blob: ea2d8afeb4430e01eb2e9c0de512e3aefe55726a [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002 * TLS shared functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000018 */
19/*
Paul Bakker5121ce52009-01-03 21:22:43 +000020 * http://www.ietf.org/rfc/rfc2246.txt
21 * http://www.ietf.org/rfc/rfc4346.txt
22 */
23
Gilles Peskinedb09ef62020-06-03 01:43:33 +020024#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Jerry Yub476a442022-01-21 18:14:45 +080028#include <assert.h>
29
SimonBd5800b72016-04-26 07:43:27 +010030#if defined(MBEDTLS_PLATFORM_C)
31#include "mbedtls/platform.h"
32#else
33#include <stdlib.h>
Jerry Yu6ade7432022-01-25 10:39:33 +080034#include <stdio.h>
SimonBd5800b72016-04-26 07:43:27 +010035#define mbedtls_calloc calloc
36#define mbedtls_free free
Jerry Yu6ade7432022-01-25 10:39:33 +080037#define mbedtls_printf printf
38#endif /* !MBEDTLS_PLATFORM_C */
SimonBd5800b72016-04-26 07:43:27 +010039
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000040#include "mbedtls/ssl.h"
Ronald Cron9f0fba32022-02-10 16:45:15 +010041#include "ssl_client.h"
Ronald Cron27c85e72022-03-08 11:37:55 +010042#include "ssl_debug_helpers.h"
Chris Jones84a773f2021-03-05 18:38:47 +000043#include "ssl_misc.h"
Janos Follath73c616b2019-12-18 15:07:04 +000044#include "mbedtls/debug.h"
45#include "mbedtls/error.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050046#include "mbedtls/platform_util.h"
Hanno Beckera835da52019-05-16 12:39:07 +010047#include "mbedtls/version.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020048#include "mbedtls/constant_time.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020049
Rich Evans00ab4702015-02-06 13:43:58 +000050#include <string.h>
51
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050052#if defined(MBEDTLS_USE_PSA_CRYPTO)
53#include "mbedtls/psa_util.h"
54#include "psa/crypto.h"
55#endif
56
Janos Follath23bdca02016-10-07 14:47:14 +010057#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000058#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020059#endif
60
Ronald Cronad8c17b2022-06-10 17:18:09 +020061#if defined(MBEDTLS_TEST_HOOKS)
62static mbedtls_ssl_chk_buf_ptr_args chk_buf_ptr_fail_args;
63
64void mbedtls_ssl_set_chk_buf_ptr_fail_args(
65 const uint8_t *cur, const uint8_t *end, size_t need )
66{
67 chk_buf_ptr_fail_args.cur = cur;
68 chk_buf_ptr_fail_args.end = end;
69 chk_buf_ptr_fail_args.need = need;
70}
71
72void mbedtls_ssl_reset_chk_buf_ptr_fail_args( void )
73{
74 memset( &chk_buf_ptr_fail_args, 0, sizeof( chk_buf_ptr_fail_args ) );
75}
76
77int mbedtls_ssl_cmp_chk_buf_ptr_fail_args( mbedtls_ssl_chk_buf_ptr_args *args )
78{
79 return( ( chk_buf_ptr_fail_args.cur != args->cur ) ||
80 ( chk_buf_ptr_fail_args.end != args->end ) ||
81 ( chk_buf_ptr_fail_args.need != args->need ) );
82}
83#endif /* MBEDTLS_TEST_HOOKS */
84
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020085#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +010086
Hanno Beckera0e20d02019-05-15 14:03:01 +010087#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerf8542cf2019-04-09 15:22:03 +010088/* Top-level Connection ID API */
89
Hanno Becker8367ccc2019-05-14 11:30:10 +010090int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
91 size_t len,
92 int ignore_other_cid )
Hanno Beckerad4a1372019-05-03 13:06:44 +010093{
94 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
95 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
96
Hanno Becker611ac772019-05-14 11:45:26 +010097 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
98 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
99 {
100 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
101 }
102
103 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckerad4a1372019-05-03 13:06:44 +0100104 conf->cid_len = len;
105 return( 0 );
106}
107
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100108int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
109 int enable,
110 unsigned char const *own_cid,
111 size_t own_cid_len )
112{
Hanno Becker76a79ab2019-05-03 14:38:32 +0100113 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
114 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
115
Hanno Beckerca092242019-04-25 16:01:49 +0100116 ssl->negotiate_cid = enable;
117 if( enable == MBEDTLS_SSL_CID_DISABLED )
118 {
119 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
120 return( 0 );
121 }
122 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckerad4a1372019-05-03 13:06:44 +0100123 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Beckerca092242019-04-25 16:01:49 +0100124
Hanno Beckerad4a1372019-05-03 13:06:44 +0100125 if( own_cid_len != ssl->conf->cid_len )
Hanno Beckerca092242019-04-25 16:01:49 +0100126 {
Hanno Beckerad4a1372019-05-03 13:06:44 +0100127 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
128 (unsigned) own_cid_len,
129 (unsigned) ssl->conf->cid_len ) );
Hanno Beckerca092242019-04-25 16:01:49 +0100130 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
131 }
132
133 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb7ee0cf2019-04-30 14:07:31 +0100134 /* Truncation is not an issue here because
135 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
136 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Beckerca092242019-04-25 16:01:49 +0100137
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100138 return( 0 );
139}
140
Paul Elliott0113cf12022-03-11 20:26:47 +0000141int mbedtls_ssl_get_own_cid( mbedtls_ssl_context *ssl,
142 int *enabled,
143 unsigned char own_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],
144 size_t *own_cid_len )
145{
146 *enabled = MBEDTLS_SSL_CID_DISABLED;
147
148 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
149 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
150
151 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID length is
152 * zero as this is indistinguishable from not requesting to use
153 * the CID extension. */
154 if( ssl->own_cid_len == 0 || ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
155 return( 0 );
156
157 if( own_cid_len != NULL )
158 {
159 *own_cid_len = ssl->own_cid_len;
160 if( own_cid != NULL )
161 memcpy( own_cid, ssl->own_cid, ssl->own_cid_len );
162 }
163
164 *enabled = MBEDTLS_SSL_CID_ENABLED;
165
166 return( 0 );
167}
168
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100169int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
170 int *enabled,
171 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
172 size_t *peer_cid_len )
173{
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100174 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100175
Hanno Becker76a79ab2019-05-03 14:38:32 +0100176 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
Paul Elliott27b0d942022-03-18 21:55:32 +0000177 mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Hanno Becker76a79ab2019-05-03 14:38:32 +0100178 {
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100179 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker76a79ab2019-05-03 14:38:32 +0100180 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100181
Hanno Beckerc5f24222019-05-03 12:54:52 +0100182 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
183 * were used, but client and server requested the empty CID.
184 * This is indistinguishable from not using the CID extension
185 * in the first place. */
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100186 if( ssl->transform_in->in_cid_len == 0 &&
187 ssl->transform_in->out_cid_len == 0 )
188 {
189 return( 0 );
190 }
191
Hanno Becker615ef172019-05-22 16:50:35 +0100192 if( peer_cid_len != NULL )
193 {
194 *peer_cid_len = ssl->transform_in->out_cid_len;
195 if( peer_cid != NULL )
196 {
197 memcpy( peer_cid, ssl->transform_in->out_cid,
198 ssl->transform_in->out_cid_len );
199 }
200 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100201
202 *enabled = MBEDTLS_SSL_CID_ENABLED;
203
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100204 return( 0 );
205}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100206#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100207
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200208#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200209
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200210#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200211/*
212 * Convert max_fragment_length codes to length.
213 * RFC 6066 says:
214 * enum{
215 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
216 * } MaxFragmentLength;
217 * and we add 0 -> extension unused
218 */
Angus Grattond8213d02016-05-25 20:56:48 +1000219static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200220{
Angus Grattond8213d02016-05-25 20:56:48 +1000221 switch( mfl )
222 {
223 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
224 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
225 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
226 return 512;
227 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
228 return 1024;
229 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
230 return 2048;
231 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
232 return 4096;
233 default:
234 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
235 }
236}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200237#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200238
Hanno Becker52055ae2019-02-06 14:30:46 +0000239int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
240 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200241{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200242 mbedtls_ssl_session_free( dst );
243 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200244
吴敬辉0b716112021-11-29 10:46:35 +0800245#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
246 dst->ticket = NULL;
247#endif
248
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200249#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker6d1986e2019-02-07 12:27:42 +0000250
251#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200252 if( src->peer_cert != NULL )
253 {
Janos Follath865b3eb2019-12-16 11:46:15 +0000254 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker2292d1f2013-09-15 17:06:49 +0200255
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200256 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200257 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200258 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200259
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200260 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200261
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200262 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200263 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200264 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200265 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200266 dst->peer_cert = NULL;
267 return( ret );
268 }
269 }
Hanno Becker6d1986e2019-02-07 12:27:42 +0000270#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Hanno Becker9198ad12019-02-05 17:00:50 +0000271 if( src->peer_cert_digest != NULL )
272 {
Hanno Becker9198ad12019-02-05 17:00:50 +0000273 dst->peer_cert_digest =
Hanno Beckeraccc5992019-02-25 10:06:59 +0000274 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9198ad12019-02-05 17:00:50 +0000275 if( dst->peer_cert_digest == NULL )
276 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
277
278 memcpy( dst->peer_cert_digest, src->peer_cert_digest,
279 src->peer_cert_digest_len );
280 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Beckeraccc5992019-02-25 10:06:59 +0000281 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9198ad12019-02-05 17:00:50 +0000282 }
283#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
284
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200285#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200286
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200287#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200288 if( src->ticket != NULL )
289 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200290 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200291 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200292 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200293
294 memcpy( dst->ticket, src->ticket, src->ticket_len );
295 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200296#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200297
298 return( 0 );
299}
300
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500301#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200302MBEDTLS_CHECK_RETURN_CRITICAL
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500303static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old )
304{
305 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new );
306 if( resized_buffer == NULL )
307 return -1;
308
309 /* We want to copy len_new bytes when downsizing the buffer, and
310 * len_old bytes when upsizing, so we choose the smaller of two sizes,
311 * to fit one buffer into another. Size checks, ensuring that no data is
312 * lost, are done outside of this function. */
313 memcpy( resized_buffer, *buffer,
314 ( len_new < *len_old ) ? len_new : *len_old );
315 mbedtls_platform_zeroize( *buffer, *len_old );
316 mbedtls_free( *buffer );
317
318 *buffer = resized_buffer;
319 *len_old = len_new;
320
321 return 0;
322}
Andrzej Kurek4a063792020-10-21 15:08:44 +0200323
324static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing,
Andrzej Kurek069fa962021-01-07 08:02:15 -0500325 size_t in_buf_new_len,
326 size_t out_buf_new_len )
Andrzej Kurek4a063792020-10-21 15:08:44 +0200327{
328 int modified = 0;
329 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
330 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
331 if( ssl->in_buf != NULL )
332 {
333 written_in = ssl->in_msg - ssl->in_buf;
334 iv_offset_in = ssl->in_iv - ssl->in_buf;
335 len_offset_in = ssl->in_len - ssl->in_buf;
336 if( downsizing ?
337 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
338 ssl->in_buf_len < in_buf_new_len )
339 {
340 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 )
341 {
342 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) );
343 }
344 else
345 {
Paul Elliottb7449902021-03-10 18:14:58 +0000346 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
347 in_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200348 modified = 1;
349 }
350 }
351 }
352
353 if( ssl->out_buf != NULL )
354 {
355 written_out = ssl->out_msg - ssl->out_buf;
356 iv_offset_out = ssl->out_iv - ssl->out_buf;
357 len_offset_out = ssl->out_len - ssl->out_buf;
358 if( downsizing ?
359 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
360 ssl->out_buf_len < out_buf_new_len )
361 {
362 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 )
363 {
364 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) );
365 }
366 else
367 {
Paul Elliottb7449902021-03-10 18:14:58 +0000368 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
369 out_buf_new_len ) );
Andrzej Kurek4a063792020-10-21 15:08:44 +0200370 modified = 1;
371 }
372 }
373 }
374 if( modified )
375 {
376 /* Update pointers here to avoid doing it twice. */
377 mbedtls_ssl_reset_in_out_pointers( ssl );
378 /* Fields below might not be properly updated with record
379 * splitting or with CID, so they are manually updated here. */
380 ssl->out_msg = ssl->out_buf + written_out;
381 ssl->out_len = ssl->out_buf + len_offset_out;
382 ssl->out_iv = ssl->out_buf + iv_offset_out;
383
384 ssl->in_msg = ssl->in_buf + written_in;
385 ssl->in_len = ssl->in_buf + len_offset_in;
386 ssl->in_iv = ssl->in_buf + iv_offset_in;
387 }
388}
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500389#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
390
Jerry Yudb8c48a2022-01-27 14:54:54 +0800391#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yued14c932022-02-17 13:40:45 +0800392
393#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
394typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen,
395 const char *label,
396 const unsigned char *random, size_t rlen,
397 unsigned char *dstbuf, size_t dlen );
398
399static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id );
400
401#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
402
403/* Type for the TLS PRF */
404typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
405 const unsigned char *, size_t,
406 unsigned char *, size_t);
407
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200408MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800409static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
410 int ciphersuite,
411 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200412#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yued14c932022-02-17 13:40:45 +0800413 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200414#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Jerry Yued14c932022-02-17 13:40:45 +0800415 ssl_tls_prf_t tls_prf,
416 const unsigned char randbytes[64],
Glenn Strauss07c64162022-03-14 12:34:51 -0400417 mbedtls_ssl_protocol_version tls_version,
Jerry Yued14c932022-02-17 13:40:45 +0800418 unsigned endpoint,
419 const mbedtls_ssl_context *ssl );
420
421#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200422MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800423static int tls_prf_sha256( const unsigned char *secret, size_t slen,
424 const char *label,
425 const unsigned char *random, size_t rlen,
426 unsigned char *dstbuf, size_t dlen );
427static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
428static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
429
430#endif /* MBEDTLS_SHA256_C */
431
432#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200433MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yued14c932022-02-17 13:40:45 +0800434static int tls_prf_sha384( const unsigned char *secret, size_t slen,
435 const char *label,
436 const unsigned char *random, size_t rlen,
437 unsigned char *dstbuf, size_t dlen );
438
439static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
440static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
441#endif /* MBEDTLS_SHA384_C */
442
Jerry Yu438ddd82022-07-07 06:55:50 +0000443static size_t ssl_tls12_session_save( const mbedtls_ssl_session *session,
Jerry Yued14c932022-02-17 13:40:45 +0800444 unsigned char *buf,
445 size_t buf_len );
Jerry Yu251a12e2022-07-13 15:15:48 +0800446
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200447MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu438ddd82022-07-07 06:55:50 +0000448static int ssl_tls12_session_load( mbedtls_ssl_session *session,
Jerry Yued14c932022-02-17 13:40:45 +0800449 const unsigned char *buf,
450 size_t len );
451#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
452
Jerry Yu53d23e22022-02-09 16:25:09 +0800453static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
454
Jerry Yudb8c48a2022-01-27 14:54:54 +0800455#if defined(MBEDTLS_SHA256_C)
456static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
Jerry Yu53d23e22022-02-09 16:25:09 +0800457#endif /* MBEDTLS_SHA256_C */
Jerry Yudb8c48a2022-01-27 14:54:54 +0800458
459#if defined(MBEDTLS_SHA384_C)
460static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
Jerry Yu53d23e22022-02-09 16:25:09 +0800461#endif /* MBEDTLS_SHA384_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000462
Ron Eldor51d3ab52019-05-12 14:54:30 +0300463int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
464 const unsigned char *secret, size_t slen,
465 const char *label,
466 const unsigned char *random, size_t rlen,
467 unsigned char *dstbuf, size_t dlen )
468{
469 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
470
471 switch( prf )
472 {
Ron Eldord2f25f72019-05-15 14:54:22 +0300473#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200474#if defined(MBEDTLS_SHA384_C)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300475 case MBEDTLS_SSL_TLS_PRF_SHA384:
476 tls_prf = tls_prf_sha384;
477 break;
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200478#endif /* MBEDTLS_SHA384_C */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300479#if defined(MBEDTLS_SHA256_C)
480 case MBEDTLS_SSL_TLS_PRF_SHA256:
481 tls_prf = tls_prf_sha256;
482 break;
Ron Eldord2f25f72019-05-15 14:54:22 +0300483#endif /* MBEDTLS_SHA256_C */
484#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ron Eldor51d3ab52019-05-12 14:54:30 +0300485 default:
486 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
487 }
488
489 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
490}
491
Jerry Yuc73c6182022-02-08 20:29:25 +0800492#if defined(MBEDTLS_X509_CRT_PARSE_C)
493static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
494{
495#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
496 if( session->peer_cert != NULL )
497 {
498 mbedtls_x509_crt_free( session->peer_cert );
499 mbedtls_free( session->peer_cert );
500 session->peer_cert = NULL;
501 }
502#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
503 if( session->peer_cert_digest != NULL )
504 {
505 /* Zeroization is not necessary. */
506 mbedtls_free( session->peer_cert_digest );
507 session->peer_cert_digest = NULL;
508 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
509 session->peer_cert_digest_len = 0;
510 }
511#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
512}
513#endif /* MBEDTLS_X509_CRT_PARSE_C */
514
515void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
516 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
517{
518 ((void) ciphersuite_info);
519
520#if defined(MBEDTLS_SHA384_C)
521 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
522 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
523 else
524#endif
525#if defined(MBEDTLS_SHA256_C)
526 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
527 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
528 else
529#endif
530 {
531 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
532 return;
533 }
534}
535
XiaokangQianadab9a62022-07-18 07:41:26 +0000536void mbedtls_ssl_add_hs_hdr_to_checksum( mbedtls_ssl_context *ssl,
537 unsigned hs_type,
538 size_t total_hs_len )
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100539{
540 unsigned char hs_hdr[4];
541
542 /* Build HS header for checksum update. */
543 hs_hdr[0] = MBEDTLS_BYTE_0( hs_type );
544 hs_hdr[1] = MBEDTLS_BYTE_2( total_hs_len );
545 hs_hdr[2] = MBEDTLS_BYTE_1( total_hs_len );
546 hs_hdr[3] = MBEDTLS_BYTE_0( total_hs_len );
547
548 ssl->handshake->update_checksum( ssl, hs_hdr, sizeof( hs_hdr ) );
549}
550
551void mbedtls_ssl_add_hs_msg_to_checksum( mbedtls_ssl_context *ssl,
552 unsigned hs_type,
553 unsigned char const *msg,
554 size_t msg_len )
555{
556 mbedtls_ssl_add_hs_hdr_to_checksum( ssl, hs_type, msg_len );
557 ssl->handshake->update_checksum( ssl, msg, msg_len );
558}
559
Jerry Yuc73c6182022-02-08 20:29:25 +0800560void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
561{
562 ((void) ssl);
563#if defined(MBEDTLS_SHA256_C)
564#if defined(MBEDTLS_USE_PSA_CRYPTO)
565 psa_hash_abort( &ssl->handshake->fin_sha256_psa );
566 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
567#else
568 mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 );
569#endif
570#endif
571#if defined(MBEDTLS_SHA384_C)
572#if defined(MBEDTLS_USE_PSA_CRYPTO)
573 psa_hash_abort( &ssl->handshake->fin_sha384_psa );
574 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
575#else
576 mbedtls_sha512_starts( &ssl->handshake->fin_sha512, 1 );
577#endif
578#endif
579}
580
581static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
582 const unsigned char *buf, size_t len )
583{
584#if defined(MBEDTLS_SHA256_C)
585#if defined(MBEDTLS_USE_PSA_CRYPTO)
586 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
587#else
588 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
589#endif
590#endif
591#if defined(MBEDTLS_SHA384_C)
592#if defined(MBEDTLS_USE_PSA_CRYPTO)
593 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
594#else
595 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
596#endif
597#endif
598}
599
600#if defined(MBEDTLS_SHA256_C)
601static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
602 const unsigned char *buf, size_t len )
603{
604#if defined(MBEDTLS_USE_PSA_CRYPTO)
605 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
606#else
607 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
608#endif
609}
610#endif
611
612#if defined(MBEDTLS_SHA384_C)
613static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
614 const unsigned char *buf, size_t len )
615{
616#if defined(MBEDTLS_USE_PSA_CRYPTO)
617 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
618#else
619 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
620#endif
621}
622#endif
623
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200624static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200625{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200626 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200627
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200628#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500629#if defined(MBEDTLS_USE_PSA_CRYPTO)
630 handshake->fin_sha256_psa = psa_hash_operation_init();
631 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
632#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200633 mbedtls_sha256_init( &handshake->fin_sha256 );
TRodziewicz26371e42021-06-08 16:45:41 +0200634 mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200635#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500636#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +0200637#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500638#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -0500639 handshake->fin_sha384_psa = psa_hash_operation_init();
640 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
Andrzej Kurekeb342242019-01-29 09:14:33 -0500641#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200642 mbedtls_sha512_init( &handshake->fin_sha512 );
TRodziewicz26371e42021-06-08 16:45:41 +0200643 mbedtls_sha512_starts( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200644#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500645#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200646
647 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100648
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200649#if defined(MBEDTLS_DHM_C)
650 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200651#endif
Neil Armstrongf3f46412022-04-12 14:43:39 +0200652#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200653 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200654#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +0200655#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200656 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +0200657#if defined(MBEDTLS_SSL_CLI_C)
658 handshake->ecjpake_cache = NULL;
659 handshake->ecjpake_cache_len = 0;
660#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200661#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200662
Gilles Peskineeccd8882020-03-10 12:19:08 +0100663#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +0200664 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +0200665#endif
666
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200667#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
668 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
669#endif
Hanno Becker75173122019-02-06 16:18:31 +0000670
671#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
672 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
673 mbedtls_pk_init( &handshake->peer_pubkey );
674#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200675}
676
Hanno Beckera18d1322018-01-03 14:27:32 +0000677void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200678{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200679 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Paul Bakker84bbeb52014-07-01 14:53:22 +0200680
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100681#if defined(MBEDTLS_USE_PSA_CRYPTO)
682 transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
683 transform->psa_key_dec = MBEDTLS_SVC_KEY_ID_INIT;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +0100684#else
685 mbedtls_cipher_init( &transform->cipher_ctx_enc );
686 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +0100687#endif
688
Hanno Beckerfd86ca82020-11-30 08:54:23 +0000689#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong39b8e7d2022-02-23 09:24:45 +0100690#if defined(MBEDTLS_USE_PSA_CRYPTO)
691 transform->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
692 transform->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100693#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200694 mbedtls_md_init( &transform->md_ctx_enc );
695 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Beckerd56ed242018-01-03 15:32:51 +0000696#endif
Neil Armstrongcf8841a2022-02-24 11:17:45 +0100697#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200698}
699
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200700void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200701{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200702 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200703}
704
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200705MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200706static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +0000707{
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200708 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +0000709 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200710 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200711 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200712 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200713 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +0200714 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200715
716 /*
717 * Either the pointers are now NULL or cleared properly and can be freed.
718 * Now allocate missing structures.
719 */
720 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200721 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200722 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200723 }
Paul Bakker48916f92012-09-16 19:57:18 +0000724
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200725 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200726 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200727 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200728 }
Paul Bakker48916f92012-09-16 19:57:18 +0000729
Paul Bakker82788fb2014-10-20 13:59:19 +0200730 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200731 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200732 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200733 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500734#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
735 /* If the buffers are too small - reallocate */
Andrzej Kurek8ea68722020-04-03 06:40:47 -0400736
Andrzej Kurek4a063792020-10-21 15:08:44 +0200737 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
738 MBEDTLS_SSL_OUT_BUFFER_LEN );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500739#endif
Paul Bakker48916f92012-09-16 19:57:18 +0000740
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200741 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +0000742 if( ssl->handshake == NULL ||
743 ssl->transform_negotiate == NULL ||
744 ssl->session_negotiate == NULL )
745 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +0200746 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200747
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200748 mbedtls_free( ssl->handshake );
749 mbedtls_free( ssl->transform_negotiate );
750 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200751
752 ssl->handshake = NULL;
753 ssl->transform_negotiate = NULL;
754 ssl->session_negotiate = NULL;
755
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200756 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +0000757 }
758
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200759 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200760 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Beckera18d1322018-01-03 14:27:32 +0000761 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +0200762 ssl_handshake_params_init( ssl->handshake );
763
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200764#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200765 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
766 {
767 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +0200768
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200769 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
770 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
771 else
772 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200773
Hanno Becker0f57a652020-02-05 10:37:26 +0000774 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +0200775 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +0200776#endif
777
Brett Warrene0edc842021-08-17 09:53:13 +0100778/*
779 * curve_list is translated to IANA TLS group identifiers here because
780 * mbedtls_ssl_conf_curves returns void and so can't return
781 * any error codes.
782 */
783#if defined(MBEDTLS_ECP_C)
784#if !defined(MBEDTLS_DEPRECATED_REMOVED)
785 /* Heap allocate and translate curve_list from internal to IANA group ids */
786 if ( ssl->conf->curve_list != NULL )
787 {
788 size_t length;
789 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
790
791 for( length = 0; ( curve_list[length] != MBEDTLS_ECP_DP_NONE ) &&
792 ( length < MBEDTLS_ECP_DP_MAX ); length++ ) {}
793
794 /* Leave room for zero termination */
795 uint16_t *group_list = mbedtls_calloc( length + 1, sizeof(uint16_t) );
796 if ( group_list == NULL )
797 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
798
799 for( size_t i = 0; i < length; i++ )
800 {
801 const mbedtls_ecp_curve_info *info =
802 mbedtls_ecp_curve_info_from_grp_id( curve_list[i] );
803 if ( info == NULL )
804 {
805 mbedtls_free( group_list );
806 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
807 }
808 group_list[i] = info->tls_id;
809 }
810
811 group_list[length] = 0;
812
813 ssl->handshake->group_list = group_list;
814 ssl->handshake->group_list_heap_allocated = 1;
815 }
816 else
817 {
818 ssl->handshake->group_list = ssl->conf->group_list;
819 ssl->handshake->group_list_heap_allocated = 0;
820 }
821#endif /* MBEDTLS_DEPRECATED_REMOVED */
822#endif /* MBEDTLS_ECP_C */
823
Jerry Yuf017ee42022-01-12 15:49:48 +0800824#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
825#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Jerry Yua69269a2022-01-17 21:06:01 +0800826#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu713013f2022-01-17 18:16:35 +0800827 /* Heap allocate and translate sig_hashes from internal hash identifiers to
828 signature algorithms IANA identifiers. */
829 if ( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) &&
Jerry Yuf017ee42022-01-12 15:49:48 +0800830 ssl->conf->sig_hashes != NULL )
831 {
832 const int *md;
833 const int *sig_hashes = ssl->conf->sig_hashes;
Jerry Yub476a442022-01-21 18:14:45 +0800834 size_t sig_algs_len = 0;
Jerry Yuf017ee42022-01-12 15:49:48 +0800835 uint16_t *p;
836
Jerry Yub476a442022-01-21 18:14:45 +0800837#if defined(static_assert)
838 static_assert( MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN
839 <= ( SIZE_MAX - ( 2 * sizeof(uint16_t) ) ),
840 "MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN too big" );
Jerry Yua68dca22022-01-20 16:28:27 +0800841#endif
842
Jerry Yuf017ee42022-01-12 15:49:48 +0800843 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
844 {
845 if( mbedtls_ssl_hash_from_md_alg( *md ) == MBEDTLS_SSL_HASH_NONE )
846 continue;
Jerry Yub476a442022-01-21 18:14:45 +0800847#if defined(MBEDTLS_ECDSA_C)
848 sig_algs_len += sizeof( uint16_t );
849#endif
Jerry Yua68dca22022-01-20 16:28:27 +0800850
Jerry Yub476a442022-01-21 18:14:45 +0800851#if defined(MBEDTLS_RSA_C)
852 sig_algs_len += sizeof( uint16_t );
853#endif
854 if( sig_algs_len > MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN )
855 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
Jerry Yuf017ee42022-01-12 15:49:48 +0800856 }
857
Jerry Yub476a442022-01-21 18:14:45 +0800858 if( sig_algs_len < MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN )
Jerry Yuf017ee42022-01-12 15:49:48 +0800859 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
860
Jerry Yub476a442022-01-21 18:14:45 +0800861 ssl->handshake->sig_algs = mbedtls_calloc( 1, sig_algs_len +
862 sizeof( uint16_t ));
Jerry Yuf017ee42022-01-12 15:49:48 +0800863 if( ssl->handshake->sig_algs == NULL )
864 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
865
866 p = (uint16_t *)ssl->handshake->sig_algs;
867 for( md = sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
868 {
869 unsigned char hash = mbedtls_ssl_hash_from_md_alg( *md );
870 if( hash == MBEDTLS_SSL_HASH_NONE )
871 continue;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800872#if defined(MBEDTLS_ECDSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +0800873 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA);
874 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800875#endif
876#if defined(MBEDTLS_RSA_C)
Jerry Yuf017ee42022-01-12 15:49:48 +0800877 *p = (( hash << 8 ) | MBEDTLS_SSL_SIG_RSA);
878 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +0800879#endif
Jerry Yuf017ee42022-01-12 15:49:48 +0800880 }
Gabor Mezei15b95a62022-05-09 16:37:58 +0200881 *p = MBEDTLS_TLS_SIG_NONE;
Jerry Yuf017ee42022-01-12 15:49:48 +0800882 ssl->handshake->sig_algs_heap_allocated = 1;
883 }
884 else
Jerry Yua69269a2022-01-17 21:06:01 +0800885#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yuf017ee42022-01-12 15:49:48 +0800886 {
Jerry Yuf017ee42022-01-12 15:49:48 +0800887 ssl->handshake->sig_algs_heap_allocated = 0;
888 }
Jerry Yucc539102022-06-27 16:27:35 +0800889#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Jerry Yuf017ee42022-01-12 15:49:48 +0800890#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +0000891 return( 0 );
892}
893
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +0200894#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200895/* Dummy cookie callbacks for defaults */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200896MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200897static int ssl_cookie_write_dummy( void *ctx,
898 unsigned char **p, unsigned char *end,
899 const unsigned char *cli_id, size_t cli_id_len )
900{
901 ((void) ctx);
902 ((void) p);
903 ((void) end);
904 ((void) cli_id);
905 ((void) cli_id_len);
906
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200907 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200908}
909
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200910MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200911static int ssl_cookie_check_dummy( void *ctx,
912 const unsigned char *cookie, size_t cookie_len,
913 const unsigned char *cli_id, size_t cli_id_len )
914{
915 ((void) ctx);
916 ((void) cookie);
917 ((void) cookie_len);
918 ((void) cli_id);
919 ((void) cli_id_len);
920
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200921 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200922}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +0200923#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +0200924
Paul Bakker5121ce52009-01-03 21:22:43 +0000925/*
926 * Initialize an SSL context
927 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +0200928void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
929{
930 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
931}
932
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200933MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu60835a82021-08-04 10:13:52 +0800934static int ssl_conf_version_check( const mbedtls_ssl_context *ssl )
935{
Ronald Cron086ee0b2022-03-15 15:18:51 +0100936 const mbedtls_ssl_config *conf = ssl->conf;
937
Ronald Cron6f135e12021-12-08 16:57:54 +0100938#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100939 if( mbedtls_ssl_conf_is_tls13_only( conf ) )
940 {
XiaokangQianed582dd2022-04-13 08:21:05 +0000941 if( conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
942 {
943 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS 1.3 is not yet supported." ) );
944 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
945 }
946
Jerry Yu60835a82021-08-04 10:13:52 +0800947 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls13 only." ) );
948 return( 0 );
949 }
950#endif
951
952#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100953 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
Jerry Yu60835a82021-08-04 10:13:52 +0800954 {
955 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is tls12 only." ) );
956 return( 0 );
957 }
958#endif
959
Ronald Cron6f135e12021-12-08 16:57:54 +0100960#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron086ee0b2022-03-15 15:18:51 +0100961 if( mbedtls_ssl_conf_is_hybrid_tls12_tls13( conf ) )
Jerry Yu60835a82021-08-04 10:13:52 +0800962 {
XiaokangQianed582dd2022-04-13 08:21:05 +0000963 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
964 {
965 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS not yet supported in Hybrid TLS 1.3 + TLS 1.2" ) );
966 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
967 }
968
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000969 if( conf->endpoint == MBEDTLS_SSL_IS_SERVER )
970 {
971 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS 1.3 server is not supported yet." ) );
972 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
973 }
974
975
Ronald Crone1d3f062022-02-10 14:50:54 +0100976 MBEDTLS_SSL_DEBUG_MSG( 4, ( "The SSL configuration is TLS 1.3 or TLS 1.2." ) );
977 return( 0 );
Jerry Yu60835a82021-08-04 10:13:52 +0800978 }
979#endif
980
981 MBEDTLS_SSL_DEBUG_MSG( 1, ( "The SSL configuration is invalid." ) );
982 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
983}
984
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200985MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu60835a82021-08-04 10:13:52 +0800986static int ssl_conf_check(const mbedtls_ssl_context *ssl)
987{
988 int ret;
989 ret = ssl_conf_version_check( ssl );
990 if( ret != 0 )
991 return( ret );
992
993 /* Space for further checks */
994
995 return( 0 );
996}
997
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +0200998/*
999 * Setup an SSL context
1000 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01001001
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02001002int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02001003 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00001004{
Janos Follath865b3eb2019-12-16 11:46:15 +00001005 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Darryl Greenb33cc762019-11-28 14:29:44 +00001006 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1007 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00001008
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02001009 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00001010
Jerry Yu60835a82021-08-04 10:13:52 +08001011 if( ( ret = ssl_conf_check( ssl ) ) != 0 )
1012 return( ret );
1013
Paul Bakker62f2dee2012-09-28 07:31:51 +00001014 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01001015 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00001016 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02001017
1018 /* Set to NULL in case of an error condition */
1019 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02001020
Darryl Greenb33cc762019-11-28 14:29:44 +00001021#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1022 ssl->in_buf_len = in_buf_len;
1023#endif
1024 ssl->in_buf = mbedtls_calloc( 1, in_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10001025 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00001026 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001027 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02001028 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001029 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10001030 }
1031
Darryl Greenb33cc762019-11-28 14:29:44 +00001032#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1033 ssl->out_buf_len = out_buf_len;
1034#endif
1035 ssl->out_buf = mbedtls_calloc( 1, out_buf_len );
Angus Grattond8213d02016-05-25 20:56:48 +10001036 if( ssl->out_buf == NULL )
1037 {
Paul Elliottd48d5c62021-01-07 14:47:05 +00001038 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len ) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02001039 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001040 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001041 }
1042
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00001043 mbedtls_ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02001044
Johan Pascalb62bb512015-12-03 21:56:45 +01001045#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldor3adb9922017-12-21 10:15:08 +02001046 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) );
Johan Pascalb62bb512015-12-03 21:56:45 +01001047#endif
1048
Paul Bakker48916f92012-09-16 19:57:18 +00001049 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02001050 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001051
1052 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02001053
1054error:
1055 mbedtls_free( ssl->in_buf );
1056 mbedtls_free( ssl->out_buf );
1057
1058 ssl->conf = NULL;
1059
Darryl Greenb33cc762019-11-28 14:29:44 +00001060#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1061 ssl->in_buf_len = 0;
1062 ssl->out_buf_len = 0;
1063#endif
k-stachowiaka47911c2018-07-04 17:41:58 +02001064 ssl->in_buf = NULL;
1065 ssl->out_buf = NULL;
1066
1067 ssl->in_hdr = NULL;
1068 ssl->in_ctr = NULL;
1069 ssl->in_len = NULL;
1070 ssl->in_iv = NULL;
1071 ssl->in_msg = NULL;
1072
1073 ssl->out_hdr = NULL;
1074 ssl->out_ctr = NULL;
1075 ssl->out_len = NULL;
1076 ssl->out_iv = NULL;
1077 ssl->out_msg = NULL;
1078
k-stachowiak9f7798e2018-07-31 16:52:32 +02001079 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001080}
1081
1082/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00001083 * Reset an initialized and used SSL context for re-use while retaining
1084 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001085 *
1086 * If partial is non-zero, keep data in the input buffer and client ID.
1087 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00001088 */
XiaokangQian78b1fa72022-01-19 06:56:30 +00001089void mbedtls_ssl_session_reset_msg_layer( mbedtls_ssl_context *ssl,
1090 int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00001091{
Darryl Greenb33cc762019-11-28 14:29:44 +00001092#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1093 size_t in_buf_len = ssl->in_buf_len;
1094 size_t out_buf_len = ssl->out_buf_len;
1095#else
1096 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1097 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
1098#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001099
Hanno Beckerb0302c42021-08-03 09:39:42 +01001100#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
1101 partial = 0;
Hanno Becker7e772132018-08-10 12:38:21 +01001102#endif
1103
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001104 /* Cancel any possibly running timer */
Hanno Becker0f57a652020-02-05 10:37:26 +00001105 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001106
Hanno Beckerb0302c42021-08-03 09:39:42 +01001107 mbedtls_ssl_reset_in_out_pointers( ssl );
1108
1109 /* Reset incoming message parsing */
1110 ssl->in_offt = NULL;
1111 ssl->nb_zero = 0;
1112 ssl->in_msgtype = 0;
1113 ssl->in_msglen = 0;
1114 ssl->in_hslen = 0;
1115 ssl->keep_current_message = 0;
1116 ssl->transform_in = NULL;
1117
1118#if defined(MBEDTLS_SSL_PROTO_DTLS)
1119 ssl->next_record_offset = 0;
1120 ssl->in_epoch = 0;
1121#endif
1122
1123 /* Keep current datagram if partial == 1 */
1124 if( partial == 0 )
1125 {
1126 ssl->in_left = 0;
1127 memset( ssl->in_buf, 0, in_buf_len );
1128 }
1129
Ronald Cronad8c17b2022-06-10 17:18:09 +02001130 ssl->send_alert = 0;
1131
Hanno Beckerb0302c42021-08-03 09:39:42 +01001132 /* Reset outgoing message writing */
1133 ssl->out_msgtype = 0;
1134 ssl->out_msglen = 0;
1135 ssl->out_left = 0;
1136 memset( ssl->out_buf, 0, out_buf_len );
1137 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
1138 ssl->transform_out = NULL;
1139
1140#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1141 mbedtls_ssl_dtls_replay_reset( ssl );
1142#endif
1143
XiaokangQian2b01dc32022-01-21 02:53:13 +00001144#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerb0302c42021-08-03 09:39:42 +01001145 if( ssl->transform )
1146 {
1147 mbedtls_ssl_transform_free( ssl->transform );
1148 mbedtls_free( ssl->transform );
1149 ssl->transform = NULL;
1150 }
XiaokangQian2b01dc32022-01-21 02:53:13 +00001151#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1152
XiaokangQian2b01dc32022-01-21 02:53:13 +00001153#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1154 mbedtls_ssl_transform_free( ssl->transform_application );
1155 mbedtls_free( ssl->transform_application );
1156 ssl->transform_application = NULL;
1157
1158 if( ssl->handshake != NULL )
1159 {
1160 mbedtls_ssl_transform_free( ssl->handshake->transform_earlydata );
1161 mbedtls_free( ssl->handshake->transform_earlydata );
1162 ssl->handshake->transform_earlydata = NULL;
1163
1164 mbedtls_ssl_transform_free( ssl->handshake->transform_handshake );
1165 mbedtls_free( ssl->handshake->transform_handshake );
1166 ssl->handshake->transform_handshake = NULL;
1167 }
1168
XiaokangQian2b01dc32022-01-21 02:53:13 +00001169#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerb0302c42021-08-03 09:39:42 +01001170}
1171
1172int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
1173{
1174 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1175
1176 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
1177
XiaokangQian78b1fa72022-01-19 06:56:30 +00001178 mbedtls_ssl_session_reset_msg_layer( ssl, partial );
Hanno Beckerb0302c42021-08-03 09:39:42 +01001179
1180 /* Reset renegotiation state */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001181#if defined(MBEDTLS_SSL_RENEGOTIATION)
1182 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001183 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001184
1185 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001186 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
1187 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001188#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001189 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00001190
Hanno Beckerb0302c42021-08-03 09:39:42 +01001191 ssl->session_in = NULL;
Hanno Becker78640902018-08-13 16:35:15 +01001192 ssl->session_out = NULL;
Paul Bakkerc0463502013-02-14 11:19:38 +01001193 if( ssl->session )
1194 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001195 mbedtls_ssl_session_free( ssl->session );
1196 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01001197 ssl->session = NULL;
1198 }
1199
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001200#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001201 ssl->alpn_chosen = NULL;
1202#endif
1203
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001204#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01001205#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001206 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01001207#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001208 {
1209 mbedtls_free( ssl->cli_id );
1210 ssl->cli_id = NULL;
1211 ssl->cli_id_len = 0;
1212 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02001213#endif
1214
Paul Bakker48916f92012-09-16 19:57:18 +00001215 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
1216 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001217
1218 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00001219}
1220
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02001221/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001222 * Reset an initialized and used SSL context for re-use while retaining
1223 * all application-set variables, function pointers and data.
1224 */
1225int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
1226{
Hanno Becker43aefe22020-02-05 10:44:56 +00001227 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001228}
1229
1230/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001231 * SSL set accessors
1232 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001233void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00001234{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001235 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00001236}
1237
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02001238void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001239{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001240 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001241}
1242
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001243#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001244void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001245{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001246 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001247}
1248#endif
1249
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001250void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001251{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001252 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001253}
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001254
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001255#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01001256
Hanno Becker1841b0a2018-08-24 11:13:57 +01001257void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
1258 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01001259{
1260 ssl->disable_datagram_packing = !allow_packing;
1261}
1262
1263void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
1264 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001265{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001266 conf->hs_timeout_min = min;
1267 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001268}
1269#endif
1270
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001271void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00001272{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001273 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00001274}
1275
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001276#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001277void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02001278 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001279 void *p_vrfy )
1280{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001281 conf->f_vrfy = f_vrfy;
1282 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001283}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001284#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001285
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001286void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00001287 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00001288 void *p_rng )
1289{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001290 conf->f_rng = f_rng;
1291 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00001292}
1293
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001294void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02001295 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00001296 void *p_dbg )
1297{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001298 conf->f_dbg = f_dbg;
1299 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00001300}
1301
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001302void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001303 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00001304 mbedtls_ssl_send_t *f_send,
1305 mbedtls_ssl_recv_t *f_recv,
1306 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001307{
1308 ssl->p_bio = p_bio;
1309 ssl->f_send = f_send;
1310 ssl->f_recv = f_recv;
1311 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001312}
1313
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02001314#if defined(MBEDTLS_SSL_PROTO_DTLS)
1315void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
1316{
1317 ssl->mtu = mtu;
1318}
1319#endif
1320
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001321void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001322{
1323 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001324}
1325
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001326void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
1327 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00001328 mbedtls_ssl_set_timer_t *f_set_timer,
1329 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001330{
1331 ssl->p_timer = p_timer;
1332 ssl->f_set_timer = f_set_timer;
1333 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001334
1335 /* Make sure we start with no timer running */
Hanno Becker0f57a652020-02-05 10:37:26 +00001336 mbedtls_ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001337}
1338
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001339#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001340void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Hanno Beckera637ff62021-04-15 08:42:48 +01001341 void *p_cache,
1342 mbedtls_ssl_cache_get_t *f_get_cache,
1343 mbedtls_ssl_cache_set_t *f_set_cache )
Paul Bakker5121ce52009-01-03 21:22:43 +00001344{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01001345 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001346 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001347 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00001348}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001349#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001350
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001351#if defined(MBEDTLS_SSL_CLI_C)
1352int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00001353{
Janos Follath865b3eb2019-12-16 11:46:15 +00001354 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001355
1356 if( ssl == NULL ||
1357 session == NULL ||
1358 ssl->session_negotiate == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001359 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001360 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001361 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001362 }
1363
Hanno Beckere810bbc2021-05-14 16:01:05 +01001364 if( ssl->handshake->resume == 1 )
1365 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
1366
Hanno Becker52055ae2019-02-06 14:30:46 +00001367 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
1368 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001369 return( ret );
1370
Paul Bakker0a597072012-09-25 21:55:46 +00001371 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001372
1373 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001374}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001375#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001376
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001377void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
1378 const int *ciphersuites )
1379{
Hanno Beckerd60b6c62021-04-29 12:04:11 +01001380 conf->ciphersuite_list = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00001381}
1382
Ronald Cron6f135e12021-12-08 16:57:54 +01001383#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yucadebe52021-08-24 10:36:45 +08001384void mbedtls_ssl_conf_tls13_key_exchange_modes( mbedtls_ssl_config *conf,
Hanno Becker71f1ed62021-07-24 06:01:47 +01001385 const int kex_modes )
1386{
Xiaofei Bai746f9482021-11-12 08:53:56 +00001387 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Hanno Becker71f1ed62021-07-24 06:01:47 +01001388}
Ronald Cron6f135e12021-12-08 16:57:54 +01001389#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01001390
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001391#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001392void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01001393 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001394{
1395 conf->cert_profile = profile;
1396}
1397
Glenn Strauss36872db2022-01-22 05:06:31 -05001398static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
1399{
1400 mbedtls_ssl_key_cert *cur = key_cert, *next;
1401
1402 while( cur != NULL )
1403 {
1404 next = cur->next;
1405 mbedtls_free( cur );
1406 cur = next;
1407 }
1408}
1409
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001410/* Append a new keycert entry to a (possibly empty) list */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001411MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001412static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
1413 mbedtls_x509_crt *cert,
1414 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001415{
niisato8ee24222018-06-25 19:05:48 +09001416 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001417
Glenn Strauss36872db2022-01-22 05:06:31 -05001418 if( cert == NULL )
1419 {
1420 /* Free list if cert is null */
1421 ssl_key_cert_free( *head );
1422 *head = NULL;
1423 return( 0 );
1424 }
1425
niisato8ee24222018-06-25 19:05:48 +09001426 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
1427 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001428 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001429
niisato8ee24222018-06-25 19:05:48 +09001430 new_cert->cert = cert;
1431 new_cert->key = key;
1432 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001433
Glenn Strauss36872db2022-01-22 05:06:31 -05001434 /* Update head if the list was null, else add to the end */
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001435 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01001436 {
niisato8ee24222018-06-25 19:05:48 +09001437 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01001438 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001439 else
1440 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001441 mbedtls_ssl_key_cert *cur = *head;
1442 while( cur->next != NULL )
1443 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09001444 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001445 }
1446
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001447 return( 0 );
1448}
1449
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001450int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001451 mbedtls_x509_crt *own_cert,
1452 mbedtls_pk_context *pk_key )
1453{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02001454 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001455}
1456
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001457void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001458 mbedtls_x509_crt *ca_chain,
1459 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001460{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001461 conf->ca_chain = ca_chain;
1462 conf->ca_crl = ca_crl;
Hanno Becker5adaad92019-03-27 16:54:37 +00001463
1464#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1465 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1466 * cannot be used together. */
1467 conf->f_ca_cb = NULL;
1468 conf->p_ca_cb = NULL;
1469#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Paul Bakker5121ce52009-01-03 21:22:43 +00001470}
Hanno Becker5adaad92019-03-27 16:54:37 +00001471
1472#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1473void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf,
Hanno Beckerafd0b0a2019-03-27 16:55:01 +00001474 mbedtls_x509_crt_ca_cb_t f_ca_cb,
Hanno Becker5adaad92019-03-27 16:54:37 +00001475 void *p_ca_cb )
1476{
1477 conf->f_ca_cb = f_ca_cb;
1478 conf->p_ca_cb = p_ca_cb;
1479
1480 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1481 * cannot be used together. */
1482 conf->ca_chain = NULL;
1483 conf->ca_crl = NULL;
1484}
1485#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001486#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00001487
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001488#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Glenn Strauss69894072022-01-24 12:58:00 -05001489const unsigned char *mbedtls_ssl_get_hs_sni( mbedtls_ssl_context *ssl,
1490 size_t *name_len )
1491{
1492 *name_len = ssl->handshake->sni_name_len;
1493 return( ssl->handshake->sni_name );
1494}
1495
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001496int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
1497 mbedtls_x509_crt *own_cert,
1498 mbedtls_pk_context *pk_key )
1499{
1500 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
1501 own_cert, pk_key ) );
1502}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02001503
1504void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
1505 mbedtls_x509_crt *ca_chain,
1506 mbedtls_x509_crl *ca_crl )
1507{
1508 ssl->handshake->sni_ca_chain = ca_chain;
1509 ssl->handshake->sni_ca_crl = ca_crl;
1510}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001511
Glenn Strauss999ef702022-03-11 01:37:23 -05001512#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
1513void mbedtls_ssl_set_hs_dn_hints( mbedtls_ssl_context *ssl,
1514 const mbedtls_x509_crt *crt)
1515{
1516 ssl->handshake->dn_hints = crt;
1517}
1518#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
1519
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001520void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
1521 int authmode )
1522{
1523 ssl->handshake->sni_authmode = authmode;
1524}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001525#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1526
Hanno Becker8927c832019-04-03 12:52:50 +01001527#if defined(MBEDTLS_X509_CRT_PARSE_C)
1528void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl,
1529 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
1530 void *p_vrfy )
1531{
1532 ssl->f_vrfy = f_vrfy;
1533 ssl->p_vrfy = p_vrfy;
1534}
1535#endif
1536
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001537#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001538/*
1539 * Set EC J-PAKE password for current handshake
1540 */
1541int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
1542 const unsigned char *pw,
1543 size_t pw_len )
1544{
1545 mbedtls_ecjpake_role role;
1546
Janos Follath8eb64132016-06-03 15:40:57 +01001547 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001548 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1549
1550 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
1551 role = MBEDTLS_ECJPAKE_SERVER;
1552 else
1553 role = MBEDTLS_ECJPAKE_CLIENT;
1554
1555 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
1556 role,
1557 MBEDTLS_MD_SHA256,
1558 MBEDTLS_ECP_DP_SECP256R1,
1559 pw, pw_len ) );
1560}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001561#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001562
Gilles Peskineeccd8882020-03-10 12:19:08 +01001563#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001564
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001565MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001566static int ssl_conf_psk_is_configured( mbedtls_ssl_config const *conf )
1567{
1568#if defined(MBEDTLS_USE_PSA_CRYPTO)
1569 if( !mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
1570 return( 1 );
1571#endif /* MBEDTLS_USE_PSA_CRYPTO */
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001572 if( conf->psk != NULL )
1573 return( 1 );
1574
1575 return( 0 );
1576}
1577
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001578static void ssl_conf_remove_psk( mbedtls_ssl_config *conf )
1579{
1580 /* Remove reference to existing PSK, if any. */
1581#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02001582 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001583 {
1584 /* The maintenance of the PSK key slot is the
1585 * user's responsibility. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001586 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001587 }
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001588#endif /* MBEDTLS_USE_PSA_CRYPTO */
1589 if( conf->psk != NULL )
1590 {
1591 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
1592
1593 mbedtls_free( conf->psk );
1594 conf->psk = NULL;
1595 conf->psk_len = 0;
1596 }
1597
1598 /* Remove reference to PSK identity, if any. */
1599 if( conf->psk_identity != NULL )
1600 {
1601 mbedtls_free( conf->psk_identity );
1602 conf->psk_identity = NULL;
1603 conf->psk_identity_len = 0;
1604 }
1605}
1606
Hanno Becker7390c712018-11-15 13:33:04 +00001607/* This function assumes that PSK identity in the SSL config is unset.
1608 * It checks that the provided identity is well-formed and attempts
1609 * to make a copy of it in the SSL config.
1610 * On failure, the PSK identity in the config remains unset. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001611MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Becker7390c712018-11-15 13:33:04 +00001612static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf,
1613 unsigned char const *psk_identity,
1614 size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02001615{
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02001616 /* Identity len will be encoded on two bytes */
Hanno Becker7390c712018-11-15 13:33:04 +00001617 if( psk_identity == NULL ||
1618 ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10001619 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02001620 {
1621 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1622 }
1623
Hanno Becker7390c712018-11-15 13:33:04 +00001624 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len );
1625 if( conf->psk_identity == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001626 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker6db455e2013-09-18 17:29:31 +02001627
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01001628 conf->psk_identity_len = psk_identity_len;
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01001629 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker5ad403f2013-09-18 21:21:30 +02001630
1631 return( 0 );
Paul Bakker6db455e2013-09-18 17:29:31 +02001632}
1633
Hanno Becker7390c712018-11-15 13:33:04 +00001634int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
1635 const unsigned char *psk, size_t psk_len,
1636 const unsigned char *psk_identity, size_t psk_identity_len )
1637{
Janos Follath865b3eb2019-12-16 11:46:15 +00001638 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001639
1640 /* We currently only support one PSK, raw or opaque. */
1641 if( ssl_conf_psk_is_configured( conf ) )
1642 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Becker7390c712018-11-15 13:33:04 +00001643
1644 /* Check and set raw PSK */
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01001645 if( psk == NULL )
Hanno Becker7390c712018-11-15 13:33:04 +00001646 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01001647 if( psk_len == 0 )
1648 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1649 if( psk_len > MBEDTLS_PSK_MAX_LEN )
1650 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1651
Hanno Becker7390c712018-11-15 13:33:04 +00001652 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
1653 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1654 conf->psk_len = psk_len;
1655 memcpy( conf->psk, psk, conf->psk_len );
1656
1657 /* Check and set PSK Identity */
1658 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len );
1659 if( ret != 0 )
1660 ssl_conf_remove_psk( conf );
1661
1662 return( ret );
1663}
1664
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001665static void ssl_remove_psk( mbedtls_ssl_context *ssl )
1666{
1667#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +02001668 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001669 {
Neil Armstrong501c9322022-05-03 09:35:09 +02001670 /* The maintenance of the external PSK key slot is the
1671 * user's responsibility. */
1672 if( ssl->handshake->psk_opaque_is_internal )
1673 {
1674 psa_destroy_key( ssl->handshake->psk_opaque );
1675 ssl->handshake->psk_opaque_is_internal = 0;
1676 }
Ronald Croncf56a0a2020-08-04 09:51:30 +02001677 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001678 }
Neil Armstronge952a302022-05-03 10:22:14 +02001679#else
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001680 if( ssl->handshake->psk != NULL )
1681 {
1682 mbedtls_platform_zeroize( ssl->handshake->psk,
1683 ssl->handshake->psk_len );
1684 mbedtls_free( ssl->handshake->psk );
1685 ssl->handshake->psk_len = 0;
1686 }
Neil Armstronge952a302022-05-03 10:22:14 +02001687#endif /* MBEDTLS_USE_PSA_CRYPTO */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001688}
1689
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001690int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
1691 const unsigned char *psk, size_t psk_len )
1692{
Neil Armstrong501c9322022-05-03 09:35:09 +02001693#if defined(MBEDTLS_USE_PSA_CRYPTO)
1694 psa_key_attributes_t key_attributes = psa_key_attributes_init();
1695 psa_status_t status;
1696 psa_algorithm_t alg;
1697 mbedtls_svc_key_id_t key;
1698#endif /* MBEDTLS_USE_PSA_CRYPTO */
1699
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001700 if( psk == NULL || ssl->handshake == NULL )
1701 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1702
1703 if( psk_len > MBEDTLS_PSK_MAX_LEN )
1704 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1705
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001706 ssl_remove_psk( ssl );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001707
Neil Armstrong501c9322022-05-03 09:35:09 +02001708#if defined(MBEDTLS_USE_PSA_CRYPTO)
1709 if( ssl->handshake->ciphersuite_info->mac == MBEDTLS_MD_SHA384)
1710 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
1711 else
1712 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
1713
Jerry Yu568ec252022-07-22 21:27:34 +08001714#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu1c105562022-07-10 06:32:38 +00001715 psa_set_key_usage_flags( &key_attributes,
1716 PSA_KEY_USAGE_DERIVE | PSA_KEY_USAGE_EXPORT );
Jerry Yu568ec252022-07-22 21:27:34 +08001717#else
Neil Armstrong501c9322022-05-03 09:35:09 +02001718 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
Jerry Yu568ec252022-07-22 21:27:34 +08001719#endif
Neil Armstrong501c9322022-05-03 09:35:09 +02001720 psa_set_key_algorithm( &key_attributes, alg );
1721 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
1722
1723 status = psa_import_key( &key_attributes, psk, psk_len, &key );
1724 if( status != PSA_SUCCESS )
1725 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
1726
1727 /* Allow calling psa_destroy_key() on psk remove */
1728 ssl->handshake->psk_opaque_is_internal = 1;
1729 return mbedtls_ssl_set_hs_psk_opaque( ssl, key );
1730#else
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02001731 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001732 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001733
1734 ssl->handshake->psk_len = psk_len;
1735 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
1736
1737 return( 0 );
Neil Armstrong501c9322022-05-03 09:35:09 +02001738#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001739}
1740
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001741#if defined(MBEDTLS_USE_PSA_CRYPTO)
1742int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
Andrzej Kurek03e01462022-01-03 12:53:24 +01001743 mbedtls_svc_key_id_t psk,
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001744 const unsigned char *psk_identity,
1745 size_t psk_identity_len )
1746{
Janos Follath865b3eb2019-12-16 11:46:15 +00001747 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01001748
1749 /* We currently only support one PSK, raw or opaque. */
1750 if( ssl_conf_psk_is_configured( conf ) )
1751 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001752
Hanno Becker7390c712018-11-15 13:33:04 +00001753 /* Check and set opaque PSK */
Ronald Croncf56a0a2020-08-04 09:51:30 +02001754 if( mbedtls_svc_key_id_is_null( psk ) )
Hanno Becker7390c712018-11-15 13:33:04 +00001755 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ronald Croncf56a0a2020-08-04 09:51:30 +02001756 conf->psk_opaque = psk;
Hanno Becker7390c712018-11-15 13:33:04 +00001757
1758 /* Check and set PSK Identity */
1759 ret = ssl_conf_set_psk_identity( conf, psk_identity,
1760 psk_identity_len );
1761 if( ret != 0 )
1762 ssl_conf_remove_psk( conf );
1763
1764 return( ret );
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01001765}
1766
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01001767int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
1768 mbedtls_svc_key_id_t psk )
1769{
1770 if( ( mbedtls_svc_key_id_is_null( psk ) ) ||
1771 ( ssl->handshake == NULL ) )
1772 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1773
1774 ssl_remove_psk( ssl );
1775 ssl->handshake->psk_opaque = psk;
1776 return( 0 );
1777}
1778#endif /* MBEDTLS_USE_PSA_CRYPTO */
1779
1780void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
1781 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
1782 size_t),
1783 void *p_psk )
1784{
1785 conf->f_psk = f_psk;
1786 conf->p_psk = p_psk;
1787}
1788#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
1789
1790#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine301711e2022-04-26 16:57:05 +02001791static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
1792 psa_algorithm_t alg )
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001793{
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001794#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001795 if( alg == PSA_ALG_CBC_NO_PADDING )
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001796 return( MBEDTLS_SSL_MODE_CBC );
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001797#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001798 if( PSA_ALG_IS_AEAD( alg ) )
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001799 return( MBEDTLS_SSL_MODE_AEAD );
Gilles Peskine301711e2022-04-26 16:57:05 +02001800 return( MBEDTLS_SSL_MODE_STREAM );
1801}
1802
1803#else /* MBEDTLS_USE_PSA_CRYPTO */
1804
1805static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
1806 mbedtls_cipher_mode_t mode )
1807{
1808#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
1809 if( mode == MBEDTLS_MODE_CBC )
1810 return( MBEDTLS_SSL_MODE_CBC );
1811#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
1812
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001813#if defined(MBEDTLS_GCM_C) || \
1814 defined(MBEDTLS_CCM_C) || \
1815 defined(MBEDTLS_CHACHAPOLY_C)
1816 if( mode == MBEDTLS_MODE_GCM ||
1817 mode == MBEDTLS_MODE_CCM ||
1818 mode == MBEDTLS_MODE_CHACHAPOLY )
1819 return( MBEDTLS_SSL_MODE_AEAD );
1820#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001821
1822 return( MBEDTLS_SSL_MODE_STREAM );
1823}
Gilles Peskine301711e2022-04-26 16:57:05 +02001824#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02001825
Gilles Peskinee108d982022-04-26 16:50:40 +02001826static mbedtls_ssl_mode_t mbedtls_ssl_get_actual_mode(
1827 mbedtls_ssl_mode_t base_mode,
1828 int encrypt_then_mac )
1829{
1830#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
1831 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
1832 base_mode == MBEDTLS_SSL_MODE_CBC )
1833 {
1834 return( MBEDTLS_SSL_MODE_CBC_ETM );
1835 }
1836#else
1837 (void) encrypt_then_mac;
1838#endif
1839 return( base_mode );
1840}
1841
Neil Armstrongab555e02022-04-04 11:07:59 +02001842mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_transform(
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001843 const mbedtls_ssl_transform *transform )
1844{
Gilles Peskinee108d982022-04-26 16:50:40 +02001845 mbedtls_ssl_mode_t base_mode = mbedtls_ssl_get_base_mode(
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001846#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskinee108d982022-04-26 16:50:40 +02001847 transform->psa_alg
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001848#else
Gilles Peskinee108d982022-04-26 16:50:40 +02001849 mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc )
1850#endif
1851 );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001852
Gilles Peskinee108d982022-04-26 16:50:40 +02001853 int encrypt_then_mac = 0;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02001854#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskinee108d982022-04-26 16:50:40 +02001855 encrypt_then_mac = transform->encrypt_then_mac;
1856#endif
1857 return( mbedtls_ssl_get_actual_mode( base_mode, encrypt_then_mac ) );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001858}
1859
Neil Armstrongab555e02022-04-04 11:07:59 +02001860mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02001861#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001862 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02001863#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001864 const mbedtls_ssl_ciphersuite_t *suite )
1865{
Gilles Peskinee108d982022-04-26 16:50:40 +02001866 mbedtls_ssl_mode_t base_mode = MBEDTLS_SSL_MODE_STREAM;
1867
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001868#if defined(MBEDTLS_USE_PSA_CRYPTO)
1869 psa_status_t status;
1870 psa_algorithm_t alg;
1871 psa_key_type_t type;
1872 size_t size;
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001873 status = mbedtls_ssl_cipher_to_psa( suite->cipher, 0, &alg, &type, &size );
1874 if( status == PSA_SUCCESS )
Gilles Peskinee108d982022-04-26 16:50:40 +02001875 base_mode = mbedtls_ssl_get_base_mode( alg );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001876#else
1877 const mbedtls_cipher_info_t *cipher =
1878 mbedtls_cipher_info_from_type( suite->cipher );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001879 if( cipher != NULL )
Gilles Peskinee108d982022-04-26 16:50:40 +02001880 {
1881 base_mode =
1882 mbedtls_ssl_get_base_mode(
1883 mbedtls_cipher_info_get_mode( cipher ) );
1884 }
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001885#endif /* MBEDTLS_USE_PSA_CRYPTO */
1886
Gilles Peskinee108d982022-04-26 16:50:40 +02001887#if !defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
1888 int encrypt_then_mac = 0;
1889#endif
1890 return( mbedtls_ssl_get_actual_mode( base_mode, encrypt_then_mac ) );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02001891}
1892
Neil Armstrong8395d7a2022-05-18 11:44:56 +02001893#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu251a12e2022-07-13 15:15:48 +08001894
1895#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu438ddd82022-07-07 06:55:50 +00001896/* Serialization of TLS 1.3 sessions:
1897 *
1898 * struct {
1899 * uint64 ticket_received;
1900 * uint32 ticket_lifetime;
1901 * opaque ticket<0..2^16>;
1902 * } ClientOnlyData;
1903 *
1904 * struct {
1905 * uint8 endpoint;
1906 * uint8 ciphersuite[2];
1907 * uint32 ticket_age_add;
1908 * uint8 ticket_flags;
1909 * opaque resumption_key<0..255>;
1910 * select ( endpoint ) {
1911 * case client: ClientOnlyData;
1912 * case server: uint64 start_time;
1913 * };
1914 * } serialized_session_tls13;
1915 *
1916 */
1917#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1918static size_t ssl_tls13_session_save( const mbedtls_ssl_session *session,
1919 unsigned char *buf,
1920 size_t buf_len )
1921{
1922 unsigned char *p = buf;
Jerry Yubc7c1a42022-07-21 22:57:37 +08001923 size_t needed = 1 /* endpoint */
1924 + 2 /* ciphersuite */
1925 + 4 /* ticket_age_add */
1926 + 2 /* resumption_key length */
1927 + session->resumption_key_len; /* resumption_key */
Jerry Yu438ddd82022-07-07 06:55:50 +00001928
1929#if defined(MBEDTLS_HAVE_TIME)
1930 needed += 8; /* start_time or ticket_received */
1931#endif
1932
1933#if defined(MBEDTLS_SSL_CLI_C)
1934 if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
1935 {
1936 needed += 4 /* ticket_lifetime */
1937 + 2 /* ticket_len */
1938 + session->ticket_len; /* ticket */
1939 }
1940#endif /* MBEDTLS_SSL_CLI_C */
1941
1942 if( needed > buf_len )
1943 return( needed );
1944
1945 p[0] = session->endpoint;
1946 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 1 );
1947 MBEDTLS_PUT_UINT32_BE( session->ticket_age_add, p, 3 );
1948 p[7] = session->ticket_flags;
1949
1950 /* save resumption_key */
Jerry Yubc7c1a42022-07-21 22:57:37 +08001951 p[8] = session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00001952 p += 9;
Jerry Yubc7c1a42022-07-21 22:57:37 +08001953 memcpy( p, session->resumption_key, session->resumption_key_len );
1954 p += session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00001955
1956#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
1957 if( session->endpoint == MBEDTLS_SSL_IS_SERVER )
1958 {
1959 MBEDTLS_PUT_UINT64_BE( (uint64_t) session->start, p, 0 );
1960 p += 8;
1961 }
1962#endif /* MBEDTLS_HAVE_TIME */
1963
1964#if defined(MBEDTLS_SSL_CLI_C)
1965 if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
1966 {
1967#if defined(MBEDTLS_HAVE_TIME)
1968 MBEDTLS_PUT_UINT64_BE( (uint64_t) session->ticket_received, p, 0 );
1969 p += 8;
1970#endif
1971 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
1972 p += 4;
1973
1974 MBEDTLS_PUT_UINT16_BE( session->ticket_len, p, 0 );
1975 p += 2;
1976 if( session->ticket_len > 0 )
1977 {
1978 memcpy( p, session->ticket, session->ticket_len );
1979 p += session->ticket_len;
1980 }
1981 }
1982#endif /* MBEDTLS_SSL_CLI_C */
1983 return( needed );
1984}
1985
1986MBEDTLS_CHECK_RETURN_CRITICAL
1987static int ssl_tls13_session_load( mbedtls_ssl_session *session,
1988 const unsigned char *buf,
1989 size_t len )
1990{
1991 const unsigned char *p = buf;
1992 const unsigned char *end = buf + len;
1993
1994 if( end - p < 9 )
1995 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1996 session->endpoint = p[0];
1997 session->ciphersuite = MBEDTLS_GET_UINT16_BE( p, 1 );
1998 session->ticket_age_add = MBEDTLS_GET_UINT32_BE( p, 3 );
1999 session->ticket_flags = p[7];
2000
2001 /* load resumption_key */
Jerry Yubc7c1a42022-07-21 22:57:37 +08002002 session->resumption_key_len = p[8];
Jerry Yu438ddd82022-07-07 06:55:50 +00002003 p += 9;
2004
Jerry Yubc7c1a42022-07-21 22:57:37 +08002005 if( end - p < session->resumption_key_len )
Jerry Yu438ddd82022-07-07 06:55:50 +00002006 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2007
Jerry Yubc7c1a42022-07-21 22:57:37 +08002008 if( sizeof( session->resumption_key ) < session->resumption_key_len )
Jerry Yu438ddd82022-07-07 06:55:50 +00002009 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yubc7c1a42022-07-21 22:57:37 +08002010 memcpy( session->resumption_key, p, session->resumption_key_len );
2011 p += session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002012
2013#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
2014 if( session->endpoint == MBEDTLS_SSL_IS_SERVER )
2015 {
2016 if( end - p < 8 )
2017 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2018 session->start = MBEDTLS_GET_UINT64_BE( p, 0 );
2019 p += 8;
2020 }
2021#endif /* MBEDTLS_HAVE_TIME */
2022
2023#if defined(MBEDTLS_SSL_CLI_C)
2024 if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
2025 {
2026#if defined(MBEDTLS_HAVE_TIME)
2027 if( end - p < 8 )
2028 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2029 session->ticket_received = MBEDTLS_GET_UINT64_BE( p, 0 );
2030 p += 8;
2031#endif
2032 if( end - p < 4 )
2033 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2034 session->ticket_lifetime = MBEDTLS_GET_UINT32_BE( p, 0 );
2035 p += 4;
2036
2037 if( end - p < 2 )
2038 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2039 session->ticket_len = MBEDTLS_GET_UINT16_BE( p, 0 );
2040 p += 2;
2041
2042 if( end - p < ( long int )session->ticket_len )
2043 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2044 if( session->ticket_len > 0 )
2045 {
2046 session->ticket = mbedtls_calloc( 1, session->ticket_len );
2047 if( session->ticket == NULL )
2048 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2049 memcpy( session->ticket, p, session->ticket_len );
2050 p += session->ticket_len;
2051 }
2052 }
2053#endif /* MBEDTLS_SSL_CLI_C */
2054
2055 return( 0 );
2056
2057}
2058#else /* MBEDTLS_SSL_SESSION_TICKETS */
2059static size_t ssl_tls13_session_save( const mbedtls_ssl_session *session,
Jerry Yu251a12e2022-07-13 15:15:48 +08002060 unsigned char *buf,
2061 size_t buf_len )
2062{
2063 ((void) session);
2064 ((void) buf);
2065 ((void) buf_len);
2066 return( 0 );
2067}
Jerry Yu438ddd82022-07-07 06:55:50 +00002068
2069static int ssl_tls13_session_load( const mbedtls_ssl_session *session,
2070 unsigned char *buf,
2071 size_t buf_len )
2072{
2073 ((void) session);
2074 ((void) buf);
2075 ((void) buf_len);
2076 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2077}
2078#endif /* !MBEDTLS_SSL_SESSION_TICKETS */
Jerry Yu251a12e2022-07-13 15:15:48 +08002079#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
2080
Przemyslaw Stekielf57b4562022-01-25 00:04:18 +01002081psa_status_t mbedtls_ssl_cipher_to_psa( mbedtls_cipher_type_t mbedtls_cipher_type,
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002082 size_t taglen,
2083 psa_algorithm_t *alg,
2084 psa_key_type_t *key_type,
2085 size_t *key_size )
2086{
2087 switch ( mbedtls_cipher_type )
2088 {
2089 case MBEDTLS_CIPHER_AES_128_CBC:
2090 *alg = PSA_ALG_CBC_NO_PADDING;
2091 *key_type = PSA_KEY_TYPE_AES;
2092 *key_size = 128;
2093 break;
2094 case MBEDTLS_CIPHER_AES_128_CCM:
2095 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2096 *key_type = PSA_KEY_TYPE_AES;
2097 *key_size = 128;
2098 break;
2099 case MBEDTLS_CIPHER_AES_128_GCM:
2100 *alg = PSA_ALG_GCM;
2101 *key_type = PSA_KEY_TYPE_AES;
2102 *key_size = 128;
2103 break;
2104 case MBEDTLS_CIPHER_AES_192_CCM:
2105 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2106 *key_type = PSA_KEY_TYPE_AES;
2107 *key_size = 192;
2108 break;
2109 case MBEDTLS_CIPHER_AES_192_GCM:
2110 *alg = PSA_ALG_GCM;
2111 *key_type = PSA_KEY_TYPE_AES;
2112 *key_size = 192;
2113 break;
2114 case MBEDTLS_CIPHER_AES_256_CBC:
2115 *alg = PSA_ALG_CBC_NO_PADDING;
2116 *key_type = PSA_KEY_TYPE_AES;
2117 *key_size = 256;
2118 break;
2119 case MBEDTLS_CIPHER_AES_256_CCM:
2120 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2121 *key_type = PSA_KEY_TYPE_AES;
2122 *key_size = 256;
2123 break;
2124 case MBEDTLS_CIPHER_AES_256_GCM:
2125 *alg = PSA_ALG_GCM;
2126 *key_type = PSA_KEY_TYPE_AES;
2127 *key_size = 256;
2128 break;
2129 case MBEDTLS_CIPHER_ARIA_128_CBC:
2130 *alg = PSA_ALG_CBC_NO_PADDING;
2131 *key_type = PSA_KEY_TYPE_ARIA;
2132 *key_size = 128;
2133 break;
2134 case MBEDTLS_CIPHER_ARIA_128_CCM:
2135 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2136 *key_type = PSA_KEY_TYPE_ARIA;
2137 *key_size = 128;
2138 break;
2139 case MBEDTLS_CIPHER_ARIA_128_GCM:
2140 *alg = PSA_ALG_GCM;
2141 *key_type = PSA_KEY_TYPE_ARIA;
2142 *key_size = 128;
2143 break;
2144 case MBEDTLS_CIPHER_ARIA_192_CCM:
2145 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2146 *key_type = PSA_KEY_TYPE_ARIA;
2147 *key_size = 192;
2148 break;
2149 case MBEDTLS_CIPHER_ARIA_192_GCM:
2150 *alg = PSA_ALG_GCM;
2151 *key_type = PSA_KEY_TYPE_ARIA;
2152 *key_size = 192;
2153 break;
2154 case MBEDTLS_CIPHER_ARIA_256_CBC:
2155 *alg = PSA_ALG_CBC_NO_PADDING;
2156 *key_type = PSA_KEY_TYPE_ARIA;
2157 *key_size = 256;
2158 break;
2159 case MBEDTLS_CIPHER_ARIA_256_CCM:
2160 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2161 *key_type = PSA_KEY_TYPE_ARIA;
2162 *key_size = 256;
2163 break;
2164 case MBEDTLS_CIPHER_ARIA_256_GCM:
2165 *alg = PSA_ALG_GCM;
2166 *key_type = PSA_KEY_TYPE_ARIA;
2167 *key_size = 256;
2168 break;
2169 case MBEDTLS_CIPHER_CAMELLIA_128_CBC:
2170 *alg = PSA_ALG_CBC_NO_PADDING;
2171 *key_type = PSA_KEY_TYPE_CAMELLIA;
2172 *key_size = 128;
2173 break;
2174 case MBEDTLS_CIPHER_CAMELLIA_128_CCM:
2175 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2176 *key_type = PSA_KEY_TYPE_CAMELLIA;
2177 *key_size = 128;
2178 break;
2179 case MBEDTLS_CIPHER_CAMELLIA_128_GCM:
2180 *alg = PSA_ALG_GCM;
2181 *key_type = PSA_KEY_TYPE_CAMELLIA;
2182 *key_size = 128;
2183 break;
2184 case MBEDTLS_CIPHER_CAMELLIA_192_CCM:
2185 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2186 *key_type = PSA_KEY_TYPE_CAMELLIA;
2187 *key_size = 192;
2188 break;
2189 case MBEDTLS_CIPHER_CAMELLIA_192_GCM:
2190 *alg = PSA_ALG_GCM;
2191 *key_type = PSA_KEY_TYPE_CAMELLIA;
2192 *key_size = 192;
2193 break;
2194 case MBEDTLS_CIPHER_CAMELLIA_256_CBC:
2195 *alg = PSA_ALG_CBC_NO_PADDING;
2196 *key_type = PSA_KEY_TYPE_CAMELLIA;
2197 *key_size = 256;
2198 break;
2199 case MBEDTLS_CIPHER_CAMELLIA_256_CCM:
2200 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, taglen ) : PSA_ALG_CCM;
2201 *key_type = PSA_KEY_TYPE_CAMELLIA;
2202 *key_size = 256;
2203 break;
2204 case MBEDTLS_CIPHER_CAMELLIA_256_GCM:
2205 *alg = PSA_ALG_GCM;
2206 *key_type = PSA_KEY_TYPE_CAMELLIA;
2207 *key_size = 256;
2208 break;
2209 case MBEDTLS_CIPHER_CHACHA20_POLY1305:
2210 *alg = PSA_ALG_CHACHA20_POLY1305;
2211 *key_type = PSA_KEY_TYPE_CHACHA20;
2212 *key_size = 256;
2213 break;
2214 case MBEDTLS_CIPHER_NULL:
2215 *alg = MBEDTLS_SSL_NULL_CIPHER;
2216 *key_type = 0;
2217 *key_size = 0;
2218 break;
2219 default:
2220 return PSA_ERROR_NOT_SUPPORTED;
2221 }
2222
2223 return PSA_SUCCESS;
2224}
Neil Armstrong8395d7a2022-05-18 11:44:56 +02002225#endif /* MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002226
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002227#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckera90658f2017-10-04 15:29:08 +01002228int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
2229 const unsigned char *dhm_P, size_t P_len,
2230 const unsigned char *dhm_G, size_t G_len )
2231{
Janos Follath865b3eb2019-12-16 11:46:15 +00002232 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckera90658f2017-10-04 15:29:08 +01002233
Glenn Strausscee11292021-12-20 01:43:17 -05002234 mbedtls_mpi_free( &conf->dhm_P );
2235 mbedtls_mpi_free( &conf->dhm_G );
2236
Hanno Beckera90658f2017-10-04 15:29:08 +01002237 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
2238 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
2239 {
2240 mbedtls_mpi_free( &conf->dhm_P );
2241 mbedtls_mpi_free( &conf->dhm_G );
2242 return( ret );
2243 }
2244
2245 return( 0 );
2246}
Paul Bakker5121ce52009-01-03 21:22:43 +00002247
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002248int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00002249{
Janos Follath865b3eb2019-12-16 11:46:15 +00002250 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1b57b062011-01-06 15:48:19 +00002251
Glenn Strausscee11292021-12-20 01:43:17 -05002252 mbedtls_mpi_free( &conf->dhm_P );
2253 mbedtls_mpi_free( &conf->dhm_G );
2254
Gilles Peskinee5702482021-06-11 21:59:08 +02002255 if( ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_P,
2256 &conf->dhm_P ) ) != 0 ||
2257 ( ret = mbedtls_dhm_get_value( dhm_ctx, MBEDTLS_DHM_PARAM_G,
2258 &conf->dhm_G ) ) != 0 )
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002259 {
2260 mbedtls_mpi_free( &conf->dhm_P );
2261 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00002262 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002263 }
Paul Bakker1b57b062011-01-06 15:48:19 +00002264
2265 return( 0 );
2266}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002267#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00002268
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02002269#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
2270/*
2271 * Set the minimum length for Diffie-Hellman parameters
2272 */
2273void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
2274 unsigned int bitlen )
2275{
2276 conf->dhm_min_bitlen = bitlen;
2277}
2278#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
2279
Gilles Peskineeccd8882020-03-10 12:19:08 +01002280#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002281#if !defined(MBEDTLS_DEPRECATED_REMOVED) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002282/*
2283 * Set allowed/preferred hashes for handshake signatures
2284 */
2285void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
2286 const int *hashes )
2287{
2288 conf->sig_hashes = hashes;
2289}
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002290#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker1cd6e002021-08-10 13:27:10 +01002291
Jerry Yuf017ee42022-01-12 15:49:48 +08002292/* Configure allowed signature algorithms for handshake */
Hanno Becker1cd6e002021-08-10 13:27:10 +01002293void mbedtls_ssl_conf_sig_algs( mbedtls_ssl_config *conf,
2294 const uint16_t* sig_algs )
2295{
Jerry Yuf017ee42022-01-12 15:49:48 +08002296#if !defined(MBEDTLS_DEPRECATED_REMOVED)
2297 conf->sig_hashes = NULL;
2298#endif /* !MBEDTLS_DEPRECATED_REMOVED */
2299 conf->sig_algs = sig_algs;
Hanno Becker1cd6e002021-08-10 13:27:10 +01002300}
Gilles Peskineeccd8882020-03-10 12:19:08 +01002301#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002302
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02002303#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01002304#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002305/*
2306 * Set the allowed elliptic curves
Brett Warrene0edc842021-08-17 09:53:13 +01002307 *
2308 * mbedtls_ssl_setup() takes the provided list
2309 * and translates it to a list of IANA TLS group identifiers,
2310 * stored in ssl->handshake->group_list.
2311 *
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002312 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002313void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002314 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002315{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002316 conf->curve_list = curve_list;
Brett Warrene0edc842021-08-17 09:53:13 +01002317 conf->group_list = NULL;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002318}
Brett Warrene0edc842021-08-17 09:53:13 +01002319#endif /* MBEDTLS_DEPRECATED_REMOVED */
Hanno Becker947194e2017-04-07 13:25:49 +01002320#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01002321
Brett Warrene0edc842021-08-17 09:53:13 +01002322/*
2323 * Set the allowed groups
2324 */
2325void mbedtls_ssl_conf_groups( mbedtls_ssl_config *conf,
2326 const uint16_t *group_list )
2327{
2328#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
2329 conf->curve_list = NULL;
2330#endif
2331 conf->group_list = group_list;
2332}
2333
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002334#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002335int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00002336{
Hanno Becker947194e2017-04-07 13:25:49 +01002337 /* Initialize to suppress unnecessary compiler warning */
2338 size_t hostname_len = 0;
2339
2340 /* Check if new hostname is valid before
2341 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01002342 if( hostname != NULL )
2343 {
2344 hostname_len = strlen( hostname );
2345
2346 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
2347 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2348 }
2349
2350 /* Now it's clear that we will overwrite the old hostname,
2351 * so we can free it safely */
2352
2353 if( ssl->hostname != NULL )
2354 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05002355 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01002356 mbedtls_free( ssl->hostname );
2357 }
2358
2359 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01002360
Paul Bakker5121ce52009-01-03 21:22:43 +00002361 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01002362 {
2363 ssl->hostname = NULL;
2364 }
2365 else
2366 {
2367 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01002368 if( ssl->hostname == NULL )
2369 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002370
Hanno Becker947194e2017-04-07 13:25:49 +01002371 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02002372
Hanno Becker947194e2017-04-07 13:25:49 +01002373 ssl->hostname[hostname_len] = '\0';
2374 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002375
2376 return( 0 );
2377}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01002378#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00002379
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01002380#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002381void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002382 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00002383 const unsigned char *, size_t),
2384 void *p_sni )
2385{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002386 conf->f_sni = f_sni;
2387 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00002388}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002389#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00002390
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002391#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002392int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002393{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002394 size_t cur_len, tot_len;
2395 const char **p;
2396
2397 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08002398 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
2399 * MUST NOT be truncated."
2400 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002401 */
2402 tot_len = 0;
2403 for( p = protos; *p != NULL; p++ )
2404 {
2405 cur_len = strlen( *p );
2406 tot_len += cur_len;
2407
Ronald Cron8216dd32020-04-23 16:41:44 +02002408 if( ( cur_len == 0 ) ||
2409 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
2410 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002411 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002412 }
2413
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002414 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002415
2416 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002417}
2418
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002419const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002420{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002421 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002422}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002423#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02002424
Johan Pascalb62bb512015-12-03 21:56:45 +01002425#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldoref72faf2018-07-12 11:54:20 +03002426void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf,
2427 int support_mki_value )
Ron Eldor591f1622018-01-22 12:30:04 +02002428{
2429 conf->dtls_srtp_mki_support = support_mki_value;
2430}
2431
Ron Eldoref72faf2018-07-12 11:54:20 +03002432int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl,
2433 unsigned char *mki_value,
Johan Pascalf6417ec2020-09-22 15:15:19 +02002434 uint16_t mki_len )
Ron Eldor591f1622018-01-22 12:30:04 +02002435{
Johan Pascal5ef72d22020-10-28 17:05:47 +01002436 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH )
Ron Eldora9788042018-12-05 11:04:31 +02002437 {
Johan Pascald576fdb2020-09-22 10:39:53 +02002438 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Ron Eldora9788042018-12-05 11:04:31 +02002439 }
Ron Eldor591f1622018-01-22 12:30:04 +02002440
2441 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED )
Ron Eldora9788042018-12-05 11:04:31 +02002442 {
Johan Pascald576fdb2020-09-22 10:39:53 +02002443 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Ron Eldora9788042018-12-05 11:04:31 +02002444 }
Ron Eldor591f1622018-01-22 12:30:04 +02002445
2446 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len );
2447 ssl->dtls_srtp_info.mki_len = mki_len;
Ron Eldora9788042018-12-05 11:04:31 +02002448 return( 0 );
Ron Eldor591f1622018-01-22 12:30:04 +02002449}
2450
Ron Eldoref72faf2018-07-12 11:54:20 +03002451int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf,
Johan Pascal253d0262020-09-22 13:04:45 +02002452 const mbedtls_ssl_srtp_profile *profiles )
Johan Pascalb62bb512015-12-03 21:56:45 +01002453{
Johan Pascal253d0262020-09-22 13:04:45 +02002454 const mbedtls_ssl_srtp_profile *p;
2455 size_t list_size = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01002456
Johan Pascal253d0262020-09-22 13:04:45 +02002457 /* check the profiles list: all entry must be valid,
2458 * its size cannot be more than the total number of supported profiles, currently 4 */
Johan Pascald387aa02020-09-23 18:47:56 +02002459 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
2460 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
2461 p++ )
Johan Pascald576fdb2020-09-22 10:39:53 +02002462 {
Johan Pascal5ef72d22020-10-28 17:05:47 +01002463 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET )
Johan Pascald576fdb2020-09-22 10:39:53 +02002464 {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02002465 list_size++;
2466 }
2467 else
2468 {
2469 /* unsupported value, stop parsing and set the size to an error value */
2470 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
Johan Pascalb62bb512015-12-03 21:56:45 +01002471 }
2472 }
2473
Johan Pascal5ef72d22020-10-28 17:05:47 +01002474 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH )
Johan Pascald387aa02020-09-23 18:47:56 +02002475 {
Johan Pascal253d0262020-09-22 13:04:45 +02002476 conf->dtls_srtp_profile_list = NULL;
2477 conf->dtls_srtp_profile_list_len = 0;
2478 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2479 }
2480
Johan Pascal9bc97ca2020-09-21 23:44:45 +02002481 conf->dtls_srtp_profile_list = profiles;
Johan Pascal253d0262020-09-22 13:04:45 +02002482 conf->dtls_srtp_profile_list_len = list_size;
Johan Pascalb62bb512015-12-03 21:56:45 +01002483
2484 return( 0 );
2485}
2486
Johan Pascal5ef72d22020-10-28 17:05:47 +01002487void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl,
2488 mbedtls_dtls_srtp_info *dtls_srtp_info )
Johan Pascalb62bb512015-12-03 21:56:45 +01002489{
Johan Pascal2258a4f2020-10-28 13:53:09 +01002490 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
2491 /* do not copy the mki value if there is no chosen profile */
Johan Pascal5ef72d22020-10-28 17:05:47 +01002492 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01002493 {
Johan Pascal2258a4f2020-10-28 13:53:09 +01002494 dtls_srtp_info->mki_len = 0;
Johan Pascal0dbcd1d2020-10-28 11:03:07 +01002495 }
Johan Pascal2258a4f2020-10-28 13:53:09 +01002496 else
2497 {
2498 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
Johan Pascal5ef72d22020-10-28 17:05:47 +01002499 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
2500 ssl->dtls_srtp_info.mki_len );
Johan Pascal2258a4f2020-10-28 13:53:09 +01002501 }
Johan Pascalb62bb512015-12-03 21:56:45 +01002502}
Johan Pascalb62bb512015-12-03 21:56:45 +01002503#endif /* MBEDTLS_SSL_DTLS_SRTP */
2504
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02002505void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00002506{
Glenn Strauss2dfcea22022-03-14 17:26:42 -04002507 conf->max_tls_version = (major << 8) | minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00002508}
2509
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02002510void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00002511{
Glenn Strauss2dfcea22022-03-14 17:26:42 -04002512 conf->min_tls_version = (major << 8) | minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00002513}
2514
Janos Follath088ce432017-04-10 12:42:31 +01002515#if defined(MBEDTLS_SSL_SRV_C)
2516void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
2517 char cert_req_ca_list )
2518{
2519 conf->cert_req_ca_list = cert_req_ca_list;
2520}
2521#endif
2522
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002523#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002524void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002525{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002526 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002527}
2528#endif
2529
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002530#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002531void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002532{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002533 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002534}
2535#endif
2536
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002537#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002538int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002539{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002540 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10002541 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002542 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002543 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002544 }
2545
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01002546 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002547
2548 return( 0 );
2549}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002550#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02002551
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002552void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00002553{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002554 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00002555}
2556
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002557#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002558void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002559{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002560 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002561}
2562
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002563void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02002564{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002565 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02002566}
2567
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02002568void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01002569 const unsigned char period[8] )
2570{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02002571 memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01002572}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002573#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00002574
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002575#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002576#if defined(MBEDTLS_SSL_CLI_C)
2577void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002578{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01002579 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002580}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002581#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02002582
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002583#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02002584void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
2585 mbedtls_ssl_ticket_write_t *f_ticket_write,
2586 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
2587 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +02002588{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02002589 conf->f_ticket_write = f_ticket_write;
2590 conf->f_ticket_parse = f_ticket_parse;
2591 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02002592}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02002593#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002594#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02002595
Hanno Becker7e6c1782021-06-08 09:24:55 +01002596void mbedtls_ssl_set_export_keys_cb( mbedtls_ssl_context *ssl,
2597 mbedtls_ssl_export_keys_t *f_export_keys,
2598 void *p_export_keys )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01002599{
Hanno Becker7e6c1782021-06-08 09:24:55 +01002600 ssl->f_export_keys = f_export_keys;
2601 ssl->p_export_keys = p_export_keys;
Ron Eldorf5cc10d2019-05-07 18:33:40 +03002602}
Robert Cragie4feb7ae2015-10-02 13:33:37 +01002603
Gilles Peskineb74a1c72018-04-24 13:09:22 +02002604#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002605void mbedtls_ssl_conf_async_private_cb(
2606 mbedtls_ssl_config *conf,
2607 mbedtls_ssl_async_sign_t *f_async_sign,
2608 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
2609 mbedtls_ssl_async_resume_t *f_async_resume,
2610 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002611 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002612{
2613 conf->f_async_sign_start = f_async_sign;
2614 conf->f_async_decrypt_start = f_async_decrypt;
2615 conf->f_async_resume = f_async_resume;
2616 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002617 conf->p_async_config_data = async_config_data;
2618}
2619
Gilles Peskine8f97af72018-04-26 11:46:10 +02002620void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
2621{
2622 return( conf->p_async_config_data );
2623}
2624
Gilles Peskine1febfef2018-04-30 11:54:39 +02002625void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002626{
2627 if( ssl->handshake == NULL )
2628 return( NULL );
2629 else
2630 return( ssl->handshake->user_async_ctx );
2631}
2632
Gilles Peskine1febfef2018-04-30 11:54:39 +02002633void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002634 void *ctx )
2635{
2636 if( ssl->handshake != NULL )
2637 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002638}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02002639#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01002640
Paul Bakker5121ce52009-01-03 21:22:43 +00002641/*
2642 * SSL get accessors
2643 */
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02002644uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002645{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00002646 if( ssl->session != NULL )
2647 return( ssl->session->verify_result );
2648
2649 if( ssl->session_negotiate != NULL )
2650 return( ssl->session_negotiate->verify_result );
2651
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +02002652 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +00002653}
2654
Glenn Strauss8f526902022-01-13 00:04:49 -05002655int mbedtls_ssl_get_ciphersuite_id_from_ssl( const mbedtls_ssl_context *ssl )
2656{
2657 if( ssl == NULL || ssl->session == NULL )
2658 return( 0 );
2659
2660 return( ssl->session->ciphersuite );
2661}
2662
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002663const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +00002664{
Paul Bakker926c8e42013-03-06 10:23:34 +01002665 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002666 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +01002667
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002668 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
Paul Bakker72f62662011-01-16 21:27:44 +00002669}
2670
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002671const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +00002672{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002673#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002674 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002675 {
Glenn Strauss60bfe602022-03-14 19:04:24 -04002676 switch( ssl->tls_version )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002677 {
Glenn Strauss60bfe602022-03-14 19:04:24 -04002678 case MBEDTLS_SSL_VERSION_TLS1_2:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002679 return( "DTLSv1.2" );
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002680 default:
2681 return( "unknown (DTLS)" );
2682 }
2683 }
2684#endif
2685
Glenn Strauss60bfe602022-03-14 19:04:24 -04002686 switch( ssl->tls_version )
Paul Bakker43ca69c2011-01-15 17:35:19 +00002687 {
Glenn Strauss60bfe602022-03-14 19:04:24 -04002688 case MBEDTLS_SSL_VERSION_TLS1_2:
Paul Bakker1ef83d62012-04-11 12:09:53 +00002689 return( "TLSv1.2" );
Glenn Strauss60bfe602022-03-14 19:04:24 -04002690 case MBEDTLS_SSL_VERSION_TLS1_3:
Gilles Peskinec63a1e02022-01-13 01:10:24 +01002691 return( "TLSv1.3" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00002692 default:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01002693 return( "unknown" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00002694 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00002695}
2696
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002697#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002698size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
2699{
David Horstmann95d516f2021-05-04 18:36:56 +01002700 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002701 size_t read_mfl;
2702
2703 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
2704 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
2705 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
2706 {
2707 return ssl_mfl_code_to_length( ssl->conf->mfl_code );
2708 }
2709
2710 /* Check if a smaller max length was negotiated */
2711 if( ssl->session_out != NULL )
2712 {
2713 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
2714 if( read_mfl < max_len )
2715 {
2716 max_len = read_mfl;
2717 }
2718 }
2719
2720 // During a handshake, use the value being negotiated
2721 if( ssl->session_negotiate != NULL )
2722 {
2723 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
2724 if( read_mfl < max_len )
2725 {
2726 max_len = read_mfl;
2727 }
2728 }
2729
2730 return( max_len );
2731}
2732
2733size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002734{
2735 size_t max_len;
2736
2737 /*
2738 * Assume mfl_code is correct since it was checked when set
2739 */
Angus Grattond8213d02016-05-25 20:56:48 +10002740 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002741
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02002742 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002743 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +10002744 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002745 {
Angus Grattond8213d02016-05-25 20:56:48 +10002746 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002747 }
2748
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02002749 /* During a handshake, use the value being negotiated */
2750 if( ssl->session_negotiate != NULL &&
2751 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
2752 {
2753 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
2754 }
2755
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002756 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02002757}
2758#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
2759
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002760#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00002761size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002762{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04002763 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
2764 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
2765 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
2766 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
2767 return ( 0 );
2768
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002769 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
2770 return( ssl->mtu );
2771
2772 if( ssl->mtu == 0 )
2773 return( ssl->handshake->mtu );
2774
2775 return( ssl->mtu < ssl->handshake->mtu ?
2776 ssl->mtu : ssl->handshake->mtu );
2777}
2778#endif /* MBEDTLS_SSL_PROTO_DTLS */
2779
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002780int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
2781{
2782 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
2783
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02002784#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
2785 !defined(MBEDTLS_SSL_PROTO_DTLS)
2786 (void) ssl;
2787#endif
2788
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002789#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04002790 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002791
2792 if( max_len > mfl )
2793 max_len = mfl;
2794#endif
2795
2796#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker89490712020-02-05 10:50:12 +00002797 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002798 {
Hanno Becker89490712020-02-05 10:50:12 +00002799 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002800 const int ret = mbedtls_ssl_get_record_expansion( ssl );
2801 const size_t overhead = (size_t) ret;
2802
2803 if( ret < 0 )
2804 return( ret );
2805
2806 if( mtu <= overhead )
2807 {
2808 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
2809 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2810 }
2811
2812 if( max_len > mtu - overhead )
2813 max_len = mtu - overhead;
2814 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02002815#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002816
Hanno Becker0defedb2018-08-10 12:35:02 +01002817#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
2818 !defined(MBEDTLS_SSL_PROTO_DTLS)
2819 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02002820#endif
2821
2822 return( (int) max_len );
2823}
2824
Hanno Becker2d8e99b2021-04-21 06:19:50 +01002825int mbedtls_ssl_get_max_in_record_payload( const mbedtls_ssl_context *ssl )
2826{
2827 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
2828
2829#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2830 (void) ssl;
2831#endif
2832
2833#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2834 const size_t mfl = mbedtls_ssl_get_input_max_frag_len( ssl );
2835
2836 if( max_len > mfl )
2837 max_len = mfl;
2838#endif
2839
2840 return( (int) max_len );
2841}
2842
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002843#if defined(MBEDTLS_X509_CRT_PARSE_C)
2844const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +00002845{
2846 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002847 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +00002848
Hanno Beckere6824572019-02-07 13:18:46 +00002849#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +02002850 return( ssl->session->peer_cert );
Hanno Beckere6824572019-02-07 13:18:46 +00002851#else
2852 return( NULL );
2853#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +00002854}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002855#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00002856
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002857#if defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerf852b1c2019-02-05 11:42:30 +00002858int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
2859 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002860{
Hanno Beckere810bbc2021-05-14 16:01:05 +01002861 int ret;
2862
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002863 if( ssl == NULL ||
2864 dst == NULL ||
2865 ssl->session == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002866 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002867 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002868 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002869 }
2870
Hanno Beckere810bbc2021-05-14 16:01:05 +01002871 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
2872 * idempotent: Each session can only be exported once.
2873 *
2874 * (This is in preparation for TLS 1.3 support where we will
2875 * need the ability to export multiple sessions (aka tickets),
2876 * which will be achieved by calling mbedtls_ssl_get_session()
2877 * multiple times until it fails.)
2878 *
2879 * Check whether we have already exported the current session,
2880 * and fail if so.
2881 */
2882 if( ssl->session->exported == 1 )
2883 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2884
2885 ret = mbedtls_ssl_session_copy( dst, ssl->session );
2886 if( ret != 0 )
2887 return( ret );
2888
2889 /* Remember that we've exported the session. */
2890 ssl->session->exported = 1;
2891 return( 0 );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002892}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002893#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02002894
Paul Bakker5121ce52009-01-03 21:22:43 +00002895/*
Hanno Beckera835da52019-05-16 12:39:07 +01002896 * Define ticket header determining Mbed TLS version
2897 * and structure of the ticket.
2898 */
2899
Hanno Becker94ef3b32019-05-16 12:50:45 +01002900/*
Hanno Becker50b59662019-05-28 14:30:45 +01002901 * Define bitflag determining compile-time settings influencing
2902 * structure of serialized SSL sessions.
Hanno Becker94ef3b32019-05-16 12:50:45 +01002903 */
2904
Hanno Becker50b59662019-05-28 14:30:45 +01002905#if defined(MBEDTLS_HAVE_TIME)
Hanno Becker3e088662019-05-29 11:10:18 +01002906#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker50b59662019-05-28 14:30:45 +01002907#else
Hanno Becker3e088662019-05-29 11:10:18 +01002908#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002909#endif /* MBEDTLS_HAVE_TIME */
2910
2911#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker3e088662019-05-29 11:10:18 +01002912#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002913#else
Hanno Becker3e088662019-05-29 11:10:18 +01002914#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002915#endif /* MBEDTLS_X509_CRT_PARSE_C */
2916
2917#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker3e088662019-05-29 11:10:18 +01002918#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002919#else
Hanno Becker3e088662019-05-29 11:10:18 +01002920#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002921#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
2922
2923#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker3e088662019-05-29 11:10:18 +01002924#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002925#else
Hanno Becker3e088662019-05-29 11:10:18 +01002926#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002927#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
2928
Hanno Becker94ef3b32019-05-16 12:50:45 +01002929#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3e088662019-05-29 11:10:18 +01002930#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01002931#else
Hanno Becker3e088662019-05-29 11:10:18 +01002932#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01002933#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
2934
Hanno Becker94ef3b32019-05-16 12:50:45 +01002935#if defined(MBEDTLS_SSL_SESSION_TICKETS)
2936#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
2937#else
2938#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
2939#endif /* MBEDTLS_SSL_SESSION_TICKETS */
2940
Hanno Becker3e088662019-05-29 11:10:18 +01002941#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
2942#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
2943#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
2944#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
Hanno Becker37bdbe62021-08-01 05:38:58 +01002945#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
2946#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
Hanno Becker3e088662019-05-29 11:10:18 +01002947
Hanno Becker50b59662019-05-28 14:30:45 +01002948#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Becker3e088662019-05-29 11:10:18 +01002949 ( (uint16_t) ( \
2950 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
2951 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
2952 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
2953 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
Hanno Becker3e088662019-05-29 11:10:18 +01002954 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Beckerbe34e8e2019-06-04 09:43:16 +01002955 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) )
Hanno Becker94ef3b32019-05-16 12:50:45 +01002956
Hanno Beckerf8787072019-05-16 12:41:07 +01002957static unsigned char ssl_serialized_session_header[] = {
Hanno Becker94ef3b32019-05-16 12:50:45 +01002958 MBEDTLS_VERSION_MAJOR,
2959 MBEDTLS_VERSION_MINOR,
2960 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01002961 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
2962 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
Hanno Beckerf8787072019-05-16 12:41:07 +01002963};
Hanno Beckera835da52019-05-16 12:39:07 +01002964
2965/*
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002966 * Serialize a session in the following format:
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02002967 * (in the presentation language of TLS, RFC 8446 section 3)
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002968 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002969 * struct {
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01002970 *
Hanno Beckerdce50972021-08-01 05:39:23 +01002971 * opaque mbedtls_version[3]; // library version: major, minor, patch
2972 * opaque session_format[2]; // library-version specific 16-bit field
2973 * // determining the format of the remaining
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002974 * // serialized data.
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01002975 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002976 * Note: When updating the format, remember to keep
2977 * these version+format bytes.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002978 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002979 * // In this version, `session_format` determines
2980 * // the setting of those compile-time
2981 * // configuration options which influence
2982 * // the structure of mbedtls_ssl_session.
2983 *
Glenn Straussda7851c2022-03-14 13:29:48 -04002984 * uint8_t minor_ver; // Protocol minor version. Possible values:
2985 * // - TLS 1.2 (3)
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002986 *
Glenn Straussda7851c2022-03-14 13:29:48 -04002987 * select (serialized_session.tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002988 *
Glenn Straussda7851c2022-03-14 13:29:48 -04002989 * case MBEDTLS_SSL_VERSION_TLS1_2:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002990 * serialized_session_tls12 data;
2991 *
2992 * };
2993 *
2994 * } serialized_session;
2995 *
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02002996 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002997
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002998MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01002999static int ssl_session_save( const mbedtls_ssl_session *session,
3000 unsigned char omit_header,
3001 unsigned char *buf,
3002 size_t buf_len,
3003 size_t *olen )
3004{
3005 unsigned char *p = buf;
3006 size_t used = 0;
Jerry Yu251a12e2022-07-13 15:15:48 +08003007 size_t remaining_len;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003008
Jerry Yu438ddd82022-07-07 06:55:50 +00003009 if( session == NULL )
3010 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3011
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003012 if( !omit_header )
3013 {
3014 /*
3015 * Add Mbed TLS version identifier
3016 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003017 used += sizeof( ssl_serialized_session_header );
3018
3019 if( used <= buf_len )
3020 {
3021 memcpy( p, ssl_serialized_session_header,
3022 sizeof( ssl_serialized_session_header ) );
3023 p += sizeof( ssl_serialized_session_header );
3024 }
3025 }
3026
3027 /*
3028 * TLS version identifier
3029 */
3030 used += 1;
3031 if( used <= buf_len )
3032 {
Glenn Straussda7851c2022-03-14 13:29:48 -04003033 *p++ = MBEDTLS_BYTE_0( session->tls_version );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003034 }
3035
3036 /* Forward to version-specific serialization routine. */
Jerry Yufca4d572022-07-21 10:37:48 +08003037 remaining_len = (buf_len >= used) ? buf_len - used : 0;
Glenn Straussda7851c2022-03-14 13:29:48 -04003038 switch( session->tls_version )
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003039 {
3040#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Glenn Straussda7851c2022-03-14 13:29:48 -04003041 case MBEDTLS_SSL_VERSION_TLS1_2:
Jerry Yu438ddd82022-07-07 06:55:50 +00003042 used += ssl_tls12_session_save( session, p, remaining_len );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003043 break;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003044#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3045
Jerry Yu251a12e2022-07-13 15:15:48 +08003046#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3047 case MBEDTLS_SSL_VERSION_TLS1_3:
Jerry Yu438ddd82022-07-07 06:55:50 +00003048 used += ssl_tls13_session_save( session, p, remaining_len );
Jerry Yu251a12e2022-07-13 15:15:48 +08003049 break;
Jerry Yu251a12e2022-07-13 15:15:48 +08003050#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3051
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003052 default:
3053 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3054 }
3055
3056 *olen = used;
Manuel Pégourié-Gonnard26f982f2019-05-21 11:01:32 +02003057 if( used > buf_len )
3058 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003059
3060 return( 0 );
3061}
3062
3063/*
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003064 * Public wrapper for ssl_session_save()
3065 */
3066int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
3067 unsigned char *buf,
3068 size_t buf_len,
3069 size_t *olen )
3070{
3071 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
3072}
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003073
Jerry Yuf1b23ca2022-02-18 11:48:47 +08003074/*
3075 * Deserialize session, see mbedtls_ssl_session_save() for format.
3076 *
3077 * This internal version is wrapped by a public function that cleans up in
3078 * case of error, and has an extra option omit_header.
3079 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003080MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003081static int ssl_session_load( mbedtls_ssl_session *session,
3082 unsigned char omit_header,
3083 const unsigned char *buf,
3084 size_t len )
3085{
3086 const unsigned char *p = buf;
3087 const unsigned char * const end = buf + len;
Jerry Yu438ddd82022-07-07 06:55:50 +00003088 size_t remaining_len;
3089
3090
3091 if( session == NULL )
3092 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003093
3094 if( !omit_header )
3095 {
3096 /*
3097 * Check Mbed TLS version identifier
3098 */
3099
3100 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
3101 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3102
3103 if( memcmp( p, ssl_serialized_session_header,
3104 sizeof( ssl_serialized_session_header ) ) != 0 )
3105 {
3106 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
3107 }
3108 p += sizeof( ssl_serialized_session_header );
3109 }
3110
3111 /*
3112 * TLS version identifier
3113 */
3114 if( 1 > (size_t)( end - p ) )
3115 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Glenn Straussda7851c2022-03-14 13:29:48 -04003116 session->tls_version = 0x0300 | *p++;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003117
3118 /* Dispatch according to TLS version. */
Jerry Yu438ddd82022-07-07 06:55:50 +00003119 remaining_len = ( end - p );
Glenn Straussda7851c2022-03-14 13:29:48 -04003120 switch( session->tls_version )
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003121 {
3122#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Glenn Straussda7851c2022-03-14 13:29:48 -04003123 case MBEDTLS_SSL_VERSION_TLS1_2:
Jerry Yu438ddd82022-07-07 06:55:50 +00003124 return( ssl_tls12_session_load( session, p, remaining_len ) );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003125#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3126
Jerry Yu438ddd82022-07-07 06:55:50 +00003127#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3128 case MBEDTLS_SSL_VERSION_TLS1_3:
3129 return( ssl_tls13_session_load( session, p, remaining_len ) );
3130#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3131
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003132 default:
3133 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3134 }
3135}
3136
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003137/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02003138 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003139 */
3140int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
3141 const unsigned char *buf,
3142 size_t len )
3143{
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003144 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003145
3146 if( ret != 0 )
3147 mbedtls_ssl_session_free( session );
3148
3149 return( ret );
3150}
3151
3152/*
Paul Bakker1961b702013-01-25 14:49:24 +01003153 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00003154 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003155MBEDTLS_CHECK_RETURN_CRITICAL
Hanno Becker41934dd2021-08-07 19:13:43 +01003156static int ssl_prepare_handshake_step( mbedtls_ssl_context *ssl )
3157{
3158 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3159
Ronald Cron66dbf912022-02-02 15:33:46 +01003160 /*
3161 * We may have not been able to send to the peer all the handshake data
Ronald Cron3f20b772022-03-08 16:00:02 +01003162 * that were written into the output buffer by the previous handshake step,
3163 * if the write to the network callback returned with the
Ronald Cron66dbf912022-02-02 15:33:46 +01003164 * #MBEDTLS_ERR_SSL_WANT_WRITE error code.
3165 * We proceed to the next handshake step only when all data from the
3166 * previous one have been sent to the peer, thus we make sure that this is
3167 * the case here by calling `mbedtls_ssl_flush_output()`. The function may
3168 * return with the #MBEDTLS_ERR_SSL_WANT_WRITE error code in which case
3169 * we have to wait before to go ahead.
3170 * In the case of TLS 1.3, handshake step handlers do not send data to the
3171 * peer. Data are only sent here and through
3172 * `mbedtls_ssl_handle_pending_alert` in case an error that triggered an
Andrzej Kurek5c65c572022-04-13 14:28:52 -04003173 * alert occurred.
Ronald Cron66dbf912022-02-02 15:33:46 +01003174 */
Hanno Becker41934dd2021-08-07 19:13:43 +01003175 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
3176 return( ret );
3177
3178#if defined(MBEDTLS_SSL_PROTO_DTLS)
3179 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3180 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
3181 {
3182 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
3183 return( ret );
3184 }
3185#endif /* MBEDTLS_SSL_PROTO_DTLS */
3186
3187 return( ret );
3188}
3189
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003190int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003191{
Hanno Becker41934dd2021-08-07 19:13:43 +01003192 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00003193
Hanno Becker41934dd2021-08-07 19:13:43 +01003194 if( ssl == NULL ||
3195 ssl->conf == NULL ||
3196 ssl->handshake == NULL ||
Paul Elliott27b0d942022-03-18 21:55:32 +00003197 mbedtls_ssl_is_handshake_over( ssl ) == 1 )
Hanno Becker41934dd2021-08-07 19:13:43 +01003198 {
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003199 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker41934dd2021-08-07 19:13:43 +01003200 }
3201
3202 ret = ssl_prepare_handshake_step( ssl );
3203 if( ret != 0 )
3204 return( ret );
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003205
Jerry Yue7047812021-09-13 19:26:39 +08003206 ret = mbedtls_ssl_handle_pending_alert( ssl );
3207 if( ret != 0 )
3208 goto cleanup;
3209
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003210#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003211 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Jerry Yub9930e72021-08-06 17:11:51 +08003212 {
Ronald Cron27c85e72022-03-08 11:37:55 +01003213 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %s",
3214 mbedtls_ssl_states_str( ssl->state ) ) );
Jerry Yub9930e72021-08-06 17:11:51 +08003215
Ronald Cron9f0fba32022-02-10 16:45:15 +01003216 switch( ssl->state )
3217 {
3218 case MBEDTLS_SSL_HELLO_REQUEST:
3219 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
3220 break;
Jerry Yub9930e72021-08-06 17:11:51 +08003221
Ronald Cron9f0fba32022-02-10 16:45:15 +01003222 case MBEDTLS_SSL_CLIENT_HELLO:
3223 ret = mbedtls_ssl_write_client_hello( ssl );
3224 break;
3225
3226 default:
3227#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Glenn Strauss60bfe602022-03-14 19:04:24 -04003228 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
Ronald Cron9f0fba32022-02-10 16:45:15 +01003229 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
3230 else
3231 ret = mbedtls_ssl_handshake_client_step( ssl );
3232#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
3233 ret = mbedtls_ssl_handshake_client_step( ssl );
3234#else
3235 ret = mbedtls_ssl_tls13_handshake_client_step( ssl );
3236#endif
3237 }
Jerry Yub9930e72021-08-06 17:11:51 +08003238 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003239#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003240#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003241 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Jerry Yub9930e72021-08-06 17:11:51 +08003242 {
Ronald Cron6f135e12021-12-08 16:57:54 +01003243#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yub9930e72021-08-06 17:11:51 +08003244 if( mbedtls_ssl_conf_is_tls13_only( ssl->conf ) )
Jerry Yu27561932021-08-27 17:07:38 +08003245 ret = mbedtls_ssl_tls13_handshake_server_step( ssl );
Ronald Cron6f135e12021-12-08 16:57:54 +01003246#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yub9930e72021-08-06 17:11:51 +08003247
3248#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3249 if( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) )
3250 ret = mbedtls_ssl_handshake_server_step( ssl );
3251#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3252 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003253#endif
3254
Jerry Yue7047812021-09-13 19:26:39 +08003255 if( ret != 0 )
3256 {
Jerry Yubbd5a3f2021-09-18 20:50:22 +08003257 /* handshake_step return error. And it is same
3258 * with alert_reason.
3259 */
Jerry Yu3bf1f972021-09-22 21:37:18 +08003260 if( ssl->send_alert )
Jerry Yue7047812021-09-13 19:26:39 +08003261 {
Jerry Yu3bf1f972021-09-22 21:37:18 +08003262 ret = mbedtls_ssl_handle_pending_alert( ssl );
Jerry Yue7047812021-09-13 19:26:39 +08003263 goto cleanup;
3264 }
3265 }
3266
3267cleanup:
Paul Bakker1961b702013-01-25 14:49:24 +01003268 return( ret );
3269}
3270
3271/*
3272 * Perform the SSL handshake
3273 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003274int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +01003275{
3276 int ret = 0;
3277
Hanno Beckera817ea42020-10-20 15:20:23 +01003278 /* Sanity checks */
3279
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003280 if( ssl == NULL || ssl->conf == NULL )
3281 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3282
Hanno Beckera817ea42020-10-20 15:20:23 +01003283#if defined(MBEDTLS_SSL_PROTO_DTLS)
3284 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3285 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) )
3286 {
3287 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
3288 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
3289 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3290 }
3291#endif /* MBEDTLS_SSL_PROTO_DTLS */
3292
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003293 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +01003294
Hanno Beckera817ea42020-10-20 15:20:23 +01003295 /* Main handshake loop */
Paul Elliott27b0d942022-03-18 21:55:32 +00003296 while( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Paul Bakker1961b702013-01-25 14:49:24 +01003297 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003298 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003299
3300 if( ret != 0 )
3301 break;
3302 }
3303
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003304 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003305
3306 return( ret );
3307}
3308
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003309#if defined(MBEDTLS_SSL_RENEGOTIATION)
3310#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00003311/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003312 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00003313 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003314MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003315static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003316{
Janos Follath865b3eb2019-12-16 11:46:15 +00003317 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003318
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003319 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003320
3321 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003322 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3323 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003324
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003325 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003326 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003327 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003328 return( ret );
3329 }
3330
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003331 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003332
3333 return( 0 );
3334}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003335#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003336
3337/*
3338 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003339 * - any side: calling mbedtls_ssl_renegotiate(),
3340 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
3341 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02003342 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003343 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003344 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003345 */
Hanno Becker40cdaa12020-02-05 10:48:27 +00003346int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00003347{
Janos Follath865b3eb2019-12-16 11:46:15 +00003348 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker48916f92012-09-16 19:57:18 +00003349
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003350 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003351
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003352 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3353 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00003354
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003355 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
3356 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003357#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003358 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003359 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003360 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003361 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003362 ssl->handshake->out_msg_seq = 1;
3363 else
3364 ssl->handshake->in_msg_seq = 1;
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02003365 }
3366#endif
3367
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003368 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
3369 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00003370
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003371 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00003372 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003373 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +00003374 return( ret );
3375 }
3376
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003377 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003378
3379 return( 0 );
3380}
3381
3382/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003383 * Renegotiate current connection on client,
3384 * or request renegotiation on server
3385 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003386int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003387{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003388 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003389
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003390 if( ssl == NULL || ssl->conf == NULL )
3391 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3392
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003393#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003394 /* On server, just send the request */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003395 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003396 {
Paul Elliott27b0d942022-03-18 21:55:32 +00003397 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003398 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003399
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003400 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003401
3402 /* Did we already try/start sending HelloRequest? */
3403 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003404 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02003405
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003406 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003407 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003408#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003409
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003410#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003411 /*
3412 * On client, either start the renegotiation process or,
3413 * if already in progress, continue the handshake
3414 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003415 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003416 {
Paul Elliott27b0d942022-03-18 21:55:32 +00003417 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003418 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003419
Hanno Becker40cdaa12020-02-05 10:48:27 +00003420 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003421 {
Hanno Becker40cdaa12020-02-05 10:48:27 +00003422 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003423 return( ret );
3424 }
3425 }
3426 else
3427 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003428 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003429 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003430 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003431 return( ret );
3432 }
3433 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003434#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01003435
Paul Bakker37ce0ff2013-10-31 14:32:04 +01003436 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003437}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003438#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01003439
Gilles Peskine9b562d52018-04-25 20:32:43 +02003440void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00003441{
Gilles Peskine9b562d52018-04-25 20:32:43 +02003442 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3443
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003444 if( handshake == NULL )
3445 return;
3446
Brett Warrene0edc842021-08-17 09:53:13 +01003447#if defined(MBEDTLS_ECP_C)
3448#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3449 if ( ssl->handshake->group_list_heap_allocated )
3450 mbedtls_free( (void*) handshake->group_list );
3451 handshake->group_list = NULL;
3452#endif /* MBEDTLS_DEPRECATED_REMOVED */
3453#endif /* MBEDTLS_ECP_C */
3454
Jerry Yuf017ee42022-01-12 15:49:48 +08003455#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
3456#if !defined(MBEDTLS_DEPRECATED_REMOVED)
3457 if ( ssl->handshake->sig_algs_heap_allocated )
3458 mbedtls_free( (void*) handshake->sig_algs );
3459 handshake->sig_algs = NULL;
3460#endif /* MBEDTLS_DEPRECATED_REMOVED */
Xiaofei Baic234ecf2022-02-08 09:59:23 +00003461#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3462 if( ssl->handshake->certificate_request_context )
3463 {
3464 mbedtls_free( (void*) handshake->certificate_request_context );
3465 }
3466#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuf017ee42022-01-12 15:49:48 +08003467#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
3468
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003469#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3470 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
3471 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003472 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003473 handshake->async_in_progress = 0;
3474 }
3475#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3476
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003477#if defined(MBEDTLS_SHA256_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05003478#if defined(MBEDTLS_USE_PSA_CRYPTO)
3479 psa_hash_abort( &handshake->fin_sha256_psa );
3480#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003481 mbedtls_sha256_free( &handshake->fin_sha256 );
3482#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05003483#endif
Mateusz Starzykc6d94ab2021-05-19 13:31:59 +02003484#if defined(MBEDTLS_SHA384_C)
Andrzej Kurekeb342242019-01-29 09:14:33 -05003485#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -05003486 psa_hash_abort( &handshake->fin_sha384_psa );
Andrzej Kurekeb342242019-01-29 09:14:33 -05003487#else
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003488 mbedtls_sha512_free( &handshake->fin_sha512 );
3489#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05003490#endif
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02003491
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003492#if defined(MBEDTLS_DHM_C)
3493 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +00003494#endif
Neil Armstrongf3f46412022-04-12 14:43:39 +02003495#if !defined(MBEDTLS_USE_PSA_CRYPTO) && defined(MBEDTLS_ECDH_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003496 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +02003497#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02003498#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02003499 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02003500#if defined(MBEDTLS_SSL_CLI_C)
3501 mbedtls_free( handshake->ecjpake_cache );
3502 handshake->ecjpake_cache = NULL;
3503 handshake->ecjpake_cache_len = 0;
3504#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02003505#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02003506
Janos Follath4ae5c292016-02-10 11:27:43 +00003507#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
3508 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02003509 /* explicit void pointer cast for buggy MS compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003510 mbedtls_free( (void *) handshake->curves );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02003511#endif
3512
Gilles Peskineeccd8882020-03-10 12:19:08 +01003513#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02003514#if defined(MBEDTLS_USE_PSA_CRYPTO)
3515 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
3516 {
3517 /* The maintenance of the external PSK key slot is the
3518 * user's responsibility. */
3519 if( ssl->handshake->psk_opaque_is_internal )
3520 {
3521 psa_destroy_key( ssl->handshake->psk_opaque );
3522 ssl->handshake->psk_opaque_is_internal = 0;
3523 }
3524 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
3525 }
Neil Armstronge952a302022-05-03 10:22:14 +02003526#else
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003527 if( handshake->psk != NULL )
3528 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003529 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003530 mbedtls_free( handshake->psk );
3531 }
Neil Armstronge952a302022-05-03 10:22:14 +02003532#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01003533#endif
3534
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003535#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3536 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02003537 /*
3538 * Free only the linked list wrapper, not the keys themselves
3539 * since the belong to the SNI callback
3540 */
Glenn Strauss36872db2022-01-22 05:06:31 -05003541 ssl_key_cert_free( handshake->sni_key_cert );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003542#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02003543
Gilles Peskineeccd8882020-03-10 12:19:08 +01003544#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02003545 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Becker3dad3112019-02-05 17:19:52 +00003546 if( handshake->ecrs_peer_cert != NULL )
3547 {
3548 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
3549 mbedtls_free( handshake->ecrs_peer_cert );
3550 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02003551#endif
3552
Hanno Becker75173122019-02-06 16:18:31 +00003553#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
3554 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3555 mbedtls_pk_free( &handshake->peer_pubkey );
3556#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3557
XiaokangQian9b93c0d2022-02-09 06:02:25 +00003558#if defined(MBEDTLS_SSL_CLI_C) && \
3559 ( defined(MBEDTLS_SSL_PROTO_DTLS) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
3560 mbedtls_free( handshake->cookie );
3561#endif /* MBEDTLS_SSL_CLI_C &&
3562 ( MBEDTLS_SSL_PROTO_DTLS || MBEDTLS_SSL_PROTO_TLS1_3 ) */
XiaokangQian8499b6c2022-01-27 09:00:11 +00003563
3564#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker533ab5f2020-02-05 10:49:13 +00003565 mbedtls_ssl_flight_free( handshake->flight );
3566 mbedtls_ssl_buffering_free( ssl );
XiaokangQian8499b6c2022-01-27 09:00:11 +00003567#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02003568
Ronald Cronf12b81d2022-03-15 10:42:41 +01003569#if defined(MBEDTLS_ECDH_C) && \
3570 ( defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
Neil Armstrongf716a702022-04-04 11:23:46 +02003571 if( handshake->ecdh_psa_privkey_is_external == 0 )
Neil Armstrong8113d252022-03-23 10:57:04 +01003572 psa_destroy_key( handshake->ecdh_psa_privkey );
Hanno Becker4a63ed42019-01-08 11:39:35 +00003573#endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */
3574
Ronald Cron6f135e12021-12-08 16:57:54 +01003575#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yua1a568c2021-11-09 10:17:21 +08003576 mbedtls_ssl_transform_free( handshake->transform_handshake );
3577 mbedtls_ssl_transform_free( handshake->transform_earlydata );
Jerry Yuba9c7272021-10-30 11:54:10 +08003578 mbedtls_free( handshake->transform_earlydata );
3579 mbedtls_free( handshake->transform_handshake );
Ronald Cron6f135e12021-12-08 16:57:54 +01003580#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuba9c7272021-10-30 11:54:10 +08003581
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003582
3583#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
3584 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
3585 * processes datagrams and the fact that a datagram is allowed to have
3586 * several records in it, it is possible that the I/O buffers are not
3587 * empty at this stage */
Andrzej Kurek4a063792020-10-21 15:08:44 +02003588 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ),
3589 mbedtls_ssl_get_output_buflen( ssl ) );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05003590#endif
Hanno Becker3aa186f2021-08-10 09:24:19 +01003591
Jerry Yuba9c7272021-10-30 11:54:10 +08003592 /* mbedtls_platform_zeroize MUST be last one in this function */
3593 mbedtls_platform_zeroize( handshake,
3594 sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003595}
3596
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003597void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +00003598{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02003599 if( session == NULL )
3600 return;
3601
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003602#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker1294a0b2019-02-05 12:38:15 +00003603 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +02003604#endif
Paul Bakker0a597072012-09-25 21:55:46 +00003605
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003606#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003607 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +02003608#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02003609
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05003610 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +00003611}
3612
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02003613#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003614
3615#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3616#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
3617#else
3618#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
3619#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3620
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003621#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003622
3623#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3624#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
3625#else
3626#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
3627#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3628
3629#if defined(MBEDTLS_SSL_ALPN)
3630#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
3631#else
3632#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
3633#endif /* MBEDTLS_SSL_ALPN */
3634
3635#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
3636#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
3637#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
3638#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
3639
3640#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
3641 ( (uint32_t) ( \
3642 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
3643 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
3644 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
3645 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
3646 0u ) )
3647
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003648static unsigned char ssl_serialized_context_header[] = {
3649 MBEDTLS_VERSION_MAJOR,
3650 MBEDTLS_VERSION_MINOR,
3651 MBEDTLS_VERSION_PATCH,
Joe Subbiani2194dc42021-07-14 12:31:31 +01003652 MBEDTLS_BYTE_1( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
3653 MBEDTLS_BYTE_0( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG ),
3654 MBEDTLS_BYTE_2( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
3655 MBEDTLS_BYTE_1( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
3656 MBEDTLS_BYTE_0( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG ),
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003657};
3658
Paul Bakker5121ce52009-01-03 21:22:43 +00003659/*
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003660 * Serialize a full SSL context
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003661 *
3662 * The format of the serialized data is:
3663 * (in the presentation language of TLS, RFC 8446 section 3)
3664 *
3665 * // header
3666 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003667 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003668 * // the format of the remaining
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003669 * // serialized data.
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02003670 * Note: When updating the format, remember to keep these
3671 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02003672 *
3673 * // session sub-structure
3674 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
3675 * // transform sub-structure
3676 * uint8 random[64]; // ServerHello.random+ClientHello.random
3677 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
3678 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
3679 * // fields from ssl_context
3680 * uint32 badmac_seen; // DTLS: number of records with failing MAC
3681 * uint64 in_window_top; // DTLS: last validated record seq_num
3682 * uint64 in_window; // DTLS: bitmask for replay protection
3683 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
3684 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
3685 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
3686 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
3687 *
3688 * Note that many fields of the ssl_context or sub-structures are not
3689 * serialized, as they fall in one of the following categories:
3690 *
3691 * 1. forced value (eg in_left must be 0)
3692 * 2. pointer to dynamically-allocated memory (eg session, transform)
3693 * 3. value can be re-derived from other data (eg session keys from MS)
3694 * 4. value was temporary (eg content of input buffer)
3695 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003696 */
3697int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
3698 unsigned char *buf,
3699 size_t buf_len,
3700 size_t *olen )
3701{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003702 unsigned char *p = buf;
3703 size_t used = 0;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003704 size_t session_len;
3705 int ret = 0;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003706
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003707 /*
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003708 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
3709 * this function's documentation.
3710 *
3711 * These are due to assumptions/limitations in the implementation. Some of
3712 * them are likely to stay (no handshake in progress) some might go away
3713 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003714 */
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003715 /* The initial handshake must be over */
Paul Elliott27b0d942022-03-18 21:55:32 +00003716 if( mbedtls_ssl_is_handshake_over( ssl ) == 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003717 {
3718 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) );
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02003719 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003720 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003721 if( ssl->handshake != NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003722 {
3723 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003724 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003725 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003726 /* Double-check that sub-structures are indeed ready */
3727 if( ssl->transform == NULL || ssl->session == NULL )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003728 {
3729 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003730 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003731 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003732 /* There must be no pending incoming or outgoing data */
3733 if( mbedtls_ssl_check_pending( ssl ) != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003734 {
3735 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003736 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003737 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003738 if( ssl->out_left != 0 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003739 {
3740 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003741 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003742 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003743 /* Protocol must be DLTS, not TLS */
3744 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003745 {
3746 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003747 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003748 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003749 /* Version must be 1.2 */
Glenn Strauss60bfe602022-03-14 19:04:24 -04003750 if( ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003751 {
3752 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003753 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003754 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003755 /* We must be using an AEAD ciphersuite */
3756 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003757 {
3758 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003759 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003760 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003761 /* Renegotiation must not be enabled */
3762#if defined(MBEDTLS_SSL_RENEGOTIATION)
3763 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED )
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003764 {
3765 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) );
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003766 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03003767 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02003768#endif
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003769
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003770 /*
3771 * Version and format identifier
3772 */
3773 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003774
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003775 if( used <= buf_len )
3776 {
3777 memcpy( p, ssl_serialized_context_header,
3778 sizeof( ssl_serialized_context_header ) );
3779 p += sizeof( ssl_serialized_context_header );
3780 }
3781
3782 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003783 * Session (length + data)
3784 */
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003785 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003786 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
3787 return( ret );
3788
3789 used += 4 + session_len;
3790 if( used <= buf_len )
3791 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003792 MBEDTLS_PUT_UINT32_BE( session_len, p, 0 );
3793 p += 4;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003794
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003795 ret = ssl_session_save( ssl->session, 1,
3796 p, session_len, &session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003797 if( ret != 0 )
3798 return( ret );
3799
3800 p += session_len;
3801 }
3802
3803 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003804 * Transform
3805 */
3806 used += sizeof( ssl->transform->randbytes );
3807 if( used <= buf_len )
3808 {
3809 memcpy( p, ssl->transform->randbytes,
3810 sizeof( ssl->transform->randbytes ) );
3811 p += sizeof( ssl->transform->randbytes );
3812 }
3813
3814#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
3815 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
3816 if( used <= buf_len )
3817 {
3818 *p++ = ssl->transform->in_cid_len;
3819 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
3820 p += ssl->transform->in_cid_len;
3821
3822 *p++ = ssl->transform->out_cid_len;
3823 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
3824 p += ssl->transform->out_cid_len;
3825 }
3826#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
3827
3828 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003829 * Saved fields from top-level ssl_context structure
3830 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003831 used += 4;
3832 if( used <= buf_len )
3833 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003834 MBEDTLS_PUT_UINT32_BE( ssl->badmac_seen, p, 0 );
3835 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003836 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003837
3838#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3839 used += 16;
3840 if( used <= buf_len )
3841 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003842 MBEDTLS_PUT_UINT64_BE( ssl->in_window_top, p, 0 );
3843 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003844
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003845 MBEDTLS_PUT_UINT64_BE( ssl->in_window, p, 0 );
3846 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003847 }
3848#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3849
3850#if defined(MBEDTLS_SSL_PROTO_DTLS)
3851 used += 1;
3852 if( used <= buf_len )
3853 {
3854 *p++ = ssl->disable_datagram_packing;
3855 }
3856#endif /* MBEDTLS_SSL_PROTO_DTLS */
3857
Jerry Yuae0b2e22021-10-08 15:21:19 +08003858 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003859 if( used <= buf_len )
3860 {
Jerry Yuae0b2e22021-10-08 15:21:19 +08003861 memcpy( p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
3862 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003863 }
3864
3865#if defined(MBEDTLS_SSL_PROTO_DTLS)
3866 used += 2;
3867 if( used <= buf_len )
3868 {
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01003869 MBEDTLS_PUT_UINT16_BE( ssl->mtu, p, 0 );
3870 p += 2;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003871 }
3872#endif /* MBEDTLS_SSL_PROTO_DTLS */
3873
3874#if defined(MBEDTLS_SSL_ALPN)
3875 {
3876 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnardf041f4e2019-07-24 00:58:27 +02003877 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02003878 : 0;
3879
3880 used += 1 + alpn_len;
3881 if( used <= buf_len )
3882 {
3883 *p++ = alpn_len;
3884
3885 if( ssl->alpn_chosen != NULL )
3886 {
3887 memcpy( p, ssl->alpn_chosen, alpn_len );
3888 p += alpn_len;
3889 }
3890 }
3891 }
3892#endif /* MBEDTLS_SSL_ALPN */
3893
3894 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003895 * Done
3896 */
3897 *olen = used;
3898
3899 if( used > buf_len )
3900 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003901
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003902 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
3903
Hanno Becker43aefe22020-02-05 10:44:56 +00003904 return( mbedtls_ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003905}
3906
3907/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02003908 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003909 *
3910 * This internal version is wrapped by a public function that cleans up in
3911 * case of error.
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003912 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003913MBEDTLS_CHECK_RETURN_CRITICAL
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003914static int ssl_context_load( mbedtls_ssl_context *ssl,
3915 const unsigned char *buf,
3916 size_t len )
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02003917{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003918 const unsigned char *p = buf;
3919 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003920 size_t session_len;
Janos Follath865b3eb2019-12-16 11:46:15 +00003921 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003922
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003923 /*
3924 * The context should have been freshly setup or reset.
3925 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard4ca930f2019-07-26 16:31:53 +02003926 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003927 * renegotiating, or if the user mistakenly loaded a session first.)
3928 */
3929 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
3930 ssl->session != NULL )
3931 {
3932 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3933 }
3934
3935 /*
3936 * We can't check that the config matches the initial one, but we can at
3937 * least check it matches the requirements for serializing.
3938 */
3939 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
Glenn Strauss2dfcea22022-03-14 17:26:42 -04003940 ssl->conf->max_tls_version < MBEDTLS_SSL_VERSION_TLS1_2 ||
3941 ssl->conf->min_tls_version > MBEDTLS_SSL_VERSION_TLS1_2 ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003942#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02003943 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003944#endif
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02003945 0 )
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02003946 {
3947 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3948 }
3949
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003950 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
3951
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02003952 /*
3953 * Check version identifier
3954 */
3955 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
3956 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3957
3958 if( memcmp( p, ssl_serialized_context_header,
3959 sizeof( ssl_serialized_context_header ) ) != 0 )
3960 {
3961 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
3962 }
3963 p += sizeof( ssl_serialized_context_header );
3964
3965 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003966 * Session
3967 */
3968 if( (size_t)( end - p ) < 4 )
3969 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3970
3971 session_len = ( (size_t) p[0] << 24 ) |
3972 ( (size_t) p[1] << 16 ) |
3973 ( (size_t) p[2] << 8 ) |
3974 ( (size_t) p[3] );
3975 p += 4;
3976
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003977 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00003978 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003979 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003980 ssl->session_in = ssl->session;
3981 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02003982 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003983
3984 if( (size_t)( end - p ) < session_len )
3985 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3986
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003987 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003988 if( ret != 0 )
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003989 {
3990 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003991 return( ret );
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003992 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02003993
3994 p += session_len;
3995
3996 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02003997 * Transform
3998 */
3999
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004000 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00004001 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004002 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004003 ssl->transform_in = ssl->transform;
4004 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004005 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004006
4007 /* Read random bytes and populate structure */
4008 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
4009 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yu840fbb22022-02-17 14:59:29 +08004010#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerbd257552021-03-22 06:59:27 +00004011 ret = ssl_tls12_populate_transform( ssl->transform,
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004012 ssl->session->ciphersuite,
4013 ssl->session->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02004014#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004015 ssl->session->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02004016#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004017 ssl_tls12prf_from_cs( ssl->session->ciphersuite ),
4018 p, /* currently pointing to randbytes */
Glenn Strauss07c64162022-03-14 12:34:51 -04004019 MBEDTLS_SSL_VERSION_TLS1_2, /* (D)TLS 1.2 is forced */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004020 ssl->conf->endpoint,
4021 ssl );
4022 if( ret != 0 )
4023 return( ret );
Jerry Yu840fbb22022-02-17 14:59:29 +08004024#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004025 p += sizeof( ssl->transform->randbytes );
4026
4027#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4028 /* Read connection IDs and store them */
4029 if( (size_t)( end - p ) < 1 )
4030 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4031
4032 ssl->transform->in_cid_len = *p++;
4033
Manuel Pégourié-Gonnard5ea13b82019-07-23 15:02:54 +02004034 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004035 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4036
4037 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
4038 p += ssl->transform->in_cid_len;
4039
4040 ssl->transform->out_cid_len = *p++;
4041
4042 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
4043 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4044
4045 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
4046 p += ssl->transform->out_cid_len;
4047#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4048
4049 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004050 * Saved fields from top-level ssl_context structure
4051 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004052 if( (size_t)( end - p ) < 4 )
4053 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4054
4055 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) |
4056 ( (uint32_t) p[1] << 16 ) |
4057 ( (uint32_t) p[2] << 8 ) |
4058 ( (uint32_t) p[3] );
4059 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004060
4061#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4062 if( (size_t)( end - p ) < 16 )
4063 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4064
4065 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
4066 ( (uint64_t) p[1] << 48 ) |
4067 ( (uint64_t) p[2] << 40 ) |
4068 ( (uint64_t) p[3] << 32 ) |
4069 ( (uint64_t) p[4] << 24 ) |
4070 ( (uint64_t) p[5] << 16 ) |
4071 ( (uint64_t) p[6] << 8 ) |
4072 ( (uint64_t) p[7] );
4073 p += 8;
4074
4075 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
4076 ( (uint64_t) p[1] << 48 ) |
4077 ( (uint64_t) p[2] << 40 ) |
4078 ( (uint64_t) p[3] << 32 ) |
4079 ( (uint64_t) p[4] << 24 ) |
4080 ( (uint64_t) p[5] << 16 ) |
4081 ( (uint64_t) p[6] << 8 ) |
4082 ( (uint64_t) p[7] );
4083 p += 8;
4084#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
4085
4086#if defined(MBEDTLS_SSL_PROTO_DTLS)
4087 if( (size_t)( end - p ) < 1 )
4088 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4089
4090 ssl->disable_datagram_packing = *p++;
4091#endif /* MBEDTLS_SSL_PROTO_DTLS */
4092
Jerry Yud9a94fe2021-09-28 18:58:59 +08004093 if( (size_t)( end - p ) < sizeof( ssl->cur_out_ctr ) )
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004094 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Jerry Yud9a94fe2021-09-28 18:58:59 +08004095 memcpy( ssl->cur_out_ctr, p, sizeof( ssl->cur_out_ctr ) );
4096 p += sizeof( ssl->cur_out_ctr );
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004097
4098#if defined(MBEDTLS_SSL_PROTO_DTLS)
4099 if( (size_t)( end - p ) < 2 )
4100 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4101
4102 ssl->mtu = ( p[0] << 8 ) | p[1];
4103 p += 2;
4104#endif /* MBEDTLS_SSL_PROTO_DTLS */
4105
4106#if defined(MBEDTLS_SSL_ALPN)
4107 {
4108 uint8_t alpn_len;
4109 const char **cur;
4110
4111 if( (size_t)( end - p ) < 1 )
4112 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4113
4114 alpn_len = *p++;
4115
4116 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
4117 {
4118 /* alpn_chosen should point to an item in the configured list */
4119 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
4120 {
4121 if( strlen( *cur ) == alpn_len &&
4122 memcmp( p, cur, alpn_len ) == 0 )
4123 {
4124 ssl->alpn_chosen = *cur;
4125 break;
4126 }
4127 }
4128 }
4129
4130 /* can only happen on conf mismatch */
4131 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
4132 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4133
4134 p += alpn_len;
4135 }
4136#endif /* MBEDTLS_SSL_ALPN */
4137
4138 /*
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004139 * Forced fields from top-level ssl_context structure
4140 *
4141 * Most of them already set to the correct value by mbedtls_ssl_init() and
4142 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
4143 */
4144 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Glenn Strauss60bfe602022-03-14 19:04:24 -04004145 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004146
Hanno Becker361b10d2019-08-30 10:42:49 +01004147 /* Adjust pointers for header fields of outgoing records to
4148 * the given transform, accounting for explicit IV and CID. */
Hanno Becker3e6f8ab2020-02-05 10:40:57 +00004149 mbedtls_ssl_update_out_pointers( ssl, ssl->transform );
Hanno Becker361b10d2019-08-30 10:42:49 +01004150
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004151#if defined(MBEDTLS_SSL_PROTO_DTLS)
4152 ssl->in_epoch = 1;
4153#endif
4154
4155 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
4156 * which we don't want - otherwise we'd end up freeing the wrong transform
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00004157 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
4158 * inappropriately. */
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004159 if( ssl->handshake != NULL )
4160 {
4161 mbedtls_ssl_handshake_free( ssl );
4162 mbedtls_free( ssl->handshake );
4163 ssl->handshake = NULL;
4164 }
4165
4166 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004167 * Done - should have consumed entire buffer
4168 */
4169 if( p != end )
4170 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004171
4172 return( 0 );
4173}
4174
4175/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02004176 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004177 */
4178int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
4179 const unsigned char *buf,
4180 size_t len )
4181{
4182 int ret = ssl_context_load( context, buf, len );
4183
4184 if( ret != 0 )
4185 mbedtls_ssl_free( context );
4186
4187 return( ret );
4188}
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02004189#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004190
4191/*
Paul Bakker5121ce52009-01-03 21:22:43 +00004192 * Free an SSL context
4193 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004194void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004195{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004196 if( ssl == NULL )
4197 return;
4198
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004199 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004200
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01004201 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004202 {
sander-visserb8aa2072020-05-06 22:05:13 +02004203#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4204 size_t out_buf_len = ssl->out_buf_len;
4205#else
4206 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
4207#endif
4208
Darryl Greenb33cc762019-11-28 14:29:44 +00004209 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004210 mbedtls_free( ssl->out_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004211 ssl->out_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00004212 }
4213
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01004214 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004215 {
sander-visserb8aa2072020-05-06 22:05:13 +02004216#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4217 size_t in_buf_len = ssl->in_buf_len;
4218#else
4219 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
4220#endif
4221
Darryl Greenb33cc762019-11-28 14:29:44 +00004222 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004223 mbedtls_free( ssl->in_buf );
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004224 ssl->in_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00004225 }
4226
Paul Bakker48916f92012-09-16 19:57:18 +00004227 if( ssl->transform )
4228 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004229 mbedtls_ssl_transform_free( ssl->transform );
4230 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00004231 }
4232
4233 if( ssl->handshake )
4234 {
Gilles Peskine9b562d52018-04-25 20:32:43 +02004235 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004236 mbedtls_ssl_transform_free( ssl->transform_negotiate );
4237 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00004238
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004239 mbedtls_free( ssl->handshake );
4240 mbedtls_free( ssl->transform_negotiate );
4241 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00004242 }
4243
Ronald Cron6f135e12021-12-08 16:57:54 +01004244#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker3aa186f2021-08-10 09:24:19 +01004245 mbedtls_ssl_transform_free( ssl->transform_application );
4246 mbedtls_free( ssl->transform_application );
Ronald Cron6f135e12021-12-08 16:57:54 +01004247#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker3aa186f2021-08-10 09:24:19 +01004248
Paul Bakkerc0463502013-02-14 11:19:38 +01004249 if( ssl->session )
4250 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004251 mbedtls_ssl_session_free( ssl->session );
4252 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01004253 }
4254
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02004255#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker66d5d072014-06-17 16:39:18 +02004256 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004257 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004258 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004259 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +00004260 }
Paul Bakker0be444a2013-08-27 21:55:01 +02004261#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00004262
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02004263#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004264 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02004265#endif
4266
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004267 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +00004268
Paul Bakker86f04f42013-02-14 11:20:09 +01004269 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004270 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004271}
4272
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004273/*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08004274 * Initialize mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004275 */
4276void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
4277{
4278 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
4279}
4280
Gilles Peskineae270bf2021-06-02 00:05:29 +02004281/* The selection should be the same as mbedtls_x509_crt_profile_default in
4282 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
Gilles Peskineb1940a72021-06-02 15:18:12 +02004283 * curves with a lower resource usage come first.
Gilles Peskineae270bf2021-06-02 00:05:29 +02004284 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
Gilles Peskineb1940a72021-06-02 15:18:12 +02004285 * about this list.
4286 */
Brett Warrene0edc842021-08-17 09:53:13 +01004287static uint16_t ssl_preset_default_groups[] = {
Gilles Peskineae270bf2021-06-02 00:05:29 +02004288#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004289 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004290#endif
4291#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004292 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004293#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02004294#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004295 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004296#endif
4297#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004298 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004299#endif
4300#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004301 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004302#endif
Gilles Peskineae270bf2021-06-02 00:05:29 +02004303#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004304 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02004305#endif
Gilles Peskineb1940a72021-06-02 15:18:12 +02004306#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004307 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004308#endif
4309#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004310 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02004311#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004312 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Gilles Peskineae270bf2021-06-02 00:05:29 +02004313};
Gilles Peskineae270bf2021-06-02 00:05:29 +02004314
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004315static int ssl_preset_suiteb_ciphersuites[] = {
4316 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
4317 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
4318 0
4319};
4320
Gilles Peskineeccd8882020-03-10 12:19:08 +01004321#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004322
Jerry Yu909df7b2022-01-22 11:56:27 +08004323/* NOTICE:
Jerry Yu0b994b82022-01-25 17:22:12 +08004324 * For ssl_preset_*_sig_algs and ssl_tls12_preset_*_sig_algs, the following
Jerry Yu370e1462022-01-25 10:36:53 +08004325 * rules SHOULD be upheld.
4326 * - No duplicate entries.
4327 * - But if there is a good reason, do not change the order of the algorithms.
Jerry Yu09a99fc2022-07-28 14:22:17 +08004328 * - ssl_tls12_preset* is for TLS 1.2 use only.
Jerry Yu370e1462022-01-25 10:36:53 +08004329 * - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes.
Jerry Yu1a8b4812022-01-20 17:56:50 +08004330 */
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004331static uint16_t ssl_preset_default_sig_algs[] = {
Jerry Yu1a8b4812022-01-20 17:56:50 +08004332
Jerry Yued5e9f42022-01-26 11:21:34 +08004333#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA256_C) && \
4334 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4335 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
4336#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA256_C &&
4337 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004338
Jerry Yu909df7b2022-01-22 11:56:27 +08004339#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA384_C) && \
4340 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4341 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
4342#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
4343 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
4344
Jerry Yued5e9f42022-01-26 11:21:34 +08004345#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA512_C) && \
4346 defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
4347 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
4348#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
4349 MBEDTLS_ECP_DP_SECP521R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004350
Jerry Yu9bb3ee42022-06-23 10:16:33 +08004351#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA512_C)
4352 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
4353#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA512_C */
4354
4355#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA384_C)
4356 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
4357#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA384_C */
4358
4359#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA256_C)
4360 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
4361#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA256_C */
4362
Jerry Yu693a47a2022-06-23 14:02:28 +08004363#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA512_C)
4364 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512,
4365#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA512_C */
4366
4367#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA384_C)
4368 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384,
4369#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA384_C */
4370
4371#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C)
4372 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
4373#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
4374
Gabor Mezei15b95a62022-05-09 16:37:58 +02004375 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08004376};
4377
4378/* NOTICE: see above */
4379#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4380static uint16_t ssl_tls12_preset_default_sig_algs[] = {
Jerry Yu713013f2022-01-17 18:16:35 +08004381#if defined(MBEDTLS_SHA512_C)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004382#if defined(MBEDTLS_ECDSA_C)
4383 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512 ),
Jerry Yu713013f2022-01-17 18:16:35 +08004384#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08004385#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
4386 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
4387#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gabor Mezeic1051b62022-05-10 13:13:58 +02004388#if defined(MBEDTLS_RSA_C)
4389 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA512 ),
4390#endif
4391#endif /* MBEDTLS_SHA512_C */
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004392#if defined(MBEDTLS_SHA384_C)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004393#if defined(MBEDTLS_ECDSA_C)
4394 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384 ),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004395#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08004396#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
4397 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
4398#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gabor Mezeic1051b62022-05-10 13:13:58 +02004399#if defined(MBEDTLS_RSA_C)
4400 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384 ),
4401#endif
4402#endif /* MBEDTLS_SHA384_C */
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004403#if defined(MBEDTLS_SHA256_C)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004404#if defined(MBEDTLS_ECDSA_C)
4405 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256 ),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08004406#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08004407#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
4408 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
4409#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
Gabor Mezeic1051b62022-05-10 13:13:58 +02004410#if defined(MBEDTLS_RSA_C)
4411 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256 ),
4412#endif
4413#endif /* MBEDTLS_SHA256_C */
Gabor Mezei15b95a62022-05-09 16:37:58 +02004414 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08004415};
4416#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4417/* NOTICE: see above */
4418static uint16_t ssl_preset_suiteb_sig_algs[] = {
4419
Jerry Yu909df7b2022-01-22 11:56:27 +08004420#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA256_C) && \
4421 defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
4422 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
4423#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA256_C &&
4424 MBEDTLS_ECP_DP_SECP256R1_ENABLED */
4425
Jerry Yu53037892022-01-25 11:02:06 +08004426#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA384_C) && \
4427 defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
4428 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
4429#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C &&
4430 MBEDTLS_ECP_DP_SECP384R1_ENABLED */
Jerry Yu909df7b2022-01-22 11:56:27 +08004431
4432#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA256_C)
4433 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
4434#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA256_C */
Jerry Yu1a8b4812022-01-20 17:56:50 +08004435
Jerry Yu53037892022-01-25 11:02:06 +08004436#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C)
4437 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
4438#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
4439
Gabor Mezei15b95a62022-05-09 16:37:58 +02004440 MBEDTLS_TLS_SIG_NONE
Jerry Yu713013f2022-01-17 18:16:35 +08004441};
Jerry Yu6106fdc2022-01-12 16:36:14 +08004442
Jerry Yu909df7b2022-01-22 11:56:27 +08004443/* NOTICE: see above */
4444#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4445static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = {
Jerry Yu713013f2022-01-17 18:16:35 +08004446#if defined(MBEDTLS_SHA256_C)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004447#if defined(MBEDTLS_ECDSA_C)
4448 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256 ),
Jerry Yu713013f2022-01-17 18:16:35 +08004449#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02004450#if defined(MBEDTLS_RSA_C)
4451 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256 ),
4452#endif
4453#endif /* MBEDTLS_SHA256_C */
Jerry Yu18c833e2022-01-25 10:55:47 +08004454#if defined(MBEDTLS_SHA384_C)
Gabor Mezeic1051b62022-05-10 13:13:58 +02004455#if defined(MBEDTLS_ECDSA_C)
4456 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384 ),
Jerry Yu18c833e2022-01-25 10:55:47 +08004457#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02004458#if defined(MBEDTLS_RSA_C)
4459 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384 ),
4460#endif
4461#endif /* MBEDTLS_SHA256_C */
Gabor Mezei15b95a62022-05-09 16:37:58 +02004462 MBEDTLS_TLS_SIG_NONE
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01004463};
Jerry Yu909df7b2022-01-22 11:56:27 +08004464#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4465
Jerry Yu1a8b4812022-01-20 17:56:50 +08004466#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004467
Brett Warrene0edc842021-08-17 09:53:13 +01004468static uint16_t ssl_preset_suiteb_groups[] = {
Jaeden Amerod4311042019-06-03 08:27:16 +01004469#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004470 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01004471#endif
4472#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Brett Warrene0edc842021-08-17 09:53:13 +01004473 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01004474#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004475 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004476};
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004477
Jerry Yu1a8b4812022-01-20 17:56:50 +08004478#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08004479/* Function for checking `ssl_preset_*_sig_algs` and `ssl_tls12_preset_*_sig_algs`
Jerry Yu370e1462022-01-25 10:36:53 +08004480 * to make sure there are no duplicated signature algorithm entries. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004481MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuf377d642022-01-25 10:43:59 +08004482static int ssl_check_no_sig_alg_duplication( uint16_t * sig_algs )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004483{
4484 size_t i, j;
4485 int ret = 0;
Jerry Yu909df7b2022-01-22 11:56:27 +08004486
Gabor Mezei15b95a62022-05-09 16:37:58 +02004487 for( i = 0; sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004488 {
Jerry Yuf377d642022-01-25 10:43:59 +08004489 for( j = 0; j < i; j++ )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004490 {
Jerry Yuf377d642022-01-25 10:43:59 +08004491 if( sig_algs[i] != sig_algs[j] )
4492 continue;
4493 mbedtls_printf( " entry(%04x,%" MBEDTLS_PRINTF_SIZET
4494 ") is duplicated at %" MBEDTLS_PRINTF_SIZET "\n",
4495 sig_algs[i], j, i );
4496 ret = -1;
Jerry Yu1a8b4812022-01-20 17:56:50 +08004497 }
4498 }
4499 return( ret );
4500}
4501
4502#endif /* MBEDTLS_DEBUG_C && MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4503
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004504/*
Tillmann Karras588ad502015-09-25 04:27:22 +02004505 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004506 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02004507int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004508 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004509{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02004510#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Janos Follath865b3eb2019-12-16 11:46:15 +00004511 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02004512#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004513
Jerry Yu1a8b4812022-01-20 17:56:50 +08004514#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yuf377d642022-01-25 10:43:59 +08004515 if( ssl_check_no_sig_alg_duplication( ssl_preset_suiteb_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004516 {
4517 mbedtls_printf( "ssl_preset_suiteb_sig_algs has duplicated entries\n" );
4518 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4519 }
4520
Jerry Yuf377d642022-01-25 10:43:59 +08004521 if( ssl_check_no_sig_alg_duplication( ssl_preset_default_sig_algs ) )
Jerry Yu1a8b4812022-01-20 17:56:50 +08004522 {
4523 mbedtls_printf( "ssl_preset_default_sig_algs has duplicated entries\n" );
4524 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4525 }
Jerry Yu909df7b2022-01-22 11:56:27 +08004526
4527#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yuf377d642022-01-25 10:43:59 +08004528 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_suiteb_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08004529 {
Jerry Yu909df7b2022-01-22 11:56:27 +08004530 mbedtls_printf( "ssl_tls12_preset_suiteb_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08004531 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4532 }
4533
Jerry Yuf377d642022-01-25 10:43:59 +08004534 if( ssl_check_no_sig_alg_duplication( ssl_tls12_preset_default_sig_algs ) )
Jerry Yu909df7b2022-01-22 11:56:27 +08004535 {
Jerry Yu909df7b2022-01-22 11:56:27 +08004536 mbedtls_printf( "ssl_tls12_preset_default_sig_algs has duplicated entries\n" );
Jerry Yu909df7b2022-01-22 11:56:27 +08004537 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
4538 }
4539#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yu1a8b4812022-01-20 17:56:50 +08004540#endif /* MBEDTLS_DEBUG_C && MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
4541
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02004542 /* Use the functions here so that they are covered in tests,
4543 * but otherwise access member directly for efficiency */
4544 mbedtls_ssl_conf_endpoint( conf, endpoint );
4545 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004546
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004547 /*
4548 * Things that are common to all presets
4549 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02004550#if defined(MBEDTLS_SSL_CLI_C)
4551 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
4552 {
4553 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
4554#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4555 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
4556#endif
4557 }
4558#endif
4559
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004560#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
4561 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
4562#endif
4563
4564#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
4565 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
4566#endif
4567
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02004568#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004569 conf->f_cookie_write = ssl_cookie_write_dummy;
4570 conf->f_cookie_check = ssl_cookie_check_dummy;
4571#endif
4572
4573#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4574 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
4575#endif
4576
Janos Follath088ce432017-04-10 12:42:31 +01004577#if defined(MBEDTLS_SSL_SRV_C)
4578 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
TRodziewicz3946f792021-06-14 12:11:18 +02004579 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
Janos Follath088ce432017-04-10 12:42:31 +01004580#endif
4581
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004582#if defined(MBEDTLS_SSL_PROTO_DTLS)
4583 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
4584 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
4585#endif
4586
4587#if defined(MBEDTLS_SSL_RENEGOTIATION)
4588 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Andres AG2196c7f2016-12-15 17:01:16 +00004589 memset( conf->renego_period, 0x00, 2 );
4590 memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004591#endif
4592
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004593#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Beckere2defad2021-07-24 05:59:17 +01004594 if( endpoint == MBEDTLS_SSL_IS_SERVER )
4595 {
4596 const unsigned char dhm_p[] =
4597 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
4598 const unsigned char dhm_g[] =
4599 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
Hanno Becker00d0a682017-10-04 13:14:29 +01004600
Hanno Beckere2defad2021-07-24 05:59:17 +01004601 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
4602 dhm_p, sizeof( dhm_p ),
4603 dhm_g, sizeof( dhm_g ) ) ) != 0 )
4604 {
4605 return( ret );
4606 }
4607 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02004608#endif
4609
Ronald Cron6f135e12021-12-08 16:57:54 +01004610#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Hanno Becker71f1ed62021-07-24 06:01:47 +01004611 /*
4612 * Allow all TLS 1.3 key exchange modes by default.
4613 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00004614 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Ronald Cron6f135e12021-12-08 16:57:54 +01004615#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01004616
XiaokangQian4d3a6042022-04-21 13:46:17 +00004617 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4618 {
Glenn Strauss2dfcea22022-03-14 17:26:42 -04004619#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
XiaokangQian4d3a6042022-04-21 13:46:17 +00004620 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian060d8672022-04-21 09:24:56 +00004621 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian4d3a6042022-04-21 13:46:17 +00004622#else
XiaokangQian060d8672022-04-21 09:24:56 +00004623 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
XiaokangQian060d8672022-04-21 09:24:56 +00004624#endif
XiaokangQian4d3a6042022-04-21 13:46:17 +00004625 }
4626 else
4627 {
4628#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
4629 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
4630 {
4631 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4632 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
4633 }
4634 else
4635 /* Hybrid TLS 1.2 / 1.3 is not supported on server side yet */
4636 {
4637 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4638 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4639 }
4640#elif defined(MBEDTLS_SSL_PROTO_TLS1_3)
4641 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
4642 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
4643#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
4644 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4645 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
4646#else
4647 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4648#endif
4649 }
Glenn Strauss2dfcea22022-03-14 17:26:42 -04004650
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004651 /*
4652 * Preset-specific defaults
4653 */
4654 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004655 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004656 /*
4657 * NSA Suite B
4658 */
4659 case MBEDTLS_SSL_PRESET_SUITEB:
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004660
Hanno Beckerd60b6c62021-04-29 12:04:11 +01004661 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004662
4663#if defined(MBEDTLS_X509_CRT_PARSE_C)
4664 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004665#endif
4666
Gilles Peskineeccd8882020-03-10 12:19:08 +01004667#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08004668#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4669 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
4670 conf->sig_algs = ssl_tls12_preset_suiteb_sig_algs;
4671 else
4672#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4673 conf->sig_algs = ssl_preset_suiteb_sig_algs;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004674#endif
4675
Brett Warrene0edc842021-08-17 09:53:13 +01004676#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4677 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004678#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004679 conf->group_list = ssl_preset_suiteb_groups;
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02004680 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004681
4682 /*
4683 * Default
4684 */
4685 default:
Ronald Cronf6606552022-03-15 11:23:25 +01004686
Hanno Beckerd60b6c62021-04-29 12:04:11 +01004687 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004688
4689#if defined(MBEDTLS_X509_CRT_PARSE_C)
4690 conf->cert_profile = &mbedtls_x509_crt_profile_default;
4691#endif
4692
Gilles Peskineeccd8882020-03-10 12:19:08 +01004693#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08004694#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4695 if( mbedtls_ssl_conf_is_tls12_only( conf ) )
4696 conf->sig_algs = ssl_tls12_preset_default_sig_algs;
4697 else
4698#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4699 conf->sig_algs = ssl_preset_default_sig_algs;
Hanno Beckerdeb68ce2021-08-10 16:04:05 +01004700#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004701
Brett Warrene0edc842021-08-17 09:53:13 +01004702#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
4703 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004704#endif
Brett Warrene0edc842021-08-17 09:53:13 +01004705 conf->group_list = ssl_preset_default_groups;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02004706
4707#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
4708 conf->dhm_min_bitlen = 1024;
4709#endif
4710 }
4711
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004712 return( 0 );
4713}
4714
4715/*
4716 * Free mbedtls_ssl_config
4717 */
4718void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
4719{
4720#if defined(MBEDTLS_DHM_C)
4721 mbedtls_mpi_free( &conf->dhm_P );
4722 mbedtls_mpi_free( &conf->dhm_G );
4723#endif
4724
Gilles Peskineeccd8882020-03-10 12:19:08 +01004725#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02004726#if defined(MBEDTLS_USE_PSA_CRYPTO)
4727 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
4728 {
Neil Armstrong501c9322022-05-03 09:35:09 +02004729 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
4730 }
Neil Armstrong8ecd6682022-05-05 11:40:35 +02004731#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004732 if( conf->psk != NULL )
4733 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004734 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004735 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +00004736 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004737 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09004738 }
4739
4740 if( conf->psk_identity != NULL )
4741 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004742 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +09004743 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +00004744 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004745 conf->psk_identity_len = 0;
4746 }
4747#endif
4748
4749#if defined(MBEDTLS_X509_CRT_PARSE_C)
4750 ssl_key_cert_free( conf->key_cert );
4751#endif
4752
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004753 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02004754}
4755
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02004756#if defined(MBEDTLS_PK_C) && \
4757 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004758/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004759 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004760 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004761unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004762{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004763#if defined(MBEDTLS_RSA_C)
4764 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
4765 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004766#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004767#if defined(MBEDTLS_ECDSA_C)
4768 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
4769 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004770#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004771 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004772}
4773
Hanno Becker7e5437a2017-04-28 17:15:26 +01004774unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
4775{
4776 switch( type ) {
4777 case MBEDTLS_PK_RSA:
4778 return( MBEDTLS_SSL_SIG_RSA );
4779 case MBEDTLS_PK_ECDSA:
4780 case MBEDTLS_PK_ECKEY:
4781 return( MBEDTLS_SSL_SIG_ECDSA );
4782 default:
4783 return( MBEDTLS_SSL_SIG_ANON );
4784 }
4785}
4786
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004787mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004788{
4789 switch( sig )
4790 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004791#if defined(MBEDTLS_RSA_C)
4792 case MBEDTLS_SSL_SIG_RSA:
4793 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004794#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004795#if defined(MBEDTLS_ECDSA_C)
4796 case MBEDTLS_SSL_SIG_ECDSA:
4797 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004798#endif
4799 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004800 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004801 }
4802}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02004803#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004804
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02004805/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004806 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02004807 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004808mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004809{
4810 switch( hash )
4811 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004812#if defined(MBEDTLS_MD5_C)
4813 case MBEDTLS_SSL_HASH_MD5:
4814 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004815#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004816#if defined(MBEDTLS_SHA1_C)
4817 case MBEDTLS_SSL_HASH_SHA1:
4818 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004819#endif
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004820#if defined(MBEDTLS_SHA224_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004821 case MBEDTLS_SSL_HASH_SHA224:
4822 return( MBEDTLS_MD_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004823#endif
4824#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004825 case MBEDTLS_SSL_HASH_SHA256:
4826 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004827#endif
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004828#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004829 case MBEDTLS_SSL_HASH_SHA384:
4830 return( MBEDTLS_MD_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004831#endif
4832#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004833 case MBEDTLS_SSL_HASH_SHA512:
4834 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004835#endif
4836 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004837 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004838 }
4839}
4840
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004841/*
4842 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
4843 */
4844unsigned char mbedtls_ssl_hash_from_md_alg( int md )
4845{
4846 switch( md )
4847 {
4848#if defined(MBEDTLS_MD5_C)
4849 case MBEDTLS_MD_MD5:
4850 return( MBEDTLS_SSL_HASH_MD5 );
4851#endif
4852#if defined(MBEDTLS_SHA1_C)
4853 case MBEDTLS_MD_SHA1:
4854 return( MBEDTLS_SSL_HASH_SHA1 );
4855#endif
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004856#if defined(MBEDTLS_SHA224_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004857 case MBEDTLS_MD_SHA224:
4858 return( MBEDTLS_SSL_HASH_SHA224 );
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02004859#endif
4860#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004861 case MBEDTLS_MD_SHA256:
4862 return( MBEDTLS_SSL_HASH_SHA256 );
4863#endif
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004864#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004865 case MBEDTLS_MD_SHA384:
4866 return( MBEDTLS_SSL_HASH_SHA384 );
Mateusz Starzyk3352a532021-04-06 14:28:22 +02004867#endif
4868#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004869 case MBEDTLS_MD_SHA512:
4870 return( MBEDTLS_SSL_HASH_SHA512 );
4871#endif
4872 default:
4873 return( MBEDTLS_SSL_HASH_NONE );
4874 }
4875}
4876
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004877/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02004878 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004879 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004880 */
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01004881int mbedtls_ssl_check_curve_tls_id( const mbedtls_ssl_context *ssl, uint16_t tls_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004882{
Brett Warrene0edc842021-08-17 09:53:13 +01004883 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004884
Brett Warrene0edc842021-08-17 09:53:13 +01004885 if( group_list == NULL )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004886 return( -1 );
4887
Brett Warrene0edc842021-08-17 09:53:13 +01004888 for( ; *group_list != 0; group_list++ )
4889 {
4890 if( *group_list == tls_id )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004891 return( 0 );
Brett Warrene0edc842021-08-17 09:53:13 +01004892 }
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004893
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02004894 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01004895}
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01004896
4897#if defined(MBEDTLS_ECP_C)
4898/*
4899 * Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id.
4900 */
4901int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
4902{
Manuel Pégourié-Gonnard422370d2022-02-07 11:55:21 +01004903 uint16_t tls_id = mbedtls_ecp_curve_info_from_grp_id( grp_id )->tls_id;
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01004904 return mbedtls_ssl_check_curve_tls_id( ssl, tls_id );
4905}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02004906#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004907
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004908#if defined(MBEDTLS_X509_CRT_PARSE_C)
4909int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
4910 const mbedtls_ssl_ciphersuite_t *ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004911 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02004912 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004913{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004914 int ret = 0;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004915 int usage = 0;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004916 const char *ext_oid;
4917 size_t ext_len;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004918
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004919 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004920 {
4921 /* Server part of the key exchange */
4922 switch( ciphersuite->key_exchange )
4923 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004924 case MBEDTLS_KEY_EXCHANGE_RSA:
4925 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004926 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004927 break;
4928
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004929 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
4930 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
4931 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
4932 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004933 break;
4934
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004935 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
4936 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004937 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004938 break;
4939
4940 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004941 case MBEDTLS_KEY_EXCHANGE_NONE:
4942 case MBEDTLS_KEY_EXCHANGE_PSK:
4943 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
4944 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02004945 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004946 usage = 0;
4947 }
4948 }
4949 else
4950 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004951 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
4952 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004953 }
4954
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004955 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004956 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004957 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004958 ret = -1;
4959 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004960
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004961 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004962 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004963 ext_oid = MBEDTLS_OID_SERVER_AUTH;
4964 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004965 }
4966 else
4967 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004968 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
4969 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004970 }
4971
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004972 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004973 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01004974 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004975 ret = -1;
4976 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02004977
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01004978 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02004979}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004980#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02004981
Jerry Yu148165c2021-09-24 23:20:59 +08004982#if defined(MBEDTLS_USE_PSA_CRYPTO)
4983int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
4984 const mbedtls_md_type_t md,
4985 unsigned char *dst,
4986 size_t dst_len,
4987 size_t *olen )
4988{
Ronald Cronf6893e12022-01-07 22:09:01 +01004989 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4990 psa_hash_operation_t *hash_operation_to_clone;
4991 psa_hash_operation_t hash_operation = psa_hash_operation_init();
4992
Jerry Yu148165c2021-09-24 23:20:59 +08004993 *olen = 0;
Ronald Cronf6893e12022-01-07 22:09:01 +01004994
4995 switch( md )
4996 {
4997#if defined(MBEDTLS_SHA384_C)
4998 case MBEDTLS_MD_SHA384:
4999 hash_operation_to_clone = &ssl->handshake->fin_sha384_psa;
5000 break;
5001#endif
5002
5003#if defined(MBEDTLS_SHA256_C)
5004 case MBEDTLS_MD_SHA256:
5005 hash_operation_to_clone = &ssl->handshake->fin_sha256_psa;
5006 break;
5007#endif
5008
5009 default:
5010 goto exit;
5011 }
5012
5013 status = psa_hash_clone( hash_operation_to_clone, &hash_operation );
5014 if( status != PSA_SUCCESS )
5015 goto exit;
5016
5017 status = psa_hash_finish( &hash_operation, dst, dst_len, olen );
5018 if( status != PSA_SUCCESS )
5019 goto exit;
5020
5021exit:
Ronald Cronb788c042022-02-15 09:14:15 +01005022 return( psa_ssl_status_to_mbedtls( status ) );
Jerry Yu148165c2021-09-24 23:20:59 +08005023}
5024#else /* MBEDTLS_USE_PSA_CRYPTO */
5025
Jerry Yu24c0ec32021-09-09 14:21:07 +08005026#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005027MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu000f9762021-09-14 11:12:51 +08005028static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl,
5029 unsigned char *dst,
5030 size_t dst_len,
5031 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08005032{
Jerry Yu24c0ec32021-09-09 14:21:07 +08005033 int ret;
5034 mbedtls_sha512_context sha512;
5035
5036 if( dst_len < 48 )
5037 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5038
5039 mbedtls_sha512_init( &sha512 );
5040 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
5041
5042 if( ( ret = mbedtls_sha512_finish( &sha512, dst ) ) != 0 )
5043 {
5044 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha512_finish", ret );
5045 goto exit;
5046 }
5047
5048 *olen = 48;
5049
5050exit:
5051
5052 mbedtls_sha512_free( &sha512 );
5053 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08005054}
5055#endif /* MBEDTLS_SHA384_C */
5056
5057#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005058MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu000f9762021-09-14 11:12:51 +08005059static int ssl_get_handshake_transcript_sha256( mbedtls_ssl_context *ssl,
5060 unsigned char *dst,
5061 size_t dst_len,
5062 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08005063{
Jerry Yu24c0ec32021-09-09 14:21:07 +08005064 int ret;
5065 mbedtls_sha256_context sha256;
5066
5067 if( dst_len < 32 )
5068 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5069
5070 mbedtls_sha256_init( &sha256 );
5071 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Jerry Yuc5aef882021-12-23 20:15:02 +08005072
Jerry Yu24c0ec32021-09-09 14:21:07 +08005073 if( ( ret = mbedtls_sha256_finish( &sha256, dst ) ) != 0 )
5074 {
5075 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha256_finish", ret );
5076 goto exit;
5077 }
5078
5079 *olen = 32;
5080
5081exit:
5082
5083 mbedtls_sha256_free( &sha256 );
5084 return( ret );
Jerry Yu24c0ec32021-09-09 14:21:07 +08005085}
5086#endif /* MBEDTLS_SHA256_C */
5087
Jerry Yu000f9762021-09-14 11:12:51 +08005088int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
5089 const mbedtls_md_type_t md,
5090 unsigned char *dst,
5091 size_t dst_len,
5092 size_t *olen )
Jerry Yu24c0ec32021-09-09 14:21:07 +08005093{
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005094 switch( md )
5095 {
5096
Jerry Yu24c0ec32021-09-09 14:21:07 +08005097#if defined(MBEDTLS_SHA384_C)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005098 case MBEDTLS_MD_SHA384:
Jerry Yuc5aef882021-12-23 20:15:02 +08005099 return( ssl_get_handshake_transcript_sha384( ssl, dst, dst_len, olen ) );
Jerry Yuc10f6b42021-12-23 17:16:42 +08005100#endif /* MBEDTLS_SHA384_C */
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005101
Jerry Yu24c0ec32021-09-09 14:21:07 +08005102#if defined(MBEDTLS_SHA256_C)
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005103 case MBEDTLS_MD_SHA256:
Jerry Yuc5aef882021-12-23 20:15:02 +08005104 return( ssl_get_handshake_transcript_sha256( ssl, dst, dst_len, olen ) );
Jerry Yuc10f6b42021-12-23 17:16:42 +08005105#endif /* MBEDTLS_SHA256_C */
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005106
5107 default:
5108 break;
5109 }
Jerry Yuc5aef882021-12-23 20:15:02 +08005110 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Jerry Yu24c0ec32021-09-09 14:21:07 +08005111}
XiaokangQian647719a2021-12-07 09:16:29 +00005112
Jerry Yu148165c2021-09-24 23:20:59 +08005113#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu24c0ec32021-09-09 14:21:07 +08005114
Gabor Mezei078e8032022-04-27 21:17:56 +02005115#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
5116/* mbedtls_ssl_parse_sig_alg_ext()
5117 *
5118 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
5119 * value (TLS 1.3 RFC8446):
5120 * enum {
5121 * ....
5122 * ecdsa_secp256r1_sha256( 0x0403 ),
5123 * ecdsa_secp384r1_sha384( 0x0503 ),
5124 * ecdsa_secp521r1_sha512( 0x0603 ),
5125 * ....
5126 * } SignatureScheme;
5127 *
5128 * struct {
5129 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
5130 * } SignatureSchemeList;
5131 *
5132 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
5133 * value (TLS 1.2 RFC5246):
5134 * enum {
5135 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
5136 * sha512(6), (255)
5137 * } HashAlgorithm;
5138 *
5139 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
5140 * SignatureAlgorithm;
5141 *
5142 * struct {
5143 * HashAlgorithm hash;
5144 * SignatureAlgorithm signature;
5145 * } SignatureAndHashAlgorithm;
5146 *
5147 * SignatureAndHashAlgorithm
5148 * supported_signature_algorithms<2..2^16-2>;
5149 *
5150 * The TLS 1.3 signature algorithm extension was defined to be a compatible
5151 * generalization of the TLS 1.2 signature algorithm extension.
5152 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
5153 * `SignatureScheme` field of TLS 1.3
5154 *
5155 */
5156int mbedtls_ssl_parse_sig_alg_ext( mbedtls_ssl_context *ssl,
5157 const unsigned char *buf,
5158 const unsigned char *end )
5159{
5160 const unsigned char *p = buf;
5161 size_t supported_sig_algs_len = 0;
5162 const unsigned char *supported_sig_algs_end;
5163 uint16_t sig_alg;
5164 uint32_t common_idx = 0;
5165
5166 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
5167 supported_sig_algs_len = MBEDTLS_GET_UINT16_BE( p, 0 );
5168 p += 2;
5169
5170 memset( ssl->handshake->received_sig_algs, 0,
5171 sizeof(ssl->handshake->received_sig_algs) );
5172
5173 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, supported_sig_algs_len );
5174 supported_sig_algs_end = p + supported_sig_algs_len;
5175 while( p < supported_sig_algs_end )
5176 {
5177 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, supported_sig_algs_end, 2 );
5178 sig_alg = MBEDTLS_GET_UINT16_BE( p, 0 );
5179 p += 2;
Jerry Yuf3b46b52022-06-19 16:52:27 +08005180 MBEDTLS_SSL_DEBUG_MSG( 4, ( "received signature algorithm: 0x%x %s",
5181 sig_alg,
5182 mbedtls_ssl_sig_alg_to_str( sig_alg ) ) );
Jerry Yu2fe6c632022-06-29 10:02:38 +08005183#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu52b7d922022-07-01 18:03:31 +08005184 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 &&
Jerry Yu2fe6c632022-06-29 10:02:38 +08005185 ( ! ( mbedtls_ssl_sig_alg_is_supported( ssl, sig_alg ) &&
5186 mbedtls_ssl_sig_alg_is_offered( ssl, sig_alg ) ) ) )
5187 {
Gabor Mezei078e8032022-04-27 21:17:56 +02005188 continue;
Jerry Yu2fe6c632022-06-29 10:02:38 +08005189 }
5190#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gabor Mezei078e8032022-04-27 21:17:56 +02005191
Jerry Yuf3b46b52022-06-19 16:52:27 +08005192 MBEDTLS_SSL_DEBUG_MSG( 4, ( "valid signature algorithm: %s",
5193 mbedtls_ssl_sig_alg_to_str( sig_alg ) ) );
Gabor Mezei078e8032022-04-27 21:17:56 +02005194
5195 if( common_idx + 1 < MBEDTLS_RECEIVED_SIG_ALGS_SIZE )
5196 {
5197 ssl->handshake->received_sig_algs[common_idx] = sig_alg;
5198 common_idx += 1;
5199 }
5200 }
5201 /* Check that we consumed all the message. */
5202 if( p != end )
5203 {
5204 MBEDTLS_SSL_DEBUG_MSG( 1,
5205 ( "Signature algorithms extension length misaligned" ) );
5206 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
5207 MBEDTLS_ERR_SSL_DECODE_ERROR );
5208 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
5209 }
5210
5211 if( common_idx == 0 )
5212 {
5213 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature algorithm in common" ) );
5214 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
5215 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
5216 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
5217 }
5218
Gabor Mezei15b95a62022-05-09 16:37:58 +02005219 ssl->handshake->received_sig_algs[common_idx] = MBEDTLS_TLS_SIG_NONE;
Gabor Mezei078e8032022-04-27 21:17:56 +02005220 return( 0 );
5221}
5222
5223#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
5224
Jerry Yudc7bd172022-02-17 13:44:15 +08005225#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5226
5227#if defined(MBEDTLS_USE_PSA_CRYPTO)
5228
5229static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation,
5230 mbedtls_svc_key_id_t key,
5231 psa_algorithm_t alg,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005232 const unsigned char* raw_psk, size_t raw_psk_length,
Jerry Yudc7bd172022-02-17 13:44:15 +08005233 const unsigned char* seed, size_t seed_length,
5234 const unsigned char* label, size_t label_length,
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005235 const unsigned char* other_secret,
5236 size_t other_secret_length,
Jerry Yudc7bd172022-02-17 13:44:15 +08005237 size_t capacity )
5238{
5239 psa_status_t status;
5240
5241 status = psa_key_derivation_setup( derivation, alg );
5242 if( status != PSA_SUCCESS )
5243 return( status );
5244
5245 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
5246 {
5247 status = psa_key_derivation_input_bytes( derivation,
5248 PSA_KEY_DERIVATION_INPUT_SEED,
5249 seed, seed_length );
5250 if( status != PSA_SUCCESS )
5251 return( status );
5252
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005253 if ( other_secret != NULL )
Przemek Stekiel1f027032022-04-05 17:12:11 +02005254 {
5255 status = psa_key_derivation_input_bytes( derivation,
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005256 PSA_KEY_DERIVATION_INPUT_OTHER_SECRET,
5257 other_secret, other_secret_length );
Przemek Stekiel1f027032022-04-05 17:12:11 +02005258 if( status != PSA_SUCCESS )
5259 return( status );
5260 }
5261
Jerry Yudc7bd172022-02-17 13:44:15 +08005262 if( mbedtls_svc_key_id_is_null( key ) )
5263 {
5264 status = psa_key_derivation_input_bytes(
5265 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005266 raw_psk, raw_psk_length );
Jerry Yudc7bd172022-02-17 13:44:15 +08005267 }
5268 else
5269 {
5270 status = psa_key_derivation_input_key(
5271 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key );
5272 }
5273 if( status != PSA_SUCCESS )
5274 return( status );
5275
5276 status = psa_key_derivation_input_bytes( derivation,
5277 PSA_KEY_DERIVATION_INPUT_LABEL,
5278 label, label_length );
5279 if( status != PSA_SUCCESS )
5280 return( status );
5281 }
5282 else
5283 {
5284 return( PSA_ERROR_NOT_SUPPORTED );
5285 }
5286
5287 status = psa_key_derivation_set_capacity( derivation, capacity );
5288 if( status != PSA_SUCCESS )
5289 return( status );
5290
5291 return( PSA_SUCCESS );
5292}
5293
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005294MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005295static int tls_prf_generic( mbedtls_md_type_t md_type,
5296 const unsigned char *secret, size_t slen,
5297 const char *label,
5298 const unsigned char *random, size_t rlen,
5299 unsigned char *dstbuf, size_t dlen )
5300{
5301 psa_status_t status;
5302 psa_algorithm_t alg;
5303 mbedtls_svc_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
5304 psa_key_derivation_operation_t derivation =
5305 PSA_KEY_DERIVATION_OPERATION_INIT;
5306
5307 if( md_type == MBEDTLS_MD_SHA384 )
5308 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
5309 else
5310 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
5311
5312 /* Normally a "secret" should be long enough to be impossible to
5313 * find by brute force, and in particular should not be empty. But
5314 * this PRF is also used to derive an IV, in particular in EAP-TLS,
5315 * and for this use case it makes sense to have a 0-length "secret".
5316 * Since the key API doesn't allow importing a key of length 0,
5317 * keep master_key=0, which setup_psa_key_derivation() understands
5318 * to mean a 0-length "secret" input. */
5319 if( slen != 0 )
5320 {
5321 psa_key_attributes_t key_attributes = psa_key_attributes_init();
5322 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
5323 psa_set_key_algorithm( &key_attributes, alg );
5324 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE );
5325
5326 status = psa_import_key( &key_attributes, secret, slen, &master_key );
5327 if( status != PSA_SUCCESS )
5328 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5329 }
5330
5331 status = setup_psa_key_derivation( &derivation,
5332 master_key, alg,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005333 NULL, 0,
Jerry Yudc7bd172022-02-17 13:44:15 +08005334 random, rlen,
5335 (unsigned char const *) label,
5336 (size_t) strlen( label ),
Przemek Stekiel1f027032022-04-05 17:12:11 +02005337 NULL, 0,
Jerry Yudc7bd172022-02-17 13:44:15 +08005338 dlen );
5339 if( status != PSA_SUCCESS )
5340 {
5341 psa_key_derivation_abort( &derivation );
5342 psa_destroy_key( master_key );
5343 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5344 }
5345
5346 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen );
5347 if( status != PSA_SUCCESS )
5348 {
5349 psa_key_derivation_abort( &derivation );
5350 psa_destroy_key( master_key );
5351 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5352 }
5353
5354 status = psa_key_derivation_abort( &derivation );
5355 if( status != PSA_SUCCESS )
5356 {
5357 psa_destroy_key( master_key );
5358 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5359 }
5360
5361 if( ! mbedtls_svc_key_id_is_null( master_key ) )
5362 status = psa_destroy_key( master_key );
5363 if( status != PSA_SUCCESS )
5364 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5365
5366 return( 0 );
5367}
5368
5369#else /* MBEDTLS_USE_PSA_CRYPTO */
5370
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005371MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005372static int tls_prf_generic( mbedtls_md_type_t md_type,
5373 const unsigned char *secret, size_t slen,
5374 const char *label,
5375 const unsigned char *random, size_t rlen,
5376 unsigned char *dstbuf, size_t dlen )
5377{
5378 size_t nb;
5379 size_t i, j, k, md_len;
5380 unsigned char *tmp;
5381 size_t tmp_len = 0;
5382 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
5383 const mbedtls_md_info_t *md_info;
5384 mbedtls_md_context_t md_ctx;
5385 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5386
5387 mbedtls_md_init( &md_ctx );
5388
5389 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
5390 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5391
5392 md_len = mbedtls_md_get_size( md_info );
5393
5394 tmp_len = md_len + strlen( label ) + rlen;
5395 tmp = mbedtls_calloc( 1, tmp_len );
5396 if( tmp == NULL )
5397 {
5398 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
5399 goto exit;
5400 }
5401
5402 nb = strlen( label );
5403 memcpy( tmp + md_len, label, nb );
5404 memcpy( tmp + md_len + nb, random, rlen );
5405 nb += rlen;
5406
5407 /*
5408 * Compute P_<hash>(secret, label + random)[0..dlen]
5409 */
5410 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
5411 goto exit;
5412
5413 ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen );
5414 if( ret != 0 )
5415 goto exit;
5416 ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
5417 if( ret != 0 )
5418 goto exit;
5419 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
5420 if( ret != 0 )
5421 goto exit;
5422
5423 for( i = 0; i < dlen; i += md_len )
5424 {
5425 ret = mbedtls_md_hmac_reset ( &md_ctx );
5426 if( ret != 0 )
5427 goto exit;
5428 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
5429 if( ret != 0 )
5430 goto exit;
5431 ret = mbedtls_md_hmac_finish( &md_ctx, h_i );
5432 if( ret != 0 )
5433 goto exit;
5434
5435 ret = mbedtls_md_hmac_reset ( &md_ctx );
5436 if( ret != 0 )
5437 goto exit;
5438 ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
5439 if( ret != 0 )
5440 goto exit;
5441 ret = mbedtls_md_hmac_finish( &md_ctx, tmp );
5442 if( ret != 0 )
5443 goto exit;
5444
5445 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
5446
5447 for( j = 0; j < k; j++ )
5448 dstbuf[i + j] = h_i[j];
5449 }
5450
5451exit:
5452 mbedtls_md_free( &md_ctx );
5453
5454 mbedtls_platform_zeroize( tmp, tmp_len );
5455 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
5456
5457 mbedtls_free( tmp );
5458
5459 return( ret );
5460}
5461#endif /* MBEDTLS_USE_PSA_CRYPTO */
5462
5463#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005464MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005465static int tls_prf_sha256( const unsigned char *secret, size_t slen,
5466 const char *label,
5467 const unsigned char *random, size_t rlen,
5468 unsigned char *dstbuf, size_t dlen )
5469{
5470 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
5471 label, random, rlen, dstbuf, dlen ) );
5472}
5473#endif /* MBEDTLS_SHA256_C */
5474
5475#if defined(MBEDTLS_SHA384_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005476MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yudc7bd172022-02-17 13:44:15 +08005477static int tls_prf_sha384( const unsigned char *secret, size_t slen,
5478 const char *label,
5479 const unsigned char *random, size_t rlen,
5480 unsigned char *dstbuf, size_t dlen )
5481{
5482 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
5483 label, random, rlen, dstbuf, dlen ) );
5484}
5485#endif /* MBEDTLS_SHA384_C */
5486
Jerry Yuf009d862022-02-17 14:01:37 +08005487/*
5488 * Set appropriate PRF function and other SSL / TLS1.2 functions
5489 *
5490 * Inputs:
Jerry Yuf009d862022-02-17 14:01:37 +08005491 * - hash associated with the ciphersuite (only used by TLS 1.2)
5492 *
5493 * Outputs:
5494 * - the tls_prf, calc_verify and calc_finished members of handshake structure
5495 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005496MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuf009d862022-02-17 14:01:37 +08005497static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
Jerry Yuf009d862022-02-17 14:01:37 +08005498 mbedtls_md_type_t hash )
5499{
Jerry Yuf009d862022-02-17 14:01:37 +08005500#if defined(MBEDTLS_SHA384_C)
Ronald Cron81591aa2022-03-07 09:05:51 +01005501 if( hash == MBEDTLS_MD_SHA384 )
Jerry Yuf009d862022-02-17 14:01:37 +08005502 {
5503 handshake->tls_prf = tls_prf_sha384;
5504 handshake->calc_verify = ssl_calc_verify_tls_sha384;
5505 handshake->calc_finished = ssl_calc_finished_tls_sha384;
5506 }
5507 else
5508#endif
5509#if defined(MBEDTLS_SHA256_C)
Jerry Yuf009d862022-02-17 14:01:37 +08005510 {
Ronald Cron81591aa2022-03-07 09:05:51 +01005511 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08005512 handshake->tls_prf = tls_prf_sha256;
5513 handshake->calc_verify = ssl_calc_verify_tls_sha256;
5514 handshake->calc_finished = ssl_calc_finished_tls_sha256;
5515 }
Ronald Cron81591aa2022-03-07 09:05:51 +01005516#else
Jerry Yuf009d862022-02-17 14:01:37 +08005517 {
Jerry Yuf009d862022-02-17 14:01:37 +08005518 (void) handshake;
Ronald Cron81591aa2022-03-07 09:05:51 +01005519 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08005520 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5521 }
Ronald Cron81591aa2022-03-07 09:05:51 +01005522#endif
Jerry Yuf009d862022-02-17 14:01:37 +08005523
5524 return( 0 );
5525}
Jerry Yud6ab2352022-02-17 14:03:43 +08005526
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005527/*
5528 * Compute master secret if needed
5529 *
5530 * Parameters:
5531 * [in/out] handshake
5532 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
5533 * (PSA-PSK) ciphersuite_info, psk_opaque
5534 * [out] premaster (cleared)
5535 * [out] master
5536 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
5537 * debug: conf->f_dbg, conf->p_dbg
5538 * EMS: passed to calc_verify (debug + session_negotiate)
Ronald Crona25cf582022-03-07 11:10:36 +01005539 * PSA-PSA: conf
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005540 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005541MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005542static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
5543 unsigned char *master,
5544 const mbedtls_ssl_context *ssl )
5545{
5546 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5547
5548 /* cf. RFC 5246, Section 8.1:
5549 * "The master secret is always exactly 48 bytes in length." */
5550 size_t const master_secret_len = 48;
5551
5552#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5553 unsigned char session_hash[48];
5554#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
5555
5556 /* The label for the KDF used for key expansion.
5557 * This is either "master secret" or "extended master secret"
5558 * depending on whether the Extended Master Secret extension
5559 * is used. */
5560 char const *lbl = "master secret";
5561
Przemek Stekielae4ed302022-04-05 17:15:55 +02005562 /* The seed for the KDF used for key expansion.
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005563 * - If the Extended Master Secret extension is not used,
5564 * this is ClientHello.Random + ServerHello.Random
5565 * (see Sect. 8.1 in RFC 5246).
5566 * - If the Extended Master Secret extension is used,
5567 * this is the transcript of the handshake so far.
5568 * (see Sect. 4 in RFC 7627). */
Przemek Stekielae4ed302022-04-05 17:15:55 +02005569 unsigned char const *seed = handshake->randbytes;
5570 size_t seed_len = 64;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005571
5572#if !defined(MBEDTLS_DEBUG_C) && \
5573 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
5574 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
5575 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
5576 ssl = NULL; /* make sure we don't use it except for those cases */
5577 (void) ssl;
5578#endif
5579
5580 if( handshake->resume != 0 )
5581 {
5582 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
5583 return( 0 );
5584 }
5585
5586#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5587 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
5588 {
5589 lbl = "extended master secret";
Przemek Stekielae4ed302022-04-05 17:15:55 +02005590 seed = session_hash;
5591 handshake->calc_verify( ssl, session_hash, &seed_len );
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005592
5593 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
Przemek Stekielae4ed302022-04-05 17:15:55 +02005594 session_hash, seed_len );
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005595 }
Przemek Stekiel169bf0b2022-04-29 07:53:29 +02005596#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005597
Przemek Stekiel99114f32022-04-22 11:20:09 +02005598#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
Przemek Stekiel8a4b7fd2022-04-28 09:22:22 +02005599 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Neil Armstronge952a302022-05-03 10:22:14 +02005600 if( mbedtls_ssl_ciphersuite_uses_psk( handshake->ciphersuite_info ) == 1 )
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005601 {
5602 /* Perform PSK-to-MS expansion in a single step. */
5603 psa_status_t status;
5604 psa_algorithm_t alg;
5605 mbedtls_svc_key_id_t psk;
5606 psa_key_derivation_operation_t derivation =
5607 PSA_KEY_DERIVATION_OPERATION_INIT;
5608 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac;
5609
5610 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
5611
5612 psk = mbedtls_ssl_get_opaque_psk( ssl );
5613
5614 if( hash_alg == MBEDTLS_MD_SHA384 )
5615 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
5616 else
5617 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
5618
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005619 size_t other_secret_len = 0;
5620 unsigned char* other_secret = NULL;
Przemek Stekielc2033402022-04-05 17:19:41 +02005621
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005622 switch( handshake->ciphersuite_info->key_exchange )
Przemek Stekielc2033402022-04-05 17:19:41 +02005623 {
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005624 /* Provide other secret.
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005625 * Other secret is stored in premaster, where first 2 bytes hold the
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005626 * length of the other key.
Przemek Stekielc2033402022-04-05 17:19:41 +02005627 */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005628 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Przemek Stekiel8abcee92022-04-28 09:16:28 +02005629 /* For RSA-PSK other key length is always 48 bytes. */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005630 other_secret_len = 48;
5631 other_secret = handshake->premaster + 2;
5632 break;
5633 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Przemek Stekielb293aaa2022-04-19 12:22:38 +02005634 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
Przemek Stekiel19b80f82022-04-14 08:29:31 +02005635 other_secret_len = MBEDTLS_GET_UINT16_BE(handshake->premaster, 0);
5636 other_secret = handshake->premaster + 2;
5637 break;
5638 default:
5639 break;
Przemek Stekielc2033402022-04-05 17:19:41 +02005640 }
5641
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005642 status = setup_psa_key_derivation( &derivation, psk, alg,
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005643 ssl->conf->psk, ssl->conf->psk_len,
Przemek Stekielae4ed302022-04-05 17:15:55 +02005644 seed, seed_len,
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005645 (unsigned char const *) lbl,
5646 (size_t) strlen( lbl ),
Przemek Stekiel51a1f362022-04-13 08:57:06 +02005647 other_secret, other_secret_len,
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005648 master_secret_len );
5649 if( status != PSA_SUCCESS )
5650 {
5651 psa_key_derivation_abort( &derivation );
5652 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5653 }
5654
5655 status = psa_key_derivation_output_bytes( &derivation,
5656 master,
5657 master_secret_len );
5658 if( status != PSA_SUCCESS )
5659 {
5660 psa_key_derivation_abort( &derivation );
5661 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5662 }
5663
5664 status = psa_key_derivation_abort( &derivation );
5665 if( status != PSA_SUCCESS )
5666 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
5667 }
5668 else
5669#endif
5670 {
5671 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
Przemek Stekielae4ed302022-04-05 17:15:55 +02005672 lbl, seed, seed_len,
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08005673 master,
5674 master_secret_len );
5675 if( ret != 0 )
5676 {
5677 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
5678 return( ret );
5679 }
5680
5681 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret",
5682 handshake->premaster,
5683 handshake->pmslen );
5684
5685 mbedtls_platform_zeroize( handshake->premaster,
5686 sizeof(handshake->premaster) );
5687 }
5688
5689 return( 0 );
5690}
5691
Jerry Yud62f87e2022-02-17 14:09:02 +08005692int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
5693{
5694 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5695 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
5696 ssl->handshake->ciphersuite_info;
5697
5698 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
5699
5700 /* Set PRF, calc_verify and calc_finished function pointers */
5701 ret = ssl_set_handshake_prfs( ssl->handshake,
Jerry Yud62f87e2022-02-17 14:09:02 +08005702 ciphersuite_info->mac );
5703 if( ret != 0 )
5704 {
5705 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret );
5706 return( ret );
5707 }
5708
5709 /* Compute master secret if needed */
5710 ret = ssl_compute_master( ssl->handshake,
5711 ssl->session_negotiate->master,
5712 ssl );
5713 if( ret != 0 )
5714 {
5715 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
5716 return( ret );
5717 }
5718
5719 /* Swap the client and server random values:
5720 * - MS derivation wanted client+server (RFC 5246 8.1)
5721 * - key derivation wants server+client (RFC 5246 6.3) */
5722 {
5723 unsigned char tmp[64];
5724 memcpy( tmp, ssl->handshake->randbytes, 64 );
5725 memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
5726 memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
5727 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
5728 }
5729
5730 /* Populate transform structure */
5731 ret = ssl_tls12_populate_transform( ssl->transform_negotiate,
5732 ssl->session_negotiate->ciphersuite,
5733 ssl->session_negotiate->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02005734#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yud62f87e2022-02-17 14:09:02 +08005735 ssl->session_negotiate->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02005736#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Jerry Yud62f87e2022-02-17 14:09:02 +08005737 ssl->handshake->tls_prf,
5738 ssl->handshake->randbytes,
Glenn Strauss60bfe602022-03-14 19:04:24 -04005739 ssl->tls_version,
Jerry Yud62f87e2022-02-17 14:09:02 +08005740 ssl->conf->endpoint,
5741 ssl );
5742 if( ret != 0 )
5743 {
5744 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls12_populate_transform", ret );
5745 return( ret );
5746 }
5747
5748 /* We no longer need Server/ClientHello.random values */
5749 mbedtls_platform_zeroize( ssl->handshake->randbytes,
5750 sizeof( ssl->handshake->randbytes ) );
5751
5752 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
5753
5754 return( 0 );
5755}
Jerry Yu8392e0d2022-02-17 14:10:24 +08005756
Ronald Cron4dcbca92022-03-07 10:21:40 +01005757int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
5758{
Ronald Cron4dcbca92022-03-07 10:21:40 +01005759 switch( md )
5760 {
5761#if defined(MBEDTLS_SHA384_C)
5762 case MBEDTLS_SSL_HASH_SHA384:
5763 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
5764 break;
5765#endif
5766#if defined(MBEDTLS_SHA256_C)
5767 case MBEDTLS_SSL_HASH_SHA256:
5768 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
5769 break;
5770#endif
5771 default:
5772 return( -1 );
5773 }
5774
Ronald Cronc2f13a02022-03-07 10:25:24 +01005775 return( 0 );
Ronald Cron4dcbca92022-03-07 10:21:40 +01005776}
5777
Jerry Yu8392e0d2022-02-17 14:10:24 +08005778#if defined(MBEDTLS_SHA256_C)
5779void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
5780 unsigned char *hash,
5781 size_t *hlen )
5782{
5783#if defined(MBEDTLS_USE_PSA_CRYPTO)
5784 size_t hash_size;
5785 psa_status_t status;
5786 psa_hash_operation_t sha256_psa = psa_hash_operation_init();
5787
5788 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) );
5789 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
5790 if( status != PSA_SUCCESS )
5791 {
5792 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
5793 return;
5794 }
5795
5796 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size );
5797 if( status != PSA_SUCCESS )
5798 {
5799 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
5800 return;
5801 }
5802
5803 *hlen = 32;
5804 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
5805 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
5806#else
5807 mbedtls_sha256_context sha256;
5808
5809 mbedtls_sha256_init( &sha256 );
5810
5811 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
5812
5813 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
5814 mbedtls_sha256_finish( &sha256, hash );
5815
5816 *hlen = 32;
5817
5818 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
5819 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
5820
5821 mbedtls_sha256_free( &sha256 );
5822#endif /* MBEDTLS_USE_PSA_CRYPTO */
5823 return;
5824}
5825#endif /* MBEDTLS_SHA256_C */
5826
Jerry Yuc1cb3842022-02-17 14:13:48 +08005827#if defined(MBEDTLS_SHA384_C)
5828void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
5829 unsigned char *hash,
5830 size_t *hlen )
5831{
5832#if defined(MBEDTLS_USE_PSA_CRYPTO)
5833 size_t hash_size;
5834 psa_status_t status;
5835 psa_hash_operation_t sha384_psa = psa_hash_operation_init();
5836
5837 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) );
5838 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
5839 if( status != PSA_SUCCESS )
5840 {
5841 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
5842 return;
5843 }
5844
5845 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size );
5846 if( status != PSA_SUCCESS )
5847 {
5848 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
5849 return;
5850 }
5851
5852 *hlen = 48;
5853 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen );
5854 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) );
5855#else
5856 mbedtls_sha512_context sha512;
5857
5858 mbedtls_sha512_init( &sha512 );
5859
5860 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
5861
5862 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
5863 mbedtls_sha512_finish( &sha512, hash );
5864
5865 *hlen = 48;
5866
5867 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
5868 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
5869
5870 mbedtls_sha512_free( &sha512 );
5871#endif /* MBEDTLS_USE_PSA_CRYPTO */
5872 return;
5873}
5874#endif /* MBEDTLS_SHA384_C */
5875
Neil Armstrong80f6f322022-05-03 17:56:38 +02005876#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
5877 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Jerry Yuce3dca42022-02-17 14:16:37 +08005878int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
5879{
5880 unsigned char *p = ssl->handshake->premaster;
5881 unsigned char *end = p + sizeof( ssl->handshake->premaster );
5882 const unsigned char *psk = NULL;
5883 size_t psk_len = 0;
Przemek Stekielb293aaa2022-04-19 12:22:38 +02005884 int psk_ret = mbedtls_ssl_get_psk( ssl, &psk, &psk_len );
Jerry Yuce3dca42022-02-17 14:16:37 +08005885
Przemek Stekielb293aaa2022-04-19 12:22:38 +02005886 if( psk_ret == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
Jerry Yuce3dca42022-02-17 14:16:37 +08005887 {
5888 /*
5889 * This should never happen because the existence of a PSK is always
Przemek Stekielb293aaa2022-04-19 12:22:38 +02005890 * checked before calling this function.
5891 *
5892 * The exception is opaque DHE-PSK. For DHE-PSK fill premaster with
Przemek Stekiel8abcee92022-04-28 09:16:28 +02005893 * the shared secret without PSK.
Jerry Yuce3dca42022-02-17 14:16:37 +08005894 */
Przemek Stekielb293aaa2022-04-19 12:22:38 +02005895 if ( key_ex != MBEDTLS_KEY_EXCHANGE_DHE_PSK )
5896 {
5897 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5898 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5899 }
Jerry Yuce3dca42022-02-17 14:16:37 +08005900 }
5901
5902 /*
5903 * PMS = struct {
5904 * opaque other_secret<0..2^16-1>;
5905 * opaque psk<0..2^16-1>;
5906 * };
5907 * with "other_secret" depending on the particular key exchange
5908 */
5909#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
5910 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
5911 {
5912 if( end - p < 2 )
5913 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5914
5915 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
5916 p += 2;
5917
5918 if( end < p || (size_t)( end - p ) < psk_len )
5919 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5920
5921 memset( p, 0, psk_len );
5922 p += psk_len;
5923 }
5924 else
5925#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
5926#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
5927 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
5928 {
5929 /*
5930 * other_secret already set by the ClientKeyExchange message,
5931 * and is 48 bytes long
5932 */
5933 if( end - p < 2 )
5934 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5935
5936 *p++ = 0;
5937 *p++ = 48;
5938 p += 48;
5939 }
5940 else
5941#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
5942#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
5943 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
5944 {
5945 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5946 size_t len;
5947
5948 /* Write length only when we know the actual value */
5949 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
5950 p + 2, end - ( p + 2 ), &len,
5951 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
5952 {
5953 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
5954 return( ret );
5955 }
5956 MBEDTLS_PUT_UINT16_BE( len, p, 0 );
5957 p += 2 + len;
5958
5959 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
5960 }
5961 else
5962#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Neil Armstrong80f6f322022-05-03 17:56:38 +02005963#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
Jerry Yuce3dca42022-02-17 14:16:37 +08005964 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
5965 {
5966 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
5967 size_t zlen;
5968
5969 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
5970 p + 2, end - ( p + 2 ),
5971 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
5972 {
5973 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
5974 return( ret );
5975 }
5976
5977 MBEDTLS_PUT_UINT16_BE( zlen, p, 0 );
5978 p += 2 + zlen;
5979
5980 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
5981 MBEDTLS_DEBUG_ECDH_Z );
5982 }
5983 else
Neil Armstrong80f6f322022-05-03 17:56:38 +02005984#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Jerry Yuce3dca42022-02-17 14:16:37 +08005985 {
5986 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5987 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5988 }
5989
5990 /* opaque psk<0..2^16-1>; */
5991 if( end - p < 2 )
5992 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5993
5994 MBEDTLS_PUT_UINT16_BE( psk_len, p, 0 );
5995 p += 2;
5996
5997 if( end < p || (size_t)( end - p ) < psk_len )
5998 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5999
6000 memcpy( p, psk, psk_len );
6001 p += psk_len;
6002
6003 ssl->handshake->pmslen = p - ssl->handshake->premaster;
6004
6005 return( 0 );
6006}
Neil Armstrong80f6f322022-05-03 17:56:38 +02006007#endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Jerry Yuc2c673d2022-02-17 14:20:39 +08006008
6009#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006010MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuc2c673d2022-02-17 14:20:39 +08006011static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
6012
6013#if defined(MBEDTLS_SSL_PROTO_DTLS)
6014int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl )
6015{
6016 /* If renegotiation is not enforced, retransmit until we would reach max
6017 * timeout if we were using the usual handshake doubling scheme */
6018 if( ssl->conf->renego_max_records < 0 )
6019 {
6020 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
6021 unsigned char doublings = 1;
6022
6023 while( ratio != 0 )
6024 {
6025 ++doublings;
6026 ratio >>= 1;
6027 }
6028
6029 if( ++ssl->renego_records_seen > doublings )
6030 {
6031 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
6032 return( 0 );
6033 }
6034 }
6035
6036 return( ssl_write_hello_request( ssl ) );
6037}
6038#endif
6039#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Jerry Yud9526692022-02-17 14:23:47 +08006040
Jerry Yud9526692022-02-17 14:23:47 +08006041/*
6042 * Handshake functions
6043 */
6044#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6045/* No certificate support -> dummy functions */
6046int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
6047{
6048 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6049 ssl->handshake->ciphersuite_info;
6050
6051 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
6052
6053 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
6054 {
6055 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
6056 ssl->state++;
6057 return( 0 );
6058 }
6059
6060 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6061 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6062}
6063
6064int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
6065{
6066 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6067 ssl->handshake->ciphersuite_info;
6068
6069 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
6070
6071 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
6072 {
6073 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
6074 ssl->state++;
6075 return( 0 );
6076 }
6077
6078 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6079 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6080}
6081
6082#else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6083/* Some certificate support -> implement write and parse */
6084
6085int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
6086{
6087 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
6088 size_t i, n;
6089 const mbedtls_x509_crt *crt;
6090 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6091 ssl->handshake->ciphersuite_info;
6092
6093 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
6094
6095 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
6096 {
6097 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
6098 ssl->state++;
6099 return( 0 );
6100 }
6101
6102#if defined(MBEDTLS_SSL_CLI_C)
6103 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
6104 {
6105 if( ssl->handshake->client_auth == 0 )
6106 {
6107 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
6108 ssl->state++;
6109 return( 0 );
6110 }
6111 }
6112#endif /* MBEDTLS_SSL_CLI_C */
6113#if defined(MBEDTLS_SSL_SRV_C)
6114 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
6115 {
6116 if( mbedtls_ssl_own_cert( ssl ) == NULL )
6117 {
6118 /* Should never happen because we shouldn't have picked the
6119 * ciphersuite if we don't have a certificate. */
6120 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6121 }
6122 }
6123#endif
6124
6125 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
6126
6127 /*
6128 * 0 . 0 handshake type
6129 * 1 . 3 handshake length
6130 * 4 . 6 length of all certs
6131 * 7 . 9 length of cert. 1
6132 * 10 . n-1 peer certificate
6133 * n . n+2 length of cert. 2
6134 * n+3 . ... upper level cert, etc.
6135 */
6136 i = 7;
6137 crt = mbedtls_ssl_own_cert( ssl );
6138
6139 while( crt != NULL )
6140 {
6141 n = crt->raw.len;
6142 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
6143 {
6144 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET
6145 " > %" MBEDTLS_PRINTF_SIZET,
6146 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
6147 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
6148 }
6149
6150 ssl->out_msg[i ] = MBEDTLS_BYTE_2( n );
6151 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1( n );
6152 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0( n );
6153
6154 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
6155 i += n; crt = crt->next;
6156 }
6157
6158 ssl->out_msg[4] = MBEDTLS_BYTE_2( i - 7 );
6159 ssl->out_msg[5] = MBEDTLS_BYTE_1( i - 7 );
6160 ssl->out_msg[6] = MBEDTLS_BYTE_0( i - 7 );
6161
6162 ssl->out_msglen = i;
6163 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6164 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
6165
6166 ssl->state++;
6167
6168 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
6169 {
6170 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
6171 return( ret );
6172 }
6173
6174 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
6175
6176 return( ret );
6177}
6178
6179#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6180
6181#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006182MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006183static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
6184 unsigned char *crt_buf,
6185 size_t crt_buf_len )
6186{
6187 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
6188
6189 if( peer_crt == NULL )
6190 return( -1 );
6191
6192 if( peer_crt->raw.len != crt_buf_len )
6193 return( -1 );
6194
6195 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) );
6196}
6197#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006198MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006199static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
6200 unsigned char *crt_buf,
6201 size_t crt_buf_len )
6202{
6203 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6204 unsigned char const * const peer_cert_digest =
6205 ssl->session->peer_cert_digest;
6206 mbedtls_md_type_t const peer_cert_digest_type =
6207 ssl->session->peer_cert_digest_type;
6208 mbedtls_md_info_t const * const digest_info =
6209 mbedtls_md_info_from_type( peer_cert_digest_type );
6210 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
6211 size_t digest_len;
6212
6213 if( peer_cert_digest == NULL || digest_info == NULL )
6214 return( -1 );
6215
6216 digest_len = mbedtls_md_get_size( digest_info );
6217 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
6218 return( -1 );
6219
6220 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
6221 if( ret != 0 )
6222 return( -1 );
6223
6224 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) );
6225}
6226#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6227#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
6228
6229/*
6230 * Once the certificate message is read, parse it into a cert chain and
6231 * perform basic checks, but leave actual verification to the caller
6232 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006233MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006234static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
6235 mbedtls_x509_crt *chain )
6236{
6237 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6238#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6239 int crt_cnt=0;
6240#endif
6241 size_t i, n;
6242 uint8_t alert;
6243
6244 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
6245 {
6246 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6247 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6248 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6249 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
6250 }
6251
6252 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE )
6253 {
6254 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6255 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
6256 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
6257 }
6258
6259 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
6260 {
6261 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6262 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6263 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6264 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6265 }
6266
6267 i = mbedtls_ssl_hs_hdr_len( ssl );
6268
6269 /*
6270 * Same message structure as in mbedtls_ssl_write_certificate()
6271 */
6272 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
6273
6274 if( ssl->in_msg[i] != 0 ||
6275 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
6276 {
6277 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6278 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6279 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6280 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6281 }
6282
6283 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
6284 i += 3;
6285
6286 /* Iterate through and parse the CRTs in the provided chain. */
6287 while( i < ssl->in_hslen )
6288 {
6289 /* Check that there's room for the next CRT's length fields. */
6290 if ( i + 3 > ssl->in_hslen ) {
6291 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6292 mbedtls_ssl_send_alert_message( ssl,
6293 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6294 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6295 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6296 }
6297 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
6298 * anything beyond 2**16 ~ 64K. */
6299 if( ssl->in_msg[i] != 0 )
6300 {
6301 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6302 mbedtls_ssl_send_alert_message( ssl,
6303 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6304 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT );
6305 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
6306 }
6307
6308 /* Read length of the next CRT in the chain. */
6309 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
6310 | (unsigned int) ssl->in_msg[i + 2];
6311 i += 3;
6312
6313 if( n < 128 || i + n > ssl->in_hslen )
6314 {
6315 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6316 mbedtls_ssl_send_alert_message( ssl,
6317 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6318 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6319 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
6320 }
6321
6322 /* Check if we're handling the first CRT in the chain. */
6323#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
6324 if( crt_cnt++ == 0 &&
6325 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
6326 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
6327 {
6328 /* During client-side renegotiation, check that the server's
6329 * end-CRTs hasn't changed compared to the initial handshake,
6330 * mitigating the triple handshake attack. On success, reuse
6331 * the original end-CRT instead of parsing it again. */
6332 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
6333 if( ssl_check_peer_crt_unchanged( ssl,
6334 &ssl->in_msg[i],
6335 n ) != 0 )
6336 {
6337 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
6338 mbedtls_ssl_send_alert_message( ssl,
6339 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6340 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
6341 return( MBEDTLS_ERR_SSL_BAD_CERTIFICATE );
6342 }
6343
6344 /* Now we can safely free the original chain. */
6345 ssl_clear_peer_cert( ssl->session );
6346 }
6347#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
6348
6349 /* Parse the next certificate in the chain. */
6350#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6351 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
6352#else
6353 /* If we don't need to store the CRT chain permanently, parse
6354 * it in-place from the input buffer instead of making a copy. */
6355 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
6356#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6357 switch( ret )
6358 {
6359 case 0: /*ok*/
6360 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
6361 /* Ignore certificate with an unknown algorithm: maybe a
6362 prior certificate was already trusted. */
6363 break;
6364
6365 case MBEDTLS_ERR_X509_ALLOC_FAILED:
6366 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
6367 goto crt_parse_der_failed;
6368
6369 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
6370 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6371 goto crt_parse_der_failed;
6372
6373 default:
6374 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
6375 crt_parse_der_failed:
6376 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
6377 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
6378 return( ret );
6379 }
6380
6381 i += n;
6382 }
6383
6384 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
6385 return( 0 );
6386}
6387
6388#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006389MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006390static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
6391{
6392 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
6393 return( -1 );
6394
6395 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
6396 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
6397 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
6398 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
6399 {
Ronald Cron19385882022-06-15 16:26:13 +02006400 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer has no certificate" ) );
Jerry Yud9526692022-02-17 14:23:47 +08006401 return( 0 );
6402 }
6403 return( -1 );
6404}
6405#endif /* MBEDTLS_SSL_SRV_C */
6406
6407/* Check if a certificate message is expected.
6408 * Return either
6409 * - SSL_CERTIFICATE_EXPECTED, or
6410 * - SSL_CERTIFICATE_SKIP
6411 * indicating whether a Certificate message is expected or not.
6412 */
6413#define SSL_CERTIFICATE_EXPECTED 0
6414#define SSL_CERTIFICATE_SKIP 1
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006415MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006416static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
6417 int authmode )
6418{
6419 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6420 ssl->handshake->ciphersuite_info;
6421
6422 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
6423 return( SSL_CERTIFICATE_SKIP );
6424
6425#if defined(MBEDTLS_SSL_SRV_C)
6426 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
6427 {
6428 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
6429 return( SSL_CERTIFICATE_SKIP );
6430
6431 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
6432 {
6433 ssl->session_negotiate->verify_result =
6434 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
6435 return( SSL_CERTIFICATE_SKIP );
6436 }
6437 }
6438#else
6439 ((void) authmode);
6440#endif /* MBEDTLS_SSL_SRV_C */
6441
6442 return( SSL_CERTIFICATE_EXPECTED );
6443}
6444
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006445MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006446static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
6447 int authmode,
6448 mbedtls_x509_crt *chain,
6449 void *rs_ctx )
6450{
6451 int ret = 0;
6452 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6453 ssl->handshake->ciphersuite_info;
6454 int have_ca_chain = 0;
6455
6456 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
6457 void *p_vrfy;
6458
6459 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
6460 return( 0 );
6461
6462 if( ssl->f_vrfy != NULL )
6463 {
6464 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) );
6465 f_vrfy = ssl->f_vrfy;
6466 p_vrfy = ssl->p_vrfy;
6467 }
6468 else
6469 {
6470 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) );
6471 f_vrfy = ssl->conf->f_vrfy;
6472 p_vrfy = ssl->conf->p_vrfy;
6473 }
6474
6475 /*
6476 * Main check: verify certificate
6477 */
6478#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
6479 if( ssl->conf->f_ca_cb != NULL )
6480 {
6481 ((void) rs_ctx);
6482 have_ca_chain = 1;
6483
6484 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) );
6485 ret = mbedtls_x509_crt_verify_with_ca_cb(
6486 chain,
6487 ssl->conf->f_ca_cb,
6488 ssl->conf->p_ca_cb,
6489 ssl->conf->cert_profile,
6490 ssl->hostname,
6491 &ssl->session_negotiate->verify_result,
6492 f_vrfy, p_vrfy );
6493 }
6494 else
6495#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
6496 {
6497 mbedtls_x509_crt *ca_chain;
6498 mbedtls_x509_crl *ca_crl;
6499
6500#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6501 if( ssl->handshake->sni_ca_chain != NULL )
6502 {
6503 ca_chain = ssl->handshake->sni_ca_chain;
6504 ca_crl = ssl->handshake->sni_ca_crl;
6505 }
6506 else
6507#endif
6508 {
6509 ca_chain = ssl->conf->ca_chain;
6510 ca_crl = ssl->conf->ca_crl;
6511 }
6512
6513 if( ca_chain != NULL )
6514 have_ca_chain = 1;
6515
6516 ret = mbedtls_x509_crt_verify_restartable(
6517 chain,
6518 ca_chain, ca_crl,
6519 ssl->conf->cert_profile,
6520 ssl->hostname,
6521 &ssl->session_negotiate->verify_result,
6522 f_vrfy, p_vrfy, rs_ctx );
6523 }
6524
6525 if( ret != 0 )
6526 {
6527 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
6528 }
6529
6530#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6531 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
6532 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
6533#endif
6534
6535 /*
6536 * Secondary checks: always done, but change 'ret' only if it was 0
6537 */
6538
6539#if defined(MBEDTLS_ECP_C)
6540 {
6541 const mbedtls_pk_context *pk = &chain->pk;
6542
Manuel Pégourié-Gonnard66b0d612022-06-17 10:49:29 +02006543 /* If certificate uses an EC key, make sure the curve is OK.
6544 * This is a public key, so it can't be opaque, so can_do() is a good
6545 * enough check to ensure pk_ec() is safe to use here. */
Jerry Yud9526692022-02-17 14:23:47 +08006546 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
6547 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
6548 {
6549 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
6550
6551 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
6552 if( ret == 0 )
6553 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
6554 }
6555 }
6556#endif /* MBEDTLS_ECP_C */
6557
6558 if( mbedtls_ssl_check_cert_usage( chain,
6559 ciphersuite_info,
6560 ! ssl->conf->endpoint,
6561 &ssl->session_negotiate->verify_result ) != 0 )
6562 {
6563 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
6564 if( ret == 0 )
6565 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
6566 }
6567
6568 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
6569 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
6570 * with details encoded in the verification flags. All other kinds
6571 * of error codes, including those from the user provided f_vrfy
6572 * functions, are treated as fatal and lead to a failure of
6573 * ssl_parse_certificate even if verification was optional. */
6574 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
6575 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
6576 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE ) )
6577 {
6578 ret = 0;
6579 }
6580
6581 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
6582 {
6583 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
6584 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
6585 }
6586
6587 if( ret != 0 )
6588 {
6589 uint8_t alert;
6590
6591 /* The certificate may have been rejected for several reasons.
6592 Pick one and send the corresponding alert. Which alert to send
6593 may be a subject of debate in some cases. */
6594 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
6595 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
6596 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
6597 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
6598 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
6599 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6600 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
6601 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6602 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
6603 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6604 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
6605 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6606 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
6607 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6608 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
6609 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
6610 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
6611 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
6612 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
6613 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
6614 else
6615 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
6616 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6617 alert );
6618 }
6619
6620#if defined(MBEDTLS_DEBUG_C)
6621 if( ssl->session_negotiate->verify_result != 0 )
6622 {
6623 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %08x",
6624 (unsigned int) ssl->session_negotiate->verify_result ) );
6625 }
6626 else
6627 {
6628 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
6629 }
6630#endif /* MBEDTLS_DEBUG_C */
6631
6632 return( ret );
6633}
6634
6635#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006636MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006637static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
6638 unsigned char *start, size_t len )
6639{
6640 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6641 /* Remember digest of the peer's end-CRT. */
6642 ssl->session_negotiate->peer_cert_digest =
6643 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
6644 if( ssl->session_negotiate->peer_cert_digest == NULL )
6645 {
6646 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
6647 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) );
6648 mbedtls_ssl_send_alert_message( ssl,
6649 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6650 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
6651
6652 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
6653 }
6654
6655 ret = mbedtls_md( mbedtls_md_info_from_type(
6656 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
6657 start, len,
6658 ssl->session_negotiate->peer_cert_digest );
6659
6660 ssl->session_negotiate->peer_cert_digest_type =
6661 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
6662 ssl->session_negotiate->peer_cert_digest_len =
6663 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
6664
6665 return( ret );
6666}
6667
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006668MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yud9526692022-02-17 14:23:47 +08006669static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
6670 unsigned char *start, size_t len )
6671{
6672 unsigned char *end = start + len;
6673 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6674
6675 /* Make a copy of the peer's raw public key. */
6676 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
6677 ret = mbedtls_pk_parse_subpubkey( &start, end,
6678 &ssl->handshake->peer_pubkey );
6679 if( ret != 0 )
6680 {
6681 /* We should have parsed the public key before. */
6682 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6683 }
6684
6685 return( 0 );
6686}
6687#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6688
6689int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
6690{
6691 int ret = 0;
6692 int crt_expected;
6693#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6694 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
6695 ? ssl->handshake->sni_authmode
6696 : ssl->conf->authmode;
6697#else
6698 const int authmode = ssl->conf->authmode;
6699#endif
6700 void *rs_ctx = NULL;
6701 mbedtls_x509_crt *chain = NULL;
6702
6703 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
6704
6705 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
6706 if( crt_expected == SSL_CERTIFICATE_SKIP )
6707 {
6708 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
6709 goto exit;
6710 }
6711
6712#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6713 if( ssl->handshake->ecrs_enabled &&
6714 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
6715 {
6716 chain = ssl->handshake->ecrs_peer_cert;
6717 ssl->handshake->ecrs_peer_cert = NULL;
6718 goto crt_verify;
6719 }
6720#endif
6721
6722 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
6723 {
6724 /* mbedtls_ssl_read_record may have sent an alert already. We
6725 let it decide whether to alert. */
6726 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
6727 goto exit;
6728 }
6729
6730#if defined(MBEDTLS_SSL_SRV_C)
6731 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
6732 {
6733 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
6734
6735 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL )
6736 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
6737
6738 goto exit;
6739 }
6740#endif /* MBEDTLS_SSL_SRV_C */
6741
6742 /* Clear existing peer CRT structure in case we tried to
6743 * reuse a session but it failed, and allocate a new one. */
6744 ssl_clear_peer_cert( ssl->session_negotiate );
6745
6746 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
6747 if( chain == NULL )
6748 {
6749 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
6750 sizeof( mbedtls_x509_crt ) ) );
6751 mbedtls_ssl_send_alert_message( ssl,
6752 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6753 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
6754
6755 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
6756 goto exit;
6757 }
6758 mbedtls_x509_crt_init( chain );
6759
6760 ret = ssl_parse_certificate_chain( ssl, chain );
6761 if( ret != 0 )
6762 goto exit;
6763
6764#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6765 if( ssl->handshake->ecrs_enabled)
6766 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
6767
6768crt_verify:
6769 if( ssl->handshake->ecrs_enabled)
6770 rs_ctx = &ssl->handshake->ecrs_ctx;
6771#endif
6772
6773 ret = ssl_parse_certificate_verify( ssl, authmode,
6774 chain, rs_ctx );
6775 if( ret != 0 )
6776 goto exit;
6777
6778#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6779 {
6780 unsigned char *crt_start, *pk_start;
6781 size_t crt_len, pk_len;
6782
6783 /* We parse the CRT chain without copying, so
6784 * these pointers point into the input buffer,
6785 * and are hence still valid after freeing the
6786 * CRT chain. */
6787
6788 crt_start = chain->raw.p;
6789 crt_len = chain->raw.len;
6790
6791 pk_start = chain->pk_raw.p;
6792 pk_len = chain->pk_raw.len;
6793
6794 /* Free the CRT structures before computing
6795 * digest and copying the peer's public key. */
6796 mbedtls_x509_crt_free( chain );
6797 mbedtls_free( chain );
6798 chain = NULL;
6799
6800 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
6801 if( ret != 0 )
6802 goto exit;
6803
6804 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
6805 if( ret != 0 )
6806 goto exit;
6807 }
6808#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6809 /* Pass ownership to session structure. */
6810 ssl->session_negotiate->peer_cert = chain;
6811 chain = NULL;
6812#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
6813
6814 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
6815
6816exit:
6817
6818 if( ret == 0 )
6819 ssl->state++;
6820
6821#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
6822 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
6823 {
6824 ssl->handshake->ecrs_peer_cert = chain;
6825 chain = NULL;
6826 }
6827#endif
6828
6829 if( chain != NULL )
6830 {
6831 mbedtls_x509_crt_free( chain );
6832 mbedtls_free( chain );
6833 }
6834
6835 return( ret );
6836}
6837#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
6838
Jerry Yu615bd6f2022-02-17 14:25:15 +08006839#if defined(MBEDTLS_SHA256_C)
6840static void ssl_calc_finished_tls_sha256(
6841 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
6842{
6843 int len = 12;
6844 const char *sender;
6845 unsigned char padbuf[32];
6846#if defined(MBEDTLS_USE_PSA_CRYPTO)
6847 size_t hash_size;
6848 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT;
6849 psa_status_t status;
6850#else
6851 mbedtls_sha256_context sha256;
6852#endif
6853
6854 mbedtls_ssl_session *session = ssl->session_negotiate;
6855 if( !session )
6856 session = ssl->session;
6857
6858 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
6859 ? "client finished"
6860 : "server finished";
6861
6862#if defined(MBEDTLS_USE_PSA_CRYPTO)
6863 sha256_psa = psa_hash_operation_init();
6864
6865 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) );
6866
6867 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa );
6868 if( status != PSA_SUCCESS )
6869 {
6870 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
6871 return;
6872 }
6873
6874 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size );
6875 if( status != PSA_SUCCESS )
6876 {
6877 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
6878 return;
6879 }
6880 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 );
6881#else
6882
6883 mbedtls_sha256_init( &sha256 );
6884
6885 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
6886
6887 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
6888
6889 /*
6890 * TLSv1.2:
6891 * hash = PRF( master, finished_label,
6892 * Hash( handshake ) )[0.11]
6893 */
6894
6895#if !defined(MBEDTLS_SHA256_ALT)
6896 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
6897 sha256.state, sizeof( sha256.state ) );
6898#endif
6899
6900 mbedtls_sha256_finish( &sha256, padbuf );
6901 mbedtls_sha256_free( &sha256 );
6902#endif /* MBEDTLS_USE_PSA_CRYPTO */
6903
6904 ssl->handshake->tls_prf( session->master, 48, sender,
6905 padbuf, 32, buf, len );
6906
6907 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
6908
6909 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
6910
6911 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
6912}
6913#endif /* MBEDTLS_SHA256_C */
6914
Jerry Yub7ba49e2022-02-17 14:25:53 +08006915
6916#if defined(MBEDTLS_SHA384_C)
6917
6918static void ssl_calc_finished_tls_sha384(
6919 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
6920{
6921 int len = 12;
6922 const char *sender;
6923 unsigned char padbuf[48];
6924#if defined(MBEDTLS_USE_PSA_CRYPTO)
6925 size_t hash_size;
6926 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT;
6927 psa_status_t status;
6928#else
6929 mbedtls_sha512_context sha512;
6930#endif
6931
6932 mbedtls_ssl_session *session = ssl->session_negotiate;
6933 if( !session )
6934 session = ssl->session;
6935
6936 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
6937 ? "client finished"
6938 : "server finished";
6939
6940#if defined(MBEDTLS_USE_PSA_CRYPTO)
6941 sha384_psa = psa_hash_operation_init();
6942
6943 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) );
6944
6945 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa );
6946 if( status != PSA_SUCCESS )
6947 {
6948 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) );
6949 return;
6950 }
6951
6952 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size );
6953 if( status != PSA_SUCCESS )
6954 {
6955 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) );
6956 return;
6957 }
6958 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 );
6959#else
6960 mbedtls_sha512_init( &sha512 );
6961
6962 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
6963
6964 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
6965
6966 /*
6967 * TLSv1.2:
6968 * hash = PRF( master, finished_label,
6969 * Hash( handshake ) )[0.11]
6970 */
6971
6972#if !defined(MBEDTLS_SHA512_ALT)
6973 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
6974 sha512.state, sizeof( sha512.state ) );
6975#endif
6976 mbedtls_sha512_finish( &sha512, padbuf );
6977
6978 mbedtls_sha512_free( &sha512 );
6979#endif
6980
6981 ssl->handshake->tls_prf( session->master, 48, sender,
6982 padbuf, 48, buf, len );
6983
6984 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
6985
6986 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
6987
6988 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
6989}
6990#endif /* MBEDTLS_SHA384_C */
6991
Jerry Yuaef00152022-02-17 14:27:31 +08006992void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
6993{
6994 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
6995
6996 /*
6997 * Free our handshake params
6998 */
6999 mbedtls_ssl_handshake_free( ssl );
7000 mbedtls_free( ssl->handshake );
7001 ssl->handshake = NULL;
7002
7003 /*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08007004 * Free the previous transform and switch in the current one
Jerry Yuaef00152022-02-17 14:27:31 +08007005 */
7006 if( ssl->transform )
7007 {
7008 mbedtls_ssl_transform_free( ssl->transform );
7009 mbedtls_free( ssl->transform );
7010 }
7011 ssl->transform = ssl->transform_negotiate;
7012 ssl->transform_negotiate = NULL;
7013
7014 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
7015}
7016
Jerry Yu2a9fff52022-02-17 14:28:51 +08007017void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
7018{
7019 int resume = ssl->handshake->resume;
7020
7021 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
7022
7023#if defined(MBEDTLS_SSL_RENEGOTIATION)
7024 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
7025 {
7026 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
7027 ssl->renego_records_seen = 0;
7028 }
7029#endif
7030
7031 /*
7032 * Free the previous session and switch in the current one
7033 */
7034 if( ssl->session )
7035 {
7036#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7037 /* RFC 7366 3.1: keep the EtM state */
7038 ssl->session_negotiate->encrypt_then_mac =
7039 ssl->session->encrypt_then_mac;
7040#endif
7041
7042 mbedtls_ssl_session_free( ssl->session );
7043 mbedtls_free( ssl->session );
7044 }
7045 ssl->session = ssl->session_negotiate;
7046 ssl->session_negotiate = NULL;
7047
7048 /*
7049 * Add cache entry
7050 */
7051 if( ssl->conf->f_set_cache != NULL &&
7052 ssl->session->id_len != 0 &&
7053 resume == 0 )
7054 {
7055 if( ssl->conf->f_set_cache( ssl->conf->p_cache,
7056 ssl->session->id,
7057 ssl->session->id_len,
7058 ssl->session ) != 0 )
7059 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
7060 }
7061
7062#if defined(MBEDTLS_SSL_PROTO_DTLS)
7063 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
7064 ssl->handshake->flight != NULL )
7065 {
7066 /* Cancel handshake timer */
7067 mbedtls_ssl_set_timer( ssl, 0 );
7068
7069 /* Keep last flight around in case we need to resend it:
7070 * we need the handshake and transform structures for that */
7071 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
7072 }
7073 else
7074#endif
7075 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl );
7076
7077 ssl->state++;
7078
7079 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
7080}
7081
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007082int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
7083{
7084 int ret, hash_len;
7085
7086 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
7087
7088 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate );
7089
7090 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
7091
7092 /*
7093 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
7094 * may define some other value. Currently (early 2016), no defined
7095 * ciphersuite does this (and this is unlikely to change as activity has
7096 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
7097 */
7098 hash_len = 12;
7099
7100#if defined(MBEDTLS_SSL_RENEGOTIATION)
7101 ssl->verify_data_len = hash_len;
7102 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
7103#endif
7104
7105 ssl->out_msglen = 4 + hash_len;
7106 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
7107 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
7108
7109 /*
7110 * In case of session resuming, invert the client and server
7111 * ChangeCipherSpec messages order.
7112 */
7113 if( ssl->handshake->resume != 0 )
7114 {
7115#if defined(MBEDTLS_SSL_CLI_C)
7116 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
7117 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
7118#endif
7119#if defined(MBEDTLS_SSL_SRV_C)
7120 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
7121 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
7122#endif
7123 }
7124 else
7125 ssl->state++;
7126
7127 /*
7128 * Switch to our negotiated transform and session parameters for outbound
7129 * data.
7130 */
7131 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
7132
7133#if defined(MBEDTLS_SSL_PROTO_DTLS)
7134 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7135 {
7136 unsigned char i;
7137
7138 /* Remember current epoch settings for resending */
7139 ssl->handshake->alt_transform_out = ssl->transform_out;
7140 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
7141 sizeof( ssl->handshake->alt_out_ctr ) );
7142
7143 /* Set sequence_number to zero */
7144 memset( &ssl->cur_out_ctr[2], 0, sizeof( ssl->cur_out_ctr ) - 2 );
7145
7146
7147 /* Increment epoch */
7148 for( i = 2; i > 0; i-- )
7149 if( ++ssl->cur_out_ctr[i - 1] != 0 )
7150 break;
7151
7152 /* The loop goes to its end iff the counter is wrapping */
7153 if( i == 0 )
7154 {
7155 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
7156 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
7157 }
7158 }
7159 else
7160#endif /* MBEDTLS_SSL_PROTO_DTLS */
7161 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
7162
7163 ssl->transform_out = ssl->transform_negotiate;
7164 ssl->session_out = ssl->session_negotiate;
7165
7166#if defined(MBEDTLS_SSL_PROTO_DTLS)
7167 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7168 mbedtls_ssl_send_flight_completed( ssl );
7169#endif
7170
7171 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
7172 {
7173 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
7174 return( ret );
7175 }
7176
7177#if defined(MBEDTLS_SSL_PROTO_DTLS)
7178 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
7179 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
7180 {
7181 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
7182 return( ret );
7183 }
7184#endif
7185
7186 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
7187
7188 return( 0 );
7189}
7190
Jerry Yu0b3d7c12022-02-17 14:30:51 +08007191#define SSL_MAX_HASH_LEN 12
7192
7193int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
7194{
7195 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7196 unsigned int hash_len = 12;
7197 unsigned char buf[SSL_MAX_HASH_LEN];
7198
7199 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
7200
7201 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
7202
7203 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
7204 {
7205 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
7206 goto exit;
7207 }
7208
7209 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
7210 {
7211 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
7212 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7213 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
7214 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
7215 goto exit;
7216 }
7217
7218 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED )
7219 {
7220 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7221 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
7222 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
7223 goto exit;
7224 }
7225
7226 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
7227 {
7228 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
7229 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7230 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
7231 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
7232 goto exit;
7233 }
7234
7235 if( mbedtls_ct_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
7236 buf, hash_len ) != 0 )
7237 {
7238 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
7239 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7240 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
7241 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
7242 goto exit;
7243 }
7244
7245#if defined(MBEDTLS_SSL_RENEGOTIATION)
7246 ssl->verify_data_len = hash_len;
7247 memcpy( ssl->peer_verify_data, buf, hash_len );
7248#endif
7249
7250 if( ssl->handshake->resume != 0 )
7251 {
7252#if defined(MBEDTLS_SSL_CLI_C)
7253 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
7254 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
7255#endif
7256#if defined(MBEDTLS_SSL_SRV_C)
7257 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
7258 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
7259#endif
7260 }
7261 else
7262 ssl->state++;
7263
7264#if defined(MBEDTLS_SSL_PROTO_DTLS)
7265 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7266 mbedtls_ssl_recv_flight_completed( ssl );
7267#endif
7268
7269 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
7270
7271exit:
7272 mbedtls_platform_zeroize( buf, hash_len );
7273 return( ret );
7274}
7275
Jerry Yu392112c2022-02-17 14:34:10 +08007276#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
7277/*
7278 * Helper to get TLS 1.2 PRF from ciphersuite
7279 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
7280 */
7281static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
7282{
7283#if defined(MBEDTLS_SHA384_C)
7284 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
7285 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
7286
7287 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
7288 return( tls_prf_sha384 );
7289#else
7290 (void) ciphersuite_id;
7291#endif
7292 return( tls_prf_sha256 );
7293}
7294#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Jerry Yue93ffcd2022-02-17 14:37:06 +08007295
7296static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
7297{
7298 ((void) tls_prf);
7299#if defined(MBEDTLS_SHA384_C)
7300 if( tls_prf == tls_prf_sha384 )
7301 {
7302 return( MBEDTLS_SSL_TLS_PRF_SHA384 );
7303 }
7304 else
7305#endif
7306#if defined(MBEDTLS_SHA256_C)
7307 if( tls_prf == tls_prf_sha256 )
7308 {
7309 return( MBEDTLS_SSL_TLS_PRF_SHA256 );
7310 }
7311 else
7312#endif
7313 return( MBEDTLS_SSL_TLS_PRF_NONE );
7314}
7315
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007316/*
7317 * Populate a transform structure with session keys and all the other
7318 * necessary information.
7319 *
7320 * Parameters:
7321 * - [in/out]: transform: structure to populate
7322 * [in] must be just initialised with mbedtls_ssl_transform_init()
7323 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
7324 * - [in] ciphersuite
7325 * - [in] master
7326 * - [in] encrypt_then_mac
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007327 * - [in] tls_prf: pointer to PRF to use for key derivation
7328 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Glenn Strauss07c64162022-03-14 12:34:51 -04007329 * - [in] tls_version: TLS version
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007330 * - [in] endpoint: client or server
7331 * - [in] ssl: used for:
7332 * - ssl->conf->{f,p}_export_keys
7333 * [in] optionally used for:
7334 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
7335 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007336MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007337static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
7338 int ciphersuite,
7339 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007340#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007341 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007342#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007343 ssl_tls_prf_t tls_prf,
7344 const unsigned char randbytes[64],
Glenn Strauss07c64162022-03-14 12:34:51 -04007345 mbedtls_ssl_protocol_version tls_version,
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007346 unsigned endpoint,
7347 const mbedtls_ssl_context *ssl )
7348{
7349 int ret = 0;
7350 unsigned char keyblk[256];
7351 unsigned char *key1;
7352 unsigned char *key2;
7353 unsigned char *mac_enc;
7354 unsigned char *mac_dec;
7355 size_t mac_key_len = 0;
7356 size_t iv_copy_len;
7357 size_t keylen;
7358 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007359 mbedtls_ssl_mode_t ssl_mode;
Neil Armstronge4512952022-03-08 09:08:22 +01007360#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007361 const mbedtls_cipher_info_t *cipher_info;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007362 const mbedtls_md_info_t *md_info;
Neil Armstronge4512952022-03-08 09:08:22 +01007363#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007364
7365#if defined(MBEDTLS_USE_PSA_CRYPTO)
7366 psa_key_type_t key_type;
7367 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
7368 psa_algorithm_t alg;
Neil Armstronge4512952022-03-08 09:08:22 +01007369 psa_algorithm_t mac_alg = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007370 size_t key_bits;
7371 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
7372#endif
7373
7374#if !defined(MBEDTLS_DEBUG_C) && \
7375 !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
7376 if( ssl->f_export_keys == NULL )
7377 {
7378 ssl = NULL; /* make sure we don't use it except for these cases */
7379 (void) ssl;
7380 }
7381#endif
7382
7383 /*
7384 * Some data just needs copying into the structure
7385 */
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007386#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007387 transform->encrypt_then_mac = encrypt_then_mac;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007388#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Glenn Strauss07c64162022-03-14 12:34:51 -04007389 transform->tls_version = tls_version;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007390
7391#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
7392 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
7393#endif
7394
7395#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Glenn Strauss07c64162022-03-14 12:34:51 -04007396 if( tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007397 {
7398 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
7399 * generation separate. This should never happen. */
7400 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7401 }
7402#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
7403
7404 /*
7405 * Get various info structures
7406 */
7407 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
7408 if( ciphersuite_info == NULL )
7409 {
7410 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
7411 ciphersuite ) );
7412 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7413 }
7414
Neil Armstrongab555e02022-04-04 11:07:59 +02007415 ssl_mode = mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007416#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007417 encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02007418#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007419 ciphersuite_info );
7420
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007421 if( ssl_mode == MBEDTLS_SSL_MODE_AEAD )
7422 transform->taglen =
7423 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
7424
7425#if defined(MBEDTLS_USE_PSA_CRYPTO)
7426 if( ( status = mbedtls_ssl_cipher_to_psa( ciphersuite_info->cipher,
7427 transform->taglen,
7428 &alg,
7429 &key_type,
7430 &key_bits ) ) != PSA_SUCCESS )
7431 {
7432 ret = psa_ssl_status_to_mbedtls( status );
7433 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_cipher_to_psa", ret );
7434 goto end;
7435 }
7436#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007437 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
7438 if( cipher_info == NULL )
7439 {
7440 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found",
7441 ciphersuite_info->cipher ) );
7442 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7443 }
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007444#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007445
Neil Armstronge4512952022-03-08 09:08:22 +01007446#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardabac0372022-07-18 13:41:11 +02007447 mac_alg = mbedtls_hash_info_psa_from_md( ciphersuite_info->mac );
Neil Armstronge4512952022-03-08 09:08:22 +01007448 if( mac_alg == 0 )
7449 {
Manuel Pégourié-Gonnardabac0372022-07-18 13:41:11 +02007450 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_hash_info_psa_from_md for %u not found",
Neil Armstronge4512952022-03-08 09:08:22 +01007451 (unsigned) ciphersuite_info->mac ) );
7452 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7453 }
7454#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007455 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
7456 if( md_info == NULL )
7457 {
7458 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
7459 (unsigned) ciphersuite_info->mac ) );
7460 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7461 }
Neil Armstronge4512952022-03-08 09:08:22 +01007462#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007463
7464#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
7465 /* Copy own and peer's CID if the use of the CID
7466 * extension has been negotiated. */
7467 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
7468 {
7469 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
7470
7471 transform->in_cid_len = ssl->own_cid_len;
7472 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
7473 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
7474 transform->in_cid_len );
7475
7476 transform->out_cid_len = ssl->handshake->peer_cid_len;
7477 memcpy( transform->out_cid, ssl->handshake->peer_cid,
7478 ssl->handshake->peer_cid_len );
7479 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
7480 transform->out_cid_len );
7481 }
7482#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
7483
7484 /*
7485 * Compute key block using the PRF
7486 */
7487 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 );
7488 if( ret != 0 )
7489 {
7490 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
7491 return( ret );
7492 }
7493
7494 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
7495 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
7496 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
7497 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
7498 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
7499
7500 /*
7501 * Determine the appropriate key, IV and MAC length.
7502 */
7503
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007504#if defined(MBEDTLS_USE_PSA_CRYPTO)
7505 keylen = PSA_BITS_TO_BYTES(key_bits);
7506#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007507 keylen = mbedtls_cipher_info_get_key_bitlen( cipher_info ) / 8;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007508#endif
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007509
7510#if defined(MBEDTLS_GCM_C) || \
7511 defined(MBEDTLS_CCM_C) || \
7512 defined(MBEDTLS_CHACHAPOLY_C)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007513 if( ssl_mode == MBEDTLS_SSL_MODE_AEAD )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007514 {
7515 size_t explicit_ivlen;
7516
7517 transform->maclen = 0;
7518 mac_key_len = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007519
7520 /* All modes haves 96-bit IVs, but the length of the static parts vary
7521 * with mode and version:
7522 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
7523 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
7524 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
7525 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
7526 * sequence number).
7527 */
7528 transform->ivlen = 12;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007529#if defined(MBEDTLS_USE_PSA_CRYPTO)
7530 if( key_type == PSA_KEY_TYPE_CHACHA20 )
7531#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007532 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CHACHAPOLY )
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007533#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007534 transform->fixed_ivlen = 12;
7535 else
7536 transform->fixed_ivlen = 4;
7537
7538 /* Minimum length of encrypted record */
7539 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
7540 transform->minlen = explicit_ivlen + transform->taglen;
7541 }
7542 else
7543#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
7544#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007545 if( ssl_mode == MBEDTLS_SSL_MODE_STREAM ||
7546 ssl_mode == MBEDTLS_SSL_MODE_CBC ||
7547 ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007548 {
Neil Armstronge4512952022-03-08 09:08:22 +01007549#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstrongd1be7672022-04-04 11:21:41 +02007550 size_t block_size = PSA_BLOCK_CIPHER_BLOCK_LENGTH( key_type );
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007551#else
7552 size_t block_size = cipher_info->block_size;
7553#endif /* MBEDTLS_USE_PSA_CRYPTO */
7554
7555#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronge4512952022-03-08 09:08:22 +01007556 /* Get MAC length */
7557 mac_key_len = PSA_HASH_LENGTH(mac_alg);
7558#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007559 /* Initialize HMAC contexts */
7560 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
7561 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
7562 {
7563 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7564 goto end;
7565 }
7566
7567 /* Get MAC length */
7568 mac_key_len = mbedtls_md_get_size( md_info );
Neil Armstronge4512952022-03-08 09:08:22 +01007569#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007570 transform->maclen = mac_key_len;
7571
7572 /* IV length */
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007573#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstrong2230e6c2022-04-27 10:36:14 +02007574 transform->ivlen = PSA_CIPHER_IV_LENGTH( key_type, alg );
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007575#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007576 transform->ivlen = cipher_info->iv_size;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007577#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007578
7579 /* Minimum length */
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007580 if( ssl_mode == MBEDTLS_SSL_MODE_STREAM )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007581 transform->minlen = transform->maclen;
7582 else
7583 {
7584 /*
7585 * GenericBlockCipher:
7586 * 1. if EtM is in use: one block plus MAC
7587 * otherwise: * first multiple of blocklen greater than maclen
7588 * 2. IV
7589 */
7590#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Neil Armstrong7fea33e2022-04-01 15:40:25 +02007591 if( ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007592 {
7593 transform->minlen = transform->maclen
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007594 + block_size;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007595 }
7596 else
7597#endif
7598 {
7599 transform->minlen = transform->maclen
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02007600 + block_size
7601 - transform->maclen % block_size;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007602 }
7603
Glenn Strauss07c64162022-03-14 12:34:51 -04007604 if( tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007605 {
7606 transform->minlen += transform->ivlen;
7607 }
7608 else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007609 {
7610 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7611 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
7612 goto end;
7613 }
7614 }
7615 }
7616 else
7617#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
7618 {
7619 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7620 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7621 }
7622
7623 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
7624 (unsigned) keylen,
7625 (unsigned) transform->minlen,
7626 (unsigned) transform->ivlen,
7627 (unsigned) transform->maclen ) );
7628
7629 /*
7630 * Finally setup the cipher contexts, IVs and MAC secrets.
7631 */
7632#if defined(MBEDTLS_SSL_CLI_C)
7633 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
7634 {
7635 key1 = keyblk + mac_key_len * 2;
7636 key2 = keyblk + mac_key_len * 2 + keylen;
7637
7638 mac_enc = keyblk;
7639 mac_dec = keyblk + mac_key_len;
7640
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007641 iv_copy_len = ( transform->fixed_ivlen ) ?
7642 transform->fixed_ivlen : transform->ivlen;
7643 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
7644 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
7645 iv_copy_len );
7646 }
7647 else
7648#endif /* MBEDTLS_SSL_CLI_C */
7649#if defined(MBEDTLS_SSL_SRV_C)
7650 if( endpoint == MBEDTLS_SSL_IS_SERVER )
7651 {
7652 key1 = keyblk + mac_key_len * 2 + keylen;
7653 key2 = keyblk + mac_key_len * 2;
7654
7655 mac_enc = keyblk + mac_key_len;
7656 mac_dec = keyblk;
7657
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007658 iv_copy_len = ( transform->fixed_ivlen ) ?
7659 transform->fixed_ivlen : transform->ivlen;
7660 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
7661 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
7662 iv_copy_len );
7663 }
7664 else
7665#endif /* MBEDTLS_SSL_SRV_C */
7666 {
7667 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
7668 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
7669 goto end;
7670 }
7671
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007672 if( ssl != NULL && ssl->f_export_keys != NULL )
7673 {
7674 ssl->f_export_keys( ssl->p_export_keys,
7675 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
7676 master, 48,
7677 randbytes + 32,
7678 randbytes,
7679 tls_prf_get_type( tls_prf ) );
7680 }
7681
7682#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007683 transform->psa_alg = alg;
7684
7685 if ( alg != MBEDTLS_SSL_NULL_CIPHER )
7686 {
7687 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
7688 psa_set_key_algorithm( &attributes, alg );
7689 psa_set_key_type( &attributes, key_type );
7690
7691 if( ( status = psa_import_key( &attributes,
7692 key1,
7693 PSA_BITS_TO_BYTES( key_bits ),
7694 &transform->psa_key_enc ) ) != PSA_SUCCESS )
7695 {
7696 MBEDTLS_SSL_DEBUG_RET( 3, "psa_import_key", (int)status );
7697 ret = psa_ssl_status_to_mbedtls( status );
7698 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
7699 goto end;
7700 }
7701
7702 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
7703
7704 if( ( status = psa_import_key( &attributes,
7705 key2,
7706 PSA_BITS_TO_BYTES( key_bits ),
7707 &transform->psa_key_dec ) ) != PSA_SUCCESS )
7708 {
7709 ret = psa_ssl_status_to_mbedtls( status );
7710 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", ret );
7711 goto end;
7712 }
7713 }
7714#else
7715 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
7716 cipher_info ) ) != 0 )
7717 {
7718 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
7719 goto end;
7720 }
7721
7722 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
7723 cipher_info ) ) != 0 )
7724 {
7725 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
7726 goto end;
7727 }
7728
7729 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
7730 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
7731 MBEDTLS_ENCRYPT ) ) != 0 )
7732 {
7733 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
7734 goto end;
7735 }
7736
7737 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
7738 (int) mbedtls_cipher_info_get_key_bitlen( cipher_info ),
7739 MBEDTLS_DECRYPT ) ) != 0 )
7740 {
7741 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
7742 goto end;
7743 }
7744
7745#if defined(MBEDTLS_CIPHER_MODE_CBC)
7746 if( mbedtls_cipher_info_get_mode( cipher_info ) == MBEDTLS_MODE_CBC )
7747 {
7748 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
7749 MBEDTLS_PADDING_NONE ) ) != 0 )
7750 {
7751 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
7752 goto end;
7753 }
7754
7755 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
7756 MBEDTLS_PADDING_NONE ) ) != 0 )
7757 {
7758 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
7759 goto end;
7760 }
7761 }
7762#endif /* MBEDTLS_CIPHER_MODE_CBC */
7763#endif /* MBEDTLS_USE_PSA_CRYPTO */
7764
Neil Armstrong29c0c042022-03-17 17:47:28 +01007765#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
7766 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
7767 For AEAD-based ciphersuites, there is nothing to do here. */
7768 if( mac_key_len != 0 )
7769 {
7770#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronge4512952022-03-08 09:08:22 +01007771 transform->psa_mac_alg = PSA_ALG_HMAC( mac_alg );
Neil Armstrong29c0c042022-03-17 17:47:28 +01007772
7773 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_MESSAGE );
Neil Armstronge4512952022-03-08 09:08:22 +01007774 psa_set_key_algorithm( &attributes, PSA_ALG_HMAC( mac_alg ) );
Neil Armstrong29c0c042022-03-17 17:47:28 +01007775 psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC );
7776
7777 if( ( status = psa_import_key( &attributes,
7778 mac_enc, mac_key_len,
7779 &transform->psa_mac_enc ) ) != PSA_SUCCESS )
7780 {
7781 ret = psa_ssl_status_to_mbedtls( status );
7782 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_mac_key", ret );
7783 goto end;
7784 }
7785
Ronald Cronfb39f152022-03-25 14:36:28 +01007786 if( ( transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER ) ||
7787 ( ( transform->psa_alg == PSA_ALG_CBC_NO_PADDING ) &&
7788 ( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ) ) )
Neil Armstrong29c0c042022-03-17 17:47:28 +01007789 /* mbedtls_ct_hmac() requires the key to be exportable */
7790 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT |
7791 PSA_KEY_USAGE_VERIFY_HASH );
7792 else
7793 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH );
7794
7795 if( ( status = psa_import_key( &attributes,
7796 mac_dec, mac_key_len,
7797 &transform->psa_mac_dec ) ) != PSA_SUCCESS )
7798 {
7799 ret = psa_ssl_status_to_mbedtls( status );
7800 MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_mac_key", ret );
7801 goto end;
7802 }
7803#else
7804 ret = mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
7805 if( ret != 0 )
7806 goto end;
7807 ret = mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
7808 if( ret != 0 )
7809 goto end;
7810#endif /* MBEDTLS_USE_PSA_CRYPTO */
7811 }
7812#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
7813
7814 ((void) mac_dec);
7815 ((void) mac_enc);
7816
Jerry Yu9bccc4c2022-02-17 14:38:28 +08007817end:
7818 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
7819 return( ret );
7820}
7821
Jerry Yuee40f9d2022-02-17 14:55:16 +08007822#if defined(MBEDTLS_USE_PSA_CRYPTO)
7823int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7824 unsigned char *hash, size_t *hashlen,
7825 unsigned char *data, size_t data_len,
7826 mbedtls_md_type_t md_alg )
7827{
7828 psa_status_t status;
7829 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
Manuel Pégourié-Gonnardabac0372022-07-18 13:41:11 +02007830 psa_algorithm_t hash_alg = mbedtls_hash_info_psa_from_md( md_alg );
Jerry Yuee40f9d2022-02-17 14:55:16 +08007831
7832 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) );
7833
7834 if( ( status = psa_hash_setup( &hash_operation,
7835 hash_alg ) ) != PSA_SUCCESS )
7836 {
7837 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status );
7838 goto exit;
7839 }
7840
7841 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes,
7842 64 ) ) != PSA_SUCCESS )
7843 {
7844 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7845 goto exit;
7846 }
7847
7848 if( ( status = psa_hash_update( &hash_operation,
7849 data, data_len ) ) != PSA_SUCCESS )
7850 {
7851 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status );
7852 goto exit;
7853 }
7854
7855 if( ( status = psa_hash_finish( &hash_operation, hash, PSA_HASH_MAX_SIZE,
7856 hashlen ) ) != PSA_SUCCESS )
7857 {
7858 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );
7859 goto exit;
7860 }
7861
7862exit:
7863 if( status != PSA_SUCCESS )
7864 {
7865 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7866 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7867 switch( status )
7868 {
7869 case PSA_ERROR_NOT_SUPPORTED:
7870 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE );
7871 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
7872 case PSA_ERROR_BUFFER_TOO_SMALL:
7873 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA );
7874 case PSA_ERROR_INSUFFICIENT_MEMORY:
7875 return( MBEDTLS_ERR_MD_ALLOC_FAILED );
7876 default:
7877 return( MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED );
7878 }
7879 }
7880 return( 0 );
7881}
7882
7883#else
7884
7885int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
7886 unsigned char *hash, size_t *hashlen,
7887 unsigned char *data, size_t data_len,
7888 mbedtls_md_type_t md_alg )
7889{
7890 int ret = 0;
7891 mbedtls_md_context_t ctx;
7892 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
7893 *hashlen = mbedtls_md_get_size( md_info );
7894
7895 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) );
7896
7897 mbedtls_md_init( &ctx );
7898
7899 /*
7900 * digitally-signed struct {
7901 * opaque client_random[32];
7902 * opaque server_random[32];
7903 * ServerDHParams params;
7904 * };
7905 */
7906 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
7907 {
7908 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
7909 goto exit;
7910 }
7911 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
7912 {
7913 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
7914 goto exit;
7915 }
7916 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
7917 {
7918 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7919 goto exit;
7920 }
7921 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
7922 {
7923 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
7924 goto exit;
7925 }
7926 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
7927 {
7928 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
7929 goto exit;
7930 }
7931
7932exit:
7933 mbedtls_md_free( &ctx );
7934
7935 if( ret != 0 )
7936 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7937 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
7938
7939 return( ret );
7940}
7941#endif /* MBEDTLS_USE_PSA_CRYPTO */
7942
Jerry Yud9d91da2022-02-17 14:57:06 +08007943#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
7944
Gabor Mezeia3d016c2022-05-10 12:44:09 +02007945/* Find the preferred hash for a given signature algorithm. */
7946unsigned int mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
7947 mbedtls_ssl_context *ssl,
7948 unsigned int sig_alg )
Jerry Yud9d91da2022-02-17 14:57:06 +08007949{
Gabor Mezei078e8032022-04-27 21:17:56 +02007950 unsigned int i;
Gabor Mezeia3d016c2022-05-10 12:44:09 +02007951 uint16_t *received_sig_algs = ssl->handshake->received_sig_algs;
Gabor Mezei078e8032022-04-27 21:17:56 +02007952
7953 if( sig_alg == MBEDTLS_SSL_SIG_ANON )
Gabor Mezeia3d016c2022-05-10 12:44:09 +02007954 return( MBEDTLS_SSL_HASH_NONE );
Gabor Mezei078e8032022-04-27 21:17:56 +02007955
Gabor Mezeia3d016c2022-05-10 12:44:09 +02007956 for( i = 0; received_sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++ )
Jerry Yud9d91da2022-02-17 14:57:06 +08007957 {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02007958 unsigned int hash_alg_received =
7959 MBEDTLS_SSL_TLS12_HASH_ALG_FROM_SIG_AND_HASH_ALG(
7960 received_sig_algs[i] );
7961 unsigned int sig_alg_received =
7962 MBEDTLS_SSL_TLS12_SIG_ALG_FROM_SIG_AND_HASH_ALG(
7963 received_sig_algs[i] );
7964
7965 if( sig_alg == sig_alg_received )
7966 {
7967#if defined(MBEDTLS_USE_PSA_CRYPTO)
7968 if( ssl->handshake->key_cert && ssl->handshake->key_cert->key )
7969 {
Neil Armstrong96eceb82022-06-30 18:05:05 +02007970 psa_algorithm_t psa_hash_alg =
Manuel Pégourié-Gonnardabac0372022-07-18 13:41:11 +02007971 mbedtls_hash_info_psa_from_md( hash_alg_received );
Neil Armstrong9f1176a2022-06-24 18:19:19 +02007972
Neil Armstrong96eceb82022-06-30 18:05:05 +02007973 if( sig_alg_received == MBEDTLS_SSL_SIG_ECDSA &&
7974 ! mbedtls_pk_can_do_ext( ssl->handshake->key_cert->key,
7975 PSA_ALG_ECDSA( psa_hash_alg ),
7976 PSA_KEY_USAGE_SIGN_HASH ) )
Neil Armstrong9f1176a2022-06-24 18:19:19 +02007977 continue;
7978
Neil Armstrong96eceb82022-06-30 18:05:05 +02007979 if( sig_alg_received == MBEDTLS_SSL_SIG_RSA &&
Neil Armstrong971f30d2022-07-01 16:23:50 +02007980 ! mbedtls_pk_can_do_ext( ssl->handshake->key_cert->key,
7981 PSA_ALG_RSA_PKCS1V15_SIGN(
7982 psa_hash_alg ),
7983 PSA_KEY_USAGE_SIGN_HASH ) )
Neil Armstrong9f1176a2022-06-24 18:19:19 +02007984 continue;
7985 }
Neil Armstrong9f1176a2022-06-24 18:19:19 +02007986#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong96eceb82022-06-30 18:05:05 +02007987
Neil Armstrong9f1176a2022-06-24 18:19:19 +02007988 return( hash_alg_received );
7989 }
Jerry Yud9d91da2022-02-17 14:57:06 +08007990 }
Jerry Yud9d91da2022-02-17 14:57:06 +08007991
Gabor Mezeia3d016c2022-05-10 12:44:09 +02007992 return( MBEDTLS_SSL_HASH_NONE );
Jerry Yud9d91da2022-02-17 14:57:06 +08007993}
7994
7995#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7996
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08007997/* Serialization of TLS 1.2 sessions:
7998 *
7999 * struct {
8000 * uint64 start_time;
8001 * uint8 ciphersuite[2]; // defined by the standard
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008002 * uint8 session_id_len; // at most 32
8003 * opaque session_id[32];
8004 * opaque master[48]; // fixed length in the standard
8005 * uint32 verify_result;
8006 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
8007 * opaque ticket<0..2^24-1>; // length 0 means no ticket
8008 * uint32 ticket_lifetime;
8009 * uint8 mfl_code; // up to 255 according to standard
8010 * uint8 encrypt_then_mac; // 0 or 1
8011 * } serialized_session_tls12;
8012 *
8013 */
Jerry Yu438ddd82022-07-07 06:55:50 +00008014static size_t ssl_tls12_session_save( const mbedtls_ssl_session *session,
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008015 unsigned char *buf,
8016 size_t buf_len )
8017{
8018 unsigned char *p = buf;
8019 size_t used = 0;
8020
8021#if defined(MBEDTLS_HAVE_TIME)
8022 uint64_t start;
8023#endif
8024#if defined(MBEDTLS_X509_CRT_PARSE_C)
8025#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8026 size_t cert_len;
8027#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8028#endif /* MBEDTLS_X509_CRT_PARSE_C */
8029
8030 /*
8031 * Time
8032 */
8033#if defined(MBEDTLS_HAVE_TIME)
8034 used += 8;
8035
8036 if( used <= buf_len )
8037 {
8038 start = (uint64_t) session->start;
8039
8040 MBEDTLS_PUT_UINT64_BE( start, p, 0 );
8041 p += 8;
8042 }
8043#endif /* MBEDTLS_HAVE_TIME */
8044
8045 /*
8046 * Basic mandatory fields
8047 */
8048 used += 2 /* ciphersuite */
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008049 + 1 /* id_len */
8050 + sizeof( session->id )
8051 + sizeof( session->master )
8052 + 4; /* verify_result */
8053
8054 if( used <= buf_len )
8055 {
8056 MBEDTLS_PUT_UINT16_BE( session->ciphersuite, p, 0 );
8057 p += 2;
8058
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008059 *p++ = MBEDTLS_BYTE_0( session->id_len );
8060 memcpy( p, session->id, 32 );
8061 p += 32;
8062
8063 memcpy( p, session->master, 48 );
8064 p += 48;
8065
8066 MBEDTLS_PUT_UINT32_BE( session->verify_result, p, 0 );
8067 p += 4;
8068 }
8069
8070 /*
8071 * Peer's end-entity certificate
8072 */
8073#if defined(MBEDTLS_X509_CRT_PARSE_C)
8074#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8075 if( session->peer_cert == NULL )
8076 cert_len = 0;
8077 else
8078 cert_len = session->peer_cert->raw.len;
8079
8080 used += 3 + cert_len;
8081
8082 if( used <= buf_len )
8083 {
8084 *p++ = MBEDTLS_BYTE_2( cert_len );
8085 *p++ = MBEDTLS_BYTE_1( cert_len );
8086 *p++ = MBEDTLS_BYTE_0( cert_len );
8087
8088 if( session->peer_cert != NULL )
8089 {
8090 memcpy( p, session->peer_cert->raw.p, cert_len );
8091 p += cert_len;
8092 }
8093 }
8094#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8095 if( session->peer_cert_digest != NULL )
8096 {
8097 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
8098 if( used <= buf_len )
8099 {
8100 *p++ = (unsigned char) session->peer_cert_digest_type;
8101 *p++ = (unsigned char) session->peer_cert_digest_len;
8102 memcpy( p, session->peer_cert_digest,
8103 session->peer_cert_digest_len );
8104 p += session->peer_cert_digest_len;
8105 }
8106 }
8107 else
8108 {
8109 used += 2;
8110 if( used <= buf_len )
8111 {
8112 *p++ = (unsigned char) MBEDTLS_MD_NONE;
8113 *p++ = 0;
8114 }
8115 }
8116#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8117#endif /* MBEDTLS_X509_CRT_PARSE_C */
8118
8119 /*
8120 * Session ticket if any, plus associated data
8121 */
8122#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
8123 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
8124
8125 if( used <= buf_len )
8126 {
8127 *p++ = MBEDTLS_BYTE_2( session->ticket_len );
8128 *p++ = MBEDTLS_BYTE_1( session->ticket_len );
8129 *p++ = MBEDTLS_BYTE_0( session->ticket_len );
8130
8131 if( session->ticket != NULL )
8132 {
8133 memcpy( p, session->ticket, session->ticket_len );
8134 p += session->ticket_len;
8135 }
8136
8137 MBEDTLS_PUT_UINT32_BE( session->ticket_lifetime, p, 0 );
8138 p += 4;
8139 }
8140#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
8141
8142 /*
8143 * Misc extension-related info
8144 */
8145#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8146 used += 1;
8147
8148 if( used <= buf_len )
8149 *p++ = session->mfl_code;
8150#endif
8151
8152#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
8153 used += 1;
8154
8155 if( used <= buf_len )
8156 *p++ = MBEDTLS_BYTE_0( session->encrypt_then_mac );
8157#endif
8158
8159 return( used );
8160}
8161
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02008162MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu438ddd82022-07-07 06:55:50 +00008163static int ssl_tls12_session_load( mbedtls_ssl_session *session,
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008164 const unsigned char *buf,
8165 size_t len )
8166{
8167#if defined(MBEDTLS_HAVE_TIME)
8168 uint64_t start;
8169#endif
8170#if defined(MBEDTLS_X509_CRT_PARSE_C)
8171#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8172 size_t cert_len;
8173#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8174#endif /* MBEDTLS_X509_CRT_PARSE_C */
8175
8176 const unsigned char *p = buf;
8177 const unsigned char * const end = buf + len;
8178
8179 /*
8180 * Time
8181 */
8182#if defined(MBEDTLS_HAVE_TIME)
8183 if( 8 > (size_t)( end - p ) )
8184 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8185
8186 start = ( (uint64_t) p[0] << 56 ) |
8187 ( (uint64_t) p[1] << 48 ) |
8188 ( (uint64_t) p[2] << 40 ) |
8189 ( (uint64_t) p[3] << 32 ) |
8190 ( (uint64_t) p[4] << 24 ) |
8191 ( (uint64_t) p[5] << 16 ) |
8192 ( (uint64_t) p[6] << 8 ) |
8193 ( (uint64_t) p[7] );
8194 p += 8;
8195
8196 session->start = (time_t) start;
8197#endif /* MBEDTLS_HAVE_TIME */
8198
8199 /*
8200 * Basic mandatory fields
8201 */
Thomas Daubney20f89a92022-06-20 15:12:19 +01008202 if( 2 + 1 + 32 + 48 + 4 > (size_t)( end - p ) )
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008203 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8204
8205 session->ciphersuite = ( p[0] << 8 ) | p[1];
8206 p += 2;
8207
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008208 session->id_len = *p++;
8209 memcpy( session->id, p, 32 );
8210 p += 32;
8211
8212 memcpy( session->master, p, 48 );
8213 p += 48;
8214
8215 session->verify_result = ( (uint32_t) p[0] << 24 ) |
8216 ( (uint32_t) p[1] << 16 ) |
8217 ( (uint32_t) p[2] << 8 ) |
8218 ( (uint32_t) p[3] );
8219 p += 4;
8220
8221 /* Immediately clear invalid pointer values that have been read, in case
8222 * we exit early before we replaced them with valid ones. */
8223#if defined(MBEDTLS_X509_CRT_PARSE_C)
8224#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8225 session->peer_cert = NULL;
8226#else
8227 session->peer_cert_digest = NULL;
8228#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8229#endif /* MBEDTLS_X509_CRT_PARSE_C */
8230#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
8231 session->ticket = NULL;
8232#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
8233
8234 /*
8235 * Peer certificate
8236 */
8237#if defined(MBEDTLS_X509_CRT_PARSE_C)
8238#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8239 /* Deserialize CRT from the end of the ticket. */
8240 if( 3 > (size_t)( end - p ) )
8241 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8242
8243 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
8244 p += 3;
8245
8246 if( cert_len != 0 )
8247 {
8248 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
8249
8250 if( cert_len > (size_t)( end - p ) )
8251 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8252
8253 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
8254
8255 if( session->peer_cert == NULL )
8256 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
8257
8258 mbedtls_x509_crt_init( session->peer_cert );
8259
8260 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
8261 p, cert_len ) ) != 0 )
8262 {
8263 mbedtls_x509_crt_free( session->peer_cert );
8264 mbedtls_free( session->peer_cert );
8265 session->peer_cert = NULL;
8266 return( ret );
8267 }
8268
8269 p += cert_len;
8270 }
8271#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8272 /* Deserialize CRT digest from the end of the ticket. */
8273 if( 2 > (size_t)( end - p ) )
8274 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8275
8276 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
8277 session->peer_cert_digest_len = (size_t) *p++;
8278
8279 if( session->peer_cert_digest_len != 0 )
8280 {
8281 const mbedtls_md_info_t *md_info =
8282 mbedtls_md_info_from_type( session->peer_cert_digest_type );
8283 if( md_info == NULL )
8284 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8285 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
8286 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8287
8288 if( session->peer_cert_digest_len > (size_t)( end - p ) )
8289 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8290
8291 session->peer_cert_digest =
8292 mbedtls_calloc( 1, session->peer_cert_digest_len );
8293 if( session->peer_cert_digest == NULL )
8294 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
8295
8296 memcpy( session->peer_cert_digest, p,
8297 session->peer_cert_digest_len );
8298 p += session->peer_cert_digest_len;
8299 }
8300#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8301#endif /* MBEDTLS_X509_CRT_PARSE_C */
8302
8303 /*
8304 * Session ticket and associated data
8305 */
8306#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
8307 if( 3 > (size_t)( end - p ) )
8308 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8309
8310 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
8311 p += 3;
8312
8313 if( session->ticket_len != 0 )
8314 {
8315 if( session->ticket_len > (size_t)( end - p ) )
8316 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8317
8318 session->ticket = mbedtls_calloc( 1, session->ticket_len );
8319 if( session->ticket == NULL )
8320 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
8321
8322 memcpy( session->ticket, p, session->ticket_len );
8323 p += session->ticket_len;
8324 }
8325
8326 if( 4 > (size_t)( end - p ) )
8327 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8328
8329 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) |
8330 ( (uint32_t) p[1] << 16 ) |
8331 ( (uint32_t) p[2] << 8 ) |
8332 ( (uint32_t) p[3] );
8333 p += 4;
8334#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
8335
8336 /*
8337 * Misc extension-related info
8338 */
8339#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8340 if( 1 > (size_t)( end - p ) )
8341 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8342
8343 session->mfl_code = *p++;
8344#endif
8345
8346#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
8347 if( 1 > (size_t)( end - p ) )
8348 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8349
8350 session->encrypt_then_mac = *p++;
8351#endif
8352
8353 /* Done, should have consumed entire buffer */
8354 if( p != end )
8355 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8356
8357 return( 0 );
8358}
Jerry Yudc7bd172022-02-17 13:44:15 +08008359#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
8360
XiaokangQian75d40ef2022-04-20 11:05:24 +00008361int mbedtls_ssl_validate_ciphersuite(
8362 const mbedtls_ssl_context *ssl,
8363 const mbedtls_ssl_ciphersuite_t *suite_info,
8364 mbedtls_ssl_protocol_version min_tls_version,
8365 mbedtls_ssl_protocol_version max_tls_version )
8366{
8367 (void) ssl;
8368
8369 if( suite_info == NULL )
8370 return( -1 );
8371
8372 if( ( suite_info->min_tls_version > max_tls_version ) ||
8373 ( suite_info->max_tls_version < min_tls_version ) )
8374 {
8375 return( -1 );
8376 }
8377
XiaokangQian060d8672022-04-21 09:24:56 +00008378#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_CLI_C)
XiaokangQian75d40ef2022-04-20 11:05:24 +00008379#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
8380 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
8381 mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
8382 {
8383 return( -1 );
8384 }
8385#endif
8386
8387 /* Don't suggest PSK-based ciphersuite if no PSK is available. */
8388#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
8389 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
8390 mbedtls_ssl_conf_has_static_psk( ssl->conf ) == 0 )
8391 {
8392 return( -1 );
8393 }
8394#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
8395#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
8396
8397 return( 0 );
8398}
8399
XiaokangQianeaf36512022-04-24 09:07:44 +00008400#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
8401/*
8402 * Function for writing a signature algorithm extension.
8403 *
8404 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
8405 * value (TLS 1.3 RFC8446):
8406 * enum {
8407 * ....
8408 * ecdsa_secp256r1_sha256( 0x0403 ),
8409 * ecdsa_secp384r1_sha384( 0x0503 ),
8410 * ecdsa_secp521r1_sha512( 0x0603 ),
8411 * ....
8412 * } SignatureScheme;
8413 *
8414 * struct {
8415 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
8416 * } SignatureSchemeList;
8417 *
8418 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
8419 * value (TLS 1.2 RFC5246):
8420 * enum {
8421 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
8422 * sha512(6), (255)
8423 * } HashAlgorithm;
8424 *
8425 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
8426 * SignatureAlgorithm;
8427 *
8428 * struct {
8429 * HashAlgorithm hash;
8430 * SignatureAlgorithm signature;
8431 * } SignatureAndHashAlgorithm;
8432 *
8433 * SignatureAndHashAlgorithm
8434 * supported_signature_algorithms<2..2^16-2>;
8435 *
8436 * The TLS 1.3 signature algorithm extension was defined to be a compatible
8437 * generalization of the TLS 1.2 signature algorithm extension.
8438 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
8439 * `SignatureScheme` field of TLS 1.3
8440 *
8441 */
8442int mbedtls_ssl_write_sig_alg_ext( mbedtls_ssl_context *ssl, unsigned char *buf,
8443 const unsigned char *end, size_t *out_len )
8444{
8445 unsigned char *p = buf;
8446 unsigned char *supported_sig_alg; /* Start of supported_signature_algorithms */
8447 size_t supported_sig_alg_len = 0; /* Length of supported_signature_algorithms */
8448
8449 *out_len = 0;
8450
8451 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding signature_algorithms extension" ) );
8452
8453 /* Check if we have space for header and length field:
8454 * - extension_type (2 bytes)
8455 * - extension_data_length (2 bytes)
8456 * - supported_signature_algorithms_length (2 bytes)
8457 */
8458 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
8459 p += 6;
8460
8461 /*
8462 * Write supported_signature_algorithms
8463 */
8464 supported_sig_alg = p;
8465 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs( ssl );
8466 if( sig_alg == NULL )
8467 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
8468
8469 for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++ )
8470 {
Jerry Yu53f5c152022-06-22 20:24:38 +08008471 MBEDTLS_SSL_DEBUG_MSG( 3, ( "got signature scheme [%x] %s",
8472 *sig_alg,
8473 mbedtls_ssl_sig_alg_to_str( *sig_alg ) ) );
XiaokangQianeaf36512022-04-24 09:07:44 +00008474 if( ! mbedtls_ssl_sig_alg_is_supported( ssl, *sig_alg ) )
8475 continue;
8476 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
8477 MBEDTLS_PUT_UINT16_BE( *sig_alg, p, 0 );
8478 p += 2;
Jerry Yu80dd5db2022-06-22 19:30:32 +08008479 MBEDTLS_SSL_DEBUG_MSG( 3, ( "sent signature scheme [%x] %s",
Jerry Yuf3b46b52022-06-19 16:52:27 +08008480 *sig_alg,
8481 mbedtls_ssl_sig_alg_to_str( *sig_alg ) ) );
XiaokangQianeaf36512022-04-24 09:07:44 +00008482 }
8483
8484 /* Length of supported_signature_algorithms */
8485 supported_sig_alg_len = p - supported_sig_alg;
8486 if( supported_sig_alg_len == 0 )
8487 {
8488 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No signature algorithms defined." ) );
8489 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
8490 }
8491
XiaokangQianeaf36512022-04-24 09:07:44 +00008492 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SIG_ALG, buf, 0 );
XiaokangQianeaf36512022-04-24 09:07:44 +00008493 MBEDTLS_PUT_UINT16_BE( supported_sig_alg_len + 2, buf, 2 );
XiaokangQianeaf36512022-04-24 09:07:44 +00008494 MBEDTLS_PUT_UINT16_BE( supported_sig_alg_len, buf, 4 );
8495
XiaokangQianeaf36512022-04-24 09:07:44 +00008496 *out_len = p - buf;
8497
8498#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
8499 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SIG_ALG;
8500#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
8501 return( 0 );
8502}
8503#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
8504
XiaokangQian40a35232022-05-07 09:02:40 +00008505#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
XiaokangQian9b2b7712022-05-17 02:57:00 +00008506/*
8507 * mbedtls_ssl_parse_server_name_ext
8508 *
8509 * Structure of server_name extension:
8510 *
8511 * enum {
8512 * host_name(0), (255)
8513 * } NameType;
8514 * opaque HostName<1..2^16-1>;
8515 *
8516 * struct {
8517 * NameType name_type;
8518 * select (name_type) {
8519 * case host_name: HostName;
8520 * } name;
8521 * } ServerName;
8522 * struct {
8523 * ServerName server_name_list<1..2^16-1>
8524 * } ServerNameList;
8525 */
Ronald Cronce7d76e2022-07-08 18:56:49 +02008526MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQian9b2b7712022-05-17 02:57:00 +00008527int mbedtls_ssl_parse_server_name_ext( mbedtls_ssl_context *ssl,
8528 const unsigned char *buf,
8529 const unsigned char *end )
XiaokangQian40a35232022-05-07 09:02:40 +00008530{
8531 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
8532 const unsigned char *p = buf;
XiaokangQian9b2b7712022-05-17 02:57:00 +00008533 size_t server_name_list_len, hostname_len;
8534 const unsigned char *server_name_list_end;
XiaokangQian40a35232022-05-07 09:02:40 +00008535
XiaokangQianf2a94202022-05-20 06:44:24 +00008536 MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
XiaokangQian40a35232022-05-07 09:02:40 +00008537
8538 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
XiaokangQian9b2b7712022-05-17 02:57:00 +00008539 server_name_list_len = MBEDTLS_GET_UINT16_BE( p, 0 );
XiaokangQian40a35232022-05-07 09:02:40 +00008540 p += 2;
8541
XiaokangQian9b2b7712022-05-17 02:57:00 +00008542 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, server_name_list_len );
8543 server_name_list_end = p + server_name_list_len;
XiaokangQian75fe8c72022-06-15 09:42:45 +00008544 while( p < server_name_list_end )
XiaokangQian40a35232022-05-07 09:02:40 +00008545 {
XiaokangQian9b2b7712022-05-17 02:57:00 +00008546 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, server_name_list_end, 3 );
XiaokangQian40a35232022-05-07 09:02:40 +00008547 hostname_len = MBEDTLS_GET_UINT16_BE( p, 1 );
XiaokangQian9b2b7712022-05-17 02:57:00 +00008548 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, server_name_list_end,
8549 hostname_len + 3 );
XiaokangQian40a35232022-05-07 09:02:40 +00008550
8551 if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
8552 {
XiaokangQian75fe8c72022-06-15 09:42:45 +00008553 /* sni_name is intended to be used only during the parsing of the
8554 * ClientHello message (it is reset to NULL before the end of
8555 * the message parsing). Thus it is ok to just point to the
8556 * reception buffer and not make a copy of it.
8557 */
XiaokangQianf2a94202022-05-20 06:44:24 +00008558 ssl->handshake->sni_name = p + 3;
8559 ssl->handshake->sni_name_len = hostname_len;
8560 if( ssl->conf->f_sni == NULL )
8561 return( 0 );
XiaokangQian40a35232022-05-07 09:02:40 +00008562 ret = ssl->conf->f_sni( ssl->conf->p_sni,
XiaokangQian9b2b7712022-05-17 02:57:00 +00008563 ssl, p + 3, hostname_len );
XiaokangQian40a35232022-05-07 09:02:40 +00008564 if( ret != 0 )
8565 {
XiaokangQianf2a94202022-05-20 06:44:24 +00008566 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
XiaokangQian129aeb92022-06-02 09:29:18 +00008567 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME,
8568 MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME );
XiaokangQian40a35232022-05-07 09:02:40 +00008569 return( MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME );
8570 }
8571 return( 0 );
8572 }
8573
8574 p += hostname_len + 3;
8575 }
8576
8577 return( 0 );
8578}
8579#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
8580
XiaokangQianacb39922022-06-17 10:18:48 +00008581#if defined(MBEDTLS_SSL_ALPN)
Ronald Cronce7d76e2022-07-08 18:56:49 +02008582MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQianacb39922022-06-17 10:18:48 +00008583int mbedtls_ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
8584 const unsigned char *buf,
8585 const unsigned char *end )
8586{
8587 const unsigned char *p = buf;
XiaokangQianc7403452022-06-23 03:24:12 +00008588 size_t protocol_name_list_len;
XiaokangQian95d5f542022-06-24 02:29:26 +00008589 const unsigned char *protocol_name_list;
8590 const unsigned char *protocol_name_list_end;
XiaokangQianc7403452022-06-23 03:24:12 +00008591 size_t protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00008592
8593 /* If ALPN not configured, just ignore the extension */
8594 if( ssl->conf->alpn_list == NULL )
8595 return( 0 );
8596
8597 /*
XiaokangQianc7403452022-06-23 03:24:12 +00008598 * RFC7301, section 3.1
8599 * opaque ProtocolName<1..2^8-1>;
XiaokangQianacb39922022-06-17 10:18:48 +00008600 *
XiaokangQianc7403452022-06-23 03:24:12 +00008601 * struct {
8602 * ProtocolName protocol_name_list<2..2^16-1>
8603 * } ProtocolNameList;
XiaokangQianacb39922022-06-17 10:18:48 +00008604 */
8605
XiaokangQianc7403452022-06-23 03:24:12 +00008606 /*
XiaokangQian0b776e22022-06-24 09:04:59 +00008607 * protocol_name_list_len 2 bytes
8608 * protocol_name_len 1 bytes
8609 * protocol_name >=1 byte
XiaokangQianc7403452022-06-23 03:24:12 +00008610 */
XiaokangQianacb39922022-06-17 10:18:48 +00008611 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 4 );
8612
XiaokangQianc7403452022-06-23 03:24:12 +00008613 protocol_name_list_len = MBEDTLS_GET_UINT16_BE( p, 0 );
XiaokangQianacb39922022-06-17 10:18:48 +00008614 p += 2;
XiaokangQianc7403452022-06-23 03:24:12 +00008615 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, protocol_name_list_len );
XiaokangQian95d5f542022-06-24 02:29:26 +00008616 protocol_name_list = p;
8617 protocol_name_list_end = p + protocol_name_list_len;
XiaokangQianacb39922022-06-17 10:18:48 +00008618
8619 /* Validate peer's list (lengths) */
XiaokangQian95d5f542022-06-24 02:29:26 +00008620 while( p < protocol_name_list_end )
XiaokangQianacb39922022-06-17 10:18:48 +00008621 {
XiaokangQian95d5f542022-06-24 02:29:26 +00008622 protocol_name_len = *p++;
8623 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, protocol_name_list_end,
8624 protocol_name_len );
XiaokangQianc7403452022-06-23 03:24:12 +00008625 if( protocol_name_len == 0 )
XiaokangQian95d5f542022-06-24 02:29:26 +00008626 {
8627 MBEDTLS_SSL_PEND_FATAL_ALERT(
8628 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
8629 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
XiaokangQianacb39922022-06-17 10:18:48 +00008630 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
XiaokangQian95d5f542022-06-24 02:29:26 +00008631 }
8632
8633 p += protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00008634 }
8635
8636 /* Use our order of preference */
8637 for( const char **alpn = ssl->conf->alpn_list; *alpn != NULL; alpn++ )
8638 {
8639 size_t const alpn_len = strlen( *alpn );
XiaokangQian95d5f542022-06-24 02:29:26 +00008640 p = protocol_name_list;
8641 while( p < protocol_name_list_end )
XiaokangQianacb39922022-06-17 10:18:48 +00008642 {
XiaokangQian95d5f542022-06-24 02:29:26 +00008643 protocol_name_len = *p++;
XiaokangQianc7403452022-06-23 03:24:12 +00008644 if( protocol_name_len == alpn_len &&
XiaokangQian95d5f542022-06-24 02:29:26 +00008645 memcmp( p, *alpn, alpn_len ) == 0 )
XiaokangQianacb39922022-06-17 10:18:48 +00008646 {
8647 ssl->alpn_chosen = *alpn;
8648 return( 0 );
8649 }
XiaokangQian95d5f542022-06-24 02:29:26 +00008650
8651 p += protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00008652 }
8653 }
8654
XiaokangQian95d5f542022-06-24 02:29:26 +00008655 /* If we get here, no match was found */
XiaokangQianacb39922022-06-17 10:18:48 +00008656 MBEDTLS_SSL_PEND_FATAL_ALERT(
8657 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL,
8658 MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL );
8659 return( MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL );
8660}
8661
8662int mbedtls_ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
8663 unsigned char *buf,
8664 unsigned char *end,
XiaokangQianc7403452022-06-23 03:24:12 +00008665 size_t *out_len )
XiaokangQianacb39922022-06-17 10:18:48 +00008666{
8667 unsigned char *p = buf;
XiaokangQian95d5f542022-06-24 02:29:26 +00008668 size_t protocol_name_len;
XiaokangQianc7403452022-06-23 03:24:12 +00008669 *out_len = 0;
XiaokangQianacb39922022-06-17 10:18:48 +00008670
8671 if( ssl->alpn_chosen == NULL )
8672 {
8673 return( 0 );
8674 }
8675
XiaokangQian95d5f542022-06-24 02:29:26 +00008676 protocol_name_len = strlen( ssl->alpn_chosen );
8677 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 + protocol_name_len );
XiaokangQianacb39922022-06-17 10:18:48 +00008678
8679 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server side, adding alpn extension" ) );
8680 /*
8681 * 0 . 1 ext identifier
8682 * 2 . 3 ext length
8683 * 4 . 5 protocol list length
8684 * 6 . 6 protocol name length
8685 * 7 . 7+n protocol name
8686 */
8687 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_ALPN, p, 0 );
8688
XiaokangQian95d5f542022-06-24 02:29:26 +00008689 *out_len = 7 + protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00008690
XiaokangQian95d5f542022-06-24 02:29:26 +00008691 MBEDTLS_PUT_UINT16_BE( protocol_name_len + 3, p, 2 );
8692 MBEDTLS_PUT_UINT16_BE( protocol_name_len + 1, p, 4 );
XiaokangQian0b776e22022-06-24 09:04:59 +00008693 /* Note: the length of the chosen protocol has been checked to be less
8694 * than 255 bytes in `mbedtls_ssl_conf_alpn_protocols`.
8695 */
XiaokangQian95d5f542022-06-24 02:29:26 +00008696 p[6] = MBEDTLS_BYTE_0( protocol_name_len );
XiaokangQianacb39922022-06-17 10:18:48 +00008697
XiaokangQian95d5f542022-06-24 02:29:26 +00008698 memcpy( p + 7, ssl->alpn_chosen, protocol_name_len );
XiaokangQianacb39922022-06-17 10:18:48 +00008699 return ( 0 );
8700}
8701#endif /* MBEDTLS_SSL_ALPN */
8702
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008703#endif /* MBEDTLS_SSL_TLS_C */