_transform_uses_aead( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1149 | const mbedtls_ssl_transform *transform) |
Manuel Pégourié-Gonnard | 1aaf669 | 2019-07-10 14:14:05 +0200 | [diff] [blame] | 1150 | { |
Hanno Becker | fd86ca8 | 2020-11-30 08:54:23 +0000 | [diff] [blame] | 1151 | #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1152 | return transform->maclen == 0 && transform->taglen != 0; |
Manuel Pégourié-Gonnard | 1aaf669 | 2019-07-10 14:14:05 +0200 | [diff] [blame] | 1153 | #else |
| 1154 | (void) transform; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1155 | return 1; |
Manuel Pégourié-Gonnard | 1aaf669 | 2019-07-10 14:14:05 +0200 | [diff] [blame] | 1156 | #endif |
| 1157 | } |
| 1158 | |
| 1159 | /* |
Hanno Becker | 12a3a86 | 2018-01-05 15:42:50 +0000 | [diff] [blame] | 1160 | * Internal representation of record frames |
| 1161 | * |
Hanno Becker | 12a3a86 | 2018-01-05 15:42:50 +0000 | [diff] [blame] | 1162 | * Instances come in two flavors: |
| 1163 | * (1) Encrypted |
| 1164 | * These always have data_offset = 0 |
| 1165 | * (2) Unencrypted |
Hanno Becker | cd430bc | 2019-04-04 16:29:48 +0100 | [diff] [blame] | 1166 | * These have data_offset set to the amount of |
| 1167 | * pre-expansion during record protection. Concretely, |
| 1168 | * this is the length of the fixed part of the explicit IV |
| 1169 | * used for encryption, or 0 if no explicit IV is used |
TRodziewicz | 2abf03c | 2021-06-25 14:40:09 +0200 | [diff] [blame] | 1170 | * (e.g. for stream ciphers). |
Hanno Becker | 12a3a86 | 2018-01-05 15:42:50 +0000 | [diff] [blame] | 1171 | * |
| 1172 | * The reason for the data_offset in the unencrypted case |
| 1173 | * is to allow for in-place conversion of an unencrypted to |
| 1174 | * an encrypted record. If the offset wasn't included, the |
| 1175 | * encrypted content would need to be shifted afterwards to |
| 1176 | * make space for the fixed IV. |
| 1177 | * |
| 1178 | */ |
Hanno Becker | f2ed448 | 2019-04-29 13:45:54 +0100 | [diff] [blame] | 1179 | #if MBEDTLS_SSL_CID_OUT_LEN_MAX > MBEDTLS_SSL_CID_IN_LEN_MAX |
Hanno Becker | 75f080f | 2019-04-30 15:01:51 +0100 | [diff] [blame] | 1180 | #define MBEDTLS_SSL_CID_LEN_MAX MBEDTLS_SSL_CID_OUT_LEN_MAX |
Hanno Becker | f2ed448 | 2019-04-29 13:45:54 +0100 | [diff] [blame] | 1181 | #else |
Hanno Becker | 75f080f | 2019-04-30 15:01:51 +0100 | [diff] [blame] | 1182 | #define MBEDTLS_SSL_CID_LEN_MAX MBEDTLS_SSL_CID_IN_LEN_MAX |
Hanno Becker | f2ed448 | 2019-04-29 13:45:54 +0100 | [diff] [blame] | 1183 | #endif |
| 1184 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1185 | typedef struct { |
Jerry Yu | ae0b2e2 | 2021-10-08 15:21:19 +0800 | [diff] [blame] | 1186 | uint8_t ctr[MBEDTLS_SSL_SEQUENCE_NUMBER_LEN]; /* In TLS: The implicit record sequence number. |
| 1187 | * In DTLS: The 2-byte epoch followed by |
| 1188 | * the 6-byte sequence number. |
| 1189 | * This is stored as a raw big endian byte array |
| 1190 | * as opposed to a uint64_t because we rarely |
| 1191 | * need to perform arithmetic on this, but do |
| 1192 | * need it as a Byte array for the purpose of |
| 1193 | * MAC computations. */ |
Hanno Becker | d840cea | 2019-07-11 09:24:36 +0100 | [diff] [blame] | 1194 | uint8_t type; /* The record content type. */ |
| 1195 | uint8_t ver[2]; /* SSL/TLS version as present on the wire. |
| 1196 | * Convert to internal presentation of versions |
| 1197 | * using mbedtls_ssl_read_version() and |
| 1198 | * mbedtls_ssl_write_version(). |
| 1199 | * Keep wire-format for MAC computations. */ |
Hanno Becker | 12a3a86 | 2018-01-05 15:42:50 +0000 | [diff] [blame] | 1200 | |
Hanno Becker | d840cea | 2019-07-11 09:24:36 +0100 | [diff] [blame] | 1201 | unsigned char *buf; /* Memory buffer enclosing the record content */ |
| 1202 | size_t buf_len; /* Buffer length */ |
| 1203 | size_t data_offset; /* Offset of record content */ |
| 1204 | size_t data_len; /* Length of record content */ |
Hanno Becker | 12a3a86 | 2018-01-05 15:42:50 +0000 | [diff] [blame] | 1205 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 1206 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | d840cea | 2019-07-11 09:24:36 +0100 | [diff] [blame] | 1207 | uint8_t cid_len; /* Length of the CID (0 if not present) */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1208 | unsigned char cid[MBEDTLS_SSL_CID_LEN_MAX]; /* The CID */ |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 1209 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | 12a3a86 | 2018-01-05 15:42:50 +0000 | [diff] [blame] | 1210 | } mbedtls_record; |
| 1211 | |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1212 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 1213 | /* |
| 1214 | * List of certificate + private key pairs |
| 1215 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1216 | struct mbedtls_ssl_key_cert { |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1217 | mbedtls_x509_crt *cert; /*!< cert */ |
| 1218 | mbedtls_pk_context *key; /*!< private key */ |
| 1219 | mbedtls_ssl_key_cert *next; /*!< next key/cert pair */ |
| 1220 | }; |
| 1221 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
| 1222 | |
| 1223 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
| 1224 | /* |
| 1225 | * List of handshake messages kept around for resending |
| 1226 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1227 | struct mbedtls_ssl_flight_item { |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1228 | unsigned char *p; /*!< message, including handshake headers */ |
| 1229 | size_t len; /*!< length of p */ |
| 1230 | unsigned char type; /*!< type of the message: handshake or CCS */ |
| 1231 | mbedtls_ssl_flight_item *next; /*!< next handshake message(s) */ |
| 1232 | }; |
| 1233 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
| 1234 | |
Ronald Cron | 4079abc | 2022-02-20 10:35:26 +0100 | [diff] [blame] | 1235 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
| 1236 | /** |
| 1237 | * \brief Given an SSL context and its associated configuration, write the TLS |
| 1238 | * 1.2 specific extensions of the ClientHello message. |
| 1239 | * |
| 1240 | * \param[in] ssl SSL context |
| 1241 | * \param[in] buf Base address of the buffer where to write the extensions |
| 1242 | * \param[in] end End address of the buffer where to write the extensions |
| 1243 | * \param uses_ec Whether one proposed ciphersuite uses an elliptic curve |
| 1244 | * (<> 0) or not ( 0 ). |
| 1245 | * \param[out] out_len Length of the data written into the buffer \p buf |
| 1246 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1247 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1248 | int mbedtls_ssl_tls12_write_client_hello_exts(mbedtls_ssl_context *ssl, |
| 1249 | unsigned char *buf, |
| 1250 | const unsigned char *end, |
| 1251 | int uses_ec, |
| 1252 | size_t *out_len); |
Ronald Cron | 4079abc | 2022-02-20 10:35:26 +0100 | [diff] [blame] | 1253 | #endif |
| 1254 | |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 1255 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 1256 | defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 1257 | |
Gabor Mezei | a3d016c | 2022-05-10 12:44:09 +0200 | [diff] [blame] | 1258 | /** |
| 1259 | * \brief Find the preferred hash for a given signature algorithm. |
| 1260 | * |
| 1261 | * \param[in] ssl SSL context |
| 1262 | * \param[in] sig_alg A signature algorithm identifier as defined in the |
| 1263 | * TLS 1.2 SignatureAlgorithm enumeration. |
| 1264 | * |
| 1265 | * \return The preferred hash algorithm for \p sig_alg. It is a hash algorithm |
| 1266 | * identifier as defined in the TLS 1.2 HashAlgorithm enumeration. |
| 1267 | */ |
| 1268 | unsigned int mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1269 | mbedtls_ssl_context *ssl, |
| 1270 | unsigned int sig_alg); |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 1271 | |
Gabor Mezei | 078e803 | 2022-04-27 21:17:56 +0200 | [diff] [blame] | 1272 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 1273 | MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1274 | |
| 1275 | /** |
| 1276 | * \brief Free referenced items in an SSL transform context and clear |
| 1277 | * memory |
| 1278 | * |
| 1279 | * \param transform SSL transform context |
| 1280 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1281 | void mbedtls_ssl_transform_free(mbedtls_ssl_transform *transform); |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1282 | |
| 1283 | /** |
| 1284 | * \brief Free referenced items in an SSL handshake context and clear |
| 1285 | * memory |
| 1286 | * |
Gilles Peskine | 9b562d5 | 2018-04-25 20:32:43 +0200 | [diff] [blame] | 1287 | * \param ssl SSL context |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1288 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1289 | void mbedtls_ssl_handshake_free(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | cd4fcc6 | 2015-05-26 12:11:48 +0200 | [diff] [blame] | 1290 | |
Jerry Yu | c7875b5 | 2021-09-05 21:05:50 +0800 | [diff] [blame] | 1291 | /* set inbound transform of ssl context */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1292 | void mbedtls_ssl_set_inbound_transform(mbedtls_ssl_context *ssl, |
| 1293 | mbedtls_ssl_transform *transform); |
Jerry Yu | c7875b5 | 2021-09-05 21:05:50 +0800 | [diff] [blame] | 1294 | |
| 1295 | /* set outbound transform of ssl context */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1296 | void mbedtls_ssl_set_outbound_transform(mbedtls_ssl_context *ssl, |
| 1297 | mbedtls_ssl_transform *transform); |
Jerry Yu | c7875b5 | 2021-09-05 21:05:50 +0800 | [diff] [blame] | 1298 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1299 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1300 | int mbedtls_ssl_handshake_client_step(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1301 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1302 | int mbedtls_ssl_handshake_server_step(mbedtls_ssl_context *ssl); |
| 1303 | void mbedtls_ssl_handshake_wrapup(mbedtls_ssl_context *ssl); |
Gilles Peskine | f670ba5 | 2025-03-07 15:09:32 +0100 | [diff] [blame] | 1304 | |
Gilles Peskine | c67befe | 2025-03-07 20:45:29 +0100 | [diff] [blame] | 1305 | #if defined(MBEDTLS_DEBUG_C) |
| 1306 | /* Declared in "ssl_debug_helpers.h". We can't include this file from |
| 1307 | * "ssl_misc.h" because it includes "ssl_misc.h" because it needs some |
| 1308 | * type definitions. TODO: split the type definitions and the helper |
| 1309 | * functions into different headers. |
| 1310 | */ |
| 1311 | const char *mbedtls_ssl_states_str(mbedtls_ssl_states state); |
| 1312 | #endif |
| 1313 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1314 | static inline void mbedtls_ssl_handshake_set_state(mbedtls_ssl_context *ssl, |
| 1315 | mbedtls_ssl_states state) |
Ronald Cron | 8f6d39a | 2022-03-10 18:56:50 +0100 | [diff] [blame] | 1316 | { |
Gilles Peskine | c67befe | 2025-03-07 20:45:29 +0100 | [diff] [blame] | 1317 | MBEDTLS_SSL_DEBUG_MSG(3, ("handshake state: %d (%s) -> %d (%s)", |
| 1318 | ssl->state, mbedtls_ssl_states_str(ssl->state), |
Gilles Peskine | bc694b3 | 2025-03-07 22:28:23 +0100 | [diff] [blame] | 1319 | (int) state, mbedtls_ssl_states_str(state))); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1320 | ssl->state = (int) state; |
Ronald Cron | 8f6d39a | 2022-03-10 18:56:50 +0100 | [diff] [blame] | 1321 | } |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1322 | |
Gilles Peskine | f670ba5 | 2025-03-07 15:09:32 +0100 | [diff] [blame] | 1323 | static inline void mbedtls_ssl_handshake_increment_state(mbedtls_ssl_context *ssl) |
| 1324 | { |
| 1325 | mbedtls_ssl_handshake_set_state(ssl, ssl->state + 1); |
| 1326 | } |
| 1327 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1328 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1329 | int mbedtls_ssl_send_fatal_handshake_failure(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1330 | |
Manuel Pégourié-Gonnard | b8b07aa | 2023-02-06 00:34:21 +0100 | [diff] [blame] | 1331 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 226aa15 | 2023-02-05 09:46:59 +0100 | [diff] [blame] | 1332 | int mbedtls_ssl_reset_checksum(mbedtls_ssl_context *ssl); |
Jerry Yu | bef175d | 2022-01-28 10:52:05 +0800 | [diff] [blame] | 1333 | |
| 1334 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1335 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1336 | int mbedtls_ssl_derive_keys(mbedtls_ssl_context *ssl); |
Jerry Yu | bef175d | 2022-01-28 10:52:05 +0800 | [diff] [blame] | 1337 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1338 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1339 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1340 | int mbedtls_ssl_handle_message_type(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1341 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1342 | int mbedtls_ssl_prepare_handshake_record(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | b8b07aa | 2023-02-06 00:34:21 +0100 | [diff] [blame] | 1343 | MBEDTLS_CHECK_RETURN_CRITICAL |
| 1344 | int mbedtls_ssl_update_handshake_status(mbedtls_ssl_context *ssl); |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 1345 | |
Hanno Becker | 4a810fb | 2017-05-24 16:27:30 +0100 | [diff] [blame] | 1346 | /** |
| 1347 | * \brief Update record layer |
| 1348 | * |
| 1349 | * This function roughly separates the implementation |
| 1350 | * of the logic of (D)TLS from the implementation |
| 1351 | * of the secure transport. |
| 1352 | * |
Hanno Becker | 3a0aad1 | 2018-08-20 09:44:02 +0100 | [diff] [blame] | 1353 | * \param ssl The SSL context to use. |
| 1354 | * \param update_hs_digest This indicates if the handshake digest |
| 1355 | * should be automatically updated in case |
| 1356 | * a handshake message is found. |
Hanno Becker | 4a810fb | 2017-05-24 16:27:30 +0100 | [diff] [blame] | 1357 | * |
| 1358 | * \return 0 or non-zero error code. |
| 1359 | * |
| 1360 | * \note A clarification on what is called 'record layer' here |
| 1361 | * is in order, as many sensible definitions are possible: |
| 1362 | * |
| 1363 | * The record layer takes as input an untrusted underlying |
| 1364 | * transport (stream or datagram) and transforms it into |
| 1365 | * a serially multiplexed, secure transport, which |
| 1366 | * conceptually provides the following: |
| 1367 | * |
| 1368 | * (1) Three datagram based, content-agnostic transports |
| 1369 | * for handshake, alert and CCS messages. |
| 1370 | * (2) One stream- or datagram-based transport |
| 1371 | * for application data. |
| 1372 | * (3) Functionality for changing the underlying transform |
| 1373 | * securing the contents. |
| 1374 | * |
| 1375 | * The interface to this functionality is given as follows: |
| 1376 | * |
| 1377 | * a Updating |
| 1378 | * [Currently implemented by mbedtls_ssl_read_record] |
| 1379 | * |
| 1380 | * Check if and on which of the four 'ports' data is pending: |
| 1381 | * Nothing, a controlling datagram of type (1), or application |
| 1382 | * data (2). In any case data is present, internal buffers |
| 1383 | * provide access to the data for the user to process it. |
| 1384 | * Consumption of type (1) datagrams is done automatically |
| 1385 | * on the next update, invalidating that the internal buffers |
| 1386 | * for previous datagrams, while consumption of application |
| 1387 | * data (2) is user-controlled. |
| 1388 | * |
| 1389 | * b Reading of application data |
| 1390 | * [Currently manual adaption of ssl->in_offt pointer] |
| 1391 | * |
| 1392 | * As mentioned in the last paragraph, consumption of data |
| 1393 | * is different from the automatic consumption of control |
| 1394 | * datagrams (1) because application data is treated as a stream. |
| 1395 | * |
| 1396 | * c Tracking availability of application data |
| 1397 | * [Currently manually through decreasing ssl->in_msglen] |
| 1398 | * |
| 1399 | * For efficiency and to retain datagram semantics for |
| 1400 | * application data in case of DTLS, the record layer |
| 1401 | * provides functionality for checking how much application |
| 1402 | * data is still available in the internal buffer. |
| 1403 | * |
| 1404 | * d Changing the transformation securing the communication. |
| 1405 | * |
| 1406 | * Given an opaque implementation of the record layer in the |
| 1407 | * above sense, it should be possible to implement the logic |
| 1408 | * of (D)TLS on top of it without the need to know anything |
| 1409 | * about the record layer's internals. This is done e.g. |
| 1410 | * in all the handshake handling functions, and in the |
| 1411 | * application data reading function mbedtls_ssl_read. |
| 1412 | * |
| 1413 | * \note The above tries to give a conceptual picture of the |
| 1414 | * record layer, but the current implementation deviates |
| 1415 | * from it in some places. For example, our implementation of |
| 1416 | * the update functionality through mbedtls_ssl_read_record |
| 1417 | * discards datagrams depending on the current state, which |
| 1418 | * wouldn't fall under the record layer's responsibility |
| 1419 | * following the above definition. |
| 1420 | * |
| 1421 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1422 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1423 | int mbedtls_ssl_read_record(mbedtls_ssl_context *ssl, |
| 1424 | unsigned update_hs_digest); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1425 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1426 | int mbedtls_ssl_fetch_input(mbedtls_ssl_context *ssl, size_t nb_want); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1427 | |
Ronald Cron | 8f6d39a | 2022-03-10 18:56:50 +0100 | [diff] [blame] | 1428 | /* |
| 1429 | * Write handshake message header |
| 1430 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1431 | MBEDTLS_CHECK_RETURN_CRITICAL |
Dave Rodgman | c37ad44 | 2023-11-03 23:36:06 +0000 | [diff] [blame] | 1432 | int mbedtls_ssl_start_handshake_msg(mbedtls_ssl_context *ssl, unsigned char hs_type, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1433 | unsigned char **buf, size_t *buf_len); |
Ronald Cron | 8f6d39a | 2022-03-10 18:56:50 +0100 | [diff] [blame] | 1434 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1435 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1436 | int mbedtls_ssl_write_handshake_msg_ext(mbedtls_ssl_context *ssl, |
| 1437 | int update_checksum, |
| 1438 | int force_flush); |
| 1439 | static inline int mbedtls_ssl_write_handshake_msg(mbedtls_ssl_context *ssl) |
Hanno Becker | f3cce8b | 2021-08-07 14:29:49 +0100 | [diff] [blame] | 1440 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1441 | return mbedtls_ssl_write_handshake_msg_ext(ssl, 1 /* update checksum */, 1 /* force flush */); |
Hanno Becker | f3cce8b | 2021-08-07 14:29:49 +0100 | [diff] [blame] | 1442 | } |
| 1443 | |
Ronald Cron | 8f6d39a | 2022-03-10 18:56:50 +0100 | [diff] [blame] | 1444 | /* |
| 1445 | * Write handshake message tail |
| 1446 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1447 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1448 | int mbedtls_ssl_finish_handshake_msg(mbedtls_ssl_context *ssl, |
| 1449 | size_t buf_len, size_t msg_len); |
Ronald Cron | 8f6d39a | 2022-03-10 18:56:50 +0100 | [diff] [blame] | 1450 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1451 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1452 | int mbedtls_ssl_write_record(mbedtls_ssl_context *ssl, int force_flush); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1453 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1454 | int mbedtls_ssl_flush_output(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1455 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1456 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1457 | int mbedtls_ssl_parse_certificate(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1458 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1459 | int mbedtls_ssl_write_certificate(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1460 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1461 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1462 | int mbedtls_ssl_parse_change_cipher_spec(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1463 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1464 | int mbedtls_ssl_write_change_cipher_spec(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1465 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1466 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1467 | int mbedtls_ssl_parse_finished(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1468 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1469 | int mbedtls_ssl_write_finished(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1470 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1471 | void mbedtls_ssl_optimize_checksum(mbedtls_ssl_context *ssl, |
| 1472 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1473 | |
Ronald Cron | 8f6d39a | 2022-03-10 18:56:50 +0100 | [diff] [blame] | 1474 | /* |
| 1475 | * Update checksum of handshake messages. |
| 1476 | */ |
Manuel Pégourié-Gonnard | b8b07aa | 2023-02-06 00:34:21 +0100 | [diff] [blame] | 1477 | MBEDTLS_CHECK_RETURN_CRITICAL |
| 1478 | int mbedtls_ssl_add_hs_msg_to_checksum(mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 43cc127 | 2023-02-06 11:48:19 +0100 | [diff] [blame] | 1479 | unsigned hs_type, |
| 1480 | unsigned char const *msg, |
| 1481 | size_t msg_len); |
Ronald Cron | 8f6d39a | 2022-03-10 18:56:50 +0100 | [diff] [blame] | 1482 | |
Manuel Pégourié-Gonnard | b8b07aa | 2023-02-06 00:34:21 +0100 | [diff] [blame] | 1483 | MBEDTLS_CHECK_RETURN_CRITICAL |
| 1484 | int mbedtls_ssl_add_hs_hdr_to_checksum(mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 43cc127 | 2023-02-06 11:48:19 +0100 | [diff] [blame] | 1485 | unsigned hs_type, |
| 1486 | size_t total_hs_len); |
XiaokangQian | 8698195 | 2022-07-19 09:51:50 +0000 | [diff] [blame] | 1487 | |
Ronald Cron | 73fe8df | 2022-10-05 14:31:43 +0200 | [diff] [blame] | 1488 | #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED) |
Michael Schuster | 4394067 | 2024-05-27 19:59:21 +0200 | [diff] [blame] | 1489 | #if defined(MBEDTLS_SSL_CLI_C) || defined(MBEDTLS_SSL_SRV_C) |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1490 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1491 | int mbedtls_ssl_conf_has_static_psk(mbedtls_ssl_config const *conf); |
Ronald Cron | d491c2d | 2022-02-19 18:30:46 +0100 | [diff] [blame] | 1492 | #endif |
Neil Armstrong | 044a32c | 2022-05-03 10:35:56 +0200 | [diff] [blame] | 1493 | /** |
| 1494 | * Get the first defined opaque PSK by order of precedence: |
| 1495 | * 1. handshake PSK set by \c mbedtls_ssl_set_hs_psk_opaque() in the PSK |
| 1496 | * callback |
| 1497 | * 2. static PSK configured by \c mbedtls_ssl_conf_psk_opaque() |
| 1498 | * Return an opaque PSK |
| 1499 | */ |
| 1500 | static inline mbedtls_svc_key_id_t mbedtls_ssl_get_opaque_psk( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1501 | const mbedtls_ssl_context *ssl) |
Neil Armstrong | 044a32c | 2022-05-03 10:35:56 +0200 | [diff] [blame] | 1502 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1503 | if (!mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque)) { |
| 1504 | return ssl->handshake->psk_opaque; |
| 1505 | } |
Neil Armstrong | 044a32c | 2022-05-03 10:35:56 +0200 | [diff] [blame] | 1506 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1507 | if (!mbedtls_svc_key_id_is_null(ssl->conf->psk_opaque)) { |
| 1508 | return ssl->conf->psk_opaque; |
| 1509 | } |
Neil Armstrong | 044a32c | 2022-05-03 10:35:56 +0200 | [diff] [blame] | 1510 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1511 | return MBEDTLS_SVC_KEY_ID_INIT; |
Neil Armstrong | 044a32c | 2022-05-03 10:35:56 +0200 | [diff] [blame] | 1512 | } |
Guilhem Bryant | d511ac3 | 2020-03-25 17:06:37 +0000 | [diff] [blame] | 1513 | |
Ronald Cron | 73fe8df | 2022-10-05 14:31:43 +0200 | [diff] [blame] | 1514 | #endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */ |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1515 | |
| 1516 | #if defined(MBEDTLS_PK_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1517 | unsigned char mbedtls_ssl_sig_from_pk(mbedtls_pk_context *pk); |
| 1518 | unsigned char mbedtls_ssl_sig_from_pk_alg(mbedtls_pk_type_t type); |
| 1519 | mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig(unsigned char sig); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1520 | #endif |
| 1521 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1522 | mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash(unsigned char hash); |
| 1523 | unsigned char mbedtls_ssl_hash_from_md_alg(int md); |
Ronald Cron | 4dcbca9 | 2022-03-07 10:21:40 +0100 | [diff] [blame] | 1524 | |
| 1525 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1526 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1527 | int mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context *ssl, int md); |
Ronald Cron | 4dcbca9 | 2022-03-07 10:21:40 +0100 | [diff] [blame] | 1528 | #endif |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1529 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1530 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1531 | int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_id); |
Elena Uziunaite | 8dde3b3 | 2024-07-05 12:10:21 +0100 | [diff] [blame] | 1532 | #if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1533 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1534 | int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id); |
Elena Uziunaite | 8dde3b3 | 2024-07-05 12:10:21 +0100 | [diff] [blame] | 1535 | #endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */ |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1536 | |
Valerio Setti | 18c9fed | 2022-12-30 17:44:24 +0100 | [diff] [blame] | 1537 | /** |
| 1538 | * \brief Return PSA EC info for the specified TLS ID. |
| 1539 | * |
| 1540 | * \param tls_id The TLS ID to look for |
Przemek Stekiel | da4fba6 | 2023-06-02 14:52:28 +0200 | [diff] [blame] | 1541 | * \param type If the TLD ID is supported, then proper \c psa_key_type_t |
Valerio Setti | 18c9fed | 2022-12-30 17:44:24 +0100 | [diff] [blame] | 1542 | * value is returned here. Can be NULL. |
| 1543 | * \param bits If the TLD ID is supported, then proper bit size is returned |
| 1544 | * here. Can be NULL. |
| 1545 | * \return PSA_SUCCESS if the TLS ID is supported, |
| 1546 | * PSA_ERROR_NOT_SUPPORTED otherwise |
| 1547 | * |
| 1548 | * \note If either \c family or \c bits parameters are NULL, then |
| 1549 | * the corresponding value is not returned. |
| 1550 | * The function can be called with both parameters as NULL |
| 1551 | * simply to check if a specific TLS ID is supported. |
| 1552 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1553 | int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id, |
Przemek Stekiel | da4fba6 | 2023-06-02 14:52:28 +0200 | [diff] [blame] | 1554 | psa_key_type_t *type, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1555 | size_t *bits); |
Valerio Setti | 18c9fed | 2022-12-30 17:44:24 +0100 | [diff] [blame] | 1556 | |
| 1557 | /** |
| 1558 | * \brief Return \c mbedtls_ecp_group_id for the specified TLS ID. |
| 1559 | * |
| 1560 | * \param tls_id The TLS ID to look for |
| 1561 | * \return Proper \c mbedtls_ecp_group_id if the TLS ID is supported, |
| 1562 | * or MBEDTLS_ECP_DP_NONE otherwise |
| 1563 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1564 | mbedtls_ecp_group_id mbedtls_ssl_get_ecp_group_id_from_tls_id(uint16_t tls_id); |
Valerio Setti | 18c9fed | 2022-12-30 17:44:24 +0100 | [diff] [blame] | 1565 | |
| 1566 | /** |
| 1567 | * \brief Return TLS ID for the specified \c mbedtls_ecp_group_id. |
| 1568 | * |
| 1569 | * \param grp_id The \c mbedtls_ecp_group_id ID to look for |
| 1570 | * \return Proper TLS ID if the \c mbedtls_ecp_group_id is supported, |
| 1571 | * or 0 otherwise |
| 1572 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1573 | uint16_t mbedtls_ssl_get_tls_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id); |
Valerio Setti | 18c9fed | 2022-12-30 17:44:24 +0100 | [diff] [blame] | 1574 | |
Valerio Setti | 67419f0 | 2023-01-04 16:12:42 +0100 | [diff] [blame] | 1575 | #if defined(MBEDTLS_DEBUG_C) |
Valerio Setti | 18c9fed | 2022-12-30 17:44:24 +0100 | [diff] [blame] | 1576 | /** |
| 1577 | * \brief Return EC's name for the specified TLS ID. |
| 1578 | * |
| 1579 | * \param tls_id The TLS ID to look for |
| 1580 | * \return A pointer to a const string with the proper name. If TLS |
Valerio Setti | 1e868cc | 2023-01-09 17:30:01 +0100 | [diff] [blame] | 1581 | * ID is not supported, a NULL pointer is returned instead. |
Valerio Setti | 18c9fed | 2022-12-30 17:44:24 +0100 | [diff] [blame] | 1582 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1583 | const char *mbedtls_ssl_get_curve_name_from_tls_id(uint16_t tls_id); |
Valerio Setti | 67419f0 | 2023-01-04 16:12:42 +0100 | [diff] [blame] | 1584 | #endif |
Valerio Setti | 18c9fed | 2022-12-30 17:44:24 +0100 | [diff] [blame] | 1585 | |
Ron Eldor | 089c9fe | 2018-12-06 17:12:49 +0200 | [diff] [blame] | 1586 | #if defined(MBEDTLS_SSL_DTLS_SRTP) |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 1587 | static inline mbedtls_ssl_srtp_profile mbedtls_ssl_check_srtp_profile_value |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1588 | (const uint16_t srtp_profile_value) |
Ron Eldor | 089c9fe | 2018-12-06 17:12:49 +0200 | [diff] [blame] | 1589 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1590 | switch (srtp_profile_value) { |
Johan Pascal | 8526957 | 2020-08-25 10:01:54 +0200 | [diff] [blame] | 1591 | case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80: |
Johan Pascal | 8526957 | 2020-08-25 10:01:54 +0200 | [diff] [blame] | 1592 | case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32: |
Johan Pascal | 8526957 | 2020-08-25 10:01:54 +0200 | [diff] [blame] | 1593 | case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80: |
Johan Pascal | 8526957 | 2020-08-25 10:01:54 +0200 | [diff] [blame] | 1594 | case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32: |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 1595 | return srtp_profile_value; |
Ron Eldor | 089c9fe | 2018-12-06 17:12:49 +0200 | [diff] [blame] | 1596 | default: break; |
| 1597 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1598 | return MBEDTLS_TLS_SRTP_UNSET; |
Ron Eldor | 089c9fe | 2018-12-06 17:12:49 +0200 | [diff] [blame] | 1599 | } |
| 1600 | #endif |
| 1601 | |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1602 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1603 | static inline mbedtls_pk_context *mbedtls_ssl_own_key(mbedtls_ssl_context *ssl) |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1604 | { |
| 1605 | mbedtls_ssl_key_cert *key_cert; |
| 1606 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1607 | if (ssl->handshake != NULL && ssl->handshake->key_cert != NULL) { |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1608 | key_cert = ssl->handshake->key_cert; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1609 | } else { |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1610 | key_cert = ssl->conf->key_cert; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1611 | } |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1612 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1613 | return key_cert == NULL ? NULL : key_cert->key; |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1614 | } |
| 1615 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1616 | static inline mbedtls_x509_crt *mbedtls_ssl_own_cert(mbedtls_ssl_context *ssl) |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1617 | { |
| 1618 | mbedtls_ssl_key_cert *key_cert; |
| 1619 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1620 | if (ssl->handshake != NULL && ssl->handshake->key_cert != NULL) { |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1621 | key_cert = ssl->handshake->key_cert; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1622 | } else { |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1623 | key_cert = ssl->conf->key_cert; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1624 | } |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1625 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1626 | return key_cert == NULL ? NULL : key_cert->cert; |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1627 | } |
| 1628 | |
| 1629 | /* |
Manuel Pégourié-Gonnard | 19dd9f5 | 2024-08-16 11:03:42 +0200 | [diff] [blame] | 1630 | * Verify a certificate. |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1631 | * |
Manuel Pégourié-Gonnard | 19dd9f5 | 2024-08-16 11:03:42 +0200 | [diff] [blame] | 1632 | * [in/out] ssl: misc. things read |
| 1633 | * ssl->session_negotiate->verify_result updated |
| 1634 | * [in] authmode: one of MBEDTLS_SSL_VERIFY_{NONE,OPTIONAL,REQUIRED} |
| 1635 | * [in] chain: the certificate chain to verify (ie the peer's chain) |
| 1636 | * [in] ciphersuite_info: For TLS 1.2, this session's ciphersuite; |
| 1637 | * for TLS 1.3, may be left NULL. |
| 1638 | * [in] rs_ctx: restart context if restartable ECC is in use; |
| 1639 | * leave NULL for no restartable behaviour. |
| 1640 | * |
| 1641 | * Return: |
Manuel Pégourié-Gonnard | 9e3e991 | 2024-08-20 10:58:20 +0200 | [diff] [blame] | 1642 | * - 0 if the handshake should continue. Depending on the |
Manuel Pégourié-Gonnard | 19dd9f5 | 2024-08-16 11:03:42 +0200 | [diff] [blame] | 1643 | * authmode it means: |
| 1644 | * - REQUIRED: the certificate was found to be valid, trusted & acceptable. |
| 1645 | * ssl->session_negotiate->verify_result is 0. |
| 1646 | * - OPTIONAL: the certificate may or may not be acceptable, but |
| 1647 | * ssl->session_negotiate->verify_result was updated with the result. |
| 1648 | * - NONE: the certificate wasn't even checked. |
| 1649 | * - MBEDTLS_ERR_X509_CERT_VERIFY_FAILED or MBEDTLS_ERR_SSL_BAD_CERTIFICATE if |
| 1650 | * the certificate was found to be invalid/untrusted/unacceptable and the |
| 1651 | * handshake should be aborted (can only happen with REQUIRED). |
| 1652 | * - another error code if another error happened (out-of-memory, etc.) |
| 1653 | */ |
| 1654 | MBEDTLS_CHECK_RETURN_CRITICAL |
| 1655 | int mbedtls_ssl_verify_certificate(mbedtls_ssl_context *ssl, |
| 1656 | int authmode, |
| 1657 | mbedtls_x509_crt *chain, |
| 1658 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info, |
| 1659 | void *rs_ctx); |
| 1660 | |
| 1661 | /* |
Manuel Pégourié-Gonnard | 94f7022 | 2024-08-09 11:26:25 +0200 | [diff] [blame] | 1662 | * Check usage of a certificate wrt usage extensions: |
| 1663 | * keyUsage and extendedKeyUsage. |
| 1664 | * (Note: nSCertType is deprecated and not standard, we don't check it.) |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1665 | * |
Manuel Pégourié-Gonnard | 7a4aa4d | 2024-08-09 11:49:12 +0200 | [diff] [blame] | 1666 | * Note: if tls_version is 1.3, ciphersuite is ignored and can be NULL. |
| 1667 | * |
Manuel Pégourié-Gonnard | 94f7022 | 2024-08-09 11:26:25 +0200 | [diff] [blame] | 1668 | * Note: recv_endpoint is the receiver's endpoint. |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1669 | * |
| 1670 | * Return 0 if everything is OK, -1 if not. |
| 1671 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1672 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1673 | int mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt *cert, |
| 1674 | const mbedtls_ssl_ciphersuite_t *ciphersuite, |
Manuel Pégourié-Gonnard | 94f7022 | 2024-08-09 11:26:25 +0200 | [diff] [blame] | 1675 | int recv_endpoint, |
Manuel Pégourié-Gonnard | 7a4aa4d | 2024-08-09 11:49:12 +0200 | [diff] [blame] | 1676 | mbedtls_ssl_protocol_version tls_version, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1677 | uint32_t *flags); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1678 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
| 1679 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1680 | void mbedtls_ssl_write_version(unsigned char version[2], int transport, |
| 1681 | mbedtls_ssl_protocol_version tls_version); |
| 1682 | uint16_t mbedtls_ssl_read_version(const unsigned char version[2], |
| 1683 | int transport); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1684 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1685 | static inline size_t mbedtls_ssl_in_hdr_len(const mbedtls_ssl_context *ssl) |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1686 | { |
Hanno Becker | 47be768 | 2019-07-12 09:55:46 +0100 | [diff] [blame] | 1687 | #if !defined(MBEDTLS_SSL_PROTO_DTLS) |
| 1688 | ((void) ssl); |
| 1689 | #endif |
| 1690 | |
| 1691 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1692 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { |
| 1693 | return 13; |
| 1694 | } else |
Hanno Becker | 47be768 | 2019-07-12 09:55:46 +0100 | [diff] [blame] | 1695 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
| 1696 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1697 | return 5; |
Hanno Becker | 47be768 | 2019-07-12 09:55:46 +0100 | [diff] [blame] | 1698 | } |
Hanno Becker | 5903de4 | 2019-05-03 14:46:38 +0100 | [diff] [blame] | 1699 | } |
| 1700 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1701 | static inline size_t mbedtls_ssl_out_hdr_len(const mbedtls_ssl_context *ssl) |
Hanno Becker | 5903de4 | 2019-05-03 14:46:38 +0100 | [diff] [blame] | 1702 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1703 | return (size_t) (ssl->out_iv - ssl->out_hdr); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1704 | } |
| 1705 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1706 | static inline size_t mbedtls_ssl_hs_hdr_len(const mbedtls_ssl_context *ssl) |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1707 | { |
| 1708 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1709 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { |
| 1710 | return 12; |
| 1711 | } |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1712 | #else |
| 1713 | ((void) ssl); |
| 1714 | #endif |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1715 | return 4; |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1716 | } |
| 1717 | |
| 1718 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1719 | void mbedtls_ssl_send_flight_completed(mbedtls_ssl_context *ssl); |
| 1720 | void mbedtls_ssl_recv_flight_completed(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1721 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1722 | int mbedtls_ssl_resend(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1723 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1724 | int mbedtls_ssl_flight_transmit(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1725 | #endif |
| 1726 | |
| 1727 | /* Visible for testing purposes only */ |
| 1728 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1729 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1730 | int mbedtls_ssl_dtls_replay_check(mbedtls_ssl_context const *ssl); |
| 1731 | void mbedtls_ssl_dtls_replay_update(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1732 | #endif |
| 1733 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1734 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1735 | int mbedtls_ssl_session_copy(mbedtls_ssl_session *dst, |
| 1736 | const mbedtls_ssl_session *src); |
Hanno Becker | 52055ae | 2019-02-06 14:30:46 +0000 | [diff] [blame] | 1737 | |
TRodziewicz | 0f82ec6 | 2021-05-12 17:49:18 +0200 | [diff] [blame] | 1738 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Andrzej Kurek | 814feff | 2019-01-14 04:35:19 -0500 | [diff] [blame] | 1739 | /* The hash buffer must have at least MBEDTLS_MD_MAX_SIZE bytes of length. */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1740 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1741 | int mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context *ssl, |
| 1742 | unsigned char *hash, size_t *hashlen, |
| 1743 | unsigned char *data, size_t data_len, |
| 1744 | mbedtls_md_type_t md_alg); |
TRodziewicz | 0f82ec6 | 2021-05-12 17:49:18 +0200 | [diff] [blame] | 1745 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
Andres Amaya Garcia | 46f5a3e | 2017-07-20 16:17:51 +0100 | [diff] [blame] | 1746 | |
Manuel Pégourié-Gonnard | 5e94dde | 2015-05-26 11:57:05 +0200 | [diff] [blame] | 1747 | #ifdef __cplusplus |
| 1748 | } |
| 1749 | #endif |
| 1750 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1751 | void mbedtls_ssl_transform_init(mbedtls_ssl_transform *transform); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1752 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1753 | int mbedtls_ssl_encrypt_buf(mbedtls_ssl_context *ssl, |
| 1754 | mbedtls_ssl_transform *transform, |
Ben Taylor | 602b296 | 2025-03-07 15:52:50 +0000 | [diff] [blame] | 1755 | mbedtls_record *rec); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1756 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1757 | int mbedtls_ssl_decrypt_buf(mbedtls_ssl_context const *ssl, |
| 1758 | mbedtls_ssl_transform *transform, |
| 1759 | mbedtls_record *rec); |
Hanno Becker | a18d132 | 2018-01-03 14:27:32 +0000 | [diff] [blame] | 1760 | |
Hanno Becker | dd77229 | 2020-02-05 10:38:31 +0000 | [diff] [blame] | 1761 | /* Length of the "epoch" field in the record header */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1762 | static inline size_t mbedtls_ssl_ep_len(const mbedtls_ssl_context *ssl) |
Hanno Becker | dd77229 | 2020-02-05 10:38:31 +0000 | [diff] [blame] | 1763 | { |
| 1764 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1765 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { |
| 1766 | return 2; |
| 1767 | } |
Hanno Becker | dd77229 | 2020-02-05 10:38:31 +0000 | [diff] [blame] | 1768 | #else |
| 1769 | ((void) ssl); |
| 1770 | #endif |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1771 | return 0; |
Hanno Becker | dd77229 | 2020-02-05 10:38:31 +0000 | [diff] [blame] | 1772 | } |
| 1773 | |
Hanno Becker | 08f0913 | 2020-02-11 15:40:07 +0000 | [diff] [blame] | 1774 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1775 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1776 | int mbedtls_ssl_resend_hello_request(mbedtls_ssl_context *ssl); |
Hanno Becker | 08f0913 | 2020-02-11 15:40:07 +0000 | [diff] [blame] | 1777 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Hanno Becker | 0f57a65 | 2020-02-05 10:37:26 +0000 | [diff] [blame] | 1778 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1779 | void mbedtls_ssl_set_timer(mbedtls_ssl_context *ssl, uint32_t millisecs); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1780 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1781 | int mbedtls_ssl_check_timer(mbedtls_ssl_context *ssl); |
Hanno Becker | 7876d12 | 2020-02-05 10:39:31 +0000 | [diff] [blame] | 1782 | |
Deomid rojer Ryabkov | ac2cf1f | 2024-03-10 02:11:03 +0000 | [diff] [blame] | 1783 | void mbedtls_ssl_reset_in_pointers(mbedtls_ssl_context *ssl); |
Deomid rojer Ryabkov | 3dfe75e | 2025-01-26 10:43:42 +0200 | [diff] [blame] | 1784 | void mbedtls_ssl_update_in_pointers(mbedtls_ssl_context *ssl); |
Deomid rojer Ryabkov | ac2cf1f | 2024-03-10 02:11:03 +0000 | [diff] [blame] | 1785 | void mbedtls_ssl_reset_out_pointers(mbedtls_ssl_context *ssl); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1786 | void mbedtls_ssl_update_out_pointers(mbedtls_ssl_context *ssl, |
| 1787 | mbedtls_ssl_transform *transform); |
Hanno Becker | 3e6f8ab | 2020-02-05 10:40:57 +0000 | [diff] [blame] | 1788 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1789 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1790 | int mbedtls_ssl_session_reset_int(mbedtls_ssl_context *ssl, int partial); |
| 1791 | void mbedtls_ssl_session_reset_msg_layer(mbedtls_ssl_context *ssl, |
| 1792 | int partial); |
Hanno Becker | 43aefe2 | 2020-02-05 10:44:56 +0000 | [diff] [blame] | 1793 | |
Jerry Yu | e704781 | 2021-09-13 19:26:39 +0800 | [diff] [blame] | 1794 | /* |
Jerry Yu | 394ece6 | 2021-09-14 22:17:21 +0800 | [diff] [blame] | 1795 | * Send pending alert |
Jerry Yu | e704781 | 2021-09-13 19:26:39 +0800 | [diff] [blame] | 1796 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1797 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1798 | int mbedtls_ssl_handle_pending_alert(mbedtls_ssl_context *ssl); |
Jerry Yu | e704781 | 2021-09-13 19:26:39 +0800 | [diff] [blame] | 1799 | |
Jerry Yu | 394ece6 | 2021-09-14 22:17:21 +0800 | [diff] [blame] | 1800 | /* |
| 1801 | * Set pending fatal alert flag. |
| 1802 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1803 | void mbedtls_ssl_pend_fatal_alert(mbedtls_ssl_context *ssl, |
| 1804 | unsigned char alert_type, |
| 1805 | int alert_reason); |
Jerry Yu | 394ece6 | 2021-09-14 22:17:21 +0800 | [diff] [blame] | 1806 | |
| 1807 | /* Alias of mbedtls_ssl_pend_fatal_alert */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1808 | #define MBEDTLS_SSL_PEND_FATAL_ALERT(type, user_return_value) \ |
| 1809 | mbedtls_ssl_pend_fatal_alert(ssl, type, user_return_value) |
Jerry Yu | 394ece6 | 2021-09-14 22:17:21 +0800 | [diff] [blame] | 1810 | |
Hanno Becker | 7e8e6a6 | 2020-02-05 10:45:48 +0000 | [diff] [blame] | 1811 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1812 | void mbedtls_ssl_dtls_replay_reset(mbedtls_ssl_context *ssl); |
Hanno Becker | 7e8e6a6 | 2020-02-05 10:45:48 +0000 | [diff] [blame] | 1813 | #endif |
| 1814 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1815 | void mbedtls_ssl_handshake_wrapup_free_hs_transform(mbedtls_ssl_context *ssl); |
Hanno Becker | ce5f5fd | 2020-02-05 10:47:44 +0000 | [diff] [blame] | 1816 | |
Hanno Becker | 08f0913 | 2020-02-11 15:40:07 +0000 | [diff] [blame] | 1817 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1818 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1819 | int mbedtls_ssl_start_renegotiation(mbedtls_ssl_context *ssl); |
Hanno Becker | 08f0913 | 2020-02-11 15:40:07 +0000 | [diff] [blame] | 1820 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Hanno Becker | 8949071 | 2020-02-05 10:50:12 +0000 | [diff] [blame] | 1821 | |
Hanno Becker | 533ab5f | 2020-02-05 10:49:13 +0000 | [diff] [blame] | 1822 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1823 | size_t mbedtls_ssl_get_current_mtu(const mbedtls_ssl_context *ssl); |
| 1824 | void mbedtls_ssl_buffering_free(mbedtls_ssl_context *ssl); |
| 1825 | void mbedtls_ssl_flight_free(mbedtls_ssl_flight_item *flight); |
Hanno Becker | 533ab5f | 2020-02-05 10:49:13 +0000 | [diff] [blame] | 1826 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
| 1827 | |
Jerry Yu | 60835a8 | 2021-08-04 10:13:52 +0800 | [diff] [blame] | 1828 | /** |
| 1829 | * ssl utils functions for checking configuration. |
| 1830 | */ |
| 1831 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 1832 | #if defined(MBEDTLS_SSL_PROTO_TLS1_3) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1833 | static inline int mbedtls_ssl_conf_is_tls13_only(const mbedtls_ssl_config *conf) |
Jerry Yu | 60835a8 | 2021-08-04 10:13:52 +0800 | [diff] [blame] | 1834 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1835 | return conf->min_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 && |
| 1836 | conf->max_tls_version == MBEDTLS_SSL_VERSION_TLS1_3; |
Jerry Yu | 60835a8 | 2021-08-04 10:13:52 +0800 | [diff] [blame] | 1837 | } |
Jerry Yu | 3ad14ac | 2022-01-11 17:13:16 +0800 | [diff] [blame] | 1838 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 1839 | #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ |
Jerry Yu | 60835a8 | 2021-08-04 10:13:52 +0800 | [diff] [blame] | 1840 | |
| 1841 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1842 | static inline int mbedtls_ssl_conf_is_tls12_only(const mbedtls_ssl_config *conf) |
Jerry Yu | 60835a8 | 2021-08-04 10:13:52 +0800 | [diff] [blame] | 1843 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1844 | return conf->min_tls_version == MBEDTLS_SSL_VERSION_TLS1_2 && |
| 1845 | conf->max_tls_version == MBEDTLS_SSL_VERSION_TLS1_2; |
Jerry Yu | 60835a8 | 2021-08-04 10:13:52 +0800 | [diff] [blame] | 1846 | } |
Jerry Yu | 3ad14ac | 2022-01-11 17:13:16 +0800 | [diff] [blame] | 1847 | |
Jerry Yu | 60835a8 | 2021-08-04 10:13:52 +0800 | [diff] [blame] | 1848 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
| 1849 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1850 | static inline int mbedtls_ssl_conf_is_tls13_enabled(const mbedtls_ssl_config *conf) |
Jerry Yu | 3ad14ac | 2022-01-11 17:13:16 +0800 | [diff] [blame] | 1851 | { |
| 1852 | #if defined(MBEDTLS_SSL_PROTO_TLS1_3) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1853 | return conf->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_3 && |
| 1854 | conf->max_tls_version >= MBEDTLS_SSL_VERSION_TLS1_3; |
Jerry Yu | 3ad14ac | 2022-01-11 17:13:16 +0800 | [diff] [blame] | 1855 | #else |
| 1856 | ((void) conf); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1857 | return 0; |
Jerry Yu | 3ad14ac | 2022-01-11 17:13:16 +0800 | [diff] [blame] | 1858 | #endif |
| 1859 | } |
| 1860 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1861 | static inline int mbedtls_ssl_conf_is_tls12_enabled(const mbedtls_ssl_config *conf) |
Jerry Yu | 3ad14ac | 2022-01-11 17:13:16 +0800 | [diff] [blame] | 1862 | { |
| 1863 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1864 | return conf->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_2 && |
| 1865 | conf->max_tls_version >= MBEDTLS_SSL_VERSION_TLS1_2; |
Jerry Yu | 3ad14ac | 2022-01-11 17:13:16 +0800 | [diff] [blame] | 1866 | #else |
| 1867 | ((void) conf); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1868 | return 0; |
Jerry Yu | 3ad14ac | 2022-01-11 17:13:16 +0800 | [diff] [blame] | 1869 | #endif |
| 1870 | } |
| 1871 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 1872 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1873 | static inline int mbedtls_ssl_conf_is_hybrid_tls12_tls13(const mbedtls_ssl_config *conf) |
Jerry Yu | 60835a8 | 2021-08-04 10:13:52 +0800 | [diff] [blame] | 1874 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1875 | return conf->min_tls_version == MBEDTLS_SSL_VERSION_TLS1_2 && |
| 1876 | conf->max_tls_version == MBEDTLS_SSL_VERSION_TLS1_3; |
Jerry Yu | 60835a8 | 2021-08-04 10:13:52 +0800 | [diff] [blame] | 1877 | } |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 1878 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_TLS1_3 */ |
Jerry Yu | 60835a8 | 2021-08-04 10:13:52 +0800 | [diff] [blame] | 1879 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 1880 | #if defined(MBEDTLS_SSL_PROTO_TLS1_3) |
Jerry Yu | fbe3e64 | 2022-04-25 19:31:51 +0800 | [diff] [blame] | 1881 | extern const uint8_t mbedtls_ssl_tls13_hello_retry_request_magic[ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1882 | MBEDTLS_SERVER_HELLO_RANDOM_LEN]; |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1883 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1884 | int mbedtls_ssl_tls13_process_finished_message(mbedtls_ssl_context *ssl); |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1885 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1886 | int mbedtls_ssl_tls13_write_finished_message(mbedtls_ssl_context *ssl); |
| 1887 | void mbedtls_ssl_tls13_handshake_wrapup(mbedtls_ssl_context *ssl); |
Jerry Yu | a6e6c27 | 2021-11-17 17:54:13 +0800 | [diff] [blame] | 1888 | |
| 1889 | /** |
Ronald Cron | 3d580bf | 2022-02-18 17:24:56 +0100 | [diff] [blame] | 1890 | * \brief Given an SSL context and its associated configuration, write the TLS |
| 1891 | * 1.3 specific extensions of the ClientHello message. |
| 1892 | * |
| 1893 | * \param[in] ssl SSL context |
| 1894 | * \param[in] buf Base address of the buffer where to write the extensions |
| 1895 | * \param[in] end End address of the buffer where to write the extensions |
| 1896 | * \param[out] out_len Length of the data written into the buffer \p buf |
| 1897 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1898 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1899 | int mbedtls_ssl_tls13_write_client_hello_exts(mbedtls_ssl_context *ssl, |
| 1900 | unsigned char *buf, |
| 1901 | unsigned char *end, |
| 1902 | size_t *out_len); |
Ronald Cron | 3d580bf | 2022-02-18 17:24:56 +0100 | [diff] [blame] | 1903 | |
| 1904 | /** |
Jerry Yu | a6e6c27 | 2021-11-17 17:54:13 +0800 | [diff] [blame] | 1905 | * \brief TLS 1.3 client side state machine entry |
| 1906 | * |
| 1907 | * \param ssl SSL context |
| 1908 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1909 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1910 | int mbedtls_ssl_tls13_handshake_client_step(mbedtls_ssl_context *ssl); |
Jerry Yu | a6e6c27 | 2021-11-17 17:54:13 +0800 | [diff] [blame] | 1911 | |
| 1912 | /** |
| 1913 | * \brief TLS 1.3 server side state machine entry |
| 1914 | * |
| 1915 | * \param ssl SSL context |
| 1916 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 1917 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1918 | int mbedtls_ssl_tls13_handshake_server_step(mbedtls_ssl_context *ssl); |
Jerry Yu | a6e6c27 | 2021-11-17 17:54:13 +0800 | [diff] [blame] | 1919 | |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1920 | |
| 1921 | /* |
| 1922 | * Helper functions around key exchange modes. |
| 1923 | */ |
Pengyu Lv | fc2cb96 | 2023-11-10 10:22:36 +0800 | [diff] [blame] | 1924 | static inline int mbedtls_ssl_conf_tls13_is_kex_mode_enabled(mbedtls_ssl_context *ssl, |
| 1925 | int kex_mode_mask) |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1926 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1927 | return (ssl->conf->tls13_kex_modes & kex_mode_mask) != 0; |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1928 | } |
| 1929 | |
Pengyu Lv | 0a1ff2b | 2023-11-14 11:03:32 +0800 | [diff] [blame] | 1930 | static inline int mbedtls_ssl_conf_tls13_is_psk_enabled(mbedtls_ssl_context *ssl) |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1931 | { |
Pengyu Lv | fc2cb96 | 2023-11-10 10:22:36 +0800 | [diff] [blame] | 1932 | return mbedtls_ssl_conf_tls13_is_kex_mode_enabled(ssl, |
| 1933 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK); |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1934 | } |
| 1935 | |
Pengyu Lv | 0a1ff2b | 2023-11-14 11:03:32 +0800 | [diff] [blame] | 1936 | static inline int mbedtls_ssl_conf_tls13_is_psk_ephemeral_enabled(mbedtls_ssl_context *ssl) |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1937 | { |
Pengyu Lv | fc2cb96 | 2023-11-10 10:22:36 +0800 | [diff] [blame] | 1938 | return mbedtls_ssl_conf_tls13_is_kex_mode_enabled(ssl, |
| 1939 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL); |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1940 | } |
| 1941 | |
Pengyu Lv | 0a1ff2b | 2023-11-14 11:03:32 +0800 | [diff] [blame] | 1942 | static inline int mbedtls_ssl_conf_tls13_is_ephemeral_enabled(mbedtls_ssl_context *ssl) |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1943 | { |
Pengyu Lv | fc2cb96 | 2023-11-10 10:22:36 +0800 | [diff] [blame] | 1944 | return mbedtls_ssl_conf_tls13_is_kex_mode_enabled(ssl, |
| 1945 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL); |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1946 | } |
| 1947 | |
Pengyu Lv | 0a1ff2b | 2023-11-14 11:03:32 +0800 | [diff] [blame] | 1948 | static inline int mbedtls_ssl_conf_tls13_is_some_ephemeral_enabled(mbedtls_ssl_context *ssl) |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1949 | { |
Pengyu Lv | fc2cb96 | 2023-11-10 10:22:36 +0800 | [diff] [blame] | 1950 | return mbedtls_ssl_conf_tls13_is_kex_mode_enabled(ssl, |
| 1951 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL); |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1952 | } |
| 1953 | |
Pengyu Lv | 0a1ff2b | 2023-11-14 11:03:32 +0800 | [diff] [blame] | 1954 | static inline int mbedtls_ssl_conf_tls13_is_some_psk_enabled(mbedtls_ssl_context *ssl) |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1955 | { |
Pengyu Lv | fc2cb96 | 2023-11-10 10:22:36 +0800 | [diff] [blame] | 1956 | return mbedtls_ssl_conf_tls13_is_kex_mode_enabled(ssl, |
| 1957 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL); |
Jerry Yu | 26f4d15 | 2021-08-23 17:42:37 +0800 | [diff] [blame] | 1958 | } |
| 1959 | |
Ronald Cron | 41a443a | 2022-10-04 16:38:25 +0200 | [diff] [blame] | 1960 | #if defined(MBEDTLS_SSL_SRV_C) && \ |
| 1961 | defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED) |
Jerry Yu | adf861a | 2021-09-29 21:22:08 +0800 | [diff] [blame] | 1962 | /** |
| 1963 | * Given a list of key exchange modes, check if at least one of them is |
Pengyu Lv | 2333b82 | 2023-11-14 12:03:49 +0800 | [diff] [blame] | 1964 | * supported by peer. |
Jerry Yu | adf861a | 2021-09-29 21:22:08 +0800 | [diff] [blame] | 1965 | * |
| 1966 | * \param[in] ssl SSL context |
Jerry Yu | 0cabad3 | 2021-09-30 09:52:35 +0800 | [diff] [blame] | 1967 | * \param kex_modes_mask Mask of the key exchange modes to check |
Jerry Yu | adf861a | 2021-09-29 21:22:08 +0800 | [diff] [blame] | 1968 | * |
Pengyu Lv | abd844f | 2023-12-05 15:28:58 +0800 | [diff] [blame] | 1969 | * \return Non-zero if at least one of the key exchange modes is supported by |
| 1970 | * the peer, otherwise \c 0. |
Jerry Yu | adf861a | 2021-09-29 21:22:08 +0800 | [diff] [blame] | 1971 | */ |
Pengyu Lv | 2333b82 | 2023-11-14 12:03:49 +0800 | [diff] [blame] | 1972 | static inline int mbedtls_ssl_tls13_is_kex_mode_supported(mbedtls_ssl_context *ssl, |
| 1973 | int kex_modes_mask) |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 1974 | { |
Pengyu Lv | 2333b82 | 2023-11-14 12:03:49 +0800 | [diff] [blame] | 1975 | return (ssl->handshake->tls13_kex_modes & kex_modes_mask) != 0; |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 1976 | } |
| 1977 | |
Pengyu Lv | b2cfafb | 2023-11-14 13:56:13 +0800 | [diff] [blame] | 1978 | static inline int mbedtls_ssl_tls13_is_psk_supported(mbedtls_ssl_context *ssl) |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 1979 | { |
Pengyu Lv | 2333b82 | 2023-11-14 12:03:49 +0800 | [diff] [blame] | 1980 | return mbedtls_ssl_tls13_is_kex_mode_supported(ssl, |
| 1981 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK); |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 1982 | } |
| 1983 | |
Pengyu Lv | b2cfafb | 2023-11-14 13:56:13 +0800 | [diff] [blame] | 1984 | static inline int mbedtls_ssl_tls13_is_psk_ephemeral_supported( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1985 | mbedtls_ssl_context *ssl) |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 1986 | { |
Pengyu Lv | 2333b82 | 2023-11-14 12:03:49 +0800 | [diff] [blame] | 1987 | return mbedtls_ssl_tls13_is_kex_mode_supported(ssl, |
| 1988 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL); |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 1989 | } |
| 1990 | |
Pengyu Lv | b2cfafb | 2023-11-14 13:56:13 +0800 | [diff] [blame] | 1991 | static inline int mbedtls_ssl_tls13_is_ephemeral_supported(mbedtls_ssl_context *ssl) |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 1992 | { |
Pengyu Lv | 2333b82 | 2023-11-14 12:03:49 +0800 | [diff] [blame] | 1993 | return mbedtls_ssl_tls13_is_kex_mode_supported(ssl, |
| 1994 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL); |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 1995 | } |
| 1996 | |
Pengyu Lv | b2cfafb | 2023-11-14 13:56:13 +0800 | [diff] [blame] | 1997 | static inline int mbedtls_ssl_tls13_is_some_ephemeral_supported(mbedtls_ssl_context *ssl) |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 1998 | { |
Pengyu Lv | 2333b82 | 2023-11-14 12:03:49 +0800 | [diff] [blame] | 1999 | return mbedtls_ssl_tls13_is_kex_mode_supported(ssl, |
| 2000 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL); |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 2001 | } |
| 2002 | |
Pengyu Lv | b2cfafb | 2023-11-14 13:56:13 +0800 | [diff] [blame] | 2003 | static inline int mbedtls_ssl_tls13_is_some_psk_supported(mbedtls_ssl_context *ssl) |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 2004 | { |
Pengyu Lv | 2333b82 | 2023-11-14 12:03:49 +0800 | [diff] [blame] | 2005 | return mbedtls_ssl_tls13_is_kex_mode_supported(ssl, |
| 2006 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL); |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 2007 | } |
Ronald Cron | 41a443a | 2022-10-04 16:38:25 +0200 | [diff] [blame] | 2008 | #endif /* MBEDTLS_SSL_SRV_C && |
| 2009 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */ |
Jerry Yu | 1b7c4a4 | 2021-09-09 17:09:12 +0800 | [diff] [blame] | 2010 | |
Jerry Yu | 5cc8f0a | 2021-08-27 17:21:44 +0800 | [diff] [blame] | 2011 | /* |
Jerry Yu | ea52ed9 | 2022-11-08 21:01:17 +0800 | [diff] [blame] | 2012 | * Helper functions for extensions checking. |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 2013 | */ |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 2014 | |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 2015 | MBEDTLS_CHECK_RETURN_CRITICAL |
Jerry Yu | c4bf5d6 | 2022-10-29 09:08:47 +0800 | [diff] [blame] | 2016 | int mbedtls_ssl_tls13_check_received_extension( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2017 | mbedtls_ssl_context *ssl, |
| 2018 | int hs_msg_type, |
| 2019 | unsigned int received_extension_type, |
| 2020 | uint32_t hs_msg_allowed_extensions_mask); |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 2021 | |
Jerry Yu | c4bf5d6 | 2022-10-29 09:08:47 +0800 | [diff] [blame] | 2022 | static inline void mbedtls_ssl_tls13_set_hs_sent_ext_mask( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2023 | mbedtls_ssl_context *ssl, unsigned int extension_type) |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 2024 | { |
| 2025 | ssl->handshake->sent_extensions |= |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2026 | mbedtls_ssl_get_extension_mask(extension_type); |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 2027 | } |
Jerry Yu | e18dc7e | 2022-08-04 16:29:22 +0800 | [diff] [blame] | 2028 | |
| 2029 | /* |
Ronald Cron | 8538549 | 2022-07-20 16:44:00 +0200 | [diff] [blame] | 2030 | * Helper functions to check the selected key exchange mode. |
| 2031 | */ |
| 2032 | static inline int mbedtls_ssl_tls13_key_exchange_mode_check( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2033 | mbedtls_ssl_context *ssl, int kex_mask) |
Ronald Cron | 8538549 | 2022-07-20 16:44:00 +0200 | [diff] [blame] | 2034 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2035 | return (ssl->handshake->key_exchange_mode & kex_mask) != 0; |
Ronald Cron | 8538549 | 2022-07-20 16:44:00 +0200 | [diff] [blame] | 2036 | } |
| 2037 | |
| 2038 | static inline int mbedtls_ssl_tls13_key_exchange_mode_with_psk( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2039 | mbedtls_ssl_context *ssl) |
Ronald Cron | 8538549 | 2022-07-20 16:44:00 +0200 | [diff] [blame] | 2040 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2041 | return mbedtls_ssl_tls13_key_exchange_mode_check(ssl, |
| 2042 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL); |
Ronald Cron | 8538549 | 2022-07-20 16:44:00 +0200 | [diff] [blame] | 2043 | } |
| 2044 | |
| 2045 | static inline int mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2046 | mbedtls_ssl_context *ssl) |
Ronald Cron | 8538549 | 2022-07-20 16:44:00 +0200 | [diff] [blame] | 2047 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2048 | return mbedtls_ssl_tls13_key_exchange_mode_check(ssl, |
| 2049 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL); |
Ronald Cron | 8538549 | 2022-07-20 16:44:00 +0200 | [diff] [blame] | 2050 | } |
| 2051 | |
| 2052 | /* |
XiaokangQian | 6b226b0 | 2021-09-24 07:51:16 +0000 | [diff] [blame] | 2053 | * Fetch TLS 1.3 handshake message header |
| 2054 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 2055 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2056 | int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl, |
| 2057 | unsigned hs_type, |
| 2058 | unsigned char **buf, |
| 2059 | size_t *buf_len); |
XiaokangQian | 6b226b0 | 2021-09-24 07:51:16 +0000 | [diff] [blame] | 2060 | |
Ronald Cron | 47dce63 | 2023-02-08 17:38:29 +0100 | [diff] [blame] | 2061 | /** |
| 2062 | * \brief Detect if a list of extensions contains a supported_versions |
| 2063 | * extension or not. |
| 2064 | * |
| 2065 | * \param[in] ssl SSL context |
| 2066 | * \param[in] buf Address of the first byte of the extensions vector. |
| 2067 | * \param[in] end End of the buffer containing the list of extensions. |
Ronald Cron | eff5673 | 2023-04-03 17:36:31 +0200 | [diff] [blame] | 2068 | * \param[out] supported_versions_data If the extension is present, address of |
| 2069 | * its first byte of data, NULL otherwise. |
| 2070 | * \param[out] supported_versions_data_end If the extension is present, address |
| 2071 | * of the first byte immediately |
| 2072 | * following the extension data, NULL |
| 2073 | * otherwise. |
Ronald Cron | 47dce63 | 2023-02-08 17:38:29 +0100 | [diff] [blame] | 2074 | * \return 0 if the list of extensions does not contain a supported_versions |
| 2075 | * extension. |
| 2076 | * \return 1 if the list of extensions contains a supported_versions |
| 2077 | * extension. |
| 2078 | * \return A negative value if an error occurred while parsing the |
| 2079 | * extensions. |
| 2080 | */ |
| 2081 | MBEDTLS_CHECK_RETURN_CRITICAL |
| 2082 | int mbedtls_ssl_tls13_is_supported_versions_ext_present_in_exts( |
| 2083 | mbedtls_ssl_context *ssl, |
| 2084 | const unsigned char *buf, const unsigned char *end, |
Ronald Cron | eff5673 | 2023-04-03 17:36:31 +0200 | [diff] [blame] | 2085 | const unsigned char **supported_versions_data, |
| 2086 | const unsigned char **supported_versions_data_end); |
Ronald Cron | 47dce63 | 2023-02-08 17:38:29 +0100 | [diff] [blame] | 2087 | |
XiaokangQian | 6b226b0 | 2021-09-24 07:51:16 +0000 | [diff] [blame] | 2088 | /* |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 2089 | * Handler of TLS 1.3 server certificate message |
| 2090 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 2091 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2092 | int mbedtls_ssl_tls13_process_certificate(mbedtls_ssl_context *ssl); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 2093 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2094 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) |
Jerry Yu | 5cc8f0a | 2021-08-27 17:21:44 +0800 | [diff] [blame] | 2095 | /* |
Jerry Yu | 3e53644 | 2022-02-15 11:05:59 +0800 | [diff] [blame] | 2096 | * Handler of TLS 1.3 write Certificate message |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 2097 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 2098 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2099 | int mbedtls_ssl_tls13_write_certificate(mbedtls_ssl_context *ssl); |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 2100 | |
| 2101 | /* |
Jerry Yu | 3e53644 | 2022-02-15 11:05:59 +0800 | [diff] [blame] | 2102 | * Handler of TLS 1.3 write Certificate Verify message |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 2103 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 2104 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2105 | int mbedtls_ssl_tls13_write_certificate_verify(mbedtls_ssl_context *ssl); |
Jerry Yu | 90f152d | 2022-01-29 22:12:42 +0800 | [diff] [blame] | 2106 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2107 | #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ |
Jerry Yu | 90f152d | 2022-01-29 22:12:42 +0800 | [diff] [blame] | 2108 | |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 2109 | /* |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 2110 | * Generic handler of Certificate Verify |
| 2111 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 2112 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2113 | int mbedtls_ssl_tls13_process_certificate_verify(mbedtls_ssl_context *ssl); |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 2114 | |
| 2115 | /* |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 2116 | * Write of dummy-CCS's for middlebox compatibility |
| 2117 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 2118 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2119 | int mbedtls_ssl_tls13_write_change_cipher_spec(mbedtls_ssl_context *ssl); |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 2120 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 2121 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2122 | int mbedtls_ssl_reset_transcript_for_hrr(mbedtls_ssl_context *ssl); |
XiaokangQian | 647719a | 2021-12-07 09:16:29 +0000 | [diff] [blame] | 2123 | |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 2124 | #if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH) |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 2125 | MBEDTLS_CHECK_RETURN_CRITICAL |
Przemek Stekiel | 408569f | 2023-07-06 11:26:44 +0200 | [diff] [blame] | 2126 | int mbedtls_ssl_tls13_generate_and_write_xxdh_key_exchange( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2127 | mbedtls_ssl_context *ssl, |
| 2128 | uint16_t named_group, |
| 2129 | unsigned char *buf, |
| 2130 | unsigned char *end, |
| 2131 | size_t *out_len); |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 2132 | #endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */ |
Jerry Yu | 89e103c | 2022-03-30 22:43:29 +0800 | [diff] [blame] | 2133 | |
Xiaokang Qian | 0e97d4d | 2022-10-24 11:12:51 +0000 | [diff] [blame] | 2134 | #if defined(MBEDTLS_SSL_EARLY_DATA) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2135 | int mbedtls_ssl_tls13_write_early_data_ext(mbedtls_ssl_context *ssl, |
Jerry Yu | c59c586 | 2023-12-05 10:40:49 +0800 | [diff] [blame] | 2136 | int in_new_session_ticket, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2137 | unsigned char *buf, |
| 2138 | const unsigned char *end, |
Jerry Yu | c59c586 | 2023-12-05 10:40:49 +0800 | [diff] [blame] | 2139 | size_t *out_len); |
Ronald Cron | 8571804 | 2024-02-22 10:22:09 +0100 | [diff] [blame] | 2140 | |
| 2141 | int mbedtls_ssl_tls13_check_early_data_len(mbedtls_ssl_context *ssl, |
| 2142 | size_t early_data_len); |
Ronald Cron | aa35931 | 2024-03-11 17:24:39 +0100 | [diff] [blame] | 2143 | |
| 2144 | typedef enum { |
| 2145 | /* |
| 2146 | * The client has not sent the first ClientHello yet, the negotiation of early |
| 2147 | * data has not started yet. |
| 2148 | */ |
| 2149 | MBEDTLS_SSL_EARLY_DATA_STATE_IDLE, |
| 2150 | |
| 2151 | /* |
| 2152 | * In its ClientHello, the client has not included an early data indication |
| 2153 | * extension. |
| 2154 | */ |
| 2155 | MBEDTLS_SSL_EARLY_DATA_STATE_NO_IND_SENT, |
| 2156 | |
| 2157 | /* |
| 2158 | * The client has sent an early data indication extension in its first |
| 2159 | * ClientHello, it has not received the response (ServerHello or |
| 2160 | * HelloRetryRequest) from the server yet. The transform to protect early data |
Ronald Cron | fd4c0c8 | 2024-03-11 17:28:44 +0100 | [diff] [blame] | 2161 | * is not set either as for middlebox compatibility a dummy CCS may have to be |
Ronald Cron | aa35931 | 2024-03-11 17:24:39 +0100 | [diff] [blame] | 2162 | * sent in clear. Early data cannot be sent to the server yet. |
| 2163 | */ |
| 2164 | MBEDTLS_SSL_EARLY_DATA_STATE_IND_SENT, |
| 2165 | |
| 2166 | /* |
| 2167 | * The client has sent an early data indication extension in its first |
| 2168 | * ClientHello, it has not received the response (ServerHello or |
| 2169 | * HelloRetryRequest) from the server yet. The transform to protect early data |
| 2170 | * has been set and early data can be written now. |
| 2171 | */ |
| 2172 | MBEDTLS_SSL_EARLY_DATA_STATE_CAN_WRITE, |
| 2173 | |
| 2174 | /* |
| 2175 | * The client has indicated the use of early data and the server has accepted |
| 2176 | * it. |
| 2177 | */ |
| 2178 | MBEDTLS_SSL_EARLY_DATA_STATE_ACCEPTED, |
| 2179 | |
| 2180 | /* |
| 2181 | * The client has indicated the use of early data but the server has rejected |
| 2182 | * it. |
| 2183 | */ |
| 2184 | MBEDTLS_SSL_EARLY_DATA_STATE_REJECTED, |
| 2185 | |
| 2186 | /* |
| 2187 | * The client has sent an early data indication extension in its first |
| 2188 | * ClientHello, the server has accepted them and the client has received the |
| 2189 | * server Finished message. It cannot send early data to the server anymore. |
| 2190 | */ |
| 2191 | MBEDTLS_SSL_EARLY_DATA_STATE_SERVER_FINISHED_RECEIVED, |
| 2192 | |
| 2193 | } mbedtls_ssl_early_data_state; |
Xiaokang Qian | 0e97d4d | 2022-10-24 11:12:51 +0000 | [diff] [blame] | 2194 | #endif /* MBEDTLS_SSL_EARLY_DATA */ |
Jerry Yu | 89e103c | 2022-03-30 22:43:29 +0800 | [diff] [blame] | 2195 | |
Jerry Yu | f017ee4 | 2022-01-12 15:49:48 +0800 | [diff] [blame] | 2196 | #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ |
| 2197 | |
Ronald Cron | e68ab4f | 2022-10-05 12:46:29 +0200 | [diff] [blame] | 2198 | #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) |
Jerry Yu | 5cc8f0a | 2021-08-27 17:21:44 +0800 | [diff] [blame] | 2199 | /* |
Jerry Yu | ddda050 | 2022-12-01 19:43:12 +0800 | [diff] [blame] | 2200 | * Write Signature Algorithm extension |
| 2201 | */ |
| 2202 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2203 | int mbedtls_ssl_write_sig_alg_ext(mbedtls_ssl_context *ssl, unsigned char *buf, |
| 2204 | const unsigned char *end, size_t *out_len); |
Jerry Yu | ddda050 | 2022-12-01 19:43:12 +0800 | [diff] [blame] | 2205 | /* |
Gabor Mezei | 53a3b14 | 2022-05-10 13:20:55 +0200 | [diff] [blame] | 2206 | * Parse TLS Signature Algorithm extension |
Xiaofei Bai | 69fcd39 | 2022-01-20 08:25:00 +0000 | [diff] [blame] | 2207 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 2208 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2209 | int mbedtls_ssl_parse_sig_alg_ext(mbedtls_ssl_context *ssl, |
| 2210 | const unsigned char *buf, |
| 2211 | const unsigned char *end); |
Ronald Cron | e68ab4f | 2022-10-05 12:46:29 +0200 | [diff] [blame] | 2212 | #endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */ |
Jerry Yu | 65dd2cc | 2021-08-18 16:38:40 +0800 | [diff] [blame] | 2213 | |
Jerry Yu | 000f976 | 2021-09-14 11:12:51 +0800 | [diff] [blame] | 2214 | /* Get handshake transcript */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 2215 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2216 | int mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context *ssl, |
| 2217 | const mbedtls_md_type_t md, |
| 2218 | unsigned char *dst, |
| 2219 | size_t dst_len, |
| 2220 | size_t *olen); |
Jerry Yu | 000f976 | 2021-09-14 11:12:51 +0800 | [diff] [blame] | 2221 | |
Brett Warren | e0edc84 | 2021-08-17 09:53:13 +0100 | [diff] [blame] | 2222 | /* |
Jerry Yu | ba07342 | 2021-12-20 22:22:15 +0800 | [diff] [blame] | 2223 | * Helper functions for NamedGroup. |
| 2224 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2225 | static inline int mbedtls_ssl_tls12_named_group_is_ecdhe(uint16_t named_group) |
Jerry Yu | ba07342 | 2021-12-20 22:22:15 +0800 | [diff] [blame] | 2226 | { |
| 2227 | /* |
Jerry Yu | 3ad14ac | 2022-01-11 17:13:16 +0800 | [diff] [blame] | 2228 | * RFC 8422 section 5.1.1 |
Jerry Yu | ba07342 | 2021-12-20 22:22:15 +0800 | [diff] [blame] | 2229 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2230 | return named_group == MBEDTLS_SSL_IANA_TLS_GROUP_X25519 || |
| 2231 | named_group == MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1 || |
| 2232 | named_group == MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1 || |
| 2233 | named_group == MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1 || |
| 2234 | named_group == MBEDTLS_SSL_IANA_TLS_GROUP_X448 || |
| 2235 | /* Below deprecated curves should be removed with notice to users */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2236 | named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1 || |
| 2237 | named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1 || |
| 2238 | named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1 || |
| 2239 | named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1; |
Jerry Yu | ba07342 | 2021-12-20 22:22:15 +0800 | [diff] [blame] | 2240 | } |
| 2241 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2242 | static inline int mbedtls_ssl_tls13_named_group_is_ecdhe(uint16_t named_group) |
Jerry Yu | ba07342 | 2021-12-20 22:22:15 +0800 | [diff] [blame] | 2243 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2244 | return named_group == MBEDTLS_SSL_IANA_TLS_GROUP_X25519 || |
| 2245 | named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1 || |
| 2246 | named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1 || |
| 2247 | named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1 || |
| 2248 | named_group == MBEDTLS_SSL_IANA_TLS_GROUP_X448; |
Jerry Yu | ba07342 | 2021-12-20 22:22:15 +0800 | [diff] [blame] | 2249 | } |
| 2250 | |
Przemek Stekiel | d5f79e7 | 2023-06-29 09:08:43 +0200 | [diff] [blame] | 2251 | static inline int mbedtls_ssl_tls13_named_group_is_ffdh(uint16_t named_group) |
Jerry Yu | ba07342 | 2021-12-20 22:22:15 +0800 | [diff] [blame] | 2252 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2253 | return named_group >= MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048 && |
| 2254 | named_group <= MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192; |
Jerry Yu | ba07342 | 2021-12-20 22:22:15 +0800 | [diff] [blame] | 2255 | } |
| 2256 | |
XiaokangQian | 0803755 | 2022-04-20 07:16:41 +0000 | [diff] [blame] | 2257 | static inline int mbedtls_ssl_named_group_is_offered( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2258 | const mbedtls_ssl_context *ssl, uint16_t named_group) |
XiaokangQian | 0803755 | 2022-04-20 07:16:41 +0000 | [diff] [blame] | 2259 | { |
Manuel Pégourié-Gonnard | 6402c35 | 2025-01-14 12:23:56 +0100 | [diff] [blame] | 2260 | const uint16_t *group_list = ssl->conf->group_list; |
XiaokangQian | 0803755 | 2022-04-20 07:16:41 +0000 | [diff] [blame] | 2261 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2262 | if (group_list == NULL) { |
| 2263 | return 0; |
XiaokangQian | 0803755 | 2022-04-20 07:16:41 +0000 | [diff] [blame] | 2264 | } |
| 2265 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2266 | for (; *group_list != 0; group_list++) { |
| 2267 | if (*group_list == named_group) { |
| 2268 | return 1; |
| 2269 | } |
| 2270 | } |
| 2271 | |
| 2272 | return 0; |
XiaokangQian | 0803755 | 2022-04-20 07:16:41 +0000 | [diff] [blame] | 2273 | } |
| 2274 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2275 | static inline int mbedtls_ssl_named_group_is_supported(uint16_t named_group) |
XiaokangQian | 0803755 | 2022-04-20 07:16:41 +0000 | [diff] [blame] | 2276 | { |
Valerio Setti | 080a22b | 2023-03-20 15:22:47 +0100 | [diff] [blame] | 2277 | #if defined(PSA_WANT_ALG_ECDH) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2278 | if (mbedtls_ssl_tls13_named_group_is_ecdhe(named_group)) { |
| 2279 | if (mbedtls_ssl_get_ecp_group_id_from_tls_id(named_group) != |
| 2280 | MBEDTLS_ECP_DP_NONE) { |
| 2281 | return 1; |
| 2282 | } |
XiaokangQian | 0803755 | 2022-04-20 07:16:41 +0000 | [diff] [blame] | 2283 | } |
Przemek Stekiel | cceb933 | 2023-05-18 14:31:10 +0200 | [diff] [blame] | 2284 | #endif |
| 2285 | #if defined(PSA_WANT_ALG_FFDH) |
Przemek Stekiel | d5f79e7 | 2023-06-29 09:08:43 +0200 | [diff] [blame] | 2286 | if (mbedtls_ssl_tls13_named_group_is_ffdh(named_group)) { |
Przemek Stekiel | cceb933 | 2023-05-18 14:31:10 +0200 | [diff] [blame] | 2287 | return 1; |
| 2288 | } |
| 2289 | #endif |
| 2290 | #if !defined(PSA_WANT_ALG_ECDH) && !defined(PSA_WANT_ALG_FFDH) |
| 2291 | (void) named_group; |
| 2292 | #endif |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2293 | return 0; |
XiaokangQian | 0803755 | 2022-04-20 07:16:41 +0000 | [diff] [blame] | 2294 | } |
| 2295 | |
Jerry Yu | afdfed1 | 2021-12-22 10:49:02 +0800 | [diff] [blame] | 2296 | /* |
Jerry Yu | 713013f | 2022-01-17 18:16:35 +0800 | [diff] [blame] | 2297 | * Return supported signature algorithms. |
Jerry Yu | afdfed1 | 2021-12-22 10:49:02 +0800 | [diff] [blame] | 2298 | */ |
Jerry Yu | 713013f | 2022-01-17 18:16:35 +0800 | [diff] [blame] | 2299 | static inline const void *mbedtls_ssl_get_sig_algs( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2300 | const mbedtls_ssl_context *ssl) |
Jerry Yu | afdfed1 | 2021-12-22 10:49:02 +0800 | [diff] [blame] | 2301 | { |
Ronald Cron | e68ab4f | 2022-10-05 12:46:29 +0200 | [diff] [blame] | 2302 | #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) |
Manuel Pégourié-Gonnard | f7d704d | 2022-01-28 10:05:56 +0100 | [diff] [blame] | 2303 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2304 | return ssl->conf->sig_algs; |
Manuel Pégourié-Gonnard | f7d704d | 2022-01-28 10:05:56 +0100 | [diff] [blame] | 2305 | |
Ronald Cron | e68ab4f | 2022-10-05 12:46:29 +0200 | [diff] [blame] | 2306 | #else /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */ |
Jerry Yu | afdfed1 | 2021-12-22 10:49:02 +0800 | [diff] [blame] | 2307 | |
Jerry Yu | 6106fdc | 2022-01-12 16:36:14 +0800 | [diff] [blame] | 2308 | ((void) ssl); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2309 | return NULL; |
Ronald Cron | e68ab4f | 2022-10-05 12:46:29 +0200 | [diff] [blame] | 2310 | #endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */ |
Jerry Yu | afdfed1 | 2021-12-22 10:49:02 +0800 | [diff] [blame] | 2311 | } |
Jerry Yu | ba07342 | 2021-12-20 22:22:15 +0800 | [diff] [blame] | 2312 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2313 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2314 | static inline int mbedtls_ssl_sig_alg_is_received(const mbedtls_ssl_context *ssl, |
| 2315 | uint16_t own_sig_alg) |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 2316 | { |
Jerry Yu | 1bb5a1f | 2022-01-30 10:52:11 +0800 | [diff] [blame] | 2317 | const uint16_t *sig_alg = ssl->handshake->received_sig_algs; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2318 | if (sig_alg == NULL) { |
| 2319 | return 0; |
Jerry Yu | 1bb5a1f | 2022-01-30 10:52:11 +0800 | [diff] [blame] | 2320 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2321 | |
| 2322 | for (; *sig_alg != MBEDTLS_TLS_SIG_NONE; sig_alg++) { |
| 2323 | if (*sig_alg == own_sig_alg) { |
| 2324 | return 1; |
| 2325 | } |
| 2326 | } |
| 2327 | return 0; |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 2328 | } |
| 2329 | |
Jerry Yu | a1255e6 | 2022-06-24 10:10:47 +0800 | [diff] [blame] | 2330 | static inline int mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2331 | const uint16_t sig_alg) |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2332 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2333 | switch (sig_alg) { |
Elena Uziunaite | a6950b8 | 2024-07-30 13:55:59 +0100 | [diff] [blame] | 2334 | #if defined(PSA_HAVE_ALG_SOME_ECDSA) |
Valerio Setti | cf29c5d | 2023-09-01 09:03:41 +0200 | [diff] [blame] | 2335 | #if defined(PSA_WANT_ALG_SHA_256) && defined(PSA_WANT_ECC_SECP_R1_256) |
Jerry Yu | 96ee23e | 2022-06-21 16:34:57 +0800 | [diff] [blame] | 2336 | case MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256: |
| 2337 | break; |
Ronald Cron | feb5e26 | 2025-09-15 18:36:39 +0200 | [diff] [blame] | 2338 | #endif /* PSA_WANT_ALG_SHA_256 && PSA_WANT_ECC_SECP_R1_256 */ |
Valerio Setti | cf29c5d | 2023-09-01 09:03:41 +0200 | [diff] [blame] | 2339 | #if defined(PSA_WANT_ALG_SHA_384) && defined(PSA_WANT_ECC_SECP_R1_384) |
Jerry Yu | 96ee23e | 2022-06-21 16:34:57 +0800 | [diff] [blame] | 2340 | case MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384: |
| 2341 | break; |
Ronald Cron | feb5e26 | 2025-09-15 18:36:39 +0200 | [diff] [blame] | 2342 | #endif /* PSA_WANT_ALG_SHA_384 && PSA_WANT_ECC_SECP_R1_384 */ |
Valerio Setti | cf29c5d | 2023-09-01 09:03:41 +0200 | [diff] [blame] | 2343 | #if defined(PSA_WANT_ALG_SHA_512) && defined(PSA_WANT_ECC_SECP_R1_521) |
Jerry Yu | 96ee23e | 2022-06-21 16:34:57 +0800 | [diff] [blame] | 2344 | case MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512: |
| 2345 | break; |
Ronald Cron | feb5e26 | 2025-09-15 18:36:39 +0200 | [diff] [blame] | 2346 | #endif /* PSA_WANT_ALG_SHA_512 && PSA_WANT_ECC_SECP_R1_521 */ |
Elena Uziunaite | a6950b8 | 2024-07-30 13:55:59 +0100 | [diff] [blame] | 2347 | #endif /* PSA_HAVE_ALG_SOME_ECDSA */ |
Jerry Yu | 96ee23e | 2022-06-21 16:34:57 +0800 | [diff] [blame] | 2348 | |
Ronald Cron | 8719c2f | 2025-07-22 11:27:39 +0200 | [diff] [blame] | 2349 | #if defined(PSA_WANT_ALG_RSA_PSS) |
Przemyslaw Stekiel | 004c218 | 2022-09-14 09:09:16 +0200 | [diff] [blame] | 2350 | #if defined(PSA_WANT_ALG_SHA_256) |
Jerry Yu | 96ee23e | 2022-06-21 16:34:57 +0800 | [diff] [blame] | 2351 | case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: |
| 2352 | break; |
Przemyslaw Stekiel | 004c218 | 2022-09-14 09:09:16 +0200 | [diff] [blame] | 2353 | #endif /* PSA_WANT_ALG_SHA_256 */ |
| 2354 | #if defined(PSA_WANT_ALG_SHA_384) |
Jerry Yu | 96ee23e | 2022-06-21 16:34:57 +0800 | [diff] [blame] | 2355 | case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: |
| 2356 | break; |
Przemyslaw Stekiel | 004c218 | 2022-09-14 09:09:16 +0200 | [diff] [blame] | 2357 | #endif /* PSA_WANT_ALG_SHA_384 */ |
| 2358 | #if defined(PSA_WANT_ALG_SHA_512) |
Jerry Yu | 96ee23e | 2022-06-21 16:34:57 +0800 | [diff] [blame] | 2359 | case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512: |
| 2360 | break; |
Przemyslaw Stekiel | 004c218 | 2022-09-14 09:09:16 +0200 | [diff] [blame] | 2361 | #endif /* PSA_WANT_ALG_SHA_512 */ |
Ronald Cron | 8719c2f | 2025-07-22 11:27:39 +0200 | [diff] [blame] | 2362 | #endif /* PSA_WANT_ALG_RSA_PSS */ |
Jerry Yu | 96ee23e | 2022-06-21 16:34:57 +0800 | [diff] [blame] | 2363 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2364 | return 0; |
Jerry Yu | 96ee23e | 2022-06-21 16:34:57 +0800 | [diff] [blame] | 2365 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2366 | return 1; |
Jerry Yu | 80dd5db | 2022-06-22 19:30:32 +0800 | [diff] [blame] | 2367 | |
| 2368 | } |
| 2369 | |
| 2370 | static inline int mbedtls_ssl_tls13_sig_alg_is_supported( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2371 | const uint16_t sig_alg) |
Jerry Yu | 80dd5db | 2022-06-22 19:30:32 +0800 | [diff] [blame] | 2372 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2373 | switch (sig_alg) { |
Ronald Cron | 8719c2f | 2025-07-22 11:27:39 +0200 | [diff] [blame] | 2374 | #if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) |
Elena Uziunaite | 0916cd7 | 2024-05-23 17:01:07 +0100 | [diff] [blame] | 2375 | #if defined(PSA_WANT_ALG_SHA_256) |
Jerry Yu | 80dd5db | 2022-06-22 19:30:32 +0800 | [diff] [blame] | 2376 | case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256: |
| 2377 | break; |
Elena Uziunaite | 0916cd7 | 2024-05-23 17:01:07 +0100 | [diff] [blame] | 2378 | #endif /* PSA_WANT_ALG_SHA_256 */ |
Elena Uziunaite | b476d4b | 2024-05-23 15:33:41 +0100 | [diff] [blame] | 2379 | #if defined(PSA_WANT_ALG_SHA_384) |
Jerry Yu | 80dd5db | 2022-06-22 19:30:32 +0800 | [diff] [blame] | 2380 | case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384: |
| 2381 | break; |
Elena Uziunaite | b476d4b | 2024-05-23 15:33:41 +0100 | [diff] [blame] | 2382 | #endif /* PSA_WANT_ALG_SHA_384 */ |
Gabor Mezei | c15ef93 | 2024-06-13 12:53:54 +0200 | [diff] [blame] | 2383 | #if defined(PSA_WANT_ALG_SHA_512) |
Jerry Yu | 80dd5db | 2022-06-22 19:30:32 +0800 | [diff] [blame] | 2384 | case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512: |
| 2385 | break; |
Gabor Mezei | c15ef93 | 2024-06-13 12:53:54 +0200 | [diff] [blame] | 2386 | #endif /* PSA_WANT_ALG_SHA_512 */ |
Ronald Cron | 8719c2f | 2025-07-22 11:27:39 +0200 | [diff] [blame] | 2387 | #endif /* PSA_WANT_ALG_RSA_PKCS1V15_SIGN */ |
Jerry Yu | 80dd5db | 2022-06-22 19:30:32 +0800 | [diff] [blame] | 2388 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2389 | return mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported( |
| 2390 | sig_alg); |
Jerry Yu | 80dd5db | 2022-06-22 19:30:32 +0800 | [diff] [blame] | 2391 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2392 | return 1; |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2393 | } |
Xiaokang Qian | a3b451f | 2022-10-11 06:20:56 +0000 | [diff] [blame] | 2394 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2395 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2396 | int mbedtls_ssl_tls13_check_sig_alg_cert_key_match(uint16_t sig_alg, |
| 2397 | mbedtls_pk_context *key); |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2398 | #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ |
| 2399 | |
Ronald Cron | e68ab4f | 2022-10-05 12:46:29 +0200 | [diff] [blame] | 2400 | #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2401 | static inline int mbedtls_ssl_sig_alg_is_offered(const mbedtls_ssl_context *ssl, |
| 2402 | uint16_t proposed_sig_alg) |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2403 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2404 | const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs(ssl); |
| 2405 | if (sig_alg == NULL) { |
| 2406 | return 0; |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2407 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2408 | |
| 2409 | for (; *sig_alg != MBEDTLS_TLS_SIG_NONE; sig_alg++) { |
| 2410 | if (*sig_alg == proposed_sig_alg) { |
| 2411 | return 1; |
| 2412 | } |
| 2413 | } |
| 2414 | return 0; |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2415 | } |
| 2416 | |
| 2417 | static inline int mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2418 | uint16_t sig_alg, mbedtls_pk_type_t *pk_type, mbedtls_md_type_t *md_alg) |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2419 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2420 | *pk_type = mbedtls_ssl_pk_alg_from_sig(sig_alg & 0xff); |
| 2421 | *md_alg = mbedtls_ssl_md_alg_from_hash((sig_alg >> 8) & 0xff); |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2422 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2423 | if (*pk_type != MBEDTLS_PK_NONE && *md_alg != MBEDTLS_MD_NONE) { |
| 2424 | return 0; |
| 2425 | } |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2426 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2427 | switch (sig_alg) { |
Ronald Cron | 8719c2f | 2025-07-22 11:27:39 +0200 | [diff] [blame] | 2428 | #if defined(PSA_WANT_ALG_RSA_PSS) |
Elena Uziunaite | 0916cd7 | 2024-05-23 17:01:07 +0100 | [diff] [blame] | 2429 | #if defined(PSA_WANT_ALG_SHA_256) |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2430 | case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: |
| 2431 | *md_alg = MBEDTLS_MD_SHA256; |
| 2432 | *pk_type = MBEDTLS_PK_RSASSA_PSS; |
| 2433 | break; |
Elena Uziunaite | 0916cd7 | 2024-05-23 17:01:07 +0100 | [diff] [blame] | 2434 | #endif /* PSA_WANT_ALG_SHA_256 */ |
Elena Uziunaite | b476d4b | 2024-05-23 15:33:41 +0100 | [diff] [blame] | 2435 | #if defined(PSA_WANT_ALG_SHA_384) |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2436 | case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: |
| 2437 | *md_alg = MBEDTLS_MD_SHA384; |
| 2438 | *pk_type = MBEDTLS_PK_RSASSA_PSS; |
| 2439 | break; |
Elena Uziunaite | b476d4b | 2024-05-23 15:33:41 +0100 | [diff] [blame] | 2440 | #endif /* PSA_WANT_ALG_SHA_384 */ |
Gabor Mezei | c15ef93 | 2024-06-13 12:53:54 +0200 | [diff] [blame] | 2441 | #if defined(PSA_WANT_ALG_SHA_512) |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2442 | case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512: |
| 2443 | *md_alg = MBEDTLS_MD_SHA512; |
| 2444 | *pk_type = MBEDTLS_PK_RSASSA_PSS; |
| 2445 | break; |
Gabor Mezei | c15ef93 | 2024-06-13 12:53:54 +0200 | [diff] [blame] | 2446 | #endif /* PSA_WANT_ALG_SHA_512 */ |
Ronald Cron | 8719c2f | 2025-07-22 11:27:39 +0200 | [diff] [blame] | 2447 | #endif /* PSA_WANT_ALG_RSA_PSS */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2448 | default: |
| 2449 | return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
| 2450 | } |
| 2451 | return 0; |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2452 | } |
Jerry Yu | 8c33886 | 2022-03-23 13:34:04 +0800 | [diff] [blame] | 2453 | |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2454 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
| 2455 | static inline int mbedtls_ssl_tls12_sig_alg_is_supported( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2456 | const uint16_t sig_alg) |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2457 | { |
| 2458 | /* High byte is hash */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2459 | unsigned char hash = MBEDTLS_BYTE_1(sig_alg); |
| 2460 | unsigned char sig = MBEDTLS_BYTE_0(sig_alg); |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2461 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2462 | switch (hash) { |
Elena Uziunaite | b66a991 | 2024-05-10 14:25:58 +0100 | [diff] [blame] | 2463 | #if defined(PSA_WANT_ALG_MD5) |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2464 | case MBEDTLS_SSL_HASH_MD5: |
| 2465 | break; |
| 2466 | #endif |
| 2467 | |
Elena Uziunaite | 9fc5be0 | 2024-09-04 18:12:59 +0100 | [diff] [blame] | 2468 | #if defined(PSA_WANT_ALG_SHA_1) |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2469 | case MBEDTLS_SSL_HASH_SHA1: |
| 2470 | break; |
| 2471 | #endif |
| 2472 | |
Elena Uziunaite | fcc9afa | 2024-05-23 14:43:22 +0100 | [diff] [blame] | 2473 | #if defined(PSA_WANT_ALG_SHA_224) |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2474 | case MBEDTLS_SSL_HASH_SHA224: |
| 2475 | break; |
| 2476 | #endif |
| 2477 | |
Elena Uziunaite | 0916cd7 | 2024-05-23 17:01:07 +0100 | [diff] [blame] | 2478 | #if defined(PSA_WANT_ALG_SHA_256) |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2479 | case MBEDTLS_SSL_HASH_SHA256: |
| 2480 | break; |
| 2481 | #endif |
| 2482 | |
Elena Uziunaite | b476d4b | 2024-05-23 15:33:41 +0100 | [diff] [blame] | 2483 | #if defined(PSA_WANT_ALG_SHA_384) |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2484 | case MBEDTLS_SSL_HASH_SHA384: |
| 2485 | break; |
| 2486 | #endif |
| 2487 | |
Gabor Mezei | c15ef93 | 2024-06-13 12:53:54 +0200 | [diff] [blame] | 2488 | #if defined(PSA_WANT_ALG_SHA_512) |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2489 | case MBEDTLS_SSL_HASH_SHA512: |
| 2490 | break; |
| 2491 | #endif |
| 2492 | |
| 2493 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2494 | return 0; |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2495 | } |
| 2496 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2497 | switch (sig) { |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2498 | #if defined(MBEDTLS_RSA_C) |
| 2499 | case MBEDTLS_SSL_SIG_RSA: |
| 2500 | break; |
| 2501 | #endif |
| 2502 | |
Valerio Setti | e9646ec | 2023-08-02 20:02:28 +0200 | [diff] [blame] | 2503 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2504 | case MBEDTLS_SSL_SIG_ECDSA: |
| 2505 | break; |
| 2506 | #endif |
| 2507 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2508 | default: |
| 2509 | return 0; |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2510 | } |
| 2511 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2512 | return 1; |
Jerry Yu | 0ebce95 | 2022-06-16 13:54:47 +0800 | [diff] [blame] | 2513 | } |
| 2514 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
| 2515 | |
Jerry Yu | 1bab301 | 2022-01-19 17:43:22 +0800 | [diff] [blame] | 2516 | static inline int mbedtls_ssl_sig_alg_is_supported( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2517 | const mbedtls_ssl_context *ssl, |
| 2518 | const uint16_t sig_alg) |
Jerry Yu | 1bab301 | 2022-01-19 17:43:22 +0800 | [diff] [blame] | 2519 | { |
| 2520 | |
| 2521 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2522 | if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2) { |
| 2523 | return mbedtls_ssl_tls12_sig_alg_is_supported(sig_alg); |
Jerry Yu | 1bab301 | 2022-01-19 17:43:22 +0800 | [diff] [blame] | 2524 | } |
| 2525 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
| 2526 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2527 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2528 | if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { |
| 2529 | return mbedtls_ssl_tls13_sig_alg_is_supported(sig_alg); |
Jerry Yu | 1bab301 | 2022-01-19 17:43:22 +0800 | [diff] [blame] | 2530 | } |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 2531 | #endif |
Jerry Yu | 1bab301 | 2022-01-19 17:43:22 +0800 | [diff] [blame] | 2532 | ((void) ssl); |
| 2533 | ((void) sig_alg); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2534 | return 0; |
Jerry Yu | 1bab301 | 2022-01-19 17:43:22 +0800 | [diff] [blame] | 2535 | } |
Ronald Cron | e68ab4f | 2022-10-05 12:46:29 +0200 | [diff] [blame] | 2536 | #endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */ |
Jerry Yu | 1bab301 | 2022-01-19 17:43:22 +0800 | [diff] [blame] | 2537 | |
Przemyslaw Stekiel | e5c2238 | 2022-01-25 00:56:34 +0100 | [diff] [blame] | 2538 | /* Corresponding PSA algorithm for MBEDTLS_CIPHER_NULL. |
Andrzej Kurek | 5c65c57 | 2022-04-13 14:28:52 -0400 | [diff] [blame] | 2539 | * Same value is used for PSA_ALG_CATEGORY_CIPHER, hence it is |
Przemyslaw Stekiel | e5c2238 | 2022-01-25 00:56:34 +0100 | [diff] [blame] | 2540 | * guaranteed to not be a valid PSA algorithm identifier. |
| 2541 | */ |
| 2542 | #define MBEDTLS_SSL_NULL_CIPHER 0x04000000 |
| 2543 | |
| 2544 | /** |
| 2545 | * \brief Translate mbedtls cipher type/taglen pair to psa: |
| 2546 | * algorithm, key type and key size. |
| 2547 | * |
| 2548 | * \param mbedtls_cipher_type [in] given mbedtls cipher type |
| 2549 | * \param taglen [in] given tag length |
| 2550 | * 0 - default tag length |
| 2551 | * \param alg [out] corresponding PSA alg |
| 2552 | * There is no corresponding PSA |
Przemyslaw Stekiel | 8c010eb | 2022-02-03 10:44:02 +0100 | [diff] [blame] | 2553 | * alg for MBEDTLS_CIPHER_NULL, so |
| 2554 | * in this case MBEDTLS_SSL_NULL_CIPHER |
| 2555 | * is returned via this parameter |
Przemyslaw Stekiel | e5c2238 | 2022-01-25 00:56:34 +0100 | [diff] [blame] | 2556 | * \param key_type [out] corresponding PSA key type |
| 2557 | * \param key_size [out] corresponding PSA key size |
| 2558 | * |
| 2559 | * \return PSA_SUCCESS on success or PSA_ERROR_NOT_SUPPORTED if |
| 2560 | * conversion is not supported. |
| 2561 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2562 | psa_status_t mbedtls_ssl_cipher_to_psa(mbedtls_cipher_type_t mbedtls_cipher_type, |
| 2563 | size_t taglen, |
| 2564 | psa_algorithm_t *alg, |
| 2565 | psa_key_type_t *key_type, |
| 2566 | size_t *key_size); |
Przemyslaw Stekiel | e5c2238 | 2022-01-25 00:56:34 +0100 | [diff] [blame] | 2567 | |
Manuel Pégourié-Gonnard | 615914b | 2025-01-22 13:03:55 +0100 | [diff] [blame] | 2568 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Valerio Setti | fbbc1f3 | 2022-11-15 16:39:55 +0100 | [diff] [blame] | 2569 | |
Valerio Setti | 6b3dab0 | 2022-11-17 17:14:54 +0100 | [diff] [blame] | 2570 | typedef enum { |
| 2571 | MBEDTLS_ECJPAKE_ROUND_ONE, |
| 2572 | MBEDTLS_ECJPAKE_ROUND_TWO |
| 2573 | } mbedtls_ecjpake_rounds_t; |
| 2574 | |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 2575 | /** |
| 2576 | * \brief Parse the provided input buffer for getting the first round |
| 2577 | * of key exchange. This code is common between server and client |
| 2578 | * |
| 2579 | * \param pake_ctx [in] the PAKE's operation/context structure |
| 2580 | * \param buf [in] input buffer to parse |
| 2581 | * \param len [in] length of the input buffer |
Valerio Setti | 6b3dab0 | 2022-11-17 17:14:54 +0100 | [diff] [blame] | 2582 | * \param round [in] either MBEDTLS_ECJPAKE_ROUND_ONE or |
| 2583 | * MBEDTLS_ECJPAKE_ROUND_TWO |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 2584 | * |
| 2585 | * \return 0 on success or a negative error code in case of failure |
| 2586 | */ |
Valerio Setti | 6b3dab0 | 2022-11-17 17:14:54 +0100 | [diff] [blame] | 2587 | int mbedtls_psa_ecjpake_read_round( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2588 | psa_pake_operation_t *pake_ctx, |
| 2589 | const unsigned char *buf, |
| 2590 | size_t len, mbedtls_ecjpake_rounds_t round); |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 2591 | |
| 2592 | /** |
| 2593 | * \brief Write the first round of key exchange into the provided output |
| 2594 | * buffer. This code is common between server and client |
| 2595 | * |
| 2596 | * \param pake_ctx [in] the PAKE's operation/context structure |
| 2597 | * \param buf [out] the output buffer in which data will be written to |
| 2598 | * \param len [in] length of the output buffer |
| 2599 | * \param olen [out] the length of the data really written on the buffer |
Valerio Setti | 6b3dab0 | 2022-11-17 17:14:54 +0100 | [diff] [blame] | 2600 | * \param round [in] either MBEDTLS_ECJPAKE_ROUND_ONE or |
| 2601 | * MBEDTLS_ECJPAKE_ROUND_TWO |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 2602 | * |
| 2603 | * \return 0 on success or a negative error code in case of failure |
| 2604 | */ |
Valerio Setti | 6b3dab0 | 2022-11-17 17:14:54 +0100 | [diff] [blame] | 2605 | int mbedtls_psa_ecjpake_write_round( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2606 | psa_pake_operation_t *pake_ctx, |
| 2607 | unsigned char *buf, |
| 2608 | size_t len, size_t *olen, |
| 2609 | mbedtls_ecjpake_rounds_t round); |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 2610 | |
Manuel Pégourié-Gonnard | 615914b | 2025-01-22 13:03:55 +0100 | [diff] [blame] | 2611 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 2612 | |
Neil Armstrong | 8a0f3e8 | 2022-03-30 10:57:37 +0200 | [diff] [blame] | 2613 | /** |
| 2614 | * \brief TLS record protection modes |
| 2615 | */ |
| 2616 | typedef enum { |
| 2617 | MBEDTLS_SSL_MODE_STREAM = 0, |
| 2618 | MBEDTLS_SSL_MODE_CBC, |
| 2619 | MBEDTLS_SSL_MODE_CBC_ETM, |
| 2620 | MBEDTLS_SSL_MODE_AEAD |
| 2621 | } mbedtls_ssl_mode_t; |
| 2622 | |
Neil Armstrong | ab555e0 | 2022-04-04 11:07:59 +0200 | [diff] [blame] | 2623 | mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_transform( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2624 | const mbedtls_ssl_transform *transform); |
Neil Armstrong | 8a0f3e8 | 2022-03-30 10:57:37 +0200 | [diff] [blame] | 2625 | |
Neil Armstrong | f2c82f0 | 2022-04-05 11:16:53 +0200 | [diff] [blame] | 2626 | #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) |
Neil Armstrong | ab555e0 | 2022-04-04 11:07:59 +0200 | [diff] [blame] | 2627 | mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2628 | int encrypt_then_mac, |
| 2629 | const mbedtls_ssl_ciphersuite_t *suite); |
Neil Armstrong | 4bf4c86 | 2022-04-01 10:35:48 +0200 | [diff] [blame] | 2630 | #else |
Neil Armstrong | ab555e0 | 2022-04-04 11:07:59 +0200 | [diff] [blame] | 2631 | mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2632 | const mbedtls_ssl_ciphersuite_t *suite); |
Neil Armstrong | f2c82f0 | 2022-04-05 11:16:53 +0200 | [diff] [blame] | 2633 | #endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */ |
Neil Armstrong | 4bf4c86 | 2022-04-01 10:35:48 +0200 | [diff] [blame] | 2634 | |
Przemek Stekiel | 6370662 | 2023-05-23 16:31:56 +0200 | [diff] [blame] | 2635 | #if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH) |
XiaokangQian | 9b5d04b | 2022-04-10 10:20:43 +0000 | [diff] [blame] | 2636 | |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 2637 | MBEDTLS_CHECK_RETURN_CRITICAL |
Przemek Stekiel | 7ac93be | 2023-07-04 10:02:38 +0200 | [diff] [blame] | 2638 | int mbedtls_ssl_tls13_read_public_xxdhe_share(mbedtls_ssl_context *ssl, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2639 | const unsigned char *buf, |
| 2640 | size_t buf_len); |
XiaokangQian | 9b5d04b | 2022-04-10 10:20:43 +0000 | [diff] [blame] | 2641 | |
Przemek Stekiel | 6370662 | 2023-05-23 16:31:56 +0200 | [diff] [blame] | 2642 | #endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */ |
XiaokangQian | 9b5d04b | 2022-04-10 10:20:43 +0000 | [diff] [blame] | 2643 | |
XiaokangQian | 0a1b54e | 2022-04-21 03:01:38 +0000 | [diff] [blame] | 2644 | static inline int mbedtls_ssl_tls13_cipher_suite_is_offered( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2645 | mbedtls_ssl_context *ssl, int cipher_suite) |
XiaokangQian | 0a1b54e | 2022-04-21 03:01:38 +0000 | [diff] [blame] | 2646 | { |
| 2647 | const int *ciphersuite_list = ssl->conf->ciphersuite_list; |
| 2648 | |
| 2649 | /* Check whether we have offered this ciphersuite */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2650 | for (size_t i = 0; ciphersuite_list[i] != 0; i++) { |
| 2651 | if (ciphersuite_list[i] == cipher_suite) { |
| 2652 | return 1; |
XiaokangQian | 0a1b54e | 2022-04-21 03:01:38 +0000 | [diff] [blame] | 2653 | } |
| 2654 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2655 | return 0; |
XiaokangQian | 0a1b54e | 2022-04-21 03:01:38 +0000 | [diff] [blame] | 2656 | } |
| 2657 | |
| 2658 | /** |
| 2659 | * \brief Validate cipher suite against config in SSL context. |
| 2660 | * |
| 2661 | * \param ssl SSL context |
| 2662 | * \param suite_info Cipher suite to validate |
| 2663 | * \param min_tls_version Minimal TLS version to accept a cipher suite |
| 2664 | * \param max_tls_version Maximal TLS version to accept a cipher suite |
| 2665 | * |
| 2666 | * \return 0 if valid, negative value otherwise. |
| 2667 | */ |
Manuel Pégourié-Gonnard | a82a8b9 | 2022-06-17 10:53:58 +0200 | [diff] [blame] | 2668 | MBEDTLS_CHECK_RETURN_CRITICAL |
XiaokangQian | 0a1b54e | 2022-04-21 03:01:38 +0000 | [diff] [blame] | 2669 | int mbedtls_ssl_validate_ciphersuite( |
| 2670 | const mbedtls_ssl_context *ssl, |
| 2671 | const mbedtls_ssl_ciphersuite_t *suite_info, |
| 2672 | mbedtls_ssl_protocol_version min_tls_version, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2673 | mbedtls_ssl_protocol_version max_tls_version); |
XiaokangQian | 0803755 | 2022-04-20 07:16:41 +0000 | [diff] [blame] | 2674 | |
XiaokangQian | 40a3523 | 2022-05-07 09:02:40 +0000 | [diff] [blame] | 2675 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
Ronald Cron | ce7d76e | 2022-07-08 18:56:49 +0200 | [diff] [blame] | 2676 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2677 | int mbedtls_ssl_parse_server_name_ext(mbedtls_ssl_context *ssl, |
| 2678 | const unsigned char *buf, |
| 2679 | const unsigned char *end); |
XiaokangQian | 40a3523 | 2022-05-07 09:02:40 +0000 | [diff] [blame] | 2680 | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
| 2681 | |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 2682 | #if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT) |
Jan Bruckner | a0589e7 | 2023-03-15 11:04:45 +0100 | [diff] [blame] | 2683 | #define MBEDTLS_SSL_RECORD_SIZE_LIMIT_EXTENSION_DATA_LENGTH (2) |
Waleed Elmelegy | f0ccf46 | 2024-01-12 10:52:45 +0000 | [diff] [blame] | 2684 | #define MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN (64) /* As defined in RFC 8449 */ |
Jan Bruckner | a0589e7 | 2023-03-15 11:04:45 +0100 | [diff] [blame] | 2685 | |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 2686 | MBEDTLS_CHECK_RETURN_CRITICAL |
| 2687 | int mbedtls_ssl_tls13_parse_record_size_limit_ext(mbedtls_ssl_context *ssl, |
| 2688 | const unsigned char *buf, |
| 2689 | const unsigned char *end); |
Yanray Wang | a8b4291 | 2023-11-08 11:10:47 +0800 | [diff] [blame] | 2690 | |
| 2691 | MBEDTLS_CHECK_RETURN_CRITICAL |
| 2692 | int mbedtls_ssl_tls13_write_record_size_limit_ext(mbedtls_ssl_context *ssl, |
Yanray Wang | a8b4291 | 2023-11-08 11:10:47 +0800 | [diff] [blame] | 2693 | unsigned char *buf, |
| 2694 | const unsigned char *end, |
| 2695 | size_t *out_len); |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 2696 | #endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */ |
| 2697 | |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 2698 | #if defined(MBEDTLS_SSL_ALPN) |
Ronald Cron | ce7d76e | 2022-07-08 18:56:49 +0200 | [diff] [blame] | 2699 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2700 | int mbedtls_ssl_parse_alpn_ext(mbedtls_ssl_context *ssl, |
| 2701 | const unsigned char *buf, |
| 2702 | const unsigned char *end); |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 2703 | |
| 2704 | |
Ronald Cron | ce7d76e | 2022-07-08 18:56:49 +0200 | [diff] [blame] | 2705 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2706 | int mbedtls_ssl_write_alpn_ext(mbedtls_ssl_context *ssl, |
| 2707 | unsigned char *buf, |
| 2708 | unsigned char *end, |
| 2709 | size_t *out_len); |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 2710 | #endif /* MBEDTLS_SSL_ALPN */ |
| 2711 | |
Andrzej Kurek | cfb0194 | 2022-06-06 13:08:23 -0400 | [diff] [blame] | 2712 | #if defined(MBEDTLS_TEST_HOOKS) |
Andrzej Kurek | 078e9bc | 2022-06-08 11:47:33 -0400 | [diff] [blame] | 2713 | int mbedtls_ssl_check_dtls_clihlo_cookie( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2714 | mbedtls_ssl_context *ssl, |
| 2715 | const unsigned char *cli_id, size_t cli_id_len, |
| 2716 | const unsigned char *in, size_t in_len, |
| 2717 | unsigned char *obuf, size_t buf_len, size_t *olen); |
Andrzej Kurek | cfb0194 | 2022-06-06 13:08:23 -0400 | [diff] [blame] | 2718 | #endif |
| 2719 | |
Ronald Cron | 41a443a | 2022-10-04 16:38:25 +0200 | [diff] [blame] | 2720 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED) |
XiaokangQian | eb69aee | 2022-07-05 08:21:43 +0000 | [diff] [blame] | 2721 | /** |
| 2722 | * \brief Given an SSL context and its associated configuration, write the TLS |
| 2723 | * 1.3 specific Pre-Shared key extension. |
| 2724 | * |
| 2725 | * \param[in] ssl SSL context |
| 2726 | * \param[in] buf Base address of the buffer where to write the extension |
| 2727 | * \param[in] end End address of the buffer where to write the extension |
XiaokangQian | 008d2bf | 2022-07-14 07:54:01 +0000 | [diff] [blame] | 2728 | * \param[out] out_len Length in bytes of the Pre-Shared key extension: data |
| 2729 | * written into the buffer \p buf by this function plus |
| 2730 | * the length of the binders to be written. |
XiaokangQian | eb69aee | 2022-07-05 08:21:43 +0000 | [diff] [blame] | 2731 | * \param[out] binders_len Length of the binders to be written at the end of |
XiaokangQian | 008d2bf | 2022-07-14 07:54:01 +0000 | [diff] [blame] | 2732 | * the extension. |
XiaokangQian | eb69aee | 2022-07-05 08:21:43 +0000 | [diff] [blame] | 2733 | */ |
XiaokangQian | 8698195 | 2022-07-19 09:51:50 +0000 | [diff] [blame] | 2734 | MBEDTLS_CHECK_RETURN_CRITICAL |
XiaokangQian | 3ad67bf | 2022-07-21 02:26:21 +0000 | [diff] [blame] | 2735 | int mbedtls_ssl_tls13_write_identities_of_pre_shared_key_ext( |
XiaokangQian | eb69aee | 2022-07-05 08:21:43 +0000 | [diff] [blame] | 2736 | mbedtls_ssl_context *ssl, |
| 2737 | unsigned char *buf, unsigned char *end, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2738 | size_t *out_len, size_t *binders_len); |
XiaokangQian | eb69aee | 2022-07-05 08:21:43 +0000 | [diff] [blame] | 2739 | |
| 2740 | /** |
| 2741 | * \brief Given an SSL context and its associated configuration, write the TLS |
| 2742 | * 1.3 specific Pre-Shared key extension binders at the end of the |
| 2743 | * ClientHello. |
| 2744 | * |
| 2745 | * \param[in] ssl SSL context |
XiaokangQian | 008d2bf | 2022-07-14 07:54:01 +0000 | [diff] [blame] | 2746 | * \param[in] buf Base address of the buffer where to write the binders |
| 2747 | * \param[in] end End address of the buffer where to write the binders |
XiaokangQian | eb69aee | 2022-07-05 08:21:43 +0000 | [diff] [blame] | 2748 | */ |
XiaokangQian | 8698195 | 2022-07-19 09:51:50 +0000 | [diff] [blame] | 2749 | MBEDTLS_CHECK_RETURN_CRITICAL |
| 2750 | int mbedtls_ssl_tls13_write_binders_of_pre_shared_key_ext( |
XiaokangQian | eb69aee | 2022-07-05 08:21:43 +0000 | [diff] [blame] | 2751 | mbedtls_ssl_context *ssl, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2752 | unsigned char *buf, unsigned char *end); |
Ronald Cron | 41a443a | 2022-10-04 16:38:25 +0200 | [diff] [blame] | 2753 | #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */ |
XiaokangQian | eb69aee | 2022-07-05 08:21:43 +0000 | [diff] [blame] | 2754 | |
Xiaokang Qian | a3b451f | 2022-10-11 06:20:56 +0000 | [diff] [blame] | 2755 | #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ |
Xiaokang Qian | 0340929 | 2022-10-12 02:49:52 +0000 | [diff] [blame] | 2756 | defined(MBEDTLS_SSL_SESSION_TICKETS) && \ |
Xiaokang Qian | ed0620c | 2022-10-12 06:58:13 +0000 | [diff] [blame] | 2757 | defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \ |
Xiaokang Qian | ed3afcd | 2022-10-12 08:31:11 +0000 | [diff] [blame] | 2758 | defined(MBEDTLS_SSL_CLI_C) |
Xiaokang Qian | 0340929 | 2022-10-12 02:49:52 +0000 | [diff] [blame] | 2759 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 2760 | int mbedtls_ssl_session_set_hostname(mbedtls_ssl_session *session, |
| 2761 | const char *hostname); |
Xiaokang Qian | a3b451f | 2022-10-11 06:20:56 +0000 | [diff] [blame] | 2762 | #endif |
| 2763 | |
Waleed Elmelegy | 883f77c | 2024-03-06 19:09:41 +0000 | [diff] [blame] | 2764 | #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_EARLY_DATA) && \ |
| 2765 | defined(MBEDTLS_SSL_ALPN) |
| 2766 | MBEDTLS_CHECK_RETURN_CRITICAL |
Waleed Elmelegy | 5bc5263 | 2024-03-12 16:25:08 +0000 | [diff] [blame] | 2767 | int mbedtls_ssl_session_set_ticket_alpn(mbedtls_ssl_session *session, |
| 2768 | const char *alpn); |
Waleed Elmelegy | 883f77c | 2024-03-06 19:09:41 +0000 | [diff] [blame] | 2769 | #endif |
| 2770 | |
Pengyu Lv | b7d50ac | 2022-11-17 15:14:12 +0800 | [diff] [blame] | 2771 | #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS) |
Jerry Yu | 46c7926 | 2023-11-10 13:58:16 +0800 | [diff] [blame] | 2772 | |
Jerry Yu | 8e0174a | 2023-11-10 13:58:16 +0800 | [diff] [blame] | 2773 | #define MBEDTLS_SSL_TLS1_3_MAX_ALLOWED_TICKET_LIFETIME (604800) |
| 2774 | |
Pengyu Lv | 94a42cc | 2023-12-06 10:04:17 +0800 | [diff] [blame] | 2775 | static inline unsigned int mbedtls_ssl_tls13_session_get_ticket_flags( |
Pengyu Lv | acecf9c | 2023-01-16 11:23:24 +0800 | [diff] [blame] | 2776 | mbedtls_ssl_session *session, unsigned int flags) |
Pengyu Lv | b7d50ac | 2022-11-17 15:14:12 +0800 | [diff] [blame] | 2777 | { |
| 2778 | return session->ticket_flags & |
| 2779 | (flags & MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK); |
| 2780 | } |
| 2781 | |
Pengyu Lv | 4f537f7 | 2023-11-13 18:07:22 +0800 | [diff] [blame] | 2782 | /** |
| 2783 | * Check if at least one of the given flags is set in |
| 2784 | * the session ticket. See the definition of |
| 2785 | * `MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK` to get all |
| 2786 | * permitted flags. |
| 2787 | */ |
Pengyu Lv | 94a42cc | 2023-12-06 10:04:17 +0800 | [diff] [blame] | 2788 | static inline int mbedtls_ssl_tls13_session_ticket_has_flags( |
Pengyu Lv | 7b71171 | 2023-10-24 17:07:14 +0800 | [diff] [blame] | 2789 | mbedtls_ssl_session *session, unsigned int flags) |
| 2790 | { |
Pengyu Lv | 94a42cc | 2023-12-06 10:04:17 +0800 | [diff] [blame] | 2791 | return mbedtls_ssl_tls13_session_get_ticket_flags(session, flags) != 0; |
Pengyu Lv | 7b71171 | 2023-10-24 17:07:14 +0800 | [diff] [blame] | 2792 | } |
| 2793 | |
Pengyu Lv | 94a42cc | 2023-12-06 10:04:17 +0800 | [diff] [blame] | 2794 | static inline int mbedtls_ssl_tls13_session_ticket_allow_psk( |
Pengyu Lv | dbd1e0d | 2023-10-31 10:08:10 +0800 | [diff] [blame] | 2795 | mbedtls_ssl_session *session) |
| 2796 | { |
Pengyu Lv | 94a42cc | 2023-12-06 10:04:17 +0800 | [diff] [blame] | 2797 | return mbedtls_ssl_tls13_session_ticket_has_flags( |
| 2798 | session, MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_RESUMPTION); |
Pengyu Lv | dbd1e0d | 2023-10-31 10:08:10 +0800 | [diff] [blame] | 2799 | } |
| 2800 | |
Pengyu Lv | 94a42cc | 2023-12-06 10:04:17 +0800 | [diff] [blame] | 2801 | static inline int mbedtls_ssl_tls13_session_ticket_allow_psk_ephemeral( |
Pengyu Lv | dbd1e0d | 2023-10-31 10:08:10 +0800 | [diff] [blame] | 2802 | mbedtls_ssl_session *session) |
| 2803 | { |
Pengyu Lv | 94a42cc | 2023-12-06 10:04:17 +0800 | [diff] [blame] | 2804 | return mbedtls_ssl_tls13_session_ticket_has_flags( |
| 2805 | session, MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_EPHEMERAL_RESUMPTION); |
Pengyu Lv | dbd1e0d | 2023-10-31 10:08:10 +0800 | [diff] [blame] | 2806 | } |
| 2807 | |
Pengyu Lv | 94a42cc | 2023-12-06 10:04:17 +0800 | [diff] [blame] | 2808 | static inline unsigned int mbedtls_ssl_tls13_session_ticket_allow_early_data( |
Jerry Yu | 4da7c22 | 2023-11-21 17:30:43 +0800 | [diff] [blame] | 2809 | mbedtls_ssl_session *session) |
| 2810 | { |
Pengyu Lv | 94a42cc | 2023-12-06 10:04:17 +0800 | [diff] [blame] | 2811 | return mbedtls_ssl_tls13_session_ticket_has_flags( |
| 2812 | session, MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA); |
Jerry Yu | 4da7c22 | 2023-11-21 17:30:43 +0800 | [diff] [blame] | 2813 | } |
| 2814 | |
Pengyu Lv | 94a42cc | 2023-12-06 10:04:17 +0800 | [diff] [blame] | 2815 | static inline void mbedtls_ssl_tls13_session_set_ticket_flags( |
Pengyu Lv | acecf9c | 2023-01-16 11:23:24 +0800 | [diff] [blame] | 2816 | mbedtls_ssl_session *session, unsigned int flags) |
Pengyu Lv | b7d50ac | 2022-11-17 15:14:12 +0800 | [diff] [blame] | 2817 | { |
| 2818 | session->ticket_flags |= (flags & MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK); |
| 2819 | } |
| 2820 | |
Pengyu Lv | 94a42cc | 2023-12-06 10:04:17 +0800 | [diff] [blame] | 2821 | static inline void mbedtls_ssl_tls13_session_clear_ticket_flags( |
Pengyu Lv | acecf9c | 2023-01-16 11:23:24 +0800 | [diff] [blame] | 2822 | mbedtls_ssl_session *session, unsigned int flags) |
Pengyu Lv | b7d50ac | 2022-11-17 15:14:12 +0800 | [diff] [blame] | 2823 | { |
| 2824 | session->ticket_flags &= ~(flags & MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK); |
| 2825 | } |
Pengyu Lv | a1aa31b | 2022-12-13 13:49:59 +0800 | [diff] [blame] | 2826 | #endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_SSL_SESSION_TICKETS */ |
Pengyu Lv | b7d50ac | 2022-11-17 15:14:12 +0800 | [diff] [blame] | 2827 | |
Xiaokang Qian | b46275c | 2023-01-04 07:38:50 +0000 | [diff] [blame] | 2828 | #if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3) |
Xiaokang Qian | 934ce6f | 2023-02-06 10:23:04 +0000 | [diff] [blame] | 2829 | int mbedtls_ssl_tls13_finalize_client_hello(mbedtls_ssl_context *ssl); |
Xiaokang Qian | b46275c | 2023-01-04 07:38:50 +0000 | [diff] [blame] | 2830 | #endif |
Xiaokang Qian | 126929f | 2023-01-03 10:29:41 +0000 | [diff] [blame] | 2831 | |
Dave Rodgman | 2801f7f | 2023-05-09 11:00:07 +0100 | [diff] [blame] | 2832 | #if defined(MBEDTLS_TEST_HOOKS) && defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) |
| 2833 | |
| 2834 | /** Compute the HMAC of variable-length data with constant flow. |
| 2835 | * |
| 2836 | * This function computes the HMAC of the concatenation of \p add_data and \p |
| 2837 | * data, and does with a code flow and memory access pattern that does not |
| 2838 | * depend on \p data_len_secret, but only on \p min_data_len and \p |
| 2839 | * max_data_len. In particular, this function always reads exactly \p |
| 2840 | * max_data_len bytes from \p data. |
| 2841 | * |
Manuel Pégourié-Gonnard | 53fe26c | 2025-01-24 09:38:29 +0100 | [diff] [blame] | 2842 | * \param key The HMAC key. |
| 2843 | * \param mac_alg The hash algorithm. |
| 2844 | * Must be one of SHA-384, SHA-256, SHA-1 or MD-5. |
Dave Rodgman | 2801f7f | 2023-05-09 11:00:07 +0100 | [diff] [blame] | 2845 | * \param add_data The first part of the message whose HMAC is being |
| 2846 | * calculated. This must point to a readable buffer |
| 2847 | * of \p add_data_len bytes. |
| 2848 | * \param add_data_len The length of \p add_data in bytes. |
| 2849 | * \param data The buffer containing the second part of the |
| 2850 | * message. This must point to a readable buffer |
| 2851 | * of \p max_data_len bytes. |
| 2852 | * \param data_len_secret The length of the data to process in \p data. |
| 2853 | * This must be no less than \p min_data_len and no |
| 2854 | * greater than \p max_data_len. |
| 2855 | * \param min_data_len The minimal length of the second part of the |
| 2856 | * message, read from \p data. |
| 2857 | * \param max_data_len The maximal length of the second part of the |
| 2858 | * message, read from \p data. |
| 2859 | * \param output The HMAC will be written here. This must point to |
| 2860 | * a writable buffer of sufficient size to hold the |
| 2861 | * HMAC value. |
| 2862 | * |
| 2863 | * \retval 0 on success. |
| 2864 | * \retval #MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED |
| 2865 | * The hardware accelerator failed. |
| 2866 | */ |
Dave Rodgman | 2801f7f | 2023-05-09 11:00:07 +0100 | [diff] [blame] | 2867 | int mbedtls_ct_hmac(mbedtls_svc_key_id_t key, |
| 2868 | psa_algorithm_t mac_alg, |
| 2869 | const unsigned char *add_data, |
| 2870 | size_t add_data_len, |
| 2871 | const unsigned char *data, |
| 2872 | size_t data_len_secret, |
| 2873 | size_t min_data_len, |
| 2874 | size_t max_data_len, |
| 2875 | unsigned char *output); |
Dave Rodgman | 2801f7f | 2023-05-09 11:00:07 +0100 | [diff] [blame] | 2876 | #endif /* MBEDTLS_TEST_HOOKS && defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) */ |
| 2877 | |
Chris Jones | 84a773f | 2021-03-05 18:38:47 +0000 | [diff] [blame] | 2878 | #endif /* ssl_misc.h */ |