blob: 1ee7af008b7f54bc0a7da7fe2fe23f5f51538be3 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 shared functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21/*
22 * The SSL 3.0 specification was drafted by Netscape in 1996,
23 * and became an IETF standard in 1999.
24 *
25 * http://wp.netscape.com/eng/ssl3/
26 * http://www.ietf.org/rfc/rfc2246.txt
27 * http://www.ietf.org/rfc/rfc4346.txt
28 */
29
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020030#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000031#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020032#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020033#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020034#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020036#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000037
SimonBd5800b72016-04-26 07:43:27 +010038#if defined(MBEDTLS_PLATFORM_C)
39#include "mbedtls/platform.h"
40#else
41#include <stdlib.h>
42#define mbedtls_calloc calloc
43#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010044#endif
45
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000046#include "mbedtls/debug.h"
47#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020048#include "mbedtls/ssl_internal.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050049#include "mbedtls/platform_util.h"
Hanno Beckerb5352f02019-05-16 12:39:07 +010050#include "mbedtls/version.h"
Jarno Lamsaaf60cd72019-12-19 16:45:23 +020051#include "mbedtls/platform.h"
52
Rich Evans00ab4702015-02-06 13:43:58 +000053#include <string.h>
54
Janos Follath23bdca02016-10-07 14:47:14 +010055#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000056#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020057#endif
58
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -040059#define PROPER_HS_FRAGMENT 0x75555555
60
Hanno Beckeref982d52019-07-23 15:56:18 +010061#if defined(MBEDTLS_USE_TINYCRYPT)
62static int uecc_rng_wrapper( uint8_t *dest, unsigned int size )
63{
Hanno Beckerd089fad2019-07-24 09:05:05 +010064 int ret;
65 ret = mbedtls_ssl_conf_rng_func( NULL, dest, size );
66 if( ret == 0 )
67 return( (int) size );
68
69 return( 0 );
Hanno Beckeref982d52019-07-23 15:56:18 +010070}
Hanno Becker75f12d12019-07-23 16:16:15 +010071
72int mbedtls_ssl_ecdh_read_peerkey( mbedtls_ssl_context *ssl,
73 unsigned char **p, unsigned char *end )
74{
75 size_t const secp256r1_uncompressed_point_length =
76 1 /* length */ + 1 /* length */ + 2 * NUM_ECC_BYTES /* data */;
77
78 if( (size_t)( end - *p ) < secp256r1_uncompressed_point_length )
79 {
80 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Bad ECDH peer pubkey (too short)" ) );
Hanno Beckerc64d5af2019-08-23 13:14:36 +010081 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker75f12d12019-07-23 16:16:15 +010082 }
83
84 if( (*p)[0] != 2 * NUM_ECC_BYTES + 1 ||
85 (*p)[1] != 0x04 )
86 {
87 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Unexpected ECDH peer pubkey header - expected { %#02x, %#02x }, got { %#02x, %#02x }",
88 2 * NUM_ECC_BYTES + 1,
89 0x04,
90 (unsigned) (*p)[0],
91 (unsigned) (*p)[1] ) );
Hanno Beckerc64d5af2019-08-23 13:14:36 +010092 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker75f12d12019-07-23 16:16:15 +010093 }
94
Teppo Järvelin91d79382019-10-02 09:09:31 +030095 mbedtls_platform_memcpy( ssl->handshake->ecdh_peerkey, *p + 2, 2 * NUM_ECC_BYTES );
Hanno Becker75f12d12019-07-23 16:16:15 +010096
97 *p += secp256r1_uncompressed_point_length;
98 return( 0 );
99}
Hanno Beckeref982d52019-07-23 15:56:18 +0100100#endif /* MBEDTLS_USE_TINYCRYPT */
101
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100102static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl );
Hanno Beckercd9dcda2018-08-28 17:18:56 +0100103static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +0100104
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100105/* Length of the "epoch" field in the record header */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200106static inline size_t ssl_ep_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100107{
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200108#if !defined(MBEDTLS_SSL_TRANSPORT__BOTH)
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +0100109 ((void) ssl);
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100110#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200111
112#if defined(MBEDTLS_SSL_PROTO_DTLS)
113 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
114 return( 2 );
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200115 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +0200116#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200117#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100118 return( 0 );
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +0200119#endif
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +0100120}
121
Hanno Beckerb82350b2019-07-26 07:24:05 +0100122static void ssl_send_pending_fatal_alert( mbedtls_ssl_context *ssl )
123{
124 if( ssl->pending_fatal_alert_msg == MBEDTLS_SSL_ALERT_MSG_NONE )
125 return;
126
127 mbedtls_ssl_send_alert_message( ssl,
128 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
129 ssl->pending_fatal_alert_msg );
130 ssl->pending_fatal_alert_msg = MBEDTLS_SSL_ALERT_MSG_NONE;
131}
132
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200133/*
134 * Start a timer.
135 * Passing millisecs = 0 cancels a running timer.
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200136 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200137static void ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200138{
Hanno Becker0ae6b242019-06-13 16:45:36 +0100139 if( mbedtls_ssl_get_set_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200140 return;
141
142 MBEDTLS_SSL_DEBUG_MSG( 3, ( "set_timer to %d ms", (int) millisecs ) );
Hanno Becker0ae6b242019-06-13 16:45:36 +0100143 mbedtls_ssl_get_set_timer( ssl )( ssl->p_timer,
144 millisecs / 4,
145 millisecs );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200146}
147
148/*
149 * Return -1 is timer is expired, 0 if it isn't.
150 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200151static int ssl_check_timer( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200152{
Hanno Becker0ae6b242019-06-13 16:45:36 +0100153 if( mbedtls_ssl_get_get_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +0200154 return( 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200155
Hanno Becker0ae6b242019-06-13 16:45:36 +0100156 if( mbedtls_ssl_get_get_timer( ssl )( ssl->p_timer ) == 2 )
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200157 {
158 MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200159 return( -1 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200160 }
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200161
162 return( 0 );
163}
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200164
Hanno Becker5aa4e2c2018-08-06 09:26:08 +0100165static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
166 mbedtls_ssl_transform *transform );
Hanno Beckerf5970a02019-05-08 09:38:41 +0100167static void ssl_update_in_pointers( mbedtls_ssl_context *ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100168
Hanno Becker02f26092019-07-03 16:13:00 +0100169#if defined(MBEDTLS_SSL_RECORD_CHECKING)
Hanno Becker03e2db62019-07-12 14:40:00 +0100170static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
171 unsigned char *buf,
172 size_t len,
173 mbedtls_record *rec );
174
Hanno Becker02f26092019-07-03 16:13:00 +0100175int mbedtls_ssl_check_record( mbedtls_ssl_context const *ssl,
176 unsigned char *buf,
177 size_t buflen )
178{
Andrzej Kurekfd56f402020-05-25 11:52:05 -0400179 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker03e2db62019-07-12 14:40:00 +0100180 mbedtls_record rec;
181 MBEDTLS_SSL_DEBUG_MSG( 1, ( "=> mbedtls_ssl_check_record" ) );
182 MBEDTLS_SSL_DEBUG_BUF( 3, "record buffer", buf, buflen );
183
184 /* We don't support record checking in TLS because
185 * (a) there doesn't seem to be a usecase for it, and
186 * (b) In SSLv3 and TLS 1.0, CBC record decryption has state
187 * and we'd need to backup the transform here.
188 */
189#if defined(MBEDTLS_SSL_PROTO_TLS)
190 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
191 {
192 ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
193 goto exit;
194 }
195 MBEDTLS_SSL_TRANSPORT_ELSE
196#endif /* MBEDTLS_SSL_PROTO_TLS */
197#if defined(MBEDTLS_SSL_PROTO_DTLS)
198 {
199 ret = ssl_parse_record_header( ssl, buf, buflen, &rec );
200 if( ret != 0 )
201 {
202 MBEDTLS_SSL_DEBUG_RET( 3, "ssl_parse_record_header", ret );
203 goto exit;
204 }
205
206 if( ssl->transform_in != NULL )
207 {
208 ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in, &rec );
209 if( ret != 0 )
210 {
211 MBEDTLS_SSL_DEBUG_RET( 3, "mbedtls_ssl_decrypt_buf", ret );
212 goto exit;
213 }
214 }
215 }
216#endif /* MBEDTLS_SSL_PROTO_DTLS */
217
218exit:
219 /* On success, we have decrypted the buffer in-place, so make
220 * sure we don't leak any plaintext data. */
221 mbedtls_platform_zeroize( buf, buflen );
222
223 /* For the purpose of this API, treat messages with unexpected CID
224 * as well as such from future epochs as unexpected. */
225 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID ||
226 ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
227 {
228 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
229 }
230
231 MBEDTLS_SSL_DEBUG_MSG( 1, ( "<= mbedtls_ssl_check_record" ) );
232 return( ret );
Hanno Becker02f26092019-07-03 16:13:00 +0100233}
234#endif /* MBEDTLS_SSL_RECORD_CHECKING */
235
Hanno Becker67bc7c32018-08-06 11:33:50 +0100236#define SSL_DONT_FORCE_FLUSH 0
237#define SSL_FORCE_FLUSH 1
238
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200239#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +0100240
Hanno Beckera5a2b082019-05-15 14:03:01 +0100241#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100242/* Top-level Connection ID API */
243
Hanno Beckere0200da2019-06-13 09:23:43 +0100244#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \
245 !defined(MBEDTLS_SSL_CONF_CID_LEN) && \
246 !defined(MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID)
Hanno Beckere8eff9a2019-05-14 11:30:10 +0100247int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
248 size_t len,
249 int ignore_other_cid )
Hanno Beckereec2be92019-05-03 13:06:44 +0100250{
251 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
252 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
253
Hanno Becker791ec6b2019-05-14 11:45:26 +0100254 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
255 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
256 {
257 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
258 }
259
260 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckereec2be92019-05-03 13:06:44 +0100261 conf->cid_len = len;
262 return( 0 );
263}
Hanno Beckere0200da2019-06-13 09:23:43 +0100264#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID &&
265 !MBEDTLS_SSL_CONF_CID_LEN &&
266 !MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID */
267
268#if MBEDTLS_SSL_CONF_CID_LEN > MBEDTLS_SSL_CID_IN_LEN_MAX
269#error "Invalid hardcoded value for MBEDTLS_SSL_CONF_CID_LEN"
270#endif
271#if MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE && \
272 MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID != MBEDTLS_SSL_UNEXPECTED_CID_FAIL
273#error "Invalid hardcoded value for MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID"
274#endif
275
276#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID &&
277 !MBEDTLS_SSL_CONF_CID_LEN &&
278 !MBEDTLS_SSL_CONF_IGNORE_UNEXPECTED_CID */
Hanno Beckereec2be92019-05-03 13:06:44 +0100279
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100280int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
281 int enable,
282 unsigned char const *own_cid,
283 size_t own_cid_len )
284{
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200285 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker78c43022019-05-03 14:38:32 +0100286 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
287
Hanno Becker07489862019-04-25 16:01:49 +0100288 ssl->negotiate_cid = enable;
289 if( enable == MBEDTLS_SSL_CID_DISABLED )
290 {
291 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
292 return( 0 );
293 }
294 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckereec2be92019-05-03 13:06:44 +0100295 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Becker07489862019-04-25 16:01:49 +0100296
Hanno Beckere0200da2019-06-13 09:23:43 +0100297 if( own_cid_len != mbedtls_ssl_conf_get_cid_len( ssl->conf ) )
Hanno Becker07489862019-04-25 16:01:49 +0100298 {
Hanno Beckereec2be92019-05-03 13:06:44 +0100299 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
300 (unsigned) own_cid_len,
Hanno Beckere0200da2019-06-13 09:23:43 +0100301 (unsigned) mbedtls_ssl_conf_get_cid_len( ssl->conf ) ) );
Hanno Becker07489862019-04-25 16:01:49 +0100302 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
303 }
304
Teppo Järvelin6f4e0302019-10-04 13:53:53 +0300305 /* Not using more secure mbedtls_platform_memcpy as cid is public */
306 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb4a56062019-04-30 14:07:31 +0100307 /* Truncation is not an issue here because
308 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
309 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Becker07489862019-04-25 16:01:49 +0100310
Andrzej Kurekafec8852020-07-15 16:31:27 -0400311 return( 0 );
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100312}
313
314int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
315 int *enabled,
316 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
317 size_t *peer_cid_len )
318{
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100319 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Becker2de89fa2019-04-26 17:08:02 +0100320
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200321 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) ||
Hanno Becker78c43022019-05-03 14:38:32 +0100322 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
323 {
Hanno Becker2de89fa2019-04-26 17:08:02 +0100324 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker78c43022019-05-03 14:38:32 +0100325 }
Hanno Becker2de89fa2019-04-26 17:08:02 +0100326
Hanno Beckercb063f52019-05-03 12:54:52 +0100327 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
328 * were used, but client and server requested the empty CID.
329 * This is indistinguishable from not using the CID extension
330 * in the first place. */
Hanno Becker2de89fa2019-04-26 17:08:02 +0100331 if( ssl->transform_in->in_cid_len == 0 &&
332 ssl->transform_in->out_cid_len == 0 )
333 {
334 return( 0 );
335 }
336
Hanno Becker633d6042019-05-22 16:50:35 +0100337 if( peer_cid_len != NULL )
338 {
339 *peer_cid_len = ssl->transform_in->out_cid_len;
340 if( peer_cid != NULL )
341 {
Teppo Järvelin6f4e0302019-10-04 13:53:53 +0300342 /* Not using more secure mbedtls_platform_memcpy as cid is public */
343 memcpy( peer_cid, ssl->transform_in->out_cid,
Hanno Becker633d6042019-05-22 16:50:35 +0100344 ssl->transform_in->out_cid_len );
345 }
346 }
Hanno Becker2de89fa2019-04-26 17:08:02 +0100347
348 *enabled = MBEDTLS_SSL_CID_ENABLED;
349
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100350 return( 0 );
351}
Hanno Beckera5a2b082019-05-15 14:03:01 +0100352#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100353
Hanno Beckerd5847772018-08-28 10:09:23 +0100354/* Forward declarations for functions related to message buffering. */
355static void ssl_buffering_free( mbedtls_ssl_context *ssl );
356static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
357 uint8_t slot );
358static void ssl_free_buffered_record( mbedtls_ssl_context *ssl );
359static int ssl_load_buffered_message( mbedtls_ssl_context *ssl );
360static int ssl_load_buffered_record( mbedtls_ssl_context *ssl );
361static int ssl_buffer_message( mbedtls_ssl_context *ssl );
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +0100362static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
363 mbedtls_record const *rec );
Hanno Beckeref7afdf2018-08-28 17:16:31 +0100364static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl );
Hanno Beckerd5847772018-08-28 10:09:23 +0100365
Hanno Beckera67dee22018-08-22 10:05:20 +0100366static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl );
Hanno Becker11682cc2018-08-22 14:41:02 +0100367static size_t ssl_get_maximum_datagram_size( mbedtls_ssl_context const *ssl )
Hanno Becker2b1e3542018-08-06 11:19:13 +0100368{
Hanno Becker11682cc2018-08-22 14:41:02 +0100369 size_t mtu = ssl_get_current_mtu( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100370
371 if( mtu != 0 && mtu < MBEDTLS_SSL_OUT_BUFFER_LEN )
Hanno Becker11682cc2018-08-22 14:41:02 +0100372 return( mtu );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100373
374 return( MBEDTLS_SSL_OUT_BUFFER_LEN );
375}
376
Hanno Becker67bc7c32018-08-06 11:33:50 +0100377static int ssl_get_remaining_space_in_datagram( mbedtls_ssl_context const *ssl )
378{
Hanno Becker11682cc2018-08-22 14:41:02 +0100379 size_t const bytes_written = ssl->out_left;
380 size_t const mtu = ssl_get_maximum_datagram_size( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100381
382 /* Double-check that the write-index hasn't gone
383 * past what we can transmit in a single datagram. */
Hanno Becker11682cc2018-08-22 14:41:02 +0100384 if( bytes_written > mtu )
Hanno Becker67bc7c32018-08-06 11:33:50 +0100385 {
386 /* Should never happen... */
387 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
388 }
389
390 return( (int) ( mtu - bytes_written ) );
391}
392
393static int ssl_get_remaining_payload_in_datagram( mbedtls_ssl_context const *ssl )
394{
395 int ret;
396 size_t remaining, expansion;
Andrzej Kurek748face2018-10-11 07:20:19 -0400397 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100398
399#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
400 const size_t mfl = mbedtls_ssl_get_max_frag_len( ssl );
401
402 if( max_len > mfl )
403 max_len = mfl;
Hanno Beckerf4b010e2018-08-24 10:47:29 +0100404
405 /* By the standard (RFC 6066 Sect. 4), the MFL extension
406 * only limits the maximum record payload size, so in theory
407 * we would be allowed to pack multiple records of payload size
408 * MFL into a single datagram. However, this would mean that there's
409 * no way to explicitly communicate MTU restrictions to the peer.
410 *
411 * The following reduction of max_len makes sure that we never
412 * write datagrams larger than MFL + Record Expansion Overhead.
413 */
414 if( max_len <= ssl->out_left )
415 return( 0 );
416
417 max_len -= ssl->out_left;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100418#endif
419
420 ret = ssl_get_remaining_space_in_datagram( ssl );
421 if( ret < 0 )
422 return( ret );
423 remaining = (size_t) ret;
424
425 ret = mbedtls_ssl_get_record_expansion( ssl );
426 if( ret < 0 )
427 return( ret );
428 expansion = (size_t) ret;
429
430 if( remaining <= expansion )
431 return( 0 );
432
433 remaining -= expansion;
434 if( remaining >= max_len )
435 remaining = max_len;
436
437 return( (int) remaining );
438}
439
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200440/*
441 * Double the retransmit timeout value, within the allowed range,
442 * returning -1 if the maximum value has already been reached.
443 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200444static int ssl_double_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200445{
446 uint32_t new_timeout;
447
Hanno Becker1f835fa2019-06-13 10:14:59 +0100448 if( ssl->handshake->retransmit_timeout >=
449 mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) )
450 {
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200451 return( -1 );
Hanno Becker1f835fa2019-06-13 10:14:59 +0100452 }
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200453
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200454 /* Implement the final paragraph of RFC 6347 section 4.1.1.1
455 * in the following way: after the initial transmission and a first
456 * retransmission, back off to a temporary estimated MTU of 508 bytes.
457 * This value is guaranteed to be deliverable (if not guaranteed to be
458 * delivered) of any compliant IPv4 (and IPv6) network, and should work
459 * on most non-IP stacks too. */
Hanno Becker1f835fa2019-06-13 10:14:59 +0100460 if( ssl->handshake->retransmit_timeout !=
461 mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf ) )
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400462 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200463 ssl->handshake->mtu = 508;
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400464 MBEDTLS_SSL_DEBUG_MSG( 2, ( "mtu autoreduction to %d bytes", ssl->handshake->mtu ) );
465 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200466
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200467 new_timeout = 2 * ssl->handshake->retransmit_timeout;
468
469 /* Avoid arithmetic overflow and range overflow */
470 if( new_timeout < ssl->handshake->retransmit_timeout ||
Hanno Becker1f835fa2019-06-13 10:14:59 +0100471 new_timeout > mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200472 {
Hanno Becker1f835fa2019-06-13 10:14:59 +0100473 new_timeout = mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200474 }
475
476 ssl->handshake->retransmit_timeout = new_timeout;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200477 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200478 ssl->handshake->retransmit_timeout ) );
479
480 return( 0 );
481}
482
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200483static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200484{
Hanno Becker1f835fa2019-06-13 10:14:59 +0100485 ssl->handshake->retransmit_timeout = mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200486 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200487 ssl->handshake->retransmit_timeout ) );
488}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200489#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200490
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200491#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200492/*
493 * Convert max_fragment_length codes to length.
494 * RFC 6066 says:
495 * enum{
496 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
497 * } MaxFragmentLength;
498 * and we add 0 -> extension unused
499 */
Angus Grattond8213d02016-05-25 20:56:48 +1000500static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200501{
Angus Grattond8213d02016-05-25 20:56:48 +1000502 switch( mfl )
503 {
504 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
Arto Kinnunen4f4849a2019-09-09 10:21:18 +0300505 return( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
Angus Grattond8213d02016-05-25 20:56:48 +1000506 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
507 return 512;
508 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
509 return 1024;
510 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
511 return 2048;
512 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
513 return 4096;
514 default:
Arto Kinnunen4f4849a2019-09-09 10:21:18 +0300515 return( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
Angus Grattond8213d02016-05-25 20:56:48 +1000516 }
517}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200518#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200519
Hanno Becker58fccf22019-02-06 14:30:46 +0000520int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
521 const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200522{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200523 mbedtls_ssl_session_free( dst );
Teppo Järvelin91d79382019-10-02 09:09:31 +0300524 mbedtls_platform_memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200525
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200526#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Beckerd5258fa2019-02-07 12:27:42 +0000527
528#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200529 if( src->peer_cert != NULL )
530 {
Paul Bakker2292d1f2013-09-15 17:06:49 +0200531 int ret;
532
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200533 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200534 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200535 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200536
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200537 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200538
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200539 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200540 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200541 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200542 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200543 dst->peer_cert = NULL;
544 return( ret );
545 }
546 }
Hanno Becker5882dd02019-06-06 16:25:57 +0100547#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000548 if( src->peer_cert_digest != NULL )
549 {
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000550 dst->peer_cert_digest =
Hanno Becker9d64b782019-02-25 10:06:59 +0000551 mbedtls_calloc( 1, src->peer_cert_digest_len );
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000552 if( dst->peer_cert_digest == NULL )
553 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
554
Teppo Järvelin91d79382019-10-02 09:09:31 +0300555 mbedtls_platform_memcpy( dst->peer_cert_digest, src->peer_cert_digest,
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000556 src->peer_cert_digest_len );
557 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Becker9d64b782019-02-25 10:06:59 +0000558 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000559 }
Hanno Becker5882dd02019-06-06 16:25:57 +0100560#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker9fb6e2e2019-02-05 17:00:50 +0000561
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200562#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200563
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200564#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200565 if( src->ticket != NULL )
566 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200567 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200568 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200569 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200570
Teppo Järvelin91d79382019-10-02 09:09:31 +0300571 mbedtls_platform_memcpy( dst->ticket, src->ticket, src->ticket_len );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200572 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200573#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200574
575 return( 0 );
576}
577
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200578#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
579int (*mbedtls_ssl_hw_record_init)( mbedtls_ssl_context *ssl,
Paul Bakker9af723c2014-05-01 13:03:14 +0200580 const unsigned char *key_enc, const unsigned char *key_dec,
581 size_t keylen,
582 const unsigned char *iv_enc, const unsigned char *iv_dec,
583 size_t ivlen,
584 const unsigned char *mac_enc, const unsigned char *mac_dec,
Paul Bakker66d5d072014-06-17 16:39:18 +0200585 size_t maclen ) = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200586int (*mbedtls_ssl_hw_record_activate)( mbedtls_ssl_context *ssl, int direction) = NULL;
587int (*mbedtls_ssl_hw_record_reset)( mbedtls_ssl_context *ssl ) = NULL;
588int (*mbedtls_ssl_hw_record_write)( mbedtls_ssl_context *ssl ) = NULL;
589int (*mbedtls_ssl_hw_record_read)( mbedtls_ssl_context *ssl ) = NULL;
590int (*mbedtls_ssl_hw_record_finish)( mbedtls_ssl_context *ssl ) = NULL;
591#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +0000592
Paul Bakker5121ce52009-01-03 21:22:43 +0000593/*
594 * Key material generation
595 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200596#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2793f742019-08-16 14:28:43 +0100597MBEDTLS_NO_INLINE static int ssl3_prf( const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200598 const char *label,
599 const unsigned char *random, size_t rlen,
Paul Bakker5f70b252012-09-13 14:23:06 +0000600 unsigned char *dstbuf, size_t dlen )
601{
Andres Amaya Garcia33952502017-07-20 16:29:16 +0100602 int ret = 0;
Paul Bakker5f70b252012-09-13 14:23:06 +0000603 size_t i;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200604 mbedtls_md5_context md5;
605 mbedtls_sha1_context sha1;
Paul Bakker5f70b252012-09-13 14:23:06 +0000606 unsigned char padding[16];
607 unsigned char sha1sum[20];
Andrzej Kurekafec8852020-07-15 16:31:27 -0400608 ((void)label);
Paul Bakker5f70b252012-09-13 14:23:06 +0000609
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200610 mbedtls_md5_init( &md5 );
611 mbedtls_sha1_init( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +0200612
Paul Bakker5f70b252012-09-13 14:23:06 +0000613 /*
614 * SSLv3:
615 * block =
616 * MD5( secret + SHA1( 'A' + secret + random ) ) +
617 * MD5( secret + SHA1( 'BB' + secret + random ) ) +
618 * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
619 * ...
620 */
621 for( i = 0; i < dlen / 16; i++ )
622 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +0200623 mbedtls_platform_memset( padding, (unsigned char) ('A' + i), 1 + i );
Paul Bakker5f70b252012-09-13 14:23:06 +0000624
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100625 if( ( ret = mbedtls_sha1_starts_ret( &sha1 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100626 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100627 if( ( ret = mbedtls_sha1_update_ret( &sha1, padding, 1 + i ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100628 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100629 if( ( ret = mbedtls_sha1_update_ret( &sha1, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100630 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100631 if( ( ret = mbedtls_sha1_update_ret( &sha1, random, rlen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100632 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100633 if( ( ret = mbedtls_sha1_finish_ret( &sha1, sha1sum ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100634 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000635
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100636 if( ( ret = mbedtls_md5_starts_ret( &md5 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100637 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100638 if( ( ret = mbedtls_md5_update_ret( &md5, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100639 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100640 if( ( ret = mbedtls_md5_update_ret( &md5, sha1sum, 20 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100641 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100642 if( ( ret = mbedtls_md5_finish_ret( &md5, dstbuf + i * 16 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100643 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000644 }
645
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100646exit:
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200647 mbedtls_md5_free( &md5 );
648 mbedtls_sha1_free( &sha1 );
Paul Bakker5f70b252012-09-13 14:23:06 +0000649
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500650 mbedtls_platform_zeroize( padding, sizeof( padding ) );
651 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
Paul Bakker5f70b252012-09-13 14:23:06 +0000652
Andrzej Kurekafec8852020-07-15 16:31:27 -0400653 return( ret );
Paul Bakker5f70b252012-09-13 14:23:06 +0000654}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200655#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +0000656
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200657#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker2793f742019-08-16 14:28:43 +0100658MBEDTLS_NO_INLINE static int tls1_prf( const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200659 const char *label,
660 const unsigned char *random, size_t rlen,
Paul Bakker23986e52011-04-24 08:57:21 +0000661 unsigned char *dstbuf, size_t dlen )
Paul Bakker5121ce52009-01-03 21:22:43 +0000662{
Paul Bakker23986e52011-04-24 08:57:21 +0000663 size_t nb, hs;
664 size_t i, j, k;
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200665 const unsigned char *S1, *S2;
Paul Bakker5121ce52009-01-03 21:22:43 +0000666 unsigned char tmp[128];
667 unsigned char h_i[20];
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100668 mbedtls_md_handle_t md_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200669 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100670 int ret;
671
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200672 mbedtls_md_init( &md_ctx );
Paul Bakker5121ce52009-01-03 21:22:43 +0000673
674 if( sizeof( tmp ) < 20 + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200675 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000676
677 hs = ( slen + 1 ) / 2;
678 S1 = secret;
679 S2 = secret + slen - hs;
680
681 nb = strlen( label );
Teppo Järvelin91d79382019-10-02 09:09:31 +0300682 mbedtls_platform_memcpy( tmp + 20, label, nb );
683 mbedtls_platform_memcpy( tmp + 20 + nb, random, rlen );
Paul Bakker5121ce52009-01-03 21:22:43 +0000684 nb += rlen;
685
686 /*
687 * First compute P_md5(secret,label+random)[0..dlen]
688 */
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100689 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) ==
690 MBEDTLS_MD_INVALID_HANDLE )
691 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200692 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100693 }
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100694
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200695 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100696 return( ret );
697
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200698 mbedtls_md_hmac_starts( &md_ctx, S1, hs );
699 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
700 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000701
702 for( i = 0; i < dlen; i += 16 )
703 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200704 mbedtls_md_hmac_reset ( &md_ctx );
705 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb );
706 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100707
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200708 mbedtls_md_hmac_reset ( &md_ctx );
709 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 );
710 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000711
712 k = ( i + 16 > dlen ) ? dlen % 16 : 16;
713
714 for( j = 0; j < k; j++ )
715 dstbuf[i + j] = h_i[j];
716 }
717
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200718 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100719
Paul Bakker5121ce52009-01-03 21:22:43 +0000720 /*
721 * XOR out with P_sha1(secret,label+random)[0..dlen]
722 */
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100723 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) ==
724 MBEDTLS_MD_INVALID_HANDLE )
725 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200726 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100727 }
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100728
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200729 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100730 return( ret );
731
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200732 mbedtls_md_hmac_starts( &md_ctx, S2, hs );
733 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
734 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000735
736 for( i = 0; i < dlen; i += 20 )
737 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200738 mbedtls_md_hmac_reset ( &md_ctx );
739 mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb );
740 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100741
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200742 mbedtls_md_hmac_reset ( &md_ctx );
743 mbedtls_md_hmac_update( &md_ctx, tmp, 20 );
744 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000745
746 k = ( i + 20 > dlen ) ? dlen % 20 : 20;
747
748 for( j = 0; j < k; j++ )
749 dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
750 }
751
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200752 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100753
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500754 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
755 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000756
Andrzej Kurekafec8852020-07-15 16:31:27 -0400757 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000758}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200759#endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker5121ce52009-01-03 21:22:43 +0000760
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200761#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Beckerf6cc7422019-08-16 14:34:52 +0100762#if !( defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_SHA512_C) )
763MBEDTLS_ALWAYS_INLINE static inline
764#else
765static
766#endif
767int tls_prf_generic( mbedtls_md_type_t md_type,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100768 const unsigned char *secret, size_t slen,
769 const char *label,
770 const unsigned char *random, size_t rlen,
771 unsigned char *dstbuf, size_t dlen )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000772{
773 size_t nb;
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100774 size_t i, j, k, md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000775 unsigned char tmp[128];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200776 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100777 mbedtls_md_handle_t md_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200778 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100779 int ret;
780
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200781 mbedtls_md_init( &md_ctx );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000782
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100783 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) ==
784 MBEDTLS_MD_INVALID_HANDLE )
785 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200786 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Hanno Beckera5cedbc2019-07-17 11:21:02 +0100787 }
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100788
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200789 md_len = mbedtls_md_get_size( md_info );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100790
791 if( sizeof( tmp ) < md_len + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200792 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000793
794 nb = strlen( label );
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200795 (void)mbedtls_platform_memcpy( tmp + md_len, label, nb );
796 (void)mbedtls_platform_memcpy( tmp + md_len + nb, random, rlen );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000797 nb += rlen;
798
799 /*
800 * Compute P_<hash>(secret, label + random)[0..dlen]
801 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200802 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100803 return( ret );
804
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200805 if ( ( ret = mbedtls_md_hmac_starts( &md_ctx, secret, slen ) ) != 0 )
806 return( ret );
807 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb ) ) != 0 )
808 return( ret );
809 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, tmp ) ) != 0 )
810 return( ret );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100811
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100812 for( i = 0; i < dlen; i += md_len )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000813 {
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200814 if ( ( ret = mbedtls_md_hmac_reset ( &md_ctx ) ) != 0 )
815 return( ret );
816 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb ) ) != 0 )
817 return( ret );
818 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, h_i ) ) != 0 )
819 return( ret );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100820
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200821 if ( ( ret = mbedtls_md_hmac_reset ( &md_ctx ) ) != 0 )
822 return( ret );
823 if ( ( ret = mbedtls_md_hmac_update( &md_ctx, tmp, md_len ) ) != 0 )
824 return( ret );
825 if ( ( ret = mbedtls_md_hmac_finish( &md_ctx, tmp ) ) != 0 )
826 return( ret );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000827
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100828 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000829
830 for( j = 0; j < k; j++ )
831 dstbuf[i + j] = h_i[j];
832 }
833
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200834 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100835
Teppo Järvelin8f7e36f2020-01-02 10:40:19 +0200836 (void)mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
837 (void)mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000838
Andrzej Kurekafec8852020-07-15 16:31:27 -0400839 return( 0 );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000840}
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100841
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200842#if defined(MBEDTLS_SHA256_C)
Hanno Becker2793f742019-08-16 14:28:43 +0100843MBEDTLS_NO_INLINE static int tls_prf_sha256(
844 const unsigned char *secret, size_t slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100845 const char *label,
846 const unsigned char *random, size_t rlen,
847 unsigned char *dstbuf, size_t dlen )
848{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200849 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100850 label, random, rlen, dstbuf, dlen ) );
851}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200852#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000853
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200854#if defined(MBEDTLS_SHA512_C)
Hanno Becker2793f742019-08-16 14:28:43 +0100855MBEDTLS_NO_INLINE static int tls_prf_sha384(
856 const unsigned char *secret, size_t slen,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200857 const char *label,
858 const unsigned char *random, size_t rlen,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000859 unsigned char *dstbuf, size_t dlen )
860{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200861 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100862 label, random, rlen, dstbuf, dlen ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +0000863}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200864#endif /* MBEDTLS_SHA512_C */
865#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +0000866
Hanno Becker39c7f7e2019-08-15 16:17:34 +0100867/*
868 * Call the appropriate PRF function
869 */
Hanno Becker2793f742019-08-16 14:28:43 +0100870MBEDTLS_ALWAYS_INLINE static inline int ssl_prf( int minor_ver,
Hanno Becker39c7f7e2019-08-15 16:17:34 +0100871 mbedtls_md_type_t hash,
872 const unsigned char *secret, size_t slen,
873 const char *label,
874 const unsigned char *random, size_t rlen,
875 unsigned char *dstbuf, size_t dlen )
876{
877#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
878 (void) hash;
879#endif
880
881#if defined(MBEDTLS_SSL_PROTO_SSL3)
882 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
883 return( ssl3_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
884 else
885#endif
886#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +0100887 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Becker39c7f7e2019-08-15 16:17:34 +0100888 return( tls1_prf( secret, slen, label, random, rlen, dstbuf, dlen ) );
889 else
890#endif
891#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
892#if defined(MBEDTLS_SHA512_C)
893 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
894 hash == MBEDTLS_MD_SHA384 )
895 {
896 return( tls_prf_sha384( secret, slen, label, random, rlen,
897 dstbuf, dlen ) );
898 }
899 else
900#endif
901#if defined(MBEDTLS_SHA256_C)
902 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
903 {
904 return( tls_prf_sha256( secret, slen, label, random, rlen,
905 dstbuf, dlen ) );
906 }
907#endif
908#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
909
910 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
911}
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +0200912
Hanno Beckerfc7429e2019-08-16 10:12:21 +0100913#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2793f742019-08-16 14:28:43 +0100914MBEDTLS_NO_INLINE static void ssl_calc_finished_ssl(
Hanno Beckerfc7429e2019-08-16 10:12:21 +0100915 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
916{
917 const char *sender;
918 mbedtls_md5_context md5;
919 mbedtls_sha1_context sha1;
920
921 unsigned char padbuf[48];
922 unsigned char md5sum[16];
923 unsigned char sha1sum[20];
924
925 mbedtls_ssl_session *session = ssl->session_negotiate;
926 if( !session )
927 session = ssl->session;
928
929 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
930
931 mbedtls_md5_init( &md5 );
932 mbedtls_sha1_init( &sha1 );
933
934 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
935 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
936
937 /*
938 * SSLv3:
939 * hash =
940 * MD5( master + pad2 +
941 * MD5( handshake + sender + master + pad1 ) )
942 * + SHA1( master + pad2 +
943 * SHA1( handshake + sender + master + pad1 ) )
944 */
945
946#if !defined(MBEDTLS_MD5_ALT)
947 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
948 md5.state, sizeof( md5.state ) );
949#endif
950
951#if !defined(MBEDTLS_SHA1_ALT)
952 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
953 sha1.state, sizeof( sha1.state ) );
954#endif
955
956 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT"
957 : "SRVR";
958
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +0200959 mbedtls_platform_memset( padbuf, 0x36, 48 );
Hanno Beckerfc7429e2019-08-16 10:12:21 +0100960
961 mbedtls_md5_update_ret( &md5, (const unsigned char *) sender, 4 );
962 mbedtls_md5_update_ret( &md5, session->master, 48 );
963 mbedtls_md5_update_ret( &md5, padbuf, 48 );
964 mbedtls_md5_finish_ret( &md5, md5sum );
965
966 mbedtls_sha1_update_ret( &sha1, (const unsigned char *) sender, 4 );
967 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
968 mbedtls_sha1_update_ret( &sha1, padbuf, 40 );
969 mbedtls_sha1_finish_ret( &sha1, sha1sum );
970
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +0200971 mbedtls_platform_memset( padbuf, 0x5C, 48 );
Hanno Beckerfc7429e2019-08-16 10:12:21 +0100972
973 mbedtls_md5_starts_ret( &md5 );
974 mbedtls_md5_update_ret( &md5, session->master, 48 );
975 mbedtls_md5_update_ret( &md5, padbuf, 48 );
976 mbedtls_md5_update_ret( &md5, md5sum, 16 );
977 mbedtls_md5_finish_ret( &md5, buf );
978
979 mbedtls_sha1_starts_ret( &sha1 );
980 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
981 mbedtls_sha1_update_ret( &sha1, padbuf , 40 );
982 mbedtls_sha1_update_ret( &sha1, sha1sum, 20 );
983 mbedtls_sha1_finish_ret( &sha1, buf + 16 );
984
985 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 );
986
987 mbedtls_md5_free( &md5 );
988 mbedtls_sha1_free( &sha1 );
989
990 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
991 mbedtls_platform_zeroize( md5sum, sizeof( md5sum ) );
992 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
993
994 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
995}
996#endif /* MBEDTLS_SSL_PROTO_SSL3 */
997
998#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker2793f742019-08-16 14:28:43 +0100999MBEDTLS_NO_INLINE static void ssl_calc_finished_tls(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001000 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1001{
1002 int len = 12;
1003 const char *sender;
1004 mbedtls_md5_context md5;
1005 mbedtls_sha1_context sha1;
1006 unsigned char padbuf[36];
1007
1008 mbedtls_ssl_session *session = ssl->session_negotiate;
1009 if( !session )
1010 session = ssl->session;
1011
1012 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
1013
1014 mbedtls_md5_init( &md5 );
1015 mbedtls_sha1_init( &sha1 );
1016
1017 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1018 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1019
1020 /*
1021 * TLSv1:
1022 * hash = PRF( master, finished_label,
1023 * MD5( handshake ) + SHA1( handshake ) )[0..11]
1024 */
1025
1026#if !defined(MBEDTLS_MD5_ALT)
1027 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
1028 md5.state, sizeof( md5.state ) );
1029#endif
1030
1031#if !defined(MBEDTLS_SHA1_ALT)
1032 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
1033 sha1.state, sizeof( sha1.state ) );
1034#endif
1035
1036 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1037 ? "client finished"
1038 : "server finished";
1039
1040 mbedtls_md5_finish_ret( &md5, padbuf );
1041 mbedtls_sha1_finish_ret( &sha1, padbuf + 16 );
1042
1043 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1044 mbedtls_ssl_suite_get_mac(
1045 mbedtls_ssl_ciphersuite_from_id(
1046 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1047 session->master, 48, sender,
1048 padbuf, 36, buf, len );
1049
1050 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1051
1052 mbedtls_md5_free( &md5 );
1053 mbedtls_sha1_free( &sha1 );
1054
1055 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1056
1057 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1058}
1059#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1060
1061#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1062#if defined(MBEDTLS_SHA256_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001063MBEDTLS_NO_INLINE static void ssl_calc_finished_tls_sha256(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001064 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1065{
1066 int len = 12;
1067 const char *sender;
1068 mbedtls_sha256_context sha256;
1069 unsigned char padbuf[32];
1070
1071 mbedtls_ssl_session *session = ssl->session_negotiate;
1072 if( !session )
1073 session = ssl->session;
1074
1075 mbedtls_sha256_init( &sha256 );
1076
1077 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
1078
1079 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1080
1081 /*
1082 * TLSv1.2:
1083 * hash = PRF( master, finished_label,
1084 * Hash( handshake ) )[0.11]
1085 */
1086
1087#if !defined(MBEDTLS_SHA256_ALT)
1088 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
1089 sha256.state, sizeof( sha256.state ) );
1090#endif
1091
1092 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1093 ? "client finished"
1094 : "server finished";
1095
1096 mbedtls_sha256_finish_ret( &sha256, padbuf );
1097
1098 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1099 mbedtls_ssl_suite_get_mac(
1100 mbedtls_ssl_ciphersuite_from_id(
1101 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1102 session->master, 48, sender,
1103 padbuf, 32, buf, len );
1104
1105 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1106
1107 mbedtls_sha256_free( &sha256 );
1108
1109 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1110
1111 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1112}
1113#endif /* MBEDTLS_SHA256_C */
1114
1115#if defined(MBEDTLS_SHA512_C)
Hanno Becker2793f742019-08-16 14:28:43 +01001116MBEDTLS_NO_INLINE static void ssl_calc_finished_tls_sha384(
Hanno Beckerfc7429e2019-08-16 10:12:21 +01001117 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
1118{
1119 int len = 12;
1120 const char *sender;
1121 mbedtls_sha512_context sha512;
1122 unsigned char padbuf[48];
1123
1124 mbedtls_ssl_session *session = ssl->session_negotiate;
1125 if( !session )
1126 session = ssl->session;
1127
1128 mbedtls_sha512_init( &sha512 );
1129
1130 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
1131
1132 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1133
1134 /*
1135 * TLSv1.2:
1136 * hash = PRF( master, finished_label,
1137 * Hash( handshake ) )[0.11]
1138 */
1139
1140#if !defined(MBEDTLS_SHA512_ALT)
1141 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
1142 sha512.state, sizeof( sha512.state ) );
1143#endif
1144
1145 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
1146 ? "client finished"
1147 : "server finished";
1148
1149 mbedtls_sha512_finish_ret( &sha512, padbuf );
1150
1151 ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1152 mbedtls_ssl_suite_get_mac(
1153 mbedtls_ssl_ciphersuite_from_id(
1154 mbedtls_ssl_session_get_ciphersuite( session ) ) ),
1155 session->master, 48, sender,
1156 padbuf, 48, buf, len );
1157
1158 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1159
1160 mbedtls_sha512_free( &sha512 );
1161
1162 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
1163
1164 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1165}
1166#endif /* MBEDTLS_SHA512_C */
1167#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1168
Hanno Becker2793f742019-08-16 14:28:43 +01001169MBEDTLS_ALWAYS_INLINE static inline int ssl_calc_finished(
1170 int minor_ver,
Hanno Beckerc2fb7592019-08-15 16:31:23 +01001171 mbedtls_md_type_t hash,
1172 mbedtls_ssl_context *ssl,
1173 unsigned char *buf,
1174 int from )
1175{
1176#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1177 (void) hash;
1178#endif
1179
1180#if defined(MBEDTLS_SSL_PROTO_SSL3)
1181 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
1182 ssl_calc_finished_ssl( ssl, buf, from );
1183 else
1184#endif
1185#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001186 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Beckerc2fb7592019-08-15 16:31:23 +01001187 ssl_calc_finished_tls( ssl, buf, from );
1188 else
1189#endif
1190#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1191#if defined(MBEDTLS_SHA512_C)
1192 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1193 hash == MBEDTLS_MD_SHA384 )
1194 {
1195 ssl_calc_finished_tls_sha384( ssl, buf, from );
1196 }
1197 else
1198#endif
1199#if defined(MBEDTLS_SHA256_C)
1200 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1201 ssl_calc_finished_tls_sha256( ssl, buf, from );
1202 else
1203#endif
1204#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1205 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1206
1207 return( 0 );
1208}
1209
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001210/*
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02001211 * Populate a transform structure with session keys and all the other
1212 * necessary information.
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001213 *
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02001214 * Parameters:
1215 * - [in/out]: transform: structure to populate
1216 * [in] must be just initialised with mbedtls_ssl_transform_init()
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001217 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001218 * - [in] ciphersuite
1219 * - [in] master
1220 * - [in] encrypt_then_mac
1221 * - [in] trunc_hmac
1222 * - [in] compression
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001223 * - [in] tls_prf: pointer to PRF to use for key derivation
1224 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001225 * - [in] minor_ver: SSL/TLS minor version
1226 * - [in] endpoint: client or server
1227 * - [in] ssl: optionally used for:
1228 * - MBEDTLS_SSL_HW_RECORD_ACCEL: whole context
1229 * - MBEDTLS_SSL_EXPORT_KEYS: ssl->conf->{f,p}_export_keys
1230 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001231 */
Hanno Becker298a4702019-08-16 10:21:32 +01001232/* Force compilers to inline this function if it's used only
1233 * from one place, because at least ARMC5 doesn't do that
1234 * automatically. */
1235#if !defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
1236MBEDTLS_ALWAYS_INLINE static inline
1237#else
1238static
1239#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
1240int ssl_populate_transform( mbedtls_ssl_transform *transform,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001241 int ciphersuite,
1242 const unsigned char master[48],
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001243#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001244#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1245 int encrypt_then_mac,
1246#endif
1247#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1248 int trunc_hmac,
1249#endif
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001250#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001251#if defined(MBEDTLS_ZLIB_SUPPORT)
1252 int compression,
1253#endif
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001254 const unsigned char randbytes[64],
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001255 int minor_ver,
1256 unsigned endpoint,
Manuel Pégourié-Gonnard13bebd02020-03-13 11:28:19 +01001257#if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1258 const
1259#endif
1260 mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001261{
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001262 int ret = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001263 unsigned char keyblk[256];
1264 unsigned char *key1;
1265 unsigned char *key2;
Paul Bakker68884e32013-01-07 18:20:04 +01001266 unsigned char *mac_enc;
1267 unsigned char *mac_dec;
Hanno Becker81c7b182017-11-09 18:39:33 +00001268 size_t mac_key_len;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001269 size_t iv_copy_len;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001270 unsigned keylen;
Hanno Becker473f98f2019-06-26 10:27:32 +01001271 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001272 const mbedtls_cipher_info_t *cipher_info;
Hanno Beckera5cedbc2019-07-17 11:21:02 +01001273 mbedtls_md_handle_t md_info;
Paul Bakker68884e32013-01-07 18:20:04 +01001274
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001275#if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL) && \
1276 !defined(MBEDTLS_SSL_EXPORT_KEYS) && \
1277 !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02001278 ssl = NULL; /* make sure we don't use it except for those cases */
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001279 (void) ssl;
Hanno Becker3307b532017-12-27 21:37:21 +00001280#endif
Hanno Becker3307b532017-12-27 21:37:21 +00001281
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001282 /*
1283 * Some data just needs copying into the structure
1284 */
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001285#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
1286 defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001287 transform->encrypt_then_mac = encrypt_then_mac;
Paul Bakker5121ce52009-01-03 21:22:43 +00001288#endif
Hanno Becker0a92b812019-06-24 15:46:40 +01001289
1290#if !defined(MBEDTLS_SSL_CONF_FIXED_MINOR_VER)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001291 transform->minor_ver = minor_ver;
Hanno Becker0a92b812019-06-24 15:46:40 +01001292#else
1293 ((void) minor_ver);
1294#endif /* !MBEDTLS_SSL_CONF_FIXED_MINOR_VER */
Paul Bakker5121ce52009-01-03 21:22:43 +00001295
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001296#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Teppo Järvelin91d79382019-10-02 09:09:31 +03001297 mbedtls_platform_memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) );
Manuel Pégourié-Gonnarda3024ee2019-07-09 12:54:17 +02001298#endif
1299
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001300 /*
1301 * Get various info structures
1302 */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001303 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
Hanno Becker473f98f2019-06-26 10:27:32 +01001304 if( ciphersuite_info == MBEDTLS_SSL_CIPHERSUITE_INVALID_HANDLE )
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001305 {
1306 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found",
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001307 ciphersuite ) );
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001308 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1309 }
1310
Hanno Becker473f98f2019-06-26 10:27:32 +01001311 cipher_info = mbedtls_cipher_info_from_type(
1312 mbedtls_ssl_suite_get_cipher( ciphersuite_info ) );
Paul Bakker68884e32013-01-07 18:20:04 +01001313 if( cipher_info == NULL )
1314 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001315 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %d not found",
Hanno Becker473f98f2019-06-26 10:27:32 +01001316 mbedtls_ssl_suite_get_cipher( ciphersuite_info ) ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001317 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +01001318 }
1319
Hanno Becker473f98f2019-06-26 10:27:32 +01001320 md_info = mbedtls_md_info_from_type(
1321 mbedtls_ssl_suite_get_mac( ciphersuite_info ) );
Hanno Beckera5cedbc2019-07-17 11:21:02 +01001322 if( md_info == MBEDTLS_MD_INVALID_HANDLE )
Paul Bakker68884e32013-01-07 18:20:04 +01001323 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001324 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %d not found",
Hanno Becker473f98f2019-06-26 10:27:32 +01001325 mbedtls_ssl_suite_get_mac( ciphersuite_info ) ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001326 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +01001327 }
1328
Hanno Beckera5a2b082019-05-15 14:03:01 +01001329#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001330 /* Copy own and peer's CID if the use of the CID
1331 * extension has been negotiated. */
1332 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
1333 {
1334 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
Hanno Beckerd91dc372019-04-30 13:52:29 +01001335
Hanno Becker4932f9f2019-05-03 15:23:51 +01001336 transform->in_cid_len = ssl->own_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03001337 /* Not using more secure mbedtls_platform_memcpy as cid is public */
1338 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
Hanno Becker8013b272019-05-03 12:55:51 +01001339 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001340 transform->in_cid_len );
Hanno Beckere582d122019-05-15 10:21:55 +01001341
1342 transform->out_cid_len = ssl->handshake->peer_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03001343 /* Not using more secure mbedtls_platform_memcpy as cid is public */
1344 memcpy( transform->out_cid, ssl->handshake->peer_cid,
Hanno Beckere582d122019-05-15 10:21:55 +01001345 ssl->handshake->peer_cid_len );
1346 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
1347 transform->out_cid_len );
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001348 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01001349#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerdd0afca2019-04-26 16:22:27 +01001350
Paul Bakker5121ce52009-01-03 21:22:43 +00001351 /*
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001352 * Compute key block using the PRF
Paul Bakker1ef83d62012-04-11 12:09:53 +00001353 */
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001354 ret = ssl_prf( minor_ver,
1355 mbedtls_ssl_suite_get_mac( ciphersuite_info ),
1356 master, 48, "key expansion", randbytes, 64,
1357 keyblk, 256 );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +01001358 if( ret != 0 )
1359 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001360 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +01001361 return( ret );
1362 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001363
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001364 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
Manuel Pégourié-Gonnard762d0112019-05-20 10:27:20 +02001365 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) );
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001366 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 );
Manuel Pégourié-Gonnard0bcfbc32019-05-06 13:32:17 +02001367 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001368 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001369
Paul Bakker5121ce52009-01-03 21:22:43 +00001370 /*
1371 * Determine the appropriate key, IV and MAC length.
1372 */
Paul Bakker68884e32013-01-07 18:20:04 +01001373
Hanno Beckere7f2df02017-12-27 08:17:40 +00001374 keylen = cipher_info->key_bitlen / 8;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001375
Hanno Beckerf1229442018-01-03 15:32:31 +00001376#if defined(MBEDTLS_GCM_C) || \
1377 defined(MBEDTLS_CCM_C) || \
1378 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001379 if( cipher_info->mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001380 cipher_info->mode == MBEDTLS_MODE_CCM ||
1381 cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakker5121ce52009-01-03 21:22:43 +00001382 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001383 transform->maclen = 0;
Hanno Becker81c7b182017-11-09 18:39:33 +00001384 mac_key_len = 0;
Hanno Becker473f98f2019-06-26 10:27:32 +01001385 transform->taglen = mbedtls_ssl_suite_get_flags( ciphersuite_info ) &
1386 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001387
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001388 /* All modes haves 96-bit IVs;
1389 * GCM and CCM has 4 implicit and 8 explicit bytes
1390 * ChachaPoly has all 12 bytes implicit
1391 */
Paul Bakker68884e32013-01-07 18:20:04 +01001392 transform->ivlen = 12;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001393 if( cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
1394 transform->fixed_ivlen = 12;
1395 else
1396 transform->fixed_ivlen = 4;
Paul Bakker68884e32013-01-07 18:20:04 +01001397 }
1398 else
Hanno Beckerf1229442018-01-03 15:32:31 +00001399#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
1400#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
1401 if( cipher_info->mode == MBEDTLS_MODE_STREAM ||
1402 cipher_info->mode == MBEDTLS_MODE_CBC )
Paul Bakker68884e32013-01-07 18:20:04 +01001403 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001404 /* Initialize HMAC contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001405 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
1406 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
Paul Bakker68884e32013-01-07 18:20:04 +01001407 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001408 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001409 return( ret );
Paul Bakker68884e32013-01-07 18:20:04 +01001410 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001411
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001412 /* Get MAC length */
Hanno Becker81c7b182017-11-09 18:39:33 +00001413 mac_key_len = mbedtls_md_get_size( md_info );
1414 transform->maclen = mac_key_len;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001415
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001416#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001417 /*
1418 * If HMAC is to be truncated, we shall keep the leftmost bytes,
1419 * (rfc 6066 page 13 or rfc 2104 section 4),
1420 * so we only need to adjust the length here.
1421 */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001422 if( trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Hanno Beckere89353a2017-11-20 16:36:41 +00001423 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001424 transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN;
Hanno Beckere89353a2017-11-20 16:36:41 +00001425
1426#if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT)
1427 /* Fall back to old, non-compliant version of the truncated
Hanno Becker563423f2017-11-21 17:20:17 +00001428 * HMAC implementation which also truncates the key
1429 * (Mbed TLS versions from 1.3 to 2.6.0) */
Hanno Beckere89353a2017-11-20 16:36:41 +00001430 mac_key_len = transform->maclen;
1431#endif
1432 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001433#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +02001434
1435 /* IV length */
Paul Bakker68884e32013-01-07 18:20:04 +01001436 transform->ivlen = cipher_info->iv_size;
Paul Bakker5121ce52009-01-03 21:22:43 +00001437 }
Hanno Beckerf1229442018-01-03 15:32:31 +00001438 else
1439#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
1440 {
1441 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1442 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1443 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001444
Hanno Beckera9d5c452019-07-25 16:47:12 +01001445 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, ivlen: %u, maclen: %u",
Hanno Beckere7f2df02017-12-27 08:17:40 +00001446 (unsigned) keylen,
Hanno Beckere7f2df02017-12-27 08:17:40 +00001447 (unsigned) transform->ivlen,
1448 (unsigned) transform->maclen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001449
1450 /*
1451 * Finally setup the cipher contexts, IVs and MAC secrets.
1452 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001453#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001454 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00001455 {
Hanno Becker81c7b182017-11-09 18:39:33 +00001456 key1 = keyblk + mac_key_len * 2;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001457 key2 = keyblk + mac_key_len * 2 + keylen;
Paul Bakker5121ce52009-01-03 21:22:43 +00001458
Paul Bakker68884e32013-01-07 18:20:04 +01001459 mac_enc = keyblk;
Hanno Becker81c7b182017-11-09 18:39:33 +00001460 mac_dec = keyblk + mac_key_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00001461
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001462 /*
1463 * This is not used in TLS v1.1.
1464 */
Paul Bakker48916f92012-09-16 19:57:18 +00001465 iv_copy_len = ( transform->fixed_ivlen ) ?
1466 transform->fixed_ivlen : transform->ivlen;
Teppo Järvelin91d79382019-10-02 09:09:31 +03001467 mbedtls_platform_memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
1468 mbedtls_platform_memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001469 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001470 }
1471 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001472#endif /* MBEDTLS_SSL_CLI_C */
1473#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001474 if( endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00001475 {
Hanno Beckere7f2df02017-12-27 08:17:40 +00001476 key1 = keyblk + mac_key_len * 2 + keylen;
Hanno Becker81c7b182017-11-09 18:39:33 +00001477 key2 = keyblk + mac_key_len * 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00001478
Hanno Becker81c7b182017-11-09 18:39:33 +00001479 mac_enc = keyblk + mac_key_len;
Paul Bakker68884e32013-01-07 18:20:04 +01001480 mac_dec = keyblk;
Paul Bakker5121ce52009-01-03 21:22:43 +00001481
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001482 /*
1483 * This is not used in TLS v1.1.
1484 */
Paul Bakker48916f92012-09-16 19:57:18 +00001485 iv_copy_len = ( transform->fixed_ivlen ) ?
1486 transform->fixed_ivlen : transform->ivlen;
Teppo Järvelin91d79382019-10-02 09:09:31 +03001487 mbedtls_platform_memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
1488 mbedtls_platform_memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001489 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001490 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001491 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001492#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001493 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001494 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1495 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001496 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001497
Hanno Becker92231322018-01-03 15:32:51 +00001498#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001499#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnard1d10a982019-05-06 13:48:22 +02001500 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker68884e32013-01-07 18:20:04 +01001501 {
Hanno Becker92231322018-01-03 15:32:51 +00001502 if( mac_key_len > sizeof( transform->mac_enc ) )
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001503 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001504 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1505 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001506 }
1507
Teppo Järvelin91d79382019-10-02 09:09:31 +03001508 mbedtls_platform_memcpy( transform->mac_enc, mac_enc, mac_key_len );
1509 mbedtls_platform_memcpy( transform->mac_dec, mac_dec, mac_key_len );
Paul Bakker68884e32013-01-07 18:20:04 +01001510 }
1511 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001512#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1513#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1514 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001515 if( mbedtls_ssl_ver_geq( minor_ver, MBEDTLS_SSL_MINOR_VERSION_1 ) )
Paul Bakker68884e32013-01-07 18:20:04 +01001516 {
Gilles Peskine039fd122018-03-19 19:06:08 +01001517 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
1518 For AEAD-based ciphersuites, there is nothing to do here. */
1519 if( mac_key_len != 0 )
1520 {
1521 mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
1522 mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
1523 }
Paul Bakker68884e32013-01-07 18:20:04 +01001524 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001525 else
1526#endif
Paul Bakker577e0062013-08-28 11:57:20 +02001527 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001528 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1529 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02001530 }
Hanno Becker92231322018-01-03 15:32:51 +00001531#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Paul Bakker68884e32013-01-07 18:20:04 +01001532
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001533#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1534 if( mbedtls_ssl_hw_record_init != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00001535 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001536 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00001537
Hanno Beckere7f2df02017-12-27 08:17:40 +00001538 if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, keylen,
Paul Bakker07eb38b2012-12-19 14:42:06 +01001539 transform->iv_enc, transform->iv_dec,
1540 iv_copy_len,
Paul Bakker68884e32013-01-07 18:20:04 +01001541 mac_enc, mac_dec,
Hanno Becker81c7b182017-11-09 18:39:33 +00001542 mac_key_len ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00001543 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001544 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret );
1545 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00001546 }
1547 }
Hanno Becker92231322018-01-03 15:32:51 +00001548#else
1549 ((void) mac_dec);
1550 ((void) mac_enc);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001551#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00001552
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001553#if defined(MBEDTLS_SSL_EXPORT_KEYS)
1554 if( ssl->conf->f_export_keys != NULL )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001555 {
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001556 ssl->conf->f_export_keys( ssl->conf->p_export_keys,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001557 master, keyblk,
Hanno Beckere7f2df02017-12-27 08:17:40 +00001558 mac_key_len, keylen,
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001559 iv_copy_len );
1560 }
1561#endif
1562
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001563 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001564 cipher_info ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001565 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001566 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001567 return( ret );
1568 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001569
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001570 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001571 cipher_info ) ) != 0 )
1572 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001573 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001574 return( ret );
1575 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001576
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001577 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001578 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001579 MBEDTLS_ENCRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001580 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001581 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001582 return( ret );
1583 }
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001584
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001585 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001586 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001587 MBEDTLS_DECRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001588 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001589 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001590 return( ret );
1591 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001592
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001593#if defined(MBEDTLS_CIPHER_MODE_CBC)
1594 if( cipher_info->mode == MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001595 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001596 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1597 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001598 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001599 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001600 return( ret );
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001601 }
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001602
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001603 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1604 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001605 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001606 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001607 return( ret );
1608 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001609 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001610#endif /* MBEDTLS_CIPHER_MODE_CBC */
Paul Bakker5121ce52009-01-03 21:22:43 +00001611
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001612 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001613
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02001614 /* Initialize Zlib contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001615#if defined(MBEDTLS_ZLIB_SUPPORT)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001616 if( compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001617 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001618 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001619
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001620 mbedtls_platform_memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) );
1621 mbedtls_platform_memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001622
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001623 if( deflateInit( &transform->ctx_deflate,
1624 Z_DEFAULT_COMPRESSION ) != Z_OK ||
Paul Bakker48916f92012-09-16 19:57:18 +00001625 inflateInit( &transform->ctx_inflate ) != Z_OK )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001626 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001627 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
1628 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001629 }
1630 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001631#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00001632
Paul Bakker5121ce52009-01-03 21:22:43 +00001633 return( 0 );
1634}
1635
Hanno Beckercf87c5e2019-08-16 10:11:21 +01001636#if defined(MBEDTLS_SSL_PROTO_SSL3)
1637static inline void ssl_calc_verify_ssl( const mbedtls_ssl_context *ssl,
1638 unsigned char hash[36],
1639 size_t *hlen )
1640{
1641 mbedtls_md5_context md5;
1642 mbedtls_sha1_context sha1;
1643 unsigned char pad_1[48];
1644 unsigned char pad_2[48];
1645
1646 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
1647
1648 mbedtls_md5_init( &md5 );
1649 mbedtls_sha1_init( &sha1 );
1650
1651 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1652 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1653
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02001654 mbedtls_platform_memset( pad_1, 0x36, 48 );
1655 mbedtls_platform_memset( pad_2, 0x5C, 48 );
Hanno Beckercf87c5e2019-08-16 10:11:21 +01001656
1657 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1658 mbedtls_md5_update_ret( &md5, pad_1, 48 );
1659 mbedtls_md5_finish_ret( &md5, hash );
1660
1661 mbedtls_md5_starts_ret( &md5 );
1662 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1663 mbedtls_md5_update_ret( &md5, pad_2, 48 );
1664 mbedtls_md5_update_ret( &md5, hash, 16 );
1665 mbedtls_md5_finish_ret( &md5, hash );
1666
1667 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1668 mbedtls_sha1_update_ret( &sha1, pad_1, 40 );
1669 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1670
1671 mbedtls_sha1_starts_ret( &sha1 );
1672 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1673 mbedtls_sha1_update_ret( &sha1, pad_2, 40 );
1674 mbedtls_sha1_update_ret( &sha1, hash + 16, 20 );
1675 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1676
1677 *hlen = 36;
1678
1679 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1680 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1681
1682 mbedtls_md5_free( &md5 );
1683 mbedtls_sha1_free( &sha1 );
1684
1685 return;
1686}
1687#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1688
1689#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
1690static inline void ssl_calc_verify_tls( const mbedtls_ssl_context *ssl,
1691 unsigned char hash[36],
1692 size_t *hlen )
1693{
1694 mbedtls_md5_context md5;
1695 mbedtls_sha1_context sha1;
1696
1697 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
1698
1699 mbedtls_md5_init( &md5 );
1700 mbedtls_sha1_init( &sha1 );
1701
1702 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1703 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
1704
1705 mbedtls_md5_finish_ret( &md5, hash );
1706 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
1707
1708 *hlen = 36;
1709
1710 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1711 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1712
1713 mbedtls_md5_free( &md5 );
1714 mbedtls_sha1_free( &sha1 );
1715
1716 return;
1717}
1718#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1719
1720#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1721#if defined(MBEDTLS_SHA256_C)
1722static inline void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
1723 unsigned char hash[32],
1724 size_t *hlen )
1725{
1726 mbedtls_sha256_context sha256;
1727
1728 mbedtls_sha256_init( &sha256 );
1729
1730 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
1731
1732 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
1733 mbedtls_sha256_finish_ret( &sha256, hash );
1734
1735 *hlen = 32;
1736
1737 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1738 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1739
1740 mbedtls_sha256_free( &sha256 );
1741
1742 return;
1743}
1744#endif /* MBEDTLS_SHA256_C */
1745
1746#if defined(MBEDTLS_SHA512_C)
1747static inline void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
1748 unsigned char hash[48],
1749 size_t *hlen )
1750{
1751 mbedtls_sha512_context sha512;
1752
1753 mbedtls_sha512_init( &sha512 );
1754
1755 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
1756
1757 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
1758 mbedtls_sha512_finish_ret( &sha512, hash );
1759
1760 *hlen = 48;
1761
1762 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen );
1763 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1764
1765 mbedtls_sha512_free( &sha512 );
1766
1767 return;
1768}
1769#endif /* MBEDTLS_SHA512_C */
1770#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1771
Hanno Becker2f41b242019-08-15 17:29:43 +01001772int mbedtls_ssl_calc_verify( int minor_ver,
1773 mbedtls_md_type_t hash,
1774 mbedtls_ssl_context const *ssl,
1775 unsigned char *dst,
1776 size_t *hlen )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001777{
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001778#if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || !defined(MBEDTLS_SHA512_C)
1779 (void) hash;
1780#endif
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001781
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001782#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001783 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Becker2f41b242019-08-15 17:29:43 +01001784 ssl_calc_verify_ssl( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001785 else
1786#endif
1787#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01001788 if( mbedtls_ssl_ver_lt( minor_ver, MBEDTLS_SSL_MINOR_VERSION_3 ) )
Hanno Becker2f41b242019-08-15 17:29:43 +01001789 ssl_calc_verify_tls( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001790 else
1791#endif
1792#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1793#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001794 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
1795 hash == MBEDTLS_MD_SHA384 )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001796 {
Hanno Becker2f41b242019-08-15 17:29:43 +01001797 ssl_calc_verify_tls_sha384( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001798 }
1799 else
1800#endif
1801#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnardaa3c7012019-04-30 12:08:59 +02001802 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001803 {
Hanno Becker2f41b242019-08-15 17:29:43 +01001804 ssl_calc_verify_tls_sha256( ssl, dst, hlen );
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001805 }
1806 else
1807#endif
1808#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1809 {
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001810 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1811 }
1812
1813 return( 0 );
1814}
1815
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001816/*
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001817 * Compute master secret if needed
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001818 *
1819 * Parameters:
1820 * [in/out] handshake
1821 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
1822 * [out] premaster (cleared)
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001823 * [out] master
1824 * [in] ssl: optionally used for debugging and calc_verify
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001825 */
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001826static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake,
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001827 unsigned char *master,
Manuel Pégourié-Gonnarded3b7a92019-05-03 09:58:33 +02001828 const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001829{
1830 int ret;
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001831
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001832/* #if !defined(MBEDTLS_DEBUG_C) && !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) */
1833/* ssl = NULL; /\* make sure we don't use it except for debug and EMS *\/ */
1834/* (void) ssl; */
1835/* #endif */
1836
1837 mbedtls_ssl_ciphersuite_handle_t const ciphersuite =
1838 mbedtls_ssl_handshake_get_ciphersuite( handshake );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001839
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03001840#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02001841 if( handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001842 {
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001843 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
1844 return( 0 );
1845 }
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03001846#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001847
1848 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret", handshake->premaster,
1849 handshake->pmslen );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001850
1851#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckera49ec562019-06-11 14:47:55 +01001852 if( mbedtls_ssl_hs_get_extended_ms( handshake )
1853 == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001854 {
1855 unsigned char session_hash[48];
1856 size_t hash_len;
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001857
Hanno Becker2f41b242019-08-15 17:29:43 +01001858 mbedtls_ssl_calc_verify(
1859 mbedtls_ssl_get_minor_ver( ssl ),
1860 mbedtls_ssl_suite_get_mac( ciphersuite ),
1861 ssl, session_hash, &hash_len );
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001862
Manuel Pégourié-Gonnard9c5bcc92019-05-20 12:09:50 +02001863 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret",
1864 session_hash, hash_len );
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001865
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001866 ret = ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1867 mbedtls_ssl_suite_get_mac( ciphersuite ),
1868 handshake->premaster, handshake->pmslen,
1869 "extended master secret",
1870 session_hash, hash_len,
1871 master, 48 );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001872 }
1873 else
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001874#endif
Manuel Pégourié-Gonnardbcf258e2019-05-03 11:46:27 +02001875 {
Hanno Becker39c7f7e2019-08-15 16:17:34 +01001876 ret = ssl_prf( mbedtls_ssl_get_minor_ver( ssl ),
1877 mbedtls_ssl_suite_get_mac( ciphersuite ),
1878 handshake->premaster, handshake->pmslen,
1879 "master secret",
1880 handshake->randbytes, 64,
1881 master, 48 );
Manuel Pégourié-Gonnardbcf258e2019-05-03 11:46:27 +02001882 }
Manuel Pégourié-Gonnarddafe5222019-05-03 09:16:16 +02001883 if( ret != 0 )
1884 {
1885 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
1886 return( ret );
1887 }
1888
1889 mbedtls_platform_zeroize( handshake->premaster,
1890 sizeof(handshake->premaster) );
Andrzej Kurekafec8852020-07-15 16:31:27 -04001891 return( 0 );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001892}
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001893
Manuel Pégourié-Gonnard5ed5e902019-04-30 11:41:40 +02001894int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
1895{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04001896 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Manuel Pégourié-Gonnard52aa5202019-04-30 11:54:22 +02001897
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02001898 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
Jarno Lamsa4031a452019-12-19 08:11:12 +02001899 ssl->handshake->key_derivation_done = MBEDTLS_SSL_FI_FLAG_UNSET;
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02001900 /* Compute master secret if needed */
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001901 ret = ssl_compute_master( ssl->handshake,
Manuel Pégourié-Gonnardc28c8892019-05-03 09:46:14 +02001902 ssl->session_negotiate->master,
1903 ssl );
Manuel Pégourié-Gonnard7edd5872019-05-03 09:05:41 +02001904 if( ret != 0 )
1905 {
1906 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret );
1907 return( ret );
1908 }
1909
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02001910 /* Swap the client and server random values:
1911 * - MS derivation wanted client+server (RFC 5246 8.1)
1912 * - key derivation wants server+client (RFC 5246 6.3) */
1913 {
1914 unsigned char tmp[64];
Teppo Järvelin91d79382019-10-02 09:09:31 +03001915 mbedtls_platform_memcpy( tmp, ssl->handshake->randbytes, 64 );
1916 mbedtls_platform_memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
1917 mbedtls_platform_memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02001918 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
1919 }
1920
1921 /* Populate transform structure */
Manuel Pégourié-Gonnard12a3f442019-05-06 12:55:40 +02001922 ret = ssl_populate_transform( ssl->transform_negotiate,
Hanno Beckere02758c2019-06-26 15:31:31 +01001923 mbedtls_ssl_session_get_ciphersuite( ssl->session_negotiate ),
1924 ssl->session_negotiate->master,
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001925#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001926#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Beckere02758c2019-06-26 15:31:31 +01001927 ssl->session_negotiate->encrypt_then_mac,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001928#endif
1929#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Hanno Beckere02758c2019-06-26 15:31:31 +01001930 ssl->session_negotiate->trunc_hmac,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001931#endif
Jaeden Amero2eaf2c72019-06-05 13:32:08 +01001932#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001933#if defined(MBEDTLS_ZLIB_SUPPORT)
Hanno Beckere02758c2019-06-26 15:31:31 +01001934 ssl->session_negotiate->compression,
Manuel Pégourié-Gonnard84ef8bd2019-05-10 10:50:04 +02001935#endif
Hanno Beckere02758c2019-06-26 15:31:31 +01001936 ssl->handshake->randbytes,
Hanno Becker2881d802019-05-22 14:44:53 +01001937 mbedtls_ssl_get_minor_ver( ssl ),
Hanno Beckere02758c2019-06-26 15:31:31 +01001938 mbedtls_ssl_conf_get_endpoint( ssl->conf ),
1939 ssl );
Jarno Lamsa4031a452019-12-19 08:11:12 +02001940 if( ret == 0 )
1941 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02001942 mbedtls_platform_random_delay();
Jarno Lamsa4031a452019-12-19 08:11:12 +02001943 if( ret == 0 )
1944 {
1945 ssl->handshake->key_derivation_done = MBEDTLS_SSL_FI_FLAG_SET;
1946 }
1947 else
1948 {
1949 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
1950 }
1951 }
1952 else
Manuel Pégourié-Gonnard707728d2019-05-06 12:05:58 +02001953 {
1954 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_populate_transform", ret );
1955 return( ret );
1956 }
1957
1958 /* We no longer need Server/ClientHello.random values */
1959 mbedtls_platform_zeroize( ssl->handshake->randbytes,
1960 sizeof( ssl->handshake->randbytes ) );
1961
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02001962 /* Allocate compression buffer */
1963#if defined(MBEDTLS_ZLIB_SUPPORT)
jiblime92af9a92019-12-18 21:40:01 -08001964 if( ssl->session_negotiate->compression == MBEDTLS_SSL_COMPRESS_DEFLATE &&
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02001965 ssl->compress_buf == NULL )
1966 {
1967 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
1968 ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
1969 if( ssl->compress_buf == NULL )
1970 {
1971 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
Manuel Pégourié-Gonnard762d0112019-05-20 10:27:20 +02001972 MBEDTLS_SSL_COMPRESS_BUFFER_LEN ) );
Manuel Pégourié-Gonnarda1abb262019-05-06 12:44:24 +02001973 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1974 }
1975 }
1976#endif
1977
Paul Bakker5121ce52009-01-03 21:22:43 +00001978 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
1979
1980 return( 0 );
1981}
1982
Hanno Becker09d23642019-07-22 17:18:18 +01001983int mbedtls_ssl_build_pms( mbedtls_ssl_context *ssl )
1984{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04001985 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker09d23642019-07-22 17:18:18 +01001986
1987 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
1988 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Beckera3c2c172019-07-23 16:51:57 +01001989#if defined(MBEDTLS_USE_TINYCRYPT)
1990 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
Hanno Beckerecf5d3f2019-09-01 07:47:29 +01001991 == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
Hanno Beckera3c2c172019-07-23 16:51:57 +01001992 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
Hanno Beckerecf5d3f2019-09-01 07:47:29 +01001993 == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
1994 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
1995 == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
1996 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
1997 == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Hanno Beckera3c2c172019-07-23 16:51:57 +01001998 {
Manuel Pégourié-Gonnard9d6a5352019-11-25 13:06:05 +01001999 ret = uECC_shared_secret( ssl->handshake->ecdh_peerkey,
2000 ssl->handshake->ecdh_privkey,
2001 ssl->handshake->premaster );
2002 if( ret == UECC_FAULT_DETECTED )
2003 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2004 if( ret != UECC_SUCCESS )
Hanno Beckera3c2c172019-07-23 16:51:57 +01002005 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002006 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
Hanno Beckera3c2c172019-07-23 16:51:57 +01002007
2008 ssl->handshake->pmslen = NUM_ECC_BYTES;
2009 }
2010 else
2011#endif
Hanno Becker09d23642019-07-22 17:18:18 +01002012#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
2013 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2014 == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
2015 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002016 ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Hanno Becker09d23642019-07-22 17:18:18 +01002017 ssl->handshake->premaster,
2018 MBEDTLS_PREMASTER_SIZE,
2019 &ssl->handshake->pmslen,
2020 mbedtls_ssl_conf_get_frng( ssl->conf ),
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002021 mbedtls_ssl_conf_get_prng( ssl->conf ) );
2022 if( ret == 0 )
2023 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002024 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002025 if( ret == 0 )
2026 {
2027 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2028 }
2029 else
2030 {
Piotr Nowickie048b912020-06-05 17:59:28 +02002031 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret",
2032 MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2033 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002034 }
2035 }
2036 else
Hanno Becker09d23642019-07-22 17:18:18 +01002037 {
2038 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
2039 return( ret );
2040 }
2041
2042 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
2043 }
2044 else
2045#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
Hanno Becker29d16552019-07-24 11:11:45 +01002046#if defined(MBEDTLS_ECDH_C) && \
2047 ( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2048 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2049 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2050 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) )
Hanno Becker09d23642019-07-22 17:18:18 +01002051 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2052 == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
2053 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2054 == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
2055 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2056 == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2057 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2058 == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
2059 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002060 ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Hanno Becker09d23642019-07-22 17:18:18 +01002061 &ssl->handshake->pmslen,
2062 ssl->handshake->premaster,
2063 MBEDTLS_MPI_MAX_SIZE,
2064 mbedtls_ssl_conf_get_frng( ssl->conf ),
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002065 mbedtls_ssl_conf_get_prng( ssl->conf ) );
2066 if( ret == 0 )
2067 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002068 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002069 if( ret == 0 )
2070 {
2071 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2072 }
2073 else
2074 {
2075 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002076 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002077 }
2078 }
2079 else
Hanno Becker09d23642019-07-22 17:18:18 +01002080 {
2081 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
2082 return( ret );
2083 }
2084
2085 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z );
2086 }
2087 else
2088#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2089 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2090 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
2091 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2092#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2093 if( mbedtls_ssl_ciphersuite_uses_psk( ciphersuite_info ) )
2094 {
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002095 ret = mbedtls_ssl_psk_derive_premaster( ssl,
2096 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) );
2097 if( ret == 0 )
2098 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002099 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002100 if( ret == 0 )
2101 {
2102 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2103 }
2104 else
2105 {
2106 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002107 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002108 }
2109 }
2110 else
Hanno Becker09d23642019-07-22 17:18:18 +01002111 {
2112 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
2113 return( ret );
2114 }
2115 }
2116 else
2117#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
2118#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2119 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
2120 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2121 {
2122 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
2123 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
2124 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002125 mbedtls_ssl_conf_get_prng( ssl->conf ) );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002126 if( ret == 0 )
2127 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02002128 mbedtls_platform_random_delay();
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002129 if( ret == 0 )
2130 {
2131 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2132 }
2133 else
2134 {
2135 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
Jarno Lamsa5aa4c072019-12-20 12:42:49 +02002136 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002137 }
2138 }
2139 else
Hanno Becker09d23642019-07-22 17:18:18 +01002140 {
2141 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
2142 return( ret );
2143 }
2144 }
2145 else
2146#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2147#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
2148 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
2149 == MBEDTLS_KEY_EXCHANGE_RSA )
2150 {
2151 ((void) ret);
Manuel Pégourié-Gonnard8793fab2019-08-01 10:44:07 +02002152 /* The premaster secret has already been set by
Hanno Becker09d23642019-07-22 17:18:18 +01002153 * ssl_rsa_generate_partial_pms(). Only the
2154 * PMS length needs to be set. */
2155 ssl->handshake->pmslen = 48;
2156 }
2157 else
2158#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2159 {
2160 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2161 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2162 }
2163
2164 return( 0 );
2165}
2166
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002167#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2168int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002169{
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002170 unsigned char *p = ssl->handshake->premaster;
2171 unsigned char *end = p + sizeof( ssl->handshake->premaster );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002172 const unsigned char *psk = ssl->conf->psk;
2173 size_t psk_len = ssl->conf->psk_len;
2174
2175 /* If the psk callback was called, use its result */
2176 if( ssl->handshake->psk != NULL )
2177 {
2178 psk = ssl->handshake->psk;
2179 psk_len = ssl->handshake->psk_len;
2180 }
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002181
2182 /*
2183 * PMS = struct {
2184 * opaque other_secret<0..2^16-1>;
2185 * opaque psk<0..2^16-1>;
2186 * };
2187 * with "other_secret" depending on the particular key exchange
2188 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002189#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
2190 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002191 {
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002192 if( end - p < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002193 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002194
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002195 p = mbedtls_platform_put_uint16_be( p, psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002196
2197 if( end < p || (size_t)( end - p ) < psk_len )
2198 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2199
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002200 mbedtls_platform_memset( p, 0, psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002201 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002202 }
2203 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002204#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
2205#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2206 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002207 {
2208 /*
2209 * other_secret already set by the ClientKeyExchange message,
2210 * and is 48 bytes long
2211 */
Philippe Antoine747fd532018-05-30 09:13:21 +02002212 if( end - p < 2 )
2213 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2214
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002215 *p++ = 0;
2216 *p++ = 48;
2217 p += 48;
2218 }
2219 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002220#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
2221#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
2222 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002223 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002224 int ret;
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01002225 size_t len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002226
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02002227 /* Write length only when we know the actual value */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002228 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01002229 p + 2, end - ( p + 2 ), &len,
Hanno Beckerece325c2019-06-13 15:39:27 +01002230 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002231 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002232 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002233 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002234 return( ret );
2235 }
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002236 p = mbedtls_platform_put_uint16_be( p, len );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002237 p += len;
2238
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002239 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002240 }
2241 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002242#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
2243#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2244 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002245 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002246 int ret;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002247 size_t zlen;
2248
Hanno Becker982da7e2019-09-02 09:47:39 +01002249#if defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard9d6a5352019-11-25 13:06:05 +01002250 ret = uECC_shared_secret( ssl->handshake->ecdh_peerkey,
2251 ssl->handshake->ecdh_privkey,
2252 p + 2 );
2253 if( ret == UECC_FAULT_DETECTED )
2254 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
2255 if( ret != UECC_SUCCESS )
Hanno Becker982da7e2019-09-02 09:47:39 +01002256 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Hanno Becker982da7e2019-09-02 09:47:39 +01002257
2258 zlen = NUM_ECC_BYTES;
2259#else /* MBEDTLS_USE_TINYCRYPT */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002260 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
Paul Bakker66d5d072014-06-17 16:39:18 +02002261 p + 2, end - ( p + 2 ),
Hanno Beckerece325c2019-06-13 15:39:27 +01002262 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01002263 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002264 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002265 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002266 return( ret );
2267 }
2268
Hanno Becker982da7e2019-09-02 09:47:39 +01002269 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
2270 MBEDTLS_DEBUG_ECDH_Z );
2271#endif /* MBEDTLS_USE_TINYCRYPT */
2272
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002273 p = mbedtls_platform_put_uint16_be( p, zlen );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002274 p += zlen;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002275 }
2276 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002277#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002278 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002279 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2280 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002281 }
2282
2283 /* opaque psk<0..2^16-1>; */
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002284 if( end - p < 2 )
2285 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01002286
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03002287 p = mbedtls_platform_put_uint16_be( p, psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02002288
2289 if( end < p || (size_t)( end - p ) < psk_len )
2290 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2291
Teppo Järvelin91d79382019-10-02 09:09:31 +03002292 mbedtls_platform_memcpy( p, psk, psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002293 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002294
2295 ssl->handshake->pmslen = p - ssl->handshake->premaster;
2296
Jarno Lamsa67f0a1e2019-12-18 16:28:51 +02002297 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
2298
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002299 return( 0 );
2300}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002301#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002302
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002303#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00002304/*
2305 * SSLv3.0 MAC functions
2306 */
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002307#define SSL_MAC_MAX_BYTES 20 /* MD-5 or SHA-1 */
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002308static void ssl_mac( mbedtls_md_context_t *md_ctx,
2309 const unsigned char *secret,
2310 const unsigned char *buf, size_t len,
2311 const unsigned char *ctr, int type,
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002312 unsigned char out[SSL_MAC_MAX_BYTES] )
Paul Bakker5121ce52009-01-03 21:22:43 +00002313{
2314 unsigned char header[11];
2315 unsigned char padding[48];
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002316 int padlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002317 int md_size = mbedtls_md_get_size( md_ctx->md_info );
2318 int md_type = mbedtls_md_get_type( md_ctx->md_info );
Paul Bakker68884e32013-01-07 18:20:04 +01002319
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002320 /* Only MD5 and SHA-1 supported */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002321 if( md_type == MBEDTLS_MD_MD5 )
Paul Bakker68884e32013-01-07 18:20:04 +01002322 padlen = 48;
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02002323 else
Paul Bakker68884e32013-01-07 18:20:04 +01002324 padlen = 40;
Paul Bakker5121ce52009-01-03 21:22:43 +00002325
Teppo Järvelin91d79382019-10-02 09:09:31 +03002326 mbedtls_platform_memcpy( header, ctr, 8 );
Arto Kinnunen6e3f09b2019-09-06 17:37:01 +03002327 header[8] = (unsigned char) type;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002328 (void)mbedtls_platform_put_uint16_be( &header[9], len );
Paul Bakker5121ce52009-01-03 21:22:43 +00002329
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002330 mbedtls_platform_memset( padding, 0x36, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002331 mbedtls_md_starts( md_ctx );
2332 mbedtls_md_update( md_ctx, secret, md_size );
2333 mbedtls_md_update( md_ctx, padding, padlen );
2334 mbedtls_md_update( md_ctx, header, 11 );
2335 mbedtls_md_update( md_ctx, buf, len );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002336 mbedtls_md_finish( md_ctx, out );
Paul Bakker5121ce52009-01-03 21:22:43 +00002337
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002338 mbedtls_platform_memset( padding, 0x5C, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002339 mbedtls_md_starts( md_ctx );
2340 mbedtls_md_update( md_ctx, secret, md_size );
2341 mbedtls_md_update( md_ctx, padding, padlen );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002342 mbedtls_md_update( md_ctx, out, md_size );
2343 mbedtls_md_finish( md_ctx, out );
Paul Bakker5f70b252012-09-13 14:23:06 +00002344}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002345#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +00002346
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002347/* The function below is only used in the Lucky 13 counter-measure in
Hanno Becker30d02cd2018-10-18 15:43:13 +01002348 * mbedtls_ssl_decrypt_buf(). These are the defines that guard the call site. */
Hanno Becker5cc04d52018-01-03 15:24:20 +00002349#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) && \
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002350 ( defined(MBEDTLS_SSL_PROTO_TLS1) || \
2351 defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2352 defined(MBEDTLS_SSL_PROTO_TLS1_2) )
2353/* This function makes sure every byte in the memory region is accessed
2354 * (in ascending addresses order) */
2355static void ssl_read_memory( unsigned char *p, size_t len )
2356{
2357 unsigned char acc = 0;
2358 volatile unsigned char force;
2359
2360 for( ; len != 0; p++, len-- )
2361 acc ^= *p;
2362
2363 force = acc;
2364 (void) force;
2365}
2366#endif /* SSL_SOME_MODES_USE_MAC && ( TLS1 || TLS1_1 || TLS1_2 ) */
2367
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002368/*
Paul Bakker5121ce52009-01-03 21:22:43 +00002369 * Encryption/decryption functions
Paul Bakkerf7abd422013-04-16 13:15:56 +02002370 */
Hanno Becker3307b532017-12-27 21:37:21 +00002371
Hanno Beckera5a2b082019-05-15 14:03:01 +01002372#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker89693692019-05-20 15:06:12 +01002373/* This functions transforms a DTLS plaintext fragment and a record content
2374 * type into an instance of the DTLSInnerPlaintext structure:
Hanno Becker92c930f2019-04-29 17:31:37 +01002375 *
2376 * struct {
2377 * opaque content[DTLSPlaintext.length];
2378 * ContentType real_type;
2379 * uint8 zeros[length_of_padding];
2380 * } DTLSInnerPlaintext;
2381 *
2382 * Input:
2383 * - `content`: The beginning of the buffer holding the
2384 * plaintext to be wrapped.
2385 * - `*content_size`: The length of the plaintext in Bytes.
2386 * - `max_len`: The number of Bytes available starting from
2387 * `content`. This must be `>= *content_size`.
2388 * - `rec_type`: The desired record content type.
2389 *
2390 * Output:
2391 * - `content`: The beginning of the resulting DTLSInnerPlaintext structure.
2392 * - `*content_size`: The length of the resulting DTLSInnerPlaintext structure.
2393 *
2394 * Returns:
2395 * - `0` on success.
2396 * - A negative error code if `max_len` didn't offer enough space
2397 * for the expansion.
2398 */
2399static int ssl_cid_build_inner_plaintext( unsigned char *content,
2400 size_t *content_size,
2401 size_t remaining,
2402 uint8_t rec_type )
2403{
2404 size_t len = *content_size;
Hanno Becker78426092019-05-13 15:31:17 +01002405 size_t pad = ( MBEDTLS_SSL_CID_PADDING_GRANULARITY -
2406 ( len + 1 ) % MBEDTLS_SSL_CID_PADDING_GRANULARITY ) %
2407 MBEDTLS_SSL_CID_PADDING_GRANULARITY;
Hanno Becker92c930f2019-04-29 17:31:37 +01002408
2409 /* Write real content type */
2410 if( remaining == 0 )
Andrzej Kurek84bde412020-07-06 15:27:34 -04002411 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Hanno Becker92c930f2019-04-29 17:31:37 +01002412 content[ len ] = rec_type;
2413 len++;
2414 remaining--;
2415
2416 if( remaining < pad )
Andrzej Kurek84bde412020-07-06 15:27:34 -04002417 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02002418 mbedtls_platform_memset( content + len, 0, pad );
Hanno Becker92c930f2019-04-29 17:31:37 +01002419 len += pad;
2420 remaining -= pad;
2421
2422 *content_size = len;
Andrzej Kurekafec8852020-07-15 16:31:27 -04002423 return( 0 );
Hanno Becker92c930f2019-04-29 17:31:37 +01002424}
2425
Hanno Becker7dc25772019-05-20 15:08:01 +01002426/* This function parses a DTLSInnerPlaintext structure.
2427 * See ssl_cid_build_inner_plaintext() for details. */
Hanno Becker92c930f2019-04-29 17:31:37 +01002428static int ssl_cid_parse_inner_plaintext( unsigned char const *content,
2429 size_t *content_size,
2430 uint8_t *rec_type )
2431{
2432 size_t remaining = *content_size;
2433
2434 /* Determine length of padding by skipping zeroes from the back. */
2435 do
2436 {
2437 if( remaining == 0 )
2438 return( -1 );
2439 remaining--;
2440 } while( content[ remaining ] == 0 );
2441
2442 *content_size = remaining;
2443 *rec_type = content[ remaining ];
2444
2445 return( 0 );
2446}
Hanno Beckera5a2b082019-05-15 14:03:01 +01002447#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker92c930f2019-04-29 17:31:37 +01002448
Hanno Becker99abf512019-05-20 14:50:53 +01002449/* `add_data` must have size 13 Bytes if the CID extension is disabled,
Hanno Beckeracadb0a2019-05-08 18:15:21 +01002450 * and 13 + 1 + CID-length Bytes if the CID extension is enabled. */
Hanno Becker3307b532017-12-27 21:37:21 +00002451static void ssl_extract_add_data_from_record( unsigned char* add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002452 size_t *add_data_len,
Hanno Becker3307b532017-12-27 21:37:21 +00002453 mbedtls_record *rec )
2454{
Hanno Becker99abf512019-05-20 14:50:53 +01002455 /* Quoting RFC 5246 (TLS 1.2):
Hanno Beckere83efe62019-04-29 13:52:53 +01002456 *
2457 * additional_data = seq_num + TLSCompressed.type +
2458 * TLSCompressed.version + TLSCompressed.length;
2459 *
Hanno Becker99abf512019-05-20 14:50:53 +01002460 * For the CID extension, this is extended as follows
2461 * (quoting draft-ietf-tls-dtls-connection-id-05,
2462 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05):
Hanno Beckere83efe62019-04-29 13:52:53 +01002463 *
2464 * additional_data = seq_num + DTLSPlaintext.type +
2465 * DTLSPlaintext.version +
Hanno Becker99abf512019-05-20 14:50:53 +01002466 * cid +
2467 * cid_length +
Hanno Beckere83efe62019-04-29 13:52:53 +01002468 * length_of_DTLSInnerPlaintext;
2469 */
2470
Teppo Järvelin91d79382019-10-02 09:09:31 +03002471 mbedtls_platform_memcpy( add_data, rec->ctr, sizeof( rec->ctr ) );
Hanno Becker3307b532017-12-27 21:37:21 +00002472 add_data[8] = rec->type;
Teppo Järvelin91d79382019-10-02 09:09:31 +03002473 mbedtls_platform_memcpy( add_data + 9, rec->ver, sizeof( rec->ver ) );
Hanno Beckere83efe62019-04-29 13:52:53 +01002474
Hanno Beckera5a2b082019-05-15 14:03:01 +01002475#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker1f02f052019-05-09 11:38:24 +01002476 if( rec->cid_len != 0 )
2477 {
Teppo Järvelin91d79382019-10-02 09:09:31 +03002478 mbedtls_platform_memcpy( add_data + 11, rec->cid, rec->cid_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002479 add_data[11 + rec->cid_len + 0] = rec->cid_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002480 (void)mbedtls_platform_put_uint16_be( &add_data[11 + rec->cid_len + 1],
2481 rec->data_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002482 *add_data_len = 13 + 1 + rec->cid_len;
2483 }
2484 else
Hanno Beckera5a2b082019-05-15 14:03:01 +01002485#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker1f02f052019-05-09 11:38:24 +01002486 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03002487 (void)mbedtls_platform_put_uint16_be( &add_data[11], rec->data_len );
Hanno Becker1f02f052019-05-09 11:38:24 +01002488 *add_data_len = 13;
2489 }
Hanno Becker3307b532017-12-27 21:37:21 +00002490}
2491
Hanno Becker611a83b2018-01-03 14:27:32 +00002492int mbedtls_ssl_encrypt_buf( mbedtls_ssl_context *ssl,
2493 mbedtls_ssl_transform *transform,
2494 mbedtls_record *rec,
2495 int (*f_rng)(void *, unsigned char *, size_t),
2496 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +00002497{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002498 mbedtls_cipher_mode_t mode;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002499 int auth_done = 0;
Hanno Becker3307b532017-12-27 21:37:21 +00002500 unsigned char * data;
Hanno Becker28a0c4e2019-05-20 14:54:26 +01002501 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_OUT_LEN_MAX ];
Hanno Beckere83efe62019-04-29 13:52:53 +01002502 size_t add_data_len;
Hanno Becker3307b532017-12-27 21:37:21 +00002503 size_t post_avail;
2504
2505 /* The SSL context is only used for debugging purposes! */
Hanno Becker611a83b2018-01-03 14:27:32 +00002506#if !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02002507 ssl = NULL; /* make sure we don't use it except for debug */
Hanno Becker3307b532017-12-27 21:37:21 +00002508 ((void) ssl);
2509#endif
2510
2511 /* The PRNG is used for dynamic IV generation that's used
2512 * for CBC transformations in TLS 1.1 and TLS 1.2. */
2513#if !( defined(MBEDTLS_CIPHER_MODE_CBC) && \
2514 ( defined(MBEDTLS_AES_C) || \
2515 defined(MBEDTLS_ARIA_C) || \
2516 defined(MBEDTLS_CAMELLIA_C) ) && \
2517 ( defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2) ) )
2518 ((void) f_rng);
2519 ((void) p_rng);
2520#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002521
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002522 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002523
Hanno Becker3307b532017-12-27 21:37:21 +00002524 if( transform == NULL )
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002525 {
Hanno Becker3307b532017-12-27 21:37:21 +00002526 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no transform provided to encrypt_buf" ) );
2527 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2528 }
Hanno Becker505089d2019-05-01 09:45:57 +01002529 if( rec == NULL
2530 || rec->buf == NULL
2531 || rec->buf_len < rec->data_offset
2532 || rec->buf_len - rec->data_offset < rec->data_len
Hanno Beckera5a2b082019-05-15 14:03:01 +01002533#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker505089d2019-05-01 09:45:57 +01002534 || rec->cid_len != 0
2535#endif
2536 )
Hanno Becker3307b532017-12-27 21:37:21 +00002537 {
2538 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to encrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002539 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002540 }
2541
Hanno Becker3307b532017-12-27 21:37:21 +00002542 data = rec->buf + rec->data_offset;
Hanno Becker92c930f2019-04-29 17:31:37 +01002543 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002544 MBEDTLS_SSL_DEBUG_BUF( 4, "before encrypt: output payload",
Hanno Becker3307b532017-12-27 21:37:21 +00002545 data, rec->data_len );
2546
2547 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc );
2548
2549 if( rec->data_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
2550 {
2551 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record content %u too large, maximum %d",
2552 (unsigned) rec->data_len,
2553 MBEDTLS_SSL_OUT_CONTENT_LEN ) );
2554 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2555 }
Manuel Pégourié-Gonnard60346be2014-11-21 11:38:37 +01002556
Hanno Beckera5a2b082019-05-15 14:03:01 +01002557#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere83efe62019-04-29 13:52:53 +01002558 /*
2559 * Add CID information
2560 */
2561 rec->cid_len = transform->out_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03002562 /* Not using more secure mbedtls_platform_memcpy as cid is public */
2563 memcpy( rec->cid, transform->out_cid, transform->out_cid_len );
Hanno Beckere83efe62019-04-29 13:52:53 +01002564 MBEDTLS_SSL_DEBUG_BUF( 3, "CID", rec->cid, rec->cid_len );
Hanno Becker92c930f2019-04-29 17:31:37 +01002565 if( rec->cid_len != 0 )
2566 {
Andrzej Kurek84bde412020-07-06 15:27:34 -04002567 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker92c930f2019-04-29 17:31:37 +01002568 /*
Hanno Becker7dc25772019-05-20 15:08:01 +01002569 * Wrap plaintext into DTLSInnerPlaintext structure.
2570 * See ssl_cid_build_inner_plaintext() for more information.
Hanno Becker92c930f2019-04-29 17:31:37 +01002571 *
Hanno Becker7dc25772019-05-20 15:08:01 +01002572 * Note that this changes `rec->data_len`, and hence
2573 * `post_avail` needs to be recalculated afterwards.
Hanno Becker92c930f2019-04-29 17:31:37 +01002574 */
Andrzej Kurek84bde412020-07-06 15:27:34 -04002575 if( ( ret = ssl_cid_build_inner_plaintext( data,
2576 &rec->data_len,
2577 post_avail,
2578 rec->type ) ) != 0 )
Hanno Becker92c930f2019-04-29 17:31:37 +01002579 {
Andrzej Kurek84bde412020-07-06 15:27:34 -04002580 return( ret );
Hanno Becker92c930f2019-04-29 17:31:37 +01002581 }
2582
2583 rec->type = MBEDTLS_SSL_MSG_CID;
2584 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01002585#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01002586
Hanno Becker92c930f2019-04-29 17:31:37 +01002587 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
2588
Paul Bakker5121ce52009-01-03 21:22:43 +00002589 /*
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002590 * Add MAC before if needed
Paul Bakker5121ce52009-01-03 21:22:43 +00002591 */
Hanno Becker5cc04d52018-01-03 15:24:20 +00002592#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002593 if( mode == MBEDTLS_MODE_STREAM ||
2594 ( mode == MBEDTLS_MODE_CBC
2595#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3307b532017-12-27 21:37:21 +00002596 && transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002597#endif
2598 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00002599 {
Hanno Becker3307b532017-12-27 21:37:21 +00002600 if( post_avail < transform->maclen )
2601 {
2602 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2603 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2604 }
2605
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002606#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01002607 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
2608 MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002609 {
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01002610 unsigned char mac[SSL_MAC_MAX_BYTES];
Hanno Becker3307b532017-12-27 21:37:21 +00002611 ssl_mac( &transform->md_ctx_enc, transform->mac_enc,
2612 data, rec->data_len, rec->ctr, rec->type, mac );
Teppo Järvelin91d79382019-10-02 09:09:31 +03002613 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002614 }
2615 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002616#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002617#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2618 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01002619 if( mbedtls_ssl_ver_geq(
2620 mbedtls_ssl_transform_get_minor_ver( transform ),
2621 MBEDTLS_SSL_MINOR_VERSION_1 ) )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002622 {
Hanno Becker992b6872017-11-09 18:57:39 +00002623 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
2624
Hanno Beckere83efe62019-04-29 13:52:53 +01002625 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker992b6872017-11-09 18:57:39 +00002626
Hanno Becker3307b532017-12-27 21:37:21 +00002627 mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002628 add_data_len );
Hanno Becker3307b532017-12-27 21:37:21 +00002629 mbedtls_md_hmac_update( &transform->md_ctx_enc,
2630 data, rec->data_len );
2631 mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
2632 mbedtls_md_hmac_reset( &transform->md_ctx_enc );
2633
Teppo Järvelin91d79382019-10-02 09:09:31 +03002634 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002635 }
2636 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002637#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002638 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002639 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2640 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002641 }
2642
Hanno Becker3307b532017-12-27 21:37:21 +00002643 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", data + rec->data_len,
2644 transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002645
Hanno Becker3307b532017-12-27 21:37:21 +00002646 rec->data_len += transform->maclen;
2647 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002648 auth_done++;
Paul Bakker577e0062013-08-28 11:57:20 +02002649 }
Hanno Becker5cc04d52018-01-03 15:24:20 +00002650#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00002651
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002652 /*
2653 * Encrypt
2654 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002655#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
2656 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00002657 {
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002658 int ret;
Hanno Becker3307b532017-12-27 21:37:21 +00002659 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002660 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Hanno Becker3307b532017-12-27 21:37:21 +00002661 "including %d bytes of padding",
2662 rec->data_len, 0 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002663
Hanno Becker3307b532017-12-27 21:37:21 +00002664 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
2665 transform->iv_enc, transform->ivlen,
2666 data, rec->data_len,
2667 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02002668 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002669 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002670 return( ret );
2671 }
2672
Hanno Becker3307b532017-12-27 21:37:21 +00002673 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002674 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002675 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2676 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002677 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002678 }
Paul Bakker68884e32013-01-07 18:20:04 +01002679 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002680#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002681
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002682#if defined(MBEDTLS_GCM_C) || \
2683 defined(MBEDTLS_CCM_C) || \
2684 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002685 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002686 mode == MBEDTLS_MODE_CCM ||
2687 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00002688 {
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02002689 int ret;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002690 unsigned char iv[12];
Hanno Becker3307b532017-12-27 21:37:21 +00002691 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00002692
Hanno Becker3307b532017-12-27 21:37:21 +00002693 /* Check that there's space for both the authentication tag
2694 * and the explicit IV before and after the record content. */
2695 if( post_avail < transform->taglen ||
2696 rec->data_offset < explicit_iv_len )
2697 {
2698 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2699 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2700 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00002701
Paul Bakker68884e32013-01-07 18:20:04 +01002702 /*
2703 * Generate IV
2704 */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002705 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
2706 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02002707 /* GCM and CCM: fixed || explicit (=seqnum) */
Teppo Järvelin91d79382019-10-02 09:09:31 +03002708 mbedtls_platform_memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
2709 mbedtls_platform_memcpy( iv + transform->fixed_ivlen, rec->ctr,
Hanno Becker3307b532017-12-27 21:37:21 +00002710 explicit_iv_len );
2711 /* Prefix record content with explicit IV. */
Teppo Järvelin91d79382019-10-02 09:09:31 +03002712 mbedtls_platform_memcpy( data - explicit_iv_len, rec->ctr, explicit_iv_len );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002713 }
2714 else if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
2715 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02002716 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002717 unsigned char i;
2718
Teppo Järvelin91d79382019-10-02 09:09:31 +03002719 mbedtls_platform_memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002720
2721 for( i = 0; i < 8; i++ )
Hanno Becker3307b532017-12-27 21:37:21 +00002722 iv[i+4] ^= rec->ctr[i];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002723 }
2724 else
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01002725 {
2726 /* Reminder if we ever add an AEAD mode with a different size */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002727 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2728 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01002729 }
2730
Hanno Beckere83efe62019-04-29 13:52:53 +01002731 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker08885812019-04-26 13:34:37 +01002732
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002733 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (internal)",
2734 iv, transform->ivlen );
2735 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (transmitted)",
Hanno Becker3307b532017-12-27 21:37:21 +00002736 data - explicit_iv_len, explicit_iv_len );
2737 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckere83efe62019-04-29 13:52:53 +01002738 add_data, add_data_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002739 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002740 "including 0 bytes of padding",
Hanno Becker3307b532017-12-27 21:37:21 +00002741 rec->data_len ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00002742
Paul Bakker68884e32013-01-07 18:20:04 +01002743 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02002744 * Encrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002745 */
Hanno Becker3307b532017-12-27 21:37:21 +00002746
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002747 if( ( ret = mbedtls_cipher_auth_encrypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00002748 iv, transform->ivlen,
Hanno Beckere83efe62019-04-29 13:52:53 +01002749 add_data, add_data_len, /* add data */
Hanno Becker3307b532017-12-27 21:37:21 +00002750 data, rec->data_len, /* source */
2751 data, &rec->data_len, /* destination */
2752 data + rec->data_len, transform->taglen ) ) != 0 )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002753 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002754 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002755 return( ret );
2756 }
2757
Hanno Becker3307b532017-12-27 21:37:21 +00002758 MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag",
2759 data + rec->data_len, transform->taglen );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002760
Hanno Becker3307b532017-12-27 21:37:21 +00002761 rec->data_len += transform->taglen + explicit_iv_len;
2762 rec->data_offset -= explicit_iv_len;
2763 post_avail -= transform->taglen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002764 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00002765 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002766 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002767#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
2768#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00002769 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) || defined(MBEDTLS_ARIA_C) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002770 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00002771 {
Paul Bakkerda02a7f2013-08-31 17:25:14 +02002772 int ret;
Hanno Becker3307b532017-12-27 21:37:21 +00002773 size_t padlen, i;
2774 size_t olen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002775
Hanno Becker3307b532017-12-27 21:37:21 +00002776 /* Currently we're always using minimal padding
2777 * (up to 255 bytes would be allowed). */
2778 padlen = transform->ivlen - ( rec->data_len + 1 ) % transform->ivlen;
2779 if( padlen == transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00002780 padlen = 0;
2781
Hanno Becker3307b532017-12-27 21:37:21 +00002782 /* Check there's enough space in the buffer for the padding. */
2783 if( post_avail < padlen + 1 )
2784 {
2785 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2786 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2787 }
2788
Paul Bakker5121ce52009-01-03 21:22:43 +00002789 for( i = 0; i <= padlen; i++ )
Hanno Becker3307b532017-12-27 21:37:21 +00002790 data[rec->data_len + i] = (unsigned char) padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00002791
Hanno Becker3307b532017-12-27 21:37:21 +00002792 rec->data_len += padlen + 1;
2793 post_avail -= padlen + 1;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002794
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002795#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002796 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00002797 * Prepend per-record IV for block cipher in TLS v1.1 and up as per
2798 * Method 1 (6.2.3.2. in RFC4346 and RFC5246)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002799 */
Hanno Becker7bcf2b52019-07-26 09:02:40 +01002800 if( mbedtls_ssl_ver_geq(
2801 mbedtls_ssl_transform_get_minor_ver( transform ),
2802 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002803 {
Hanno Becker3307b532017-12-27 21:37:21 +00002804 if( f_rng == NULL )
2805 {
2806 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No PRNG provided to encrypt_record routine" ) );
2807 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2808 }
2809
2810 if( rec->data_offset < transform->ivlen )
2811 {
2812 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2813 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2814 }
2815
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002816 /*
2817 * Generate IV
2818 */
Hanno Becker3307b532017-12-27 21:37:21 +00002819 ret = f_rng( p_rng, transform->iv_enc, transform->ivlen );
Paul Bakkera3d195c2011-11-27 21:07:34 +00002820 if( ret != 0 )
2821 return( ret );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002822
Teppo Järvelin91d79382019-10-02 09:09:31 +03002823 mbedtls_platform_memcpy( data - transform->ivlen, transform->iv_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00002824 transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002825
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002826 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002827#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002828
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002829 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002830 "including %d bytes of IV and %d bytes of padding",
Hanno Becker3307b532017-12-27 21:37:21 +00002831 rec->data_len, transform->ivlen,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02002832 padlen + 1 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002833
Hanno Becker3307b532017-12-27 21:37:21 +00002834 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
2835 transform->iv_enc,
2836 transform->ivlen,
2837 data, rec->data_len,
2838 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02002839 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002840 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02002841 return( ret );
2842 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02002843
Hanno Becker3307b532017-12-27 21:37:21 +00002844 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02002845 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002846 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2847 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02002848 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02002849
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002850#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01002851 if( mbedtls_ssl_ver_lt(
2852 mbedtls_ssl_transform_get_minor_ver( transform ),
2853 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakkercca5b812013-08-31 17:40:26 +02002854 {
2855 /*
2856 * Save IV in SSL3 and TLS1
2857 */
Teppo Järvelin91d79382019-10-02 09:09:31 +03002858 mbedtls_platform_memcpy( transform->iv_enc, transform->cipher_ctx_enc.iv,
Hanno Becker3307b532017-12-27 21:37:21 +00002859 transform->ivlen );
Paul Bakker5121ce52009-01-03 21:22:43 +00002860 }
Hanno Becker3307b532017-12-27 21:37:21 +00002861 else
Paul Bakkercca5b812013-08-31 17:40:26 +02002862#endif
Hanno Becker3307b532017-12-27 21:37:21 +00002863 {
2864 data -= transform->ivlen;
2865 rec->data_offset -= transform->ivlen;
2866 rec->data_len += transform->ivlen;
2867 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002868
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002869#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002870 if( auth_done == 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002871 {
Hanno Becker3d8c9072018-01-05 16:24:22 +00002872 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
2873
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002874 /*
2875 * MAC(MAC_write_key, seq_num +
2876 * TLSCipherText.type +
2877 * TLSCipherText.version +
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01002878 * length_of( (IV +) ENC(...) ) +
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002879 * IV + // except for TLS 1.0
2880 * ENC(content + padding + padding_length));
2881 */
Hanno Becker3307b532017-12-27 21:37:21 +00002882
2883 if( post_avail < transform->maclen)
2884 {
2885 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2886 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2887 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002888
Hanno Beckere83efe62019-04-29 13:52:53 +01002889 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002891 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Hanno Becker3307b532017-12-27 21:37:21 +00002892 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002893 add_data_len );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002894
Hanno Becker3307b532017-12-27 21:37:21 +00002895 mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002896 add_data_len );
Hanno Becker3307b532017-12-27 21:37:21 +00002897 mbedtls_md_hmac_update( &transform->md_ctx_enc,
2898 data, rec->data_len );
2899 mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
2900 mbedtls_md_hmac_reset( &transform->md_ctx_enc );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01002901
Teppo Järvelin91d79382019-10-02 09:09:31 +03002902 mbedtls_platform_memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002903
Hanno Becker3307b532017-12-27 21:37:21 +00002904 rec->data_len += transform->maclen;
2905 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002906 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002907 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002908#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00002909 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002910 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002911#endif /* MBEDTLS_CIPHER_MODE_CBC &&
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00002912 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C || MBEDTLS_ARIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002913 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002914 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2915 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002916 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002917
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002918 /* Make extra sure authentication was performed, exactly once */
2919 if( auth_done != 1 )
2920 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002921 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2922 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002923 }
2924
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002925 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002926
2927 return( 0 );
2928}
2929
Hanno Becker40478be2019-07-12 08:23:59 +01002930int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context const *ssl,
Hanno Becker611a83b2018-01-03 14:27:32 +00002931 mbedtls_ssl_transform *transform,
2932 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00002933{
Hanno Becker4c6876b2017-12-27 21:28:58 +00002934 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002935 mbedtls_cipher_mode_t mode;
Hanno Becker4c6876b2017-12-27 21:28:58 +00002936 int ret, auth_done = 0;
Hanno Becker5cc04d52018-01-03 15:24:20 +00002937#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Paul Bakker1e5369c2013-12-19 16:40:57 +01002938 size_t padlen = 0, correct = 1;
2939#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00002940 unsigned char* data;
Hanno Becker28a0c4e2019-05-20 14:54:26 +01002941 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_IN_LEN_MAX ];
Hanno Beckere83efe62019-04-29 13:52:53 +01002942 size_t add_data_len;
Hanno Becker4c6876b2017-12-27 21:28:58 +00002943
Hanno Becker611a83b2018-01-03 14:27:32 +00002944#if !defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard86e48c22019-05-07 10:17:56 +02002945 ssl = NULL; /* make sure we don't use it except for debug */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002946 ((void) ssl);
2947#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002948
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002949 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
Hanno Becker4c6876b2017-12-27 21:28:58 +00002950 if( rec == NULL ||
2951 rec->buf == NULL ||
2952 rec->buf_len < rec->data_offset ||
2953 rec->buf_len - rec->data_offset < rec->data_len )
2954 {
2955 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to decrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002956 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002957 }
2958
Hanno Becker4c6876b2017-12-27 21:28:58 +00002959 data = rec->buf + rec->data_offset;
2960 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_dec );
Paul Bakker5121ce52009-01-03 21:22:43 +00002961
Hanno Beckera5a2b082019-05-15 14:03:01 +01002962#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere83efe62019-04-29 13:52:53 +01002963 /*
2964 * Match record's CID with incoming CID.
2965 */
Hanno Beckerabd7c892019-05-08 13:02:22 +01002966 if( rec->cid_len != transform->in_cid_len ||
Teppo Järvelin0efac532019-10-04 13:21:08 +03002967 memcmp( rec->cid, transform->in_cid, rec->cid_len ) != 0 ) // use regular memcmp as CID is public
Hanno Beckerabd7c892019-05-08 13:02:22 +01002968 {
Hanno Beckere8eff9a2019-05-14 11:30:10 +01002969 return( MBEDTLS_ERR_SSL_UNEXPECTED_CID );
Hanno Beckerabd7c892019-05-08 13:02:22 +01002970 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01002971#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01002972
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002973#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
2974 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker68884e32013-01-07 18:20:04 +01002975 {
2976 padlen = 0;
Hanno Becker4c6876b2017-12-27 21:28:58 +00002977 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
2978 transform->iv_dec,
2979 transform->ivlen,
2980 data, rec->data_len,
2981 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02002982 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002983 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002984 return( ret );
2985 }
2986
Hanno Becker4c6876b2017-12-27 21:28:58 +00002987 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002988 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002989 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2990 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002991 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002992 }
Paul Bakker68884e32013-01-07 18:20:04 +01002993 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002994#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002995#if defined(MBEDTLS_GCM_C) || \
2996 defined(MBEDTLS_CCM_C) || \
2997 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002998 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002999 mode == MBEDTLS_MODE_CCM ||
3000 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00003001 {
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003002 unsigned char iv[12];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003003 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00003004
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003005 /*
3006 * Prepare IV from explicit and implicit data.
3007 */
3008
3009 /* Check that there's enough space for the explicit IV
3010 * (at the beginning of the record) and the MAC (at the
3011 * end of the record). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003012 if( rec->data_len < explicit_iv_len + transform->taglen )
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02003013 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003014 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < explicit_iv_len (%d) "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003015 "+ taglen (%d)", rec->data_len,
3016 explicit_iv_len, transform->taglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003017 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02003018 }
Paul Bakker68884e32013-01-07 18:20:04 +01003019
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003020#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C)
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003021 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
3022 {
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003023 /* GCM and CCM: fixed || explicit */
Paul Bakker68884e32013-01-07 18:20:04 +01003024
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003025 /* Fixed */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003026 mbedtls_platform_memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003027 /* Explicit */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003028 mbedtls_platform_memcpy( iv + transform->fixed_ivlen, data, 8 );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003029 }
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003030 else
3031#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
3032#if defined(MBEDTLS_CHACHAPOLY_C)
3033 if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003034 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02003035 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003036 unsigned char i;
3037
Teppo Järvelin91d79382019-10-02 09:09:31 +03003038 mbedtls_platform_memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003039
3040 for( i = 0; i < 8; i++ )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003041 iv[i+4] ^= rec->ctr[i];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003042 }
3043 else
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003044#endif /* MBEDTLS_CHACHAPOLY_C */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003045 {
3046 /* Reminder if we ever add an AEAD mode with a different size */
3047 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3048 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3049 }
3050
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003051 /* Group changes to data, data_len, and add_data, because
3052 * add_data depends on data_len. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003053 data += explicit_iv_len;
3054 rec->data_offset += explicit_iv_len;
3055 rec->data_len -= explicit_iv_len + transform->taglen;
3056
Hanno Beckere83efe62019-04-29 13:52:53 +01003057 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003058 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckere83efe62019-04-29 13:52:53 +01003059 add_data, add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003060
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003061 /* Because of the check above, we know that there are
3062 * explicit_iv_len Bytes preceeding data, and taglen
3063 * bytes following data + data_len. This justifies
Hanno Becker07d420d2019-07-10 11:44:13 +01003064 * the debug message and the invocation of
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003065 * mbedtls_cipher_auth_decrypt() below. */
3066
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02003067 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", iv, transform->ivlen );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003068 MBEDTLS_SSL_DEBUG_BUF( 4, "TAG used", data + rec->data_len,
Hanno Becker8759e162017-12-27 21:34:08 +00003069 transform->taglen );
Paul Bakker68884e32013-01-07 18:20:04 +01003070
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003071 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003072 * Decrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003073 */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003074 if( ( ret = mbedtls_cipher_auth_decrypt( &transform->cipher_ctx_dec,
3075 iv, transform->ivlen,
Hanno Beckere83efe62019-04-29 13:52:53 +01003076 add_data, add_data_len,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003077 data, rec->data_len,
3078 data, &olen,
3079 data + rec->data_len,
3080 transform->taglen ) ) != 0 )
Paul Bakkerca4ab492012-04-18 14:23:57 +00003081 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003082 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003083
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003084 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
3085 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02003086
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003087 return( ret );
3088 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003089 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00003090
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003091 /* Double-check that AEAD decryption doesn't change content length. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003092 if( olen != rec->data_len )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003093 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003094 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3095 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02003096 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00003097 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003098 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003099#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
3100#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003101 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) || defined(MBEDTLS_ARIA_C) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003102 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00003103 {
Paul Bakkere47b34b2013-02-27 14:48:00 +01003104 size_t minlen = 0;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003105
Paul Bakker5121ce52009-01-03 21:22:43 +00003106 /*
Paul Bakker45829992013-01-03 14:52:21 +01003107 * Check immediate ciphertext sanity
Paul Bakker5121ce52009-01-03 21:22:43 +00003108 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003109#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003110 if( mbedtls_ssl_ver_geq(
3111 mbedtls_ssl_transform_get_minor_ver( transform ),
3112 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003113 {
3114 /* The ciphertext is prefixed with the CBC IV. */
3115 minlen += transform->ivlen;
3116 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003117#endif
Paul Bakker45829992013-01-03 14:52:21 +01003118
Hanno Becker4c6876b2017-12-27 21:28:58 +00003119 /* Size considerations:
3120 *
3121 * - The CBC cipher text must not be empty and hence
3122 * at least of size transform->ivlen.
3123 *
3124 * Together with the potential IV-prefix, this explains
3125 * the first of the two checks below.
3126 *
3127 * - The record must contain a MAC, either in plain or
3128 * encrypted, depending on whether Encrypt-then-MAC
3129 * is used or not.
3130 * - If it is, the message contains the IV-prefix,
3131 * the CBC ciphertext, and the MAC.
3132 * - If it is not, the padded plaintext, and hence
3133 * the CBC ciphertext, has at least length maclen + 1
3134 * because there is at least the padding length byte.
3135 *
3136 * As the CBC ciphertext is not empty, both cases give the
3137 * lower bound minlen + maclen + 1 on the record size, which
3138 * we test for in the second check below.
3139 */
3140 if( rec->data_len < minlen + transform->ivlen ||
3141 rec->data_len < minlen + transform->maclen + 1 )
Paul Bakker45829992013-01-03 14:52:21 +01003142 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003143 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < max( ivlen(%d), maclen (%d) "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003144 "+ 1 ) ( + expl IV )", rec->data_len,
3145 transform->ivlen,
3146 transform->maclen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003147 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker45829992013-01-03 14:52:21 +01003148 }
3149
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003150 /*
3151 * Authenticate before decrypt if enabled
3152 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003153#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003154 if( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003155 {
Hanno Becker992b6872017-11-09 18:57:39 +00003156 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003158 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003159
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003160 /* Update data_len in tandem with add_data.
3161 *
3162 * The subtraction is safe because of the previous check
3163 * data_len >= minlen + maclen + 1.
3164 *
3165 * Afterwards, we know that data + data_len is followed by at
3166 * least maclen Bytes, which justifies the call to
Teppo Järvelin707ceb82019-10-04 07:49:39 +03003167 * mbedtls_platform_memcmp() below.
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003168 *
3169 * Further, we still know that data_len > minlen */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003170 rec->data_len -= transform->maclen;
Hanno Beckere83efe62019-04-29 13:52:53 +01003171 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003172
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003173 /* Calculate expected MAC. */
Hanno Beckere83efe62019-04-29 13:52:53 +01003174 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
3175 add_data_len );
3176 mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
3177 add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003178 mbedtls_md_hmac_update( &transform->md_ctx_dec,
3179 data, rec->data_len );
3180 mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
3181 mbedtls_md_hmac_reset( &transform->md_ctx_dec );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01003182
Hanno Becker4c6876b2017-12-27 21:28:58 +00003183 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len,
3184 transform->maclen );
Hanno Becker992b6872017-11-09 18:57:39 +00003185 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003186 transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003187
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003188 /* Compare expected MAC with MAC at the end of the record. */
Teppo Järvelin707ceb82019-10-04 07:49:39 +03003189 if( mbedtls_platform_memcmp( data + rec->data_len, mac_expect,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003190 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003191 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003192 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003193 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003194 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003195 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003196 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003197#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003198
3199 /*
3200 * Check length sanity
3201 */
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003202
3203 /* We know from above that data_len > minlen >= 0,
3204 * so the following check in particular implies that
3205 * data_len >= minlen + ivlen ( = minlen or 2 * minlen ). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003206 if( rec->data_len % transform->ivlen != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003207 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003208 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0",
Hanno Becker4c6876b2017-12-27 21:28:58 +00003209 rec->data_len, transform->ivlen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003210 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003211 }
3212
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003213#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003214 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00003215 * Initialize for prepended IV for block cipher in TLS v1.1 and up
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003216 */
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003217 if( mbedtls_ssl_ver_geq(
3218 mbedtls_ssl_transform_get_minor_ver( transform ),
3219 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003220 {
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003221 /* Safe because data_len >= minlen + ivlen = 2 * ivlen. */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003222 mbedtls_platform_memcpy( transform->iv_dec, data, transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003223
Hanno Becker4c6876b2017-12-27 21:28:58 +00003224 data += transform->ivlen;
3225 rec->data_offset += transform->ivlen;
3226 rec->data_len -= transform->ivlen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003227 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003228#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00003229
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003230 /* We still have data_len % ivlen == 0 and data_len >= ivlen here. */
3231
Hanno Becker4c6876b2017-12-27 21:28:58 +00003232 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
3233 transform->iv_dec, transform->ivlen,
3234 data, rec->data_len, data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02003235 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003236 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02003237 return( ret );
3238 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02003239
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003240 /* Double-check that length hasn't changed during decryption. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003241 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02003242 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003243 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3244 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02003245 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02003246
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003247#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003248 if( mbedtls_ssl_ver_lt(
3249 mbedtls_ssl_transform_get_minor_ver( transform ),
3250 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Paul Bakkercca5b812013-08-31 17:40:26 +02003251 {
3252 /*
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003253 * Save IV in SSL3 and TLS1, where CBC decryption of consecutive
3254 * records is equivalent to CBC decryption of the concatenation
3255 * of the records; in other words, IVs are maintained across
3256 * record decryptions.
Paul Bakkercca5b812013-08-31 17:40:26 +02003257 */
Teppo Järvelin91d79382019-10-02 09:09:31 +03003258 mbedtls_platform_memcpy( transform->iv_dec, transform->cipher_ctx_dec.iv,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003259 transform->ivlen );
Paul Bakker5121ce52009-01-03 21:22:43 +00003260 }
Paul Bakkercca5b812013-08-31 17:40:26 +02003261#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003262
Hanno Becker4c6876b2017-12-27 21:28:58 +00003263 /* Safe since data_len >= minlen + maclen + 1, so after having
3264 * subtracted at most minlen and maclen up to this point,
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003265 * data_len > 0 (because of data_len % ivlen == 0, it's actually
3266 * >= ivlen ). */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003267 padlen = data[rec->data_len - 1];
Paul Bakker45829992013-01-03 14:52:21 +01003268
Hanno Becker4c6876b2017-12-27 21:28:58 +00003269 if( auth_done == 1 )
3270 {
3271 correct *= ( rec->data_len >= padlen + 1 );
3272 padlen *= ( rec->data_len >= padlen + 1 );
3273 }
3274 else
Paul Bakker45829992013-01-03 14:52:21 +01003275 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003276#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003277 if( rec->data_len < transform->maclen + padlen + 1 )
3278 {
3279 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
3280 rec->data_len,
3281 transform->maclen,
3282 padlen + 1 ) );
3283 }
Paul Bakkerd66f0702013-01-31 16:57:45 +01003284#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00003285
3286 correct *= ( rec->data_len >= transform->maclen + padlen + 1 );
3287 padlen *= ( rec->data_len >= transform->maclen + padlen + 1 );
Paul Bakker45829992013-01-03 14:52:21 +01003288 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003289
Hanno Becker4c6876b2017-12-27 21:28:58 +00003290 padlen++;
3291
3292 /* Regardless of the validity of the padding,
3293 * we have data_len >= padlen here. */
3294
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003295#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01003296 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
3297 MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003298 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003299 if( padlen > transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00003300 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003301#if defined(MBEDTLS_SSL_DEBUG_ALL)
3302 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
Hanno Becker4c6876b2017-12-27 21:28:58 +00003303 "should be no more than %d",
3304 padlen, transform->ivlen ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01003305#endif
Paul Bakker45829992013-01-03 14:52:21 +01003306 correct = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00003307 }
3308 }
3309 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003310#endif /* MBEDTLS_SSL_PROTO_SSL3 */
3311#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3312 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003313 if( mbedtls_ssl_ver_gt(
3314 mbedtls_ssl_transform_get_minor_ver( transform ),
3315 MBEDTLS_SSL_MINOR_VERSION_0 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00003316 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003317 /* The padding check involves a series of up to 256
3318 * consecutive memory reads at the end of the record
3319 * plaintext buffer. In order to hide the length and
3320 * validity of the padding, always perform exactly
3321 * `min(256,plaintext_len)` reads (but take into account
3322 * only the last `padlen` bytes for the padding check). */
3323 size_t pad_count = 0;
3324 size_t real_count = 0;
3325 volatile unsigned char* const check = data;
Paul Bakkere47b34b2013-02-27 14:48:00 +01003326
Hanno Becker4c6876b2017-12-27 21:28:58 +00003327 /* Index of first padding byte; it has been ensured above
3328 * that the subtraction is safe. */
3329 size_t const padding_idx = rec->data_len - padlen;
3330 size_t const num_checks = rec->data_len <= 256 ? rec->data_len : 256;
3331 size_t const start_idx = rec->data_len - num_checks;
3332 size_t idx;
Paul Bakker956c9e02013-12-19 14:42:28 +01003333
Hanno Becker4c6876b2017-12-27 21:28:58 +00003334 for( idx = start_idx; idx < rec->data_len; idx++ )
Paul Bakkerca9c87e2013-09-25 18:52:37 +02003335 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003336 real_count |= ( idx >= padding_idx );
3337 pad_count += real_count * ( check[idx] == padlen - 1 );
Paul Bakkerca9c87e2013-09-25 18:52:37 +02003338 }
Hanno Becker4c6876b2017-12-27 21:28:58 +00003339 correct &= ( pad_count == padlen );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003340
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003341#if defined(MBEDTLS_SSL_DEBUG_ALL)
Paul Bakker66d5d072014-06-17 16:39:18 +02003342 if( padlen > 0 && correct == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003343 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01003344#endif
Paul Bakkere47b34b2013-02-27 14:48:00 +01003345 padlen &= correct * 0x1FF;
Paul Bakker5121ce52009-01-03 21:22:43 +00003346 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003347 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003348#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3349 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02003350 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003351 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3352 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02003353 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003354
Hanno Becker4c6876b2017-12-27 21:28:58 +00003355 /* If the padding was found to be invalid, padlen == 0
3356 * and the subtraction is safe. If the padding was found valid,
3357 * padlen hasn't been changed and the previous assertion
3358 * data_len >= padlen still holds. */
3359 rec->data_len -= padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00003360 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003361 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003362#endif /* MBEDTLS_CIPHER_MODE_CBC &&
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00003363 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C || MBEDTLS_ARIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003364 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003365 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3366 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02003367 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003368
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02003369#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003370 MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption",
Hanno Becker4c6876b2017-12-27 21:28:58 +00003371 data, rec->data_len );
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02003372#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003373
3374 /*
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01003375 * Authenticate if not done yet.
3376 * Compute the MAC regardless of the padding result (RFC4346, CBCTIME).
Paul Bakker5121ce52009-01-03 21:22:43 +00003377 */
Hanno Becker5cc04d52018-01-03 15:24:20 +00003378#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003379 if( auth_done == 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003380 {
Hanno Becker992b6872017-11-09 18:57:39 +00003381 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Paul Bakker1e5369c2013-12-19 16:40:57 +01003382
Hanno Becker4c6876b2017-12-27 21:28:58 +00003383 /* If the initial value of padlen was such that
3384 * data_len < maclen + padlen + 1, then padlen
3385 * got reset to 1, and the initial check
3386 * data_len >= minlen + maclen + 1
3387 * guarantees that at this point we still
3388 * have at least data_len >= maclen.
3389 *
3390 * If the initial value of padlen was such that
3391 * data_len >= maclen + padlen + 1, then we have
3392 * subtracted either padlen + 1 (if the padding was correct)
3393 * or 0 (if the padding was incorrect) since then,
3394 * hence data_len >= maclen in any case.
3395 */
3396 rec->data_len -= transform->maclen;
Hanno Beckere83efe62019-04-29 13:52:53 +01003397 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Paul Bakker5121ce52009-01-03 21:22:43 +00003398
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003399#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker0a92b812019-06-24 15:46:40 +01003400 if( mbedtls_ssl_transform_get_minor_ver( transform ) ==
3401 MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003402 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00003403 ssl_mac( &transform->md_ctx_dec,
3404 transform->mac_dec,
3405 data, rec->data_len,
3406 rec->ctr, rec->type,
3407 mac_expect );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003408 }
3409 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003410#endif /* MBEDTLS_SSL_PROTO_SSL3 */
3411#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3412 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01003413 if( mbedtls_ssl_ver_gt(
3414 mbedtls_ssl_transform_get_minor_ver( transform ),
3415 MBEDTLS_SSL_MINOR_VERSION_0 ) )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003416 {
3417 /*
3418 * Process MAC and always update for padlen afterwards to make
Gilles Peskine20b44082018-05-29 14:06:49 +02003419 * total time independent of padlen.
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003420 *
3421 * Known timing attacks:
3422 * - Lucky Thirteen (http://www.isg.rhul.ac.uk/tls/TLStiming.pdf)
3423 *
Gilles Peskine20b44082018-05-29 14:06:49 +02003424 * To compensate for different timings for the MAC calculation
3425 * depending on how much padding was removed (which is determined
3426 * by padlen), process extra_run more blocks through the hash
3427 * function.
3428 *
3429 * The formula in the paper is
3430 * extra_run = ceil( (L1-55) / 64 ) - ceil( (L2-55) / 64 )
3431 * where L1 is the size of the header plus the decrypted message
3432 * plus CBC padding and L2 is the size of the header plus the
3433 * decrypted message. This is for an underlying hash function
3434 * with 64-byte blocks.
3435 * We use ( (Lx+8) / 64 ) to handle 'negative Lx' values
3436 * correctly. We round down instead of up, so -56 is the correct
3437 * value for our calculations instead of -55.
3438 *
Gilles Peskine1bd9d582018-06-04 11:58:44 +02003439 * Repeat the formula rather than defining a block_size variable.
3440 * This avoids requiring division by a variable at runtime
3441 * (which would be marginally less efficient and would require
3442 * linking an extra division function in some builds).
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003443 */
3444 size_t j, extra_run = 0;
Hanno Becker4c6876b2017-12-27 21:28:58 +00003445 unsigned char tmp[MBEDTLS_MD_MAX_BLOCK_SIZE];
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003446
3447 /*
3448 * The next two sizes are the minimum and maximum values of
3449 * in_msglen over all padlen values.
3450 *
3451 * They're independent of padlen, since we previously did
Hanno Becker6d3db0f2019-07-10 13:55:25 +01003452 * data_len -= padlen.
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003453 *
3454 * Note that max_len + maclen is never more than the buffer
3455 * length, as we previously did in_msglen -= maclen too.
3456 */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003457 const size_t max_len = rec->data_len + padlen;
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003458 const size_t min_len = ( max_len > 256 ) ? max_len - 256 : 0;
3459
Hanno Becker4c6876b2017-12-27 21:28:58 +00003460 memset( tmp, 0, sizeof( tmp ) );
3461
Hanno Beckera5cedbc2019-07-17 11:21:02 +01003462 switch( mbedtls_md_get_type(
3463 mbedtls_md_get_handle( &transform->md_ctx_dec ) ) )
Gilles Peskine20b44082018-05-29 14:06:49 +02003464 {
Gilles Peskined0e55a42018-06-04 12:03:30 +02003465#if defined(MBEDTLS_MD5_C) || defined(MBEDTLS_SHA1_C) || \
3466 defined(MBEDTLS_SHA256_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02003467 case MBEDTLS_MD_MD5:
3468 case MBEDTLS_MD_SHA1:
Gilles Peskine20b44082018-05-29 14:06:49 +02003469 case MBEDTLS_MD_SHA256:
Gilles Peskine20b44082018-05-29 14:06:49 +02003470 /* 8 bytes of message size, 64-byte compression blocks */
Hanno Beckere83efe62019-04-29 13:52:53 +01003471 extra_run =
3472 ( add_data_len + rec->data_len + padlen + 8 ) / 64 -
3473 ( add_data_len + rec->data_len + 8 ) / 64;
Gilles Peskine20b44082018-05-29 14:06:49 +02003474 break;
3475#endif
Gilles Peskinea7fe25d2018-06-04 12:01:18 +02003476#if defined(MBEDTLS_SHA512_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02003477 case MBEDTLS_MD_SHA384:
Gilles Peskine20b44082018-05-29 14:06:49 +02003478 /* 16 bytes of message size, 128-byte compression blocks */
Hanno Beckere83efe62019-04-29 13:52:53 +01003479 extra_run =
3480 ( add_data_len + rec->data_len + padlen + 16 ) / 128 -
3481 ( add_data_len + rec->data_len + 16 ) / 128;
Gilles Peskine20b44082018-05-29 14:06:49 +02003482 break;
3483#endif
3484 default:
Gilles Peskine5c389842018-06-04 12:02:43 +02003485 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Gilles Peskine20b44082018-05-29 14:06:49 +02003486 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3487 }
Paul Bakkere47b34b2013-02-27 14:48:00 +01003488
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003489 extra_run &= correct * 0xFF;
Paul Bakkere47b34b2013-02-27 14:48:00 +01003490
Hanno Beckere83efe62019-04-29 13:52:53 +01003491 mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
3492 add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00003493 mbedtls_md_hmac_update( &transform->md_ctx_dec, data,
3494 rec->data_len );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003495 /* Make sure we access everything even when padlen > 0. This
3496 * makes the synchronisation requirements for just-in-time
3497 * Prime+Probe attacks much tighter and hopefully impractical. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003498 ssl_read_memory( data + rec->data_len, padlen );
3499 mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003500
3501 /* Call mbedtls_md_process at least once due to cache attacks
3502 * that observe whether md_process() was called of not */
Manuel Pégourié-Gonnard47fede02015-04-29 01:35:48 +02003503 for( j = 0; j < extra_run + 1; j++ )
Hanno Becker4c6876b2017-12-27 21:28:58 +00003504 mbedtls_md_process( &transform->md_ctx_dec, tmp );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003505
Hanno Becker4c6876b2017-12-27 21:28:58 +00003506 mbedtls_md_hmac_reset( &transform->md_ctx_dec );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003507
3508 /* Make sure we access all the memory that could contain the MAC,
3509 * before we check it in the next code block. This makes the
3510 * synchronisation requirements for just-in-time Prime+Probe
3511 * attacks much tighter and hopefully impractical. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00003512 ssl_read_memory( data + min_len,
3513 max_len - min_len + transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003514 }
3515 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003516#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3517 MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003518 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003519 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3520 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003521 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003522
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003523#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker4c6876b2017-12-27 21:28:58 +00003524 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect, transform->maclen );
3525 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len, transform->maclen );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02003526#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003527
Teppo Järvelin707ceb82019-10-04 07:49:39 +03003528 if( mbedtls_platform_memcmp( data + rec->data_len, mac_expect,
Hanno Becker4c6876b2017-12-27 21:28:58 +00003529 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003530 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003531#if defined(MBEDTLS_SSL_DEBUG_ALL)
3532 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Paul Bakkere47b34b2013-02-27 14:48:00 +01003533#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003534 correct = 0;
3535 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003536 auth_done++;
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02003537 }
Hanno Beckerdd3ab132018-10-17 14:43:14 +01003538
3539 /*
3540 * Finally check the correct flag
3541 */
3542 if( correct == 0 )
3543 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Hanno Becker5cc04d52018-01-03 15:24:20 +00003544#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003545
3546 /* Make extra sure authentication was performed, exactly once */
3547 if( auth_done != 1 )
3548 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003549 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3550 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01003551 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003552
Hanno Beckera5a2b082019-05-15 14:03:01 +01003553#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker92c930f2019-04-29 17:31:37 +01003554 if( rec->cid_len != 0 )
3555 {
3556 ret = ssl_cid_parse_inner_plaintext( data, &rec->data_len,
3557 &rec->type );
3558 if( ret != 0 )
3559 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3560 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01003561#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker92c930f2019-04-29 17:31:37 +01003562
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003563 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003564
3565 return( 0 );
3566}
3567
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01003568#undef MAC_NONE
3569#undef MAC_PLAINTEXT
3570#undef MAC_CIPHERTEXT
3571
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003572#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker2770fbd2012-07-03 13:30:23 +00003573/*
3574 * Compression/decompression functions
3575 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003576static int ssl_compress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003577{
3578 int ret;
3579 unsigned char *msg_post = ssl->out_msg;
Andrzej Kurek5462e022018-04-20 07:58:53 -04003580 ptrdiff_t bytes_written = ssl->out_msg - ssl->out_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003581 size_t len_pre = ssl->out_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02003582 unsigned char *msg_pre = ssl->compress_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003584 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003585
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02003586 if( len_pre == 0 )
3587 return( 0 );
3588
Teppo Järvelin91d79382019-10-02 09:09:31 +03003589 mbedtls_platform_memcpy( msg_pre, ssl->out_msg, len_pre );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003590
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003591 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003592 ssl->out_msglen ) );
3593
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003594 MBEDTLS_SSL_DEBUG_BUF( 4, "before compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003595 ssl->out_msg, ssl->out_msglen );
3596
Paul Bakker48916f92012-09-16 19:57:18 +00003597 ssl->transform_out->ctx_deflate.next_in = msg_pre;
3598 ssl->transform_out->ctx_deflate.avail_in = len_pre;
3599 ssl->transform_out->ctx_deflate.next_out = msg_post;
Angus Grattond8213d02016-05-25 20:56:48 +10003600 ssl->transform_out->ctx_deflate.avail_out = MBEDTLS_SSL_OUT_BUFFER_LEN - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003601
Paul Bakker48916f92012-09-16 19:57:18 +00003602 ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003603 if( ret != Z_OK )
3604 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003605 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform compression (%d)", ret ) );
3606 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003607 }
3608
Angus Grattond8213d02016-05-25 20:56:48 +10003609 ssl->out_msglen = MBEDTLS_SSL_OUT_BUFFER_LEN -
Andrzej Kurek5462e022018-04-20 07:58:53 -04003610 ssl->transform_out->ctx_deflate.avail_out - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003611
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003612 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003613 ssl->out_msglen ) );
3614
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003615 MBEDTLS_SSL_DEBUG_BUF( 4, "after compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003616 ssl->out_msg, ssl->out_msglen );
3617
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003618 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003619
3620 return( 0 );
3621}
3622
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003623static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003624{
3625 int ret;
3626 unsigned char *msg_post = ssl->in_msg;
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003627 ptrdiff_t header_bytes = ssl->in_msg - ssl->in_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003628 size_t len_pre = ssl->in_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02003629 unsigned char *msg_pre = ssl->compress_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003630
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003631 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003632
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02003633 if( len_pre == 0 )
3634 return( 0 );
3635
Teppo Järvelin91d79382019-10-02 09:09:31 +03003636 mbedtls_platform_memcpy( msg_pre, ssl->in_msg, len_pre );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003637
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003638 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003639 ssl->in_msglen ) );
3640
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003641 MBEDTLS_SSL_DEBUG_BUF( 4, "before decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003642 ssl->in_msg, ssl->in_msglen );
3643
Paul Bakker48916f92012-09-16 19:57:18 +00003644 ssl->transform_in->ctx_inflate.next_in = msg_pre;
3645 ssl->transform_in->ctx_inflate.avail_in = len_pre;
3646 ssl->transform_in->ctx_inflate.next_out = msg_post;
Angus Grattond8213d02016-05-25 20:56:48 +10003647 ssl->transform_in->ctx_inflate.avail_out = MBEDTLS_SSL_IN_BUFFER_LEN -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003648 header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003649
Paul Bakker48916f92012-09-16 19:57:18 +00003650 ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003651 if( ret != Z_OK )
3652 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003653 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform decompression (%d)", ret ) );
3654 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003655 }
3656
Angus Grattond8213d02016-05-25 20:56:48 +10003657 ssl->in_msglen = MBEDTLS_SSL_IN_BUFFER_LEN -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04003658 ssl->transform_in->ctx_inflate.avail_out - header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00003659
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003660 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003661 ssl->in_msglen ) );
3662
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003663 MBEDTLS_SSL_DEBUG_BUF( 4, "after decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00003664 ssl->in_msg, ssl->in_msglen );
3665
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003666 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003667
3668 return( 0 );
3669}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003670#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00003671
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003672#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
3673static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02003674
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003675#if defined(MBEDTLS_SSL_PROTO_DTLS)
3676static int ssl_resend_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02003677{
3678 /* If renegotiation is not enforced, retransmit until we would reach max
3679 * timeout if we were using the usual handshake doubling scheme */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003680 if( ssl->conf->renego_max_records < 0 )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02003681 {
Hanno Becker1f835fa2019-06-13 10:14:59 +01003682 uint32_t ratio =
3683 mbedtls_ssl_conf_get_hs_timeout_max( ssl->conf ) /
3684 mbedtls_ssl_conf_get_hs_timeout_min( ssl->conf ) + 1;
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02003685 unsigned char doublings = 1;
3686
3687 while( ratio != 0 )
3688 {
3689 ++doublings;
3690 ratio >>= 1;
3691 }
3692
3693 if( ++ssl->renego_records_seen > doublings )
3694 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02003695 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02003696 return( 0 );
3697 }
3698 }
3699
3700 return( ssl_write_hello_request( ssl ) );
3701}
3702#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003703#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02003704
Paul Bakker5121ce52009-01-03 21:22:43 +00003705/*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003706 * Fill the input message buffer by appending data to it.
3707 * The amount of data already fetched is in ssl->in_left.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003708 *
3709 * If we return 0, is it guaranteed that (at least) nb_want bytes are
3710 * available (from this read and/or a previous one). Otherwise, an error code
3711 * is returned (possibly EOF or WANT_READ).
3712 *
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003713 * With stream transport (TLS) on success ssl->in_left == nb_want, but
3714 * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
3715 * since we always read a whole datagram at once.
3716 *
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02003717 * For DTLS, it is up to the caller to set ssl->next_record_offset when
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003718 * they're done reading a record.
Paul Bakker5121ce52009-01-03 21:22:43 +00003719 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003720int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want )
Paul Bakker5121ce52009-01-03 21:22:43 +00003721{
Paul Bakker23986e52011-04-24 08:57:21 +00003722 int ret;
3723 size_t len;
Paul Bakker5121ce52009-01-03 21:22:43 +00003724
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003725 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003726
Hanno Beckera58a8962019-06-13 16:11:15 +01003727 if( mbedtls_ssl_get_recv( ssl ) == NULL &&
3728 mbedtls_ssl_get_recv_timeout( ssl ) == NULL )
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02003729 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003730 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01003731 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003732 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02003733 }
3734
Angus Grattond8213d02016-05-25 20:56:48 +10003735 if( nb_want > MBEDTLS_SSL_IN_BUFFER_LEN - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02003736 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003737 MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
3738 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02003739 }
3740
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003741#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01003742 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00003743 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02003744 uint32_t timeout;
3745
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02003746 /* Just to be sure */
Hanno Becker0ae6b242019-06-13 16:45:36 +01003747 if( mbedtls_ssl_get_set_timer( ssl ) == NULL ||
3748 mbedtls_ssl_get_get_timer( ssl ) == NULL )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02003749 {
3750 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
3751 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
3752 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3753 }
3754
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003755 /*
3756 * The point is, we need to always read a full datagram at once, so we
3757 * sometimes read more then requested, and handle the additional data.
3758 * It could be the rest of the current record (while fetching the
3759 * header) and/or some other records in the same datagram.
3760 */
3761
3762 /*
3763 * Move to the next record in the already read datagram if applicable
3764 */
3765 if( ssl->next_record_offset != 0 )
3766 {
3767 if( ssl->in_left < ssl->next_record_offset )
3768 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003769 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3770 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003771 }
3772
3773 ssl->in_left -= ssl->next_record_offset;
3774
3775 if( ssl->in_left != 0 )
3776 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003777 MBEDTLS_SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003778 ssl->next_record_offset ) );
3779 memmove( ssl->in_hdr,
3780 ssl->in_hdr + ssl->next_record_offset,
3781 ssl->in_left );
3782 }
3783
3784 ssl->next_record_offset = 0;
3785 }
3786
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003787 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Paul Bakker5121ce52009-01-03 21:22:43 +00003788 ssl->in_left, nb_want ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003789
3790 /*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003791 * Done if we already have enough data.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003792 */
3793 if( nb_want <= ssl->in_left)
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003794 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003795 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003796 return( 0 );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003797 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003798
3799 /*
Antonin Décimod5f47592019-01-23 15:24:37 +01003800 * A record can't be split across datagrams. If we need to read but
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003801 * are not at the beginning of a new record, the caller did something
3802 * wrong.
3803 */
3804 if( ssl->in_left != 0 )
3805 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003806 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3807 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003808 }
3809
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003810 /*
3811 * Don't even try to read if time's out already.
3812 * This avoids by-passing the timer when repeatedly receiving messages
3813 * that will end up being dropped.
3814 */
3815 if( ssl_check_timer( ssl ) != 0 )
Hanno Beckere65ce782017-05-22 14:47:48 +01003816 {
3817 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timer has expired" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01003818 ret = MBEDTLS_ERR_SSL_TIMEOUT;
Hanno Beckere65ce782017-05-22 14:47:48 +01003819 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02003820 else
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003821 {
Angus Grattond8213d02016-05-25 20:56:48 +10003822 len = MBEDTLS_SSL_IN_BUFFER_LEN - ( ssl->in_hdr - ssl->in_buf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003823
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003824 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003825 timeout = ssl->handshake->retransmit_timeout;
3826 else
Hanno Becker1f835fa2019-06-13 10:14:59 +01003827 timeout = mbedtls_ssl_conf_get_read_timeout( ssl->conf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003828
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003829 MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003830
Hanno Beckera58a8962019-06-13 16:11:15 +01003831 if( mbedtls_ssl_get_recv_timeout( ssl ) != NULL )
3832 {
3833 ret = mbedtls_ssl_get_recv_timeout( ssl )
3834 ( ssl->p_bio, ssl->in_hdr, len, timeout );
3835 }
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003836 else
Hanno Beckera58a8962019-06-13 16:11:15 +01003837 {
3838 ret = mbedtls_ssl_get_recv( ssl )
3839 ( ssl->p_bio, ssl->in_hdr, len );
3840 }
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003841
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003842 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003843
3844 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003845 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003846 }
3847
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01003848 if( ret == MBEDTLS_ERR_SSL_TIMEOUT )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003849 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003850 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003851 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003852
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003853 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02003854 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02003855 if( ssl_double_retransmit_timeout( ssl ) != 0 )
3856 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003857 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01003858 return( MBEDTLS_ERR_SSL_TIMEOUT );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02003859 }
3860
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003861 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02003862 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003863 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02003864 return( ret );
3865 }
3866
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01003867 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02003868 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003869#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker2d9623f2019-06-13 12:07:05 +01003870 else if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
3871 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003872 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02003873 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02003874 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02003875 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003876 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02003877 return( ret );
3878 }
3879
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01003880 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02003881 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003882#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003883 }
3884
Paul Bakker5121ce52009-01-03 21:22:43 +00003885 if( ret < 0 )
3886 return( ret );
3887
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003888 ssl->in_left = ret;
3889 }
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01003890 MBEDTLS_SSL_TRANSPORT_ELSE
3891#endif /* MBEDTLS_SSL_PROTO_DTLS */
3892#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003893 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003894 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003895 ssl->in_left, nb_want ) );
3896
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003897 while( ssl->in_left < nb_want )
3898 {
3899 len = nb_want - ssl->in_left;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02003900
3901 if( ssl_check_timer( ssl ) != 0 )
3902 ret = MBEDTLS_ERR_SSL_TIMEOUT;
3903 else
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02003904 {
Hanno Beckera58a8962019-06-13 16:11:15 +01003905 if( mbedtls_ssl_get_recv_timeout( ssl ) != NULL )
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02003906 {
Hanno Beckera58a8962019-06-13 16:11:15 +01003907 ret = mbedtls_ssl_get_recv_timeout( ssl )( ssl->p_bio,
3908 ssl->in_hdr + ssl->in_left, len,
3909 mbedtls_ssl_conf_get_read_timeout( ssl->conf ) );
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02003910 }
3911 else
3912 {
Hanno Beckera58a8962019-06-13 16:11:15 +01003913 ret = mbedtls_ssl_get_recv( ssl )( ssl->p_bio,
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02003914 ssl->in_hdr + ssl->in_left, len );
3915 }
3916 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003917
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003918 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02003919 ssl->in_left, nb_want ) );
3920 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003921
3922 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003923 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003924
3925 if( ret < 0 )
3926 return( ret );
3927
mohammad160352aecb92018-03-28 23:41:40 -07003928 if ( (size_t)ret > len || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16035bd15cb2018-02-28 04:30:59 -08003929 {
Darryl Green11999bb2018-03-13 15:22:58 +00003930 MBEDTLS_SSL_DEBUG_MSG( 1,
3931 ( "f_recv returned %d bytes but only %lu were requested",
mohammad160319d392b2018-04-02 07:25:26 -07003932 ret, (unsigned long)len ) );
mohammad16035bd15cb2018-02-28 04:30:59 -08003933 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3934 }
3935
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003936 ssl->in_left += ret;
3937 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003938 }
Manuel Pégourié-Gonnard25838b72019-03-19 10:23:56 +01003939#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakker5121ce52009-01-03 21:22:43 +00003940
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003941 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003942
3943 return( 0 );
3944}
3945
3946/*
3947 * Flush any data not yet written
3948 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003949int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003950{
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01003951 int ret;
Hanno Becker04484622018-08-06 09:49:38 +01003952 unsigned char *buf;
Paul Bakker5121ce52009-01-03 21:22:43 +00003953
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003954 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003955
Hanno Beckera58a8962019-06-13 16:11:15 +01003956 if( mbedtls_ssl_get_send( ssl ) == NULL )
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02003957 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003958 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01003959 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003960 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02003961 }
3962
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01003963 /* Avoid incrementing counter if data is flushed */
3964 if( ssl->out_left == 0 )
3965 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003966 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01003967 return( 0 );
3968 }
3969
Paul Bakker5121ce52009-01-03 21:22:43 +00003970 while( ssl->out_left > 0 )
3971 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003972 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
Hanno Becker43395762019-05-03 14:46:38 +01003973 mbedtls_ssl_out_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003974
Hanno Becker2b1e3542018-08-06 11:19:13 +01003975 buf = ssl->out_hdr - ssl->out_left;
Hanno Beckera58a8962019-06-13 16:11:15 +01003976 ret = mbedtls_ssl_get_send( ssl )( ssl->p_bio, buf, ssl->out_left );
Paul Bakker186751d2012-05-08 13:16:14 +00003977
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003978 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003979
3980 if( ret <= 0 )
3981 return( ret );
3982
mohammad160352aecb92018-03-28 23:41:40 -07003983 if( (size_t)ret > ssl->out_left || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16034bbaeb42018-02-22 04:29:04 -08003984 {
Darryl Green11999bb2018-03-13 15:22:58 +00003985 MBEDTLS_SSL_DEBUG_MSG( 1,
3986 ( "f_send returned %d bytes but only %lu bytes were sent",
mohammad160319d392b2018-04-02 07:25:26 -07003987 ret, (unsigned long)ssl->out_left ) );
mohammad16034bbaeb42018-02-22 04:29:04 -08003988 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3989 }
3990
Paul Bakker5121ce52009-01-03 21:22:43 +00003991 ssl->out_left -= ret;
3992 }
3993
Hanno Becker2b1e3542018-08-06 11:19:13 +01003994#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02003995 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01003996 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01003997 ssl->out_hdr = ssl->out_buf;
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01003998 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02003999 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Becker2b1e3542018-08-06 11:19:13 +01004000#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004001#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +01004002 {
4003 ssl->out_hdr = ssl->out_buf + 8;
4004 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004005#endif
Hanno Becker2b1e3542018-08-06 11:19:13 +01004006 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01004007
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004008 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004009
4010 return( 0 );
4011}
4012
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004013/*
4014 * Functions to handle the DTLS retransmission state machine
4015 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004016#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004017/*
4018 * Append current handshake message to current outgoing flight
4019 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004020static int ssl_flight_append( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004021{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004022 mbedtls_ssl_flight_item *msg;
Hanno Becker3b235902018-08-06 09:54:53 +01004023 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_flight_append" ) );
4024 MBEDTLS_SSL_DEBUG_BUF( 4, "message appended to flight",
4025 ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004026
4027 /* Allocate space for current message */
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02004028 if( ( msg = mbedtls_calloc( 1, sizeof( mbedtls_ssl_flight_item ) ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004029 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02004030 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004031 sizeof( mbedtls_ssl_flight_item ) ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02004032 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004033 }
4034
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02004035 if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004036 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02004037 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl->out_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004038 mbedtls_free( msg );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02004039 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004040 }
4041
4042 /* Copy current handshake message with headers */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004043 mbedtls_platform_memcpy( msg->p, ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004044 msg->len = ssl->out_msglen;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004045 msg->type = ssl->out_msgtype;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004046 msg->next = NULL;
4047
4048 /* Append to the current flight */
4049 if( ssl->handshake->flight == NULL )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004050 ssl->handshake->flight = msg;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004051 else
4052 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004053 mbedtls_ssl_flight_item *cur = ssl->handshake->flight;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004054 while( cur->next != NULL )
4055 cur = cur->next;
4056 cur->next = msg;
4057 }
4058
Hanno Becker3b235902018-08-06 09:54:53 +01004059 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_flight_append" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004060 return( 0 );
4061}
4062
4063/*
4064 * Free the current flight of handshake messages
4065 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004066static void ssl_flight_free( mbedtls_ssl_flight_item *flight )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004067{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004068 mbedtls_ssl_flight_item *cur = flight;
4069 mbedtls_ssl_flight_item *next;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004070
4071 while( cur != NULL )
4072 {
4073 next = cur->next;
4074
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004075 mbedtls_free( cur->p );
4076 mbedtls_free( cur );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004077
4078 cur = next;
4079 }
4080}
4081
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004082#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4083static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02004084#endif
4085
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004086/*
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004087 * Swap transform_out and out_ctr with the alternative ones
4088 */
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004089static int ssl_swap_epochs( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004090{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004091 mbedtls_ssl_transform *tmp_transform;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004092 unsigned char tmp_out_ctr[8];
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004093#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4094 int ret;
4095#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004096
4097 if( ssl->transform_out == ssl->handshake->alt_transform_out )
4098 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004099 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004100 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004101 }
4102
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004103 MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004104
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004105 /* Swap transforms */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004106 tmp_transform = ssl->transform_out;
4107 ssl->transform_out = ssl->handshake->alt_transform_out;
4108 ssl->handshake->alt_transform_out = tmp_transform;
4109
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004110 /* Swap epoch + sequence_number */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004111 mbedtls_platform_memcpy( tmp_out_ctr, ssl->cur_out_ctr, 8 );
4112 mbedtls_platform_memcpy( ssl->cur_out_ctr, ssl->handshake->alt_out_ctr, 8 );
4113 mbedtls_platform_memcpy( ssl->handshake->alt_out_ctr, tmp_out_ctr, 8 );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004114
4115 /* Adjust to the newly activated transform */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01004116 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004117
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004118#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4119 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004120 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004121 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004122 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004123 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
4124 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004125 }
4126 }
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004127#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
4128
4129 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004130}
4131
4132/*
4133 * Retransmit the current flight of messages.
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004134 */
4135int mbedtls_ssl_resend( mbedtls_ssl_context *ssl )
4136{
4137 int ret = 0;
4138
4139 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_resend" ) );
4140
4141 ret = mbedtls_ssl_flight_transmit( ssl );
4142
4143 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) );
4144
4145 return( ret );
4146}
4147
4148/*
4149 * Transmit or retransmit the current flight of messages.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004150 *
4151 * Need to remember the current message in case flush_output returns
4152 * WANT_WRITE, causing us to exit this function and come back later.
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004153 * This function must be called until state is no longer SENDING.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004154 */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004155int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004156{
Hanno Becker67bc7c32018-08-06 11:33:50 +01004157 int ret;
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004158 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004159
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004160 if( ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004161 {
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004162 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialise flight transmission" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004163
4164 ssl->handshake->cur_msg = ssl->handshake->flight;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004165 ssl->handshake->cur_msg_p = ssl->handshake->flight->p + 12;
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004166 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4167 return( ret );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004168
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004169 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004170 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004171
4172 while( ssl->handshake->cur_msg != NULL )
4173 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004174 size_t max_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004175 const mbedtls_ssl_flight_item * const cur = ssl->handshake->cur_msg;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004176
Hanno Beckere1dcb032018-08-17 16:47:58 +01004177 int const is_finished =
4178 ( cur->type == MBEDTLS_SSL_MSG_HANDSHAKE &&
4179 cur->p[0] == MBEDTLS_SSL_HS_FINISHED );
4180
Hanno Becker04da1892018-08-14 13:22:10 +01004181 uint8_t const force_flush = ssl->disable_datagram_packing == 1 ?
4182 SSL_FORCE_FLUSH : SSL_DONT_FORCE_FLUSH;
4183
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004184 /* Swap epochs before sending Finished: we can't do it after
4185 * sending ChangeCipherSpec, in case write returns WANT_READ.
4186 * Must be done before copying, may change out_msg pointer */
Hanno Beckere1dcb032018-08-17 16:47:58 +01004187 if( is_finished && ssl->handshake->cur_msg_p == ( cur->p + 12 ) )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004188 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004189 MBEDTLS_SSL_DEBUG_MSG( 2, ( "swap epochs to send finished message" ) );
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004190 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4191 return( ret );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02004192 }
4193
Hanno Becker67bc7c32018-08-06 11:33:50 +01004194 ret = ssl_get_remaining_payload_in_datagram( ssl );
4195 if( ret < 0 )
4196 return( ret );
4197 max_frag_len = (size_t) ret;
4198
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004199 /* CCS is copied as is, while HS messages may need fragmentation */
4200 if( cur->type == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
4201 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004202 if( max_frag_len == 0 )
4203 {
4204 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4205 return( ret );
4206
4207 continue;
4208 }
4209
Teppo Järvelin91d79382019-10-02 09:09:31 +03004210 mbedtls_platform_memcpy( ssl->out_msg, cur->p, cur->len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01004211 ssl->out_msglen = cur->len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004212 ssl->out_msgtype = cur->type;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004213
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004214 /* Update position inside current message */
4215 ssl->handshake->cur_msg_p += cur->len;
4216 }
4217 else
4218 {
4219 const unsigned char * const p = ssl->handshake->cur_msg_p;
4220 const size_t hs_len = cur->len - 12;
4221 const size_t frag_off = p - ( cur->p + 12 );
4222 const size_t rem_len = hs_len - frag_off;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004223 size_t cur_hs_frag_len, max_hs_frag_len;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004224
Hanno Beckere1dcb032018-08-17 16:47:58 +01004225 if( ( max_frag_len < 12 ) || ( max_frag_len == 12 && hs_len != 0 ) )
Manuel Pégourié-Gonnarda1071a52018-08-20 11:56:14 +02004226 {
Hanno Beckere1dcb032018-08-17 16:47:58 +01004227 if( is_finished )
Andrzej Kurek825ebd42020-05-18 11:47:25 -04004228 {
4229 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
4230 return( ret );
4231 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004232
Hanno Becker67bc7c32018-08-06 11:33:50 +01004233 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4234 return( ret );
4235
4236 continue;
4237 }
4238 max_hs_frag_len = max_frag_len - 12;
4239
4240 cur_hs_frag_len = rem_len > max_hs_frag_len ?
4241 max_hs_frag_len : rem_len;
4242
4243 if( frag_off == 0 && cur_hs_frag_len != hs_len )
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004244 {
4245 MBEDTLS_SSL_DEBUG_MSG( 2, ( "fragmenting handshake message (%u > %u)",
Hanno Becker67bc7c32018-08-06 11:33:50 +01004246 (unsigned) cur_hs_frag_len,
4247 (unsigned) max_hs_frag_len ) );
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02004248 }
Manuel Pégourié-Gonnardb747c6c2018-08-12 13:28:53 +02004249
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004250 /* Messages are stored with handshake headers as if not fragmented,
4251 * copy beginning of headers then fill fragmentation fields.
4252 * Handshake headers: type(1) len(3) seq(2) f_off(3) f_len(3) */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004253 mbedtls_platform_memcpy( ssl->out_msg, cur->p, 6 );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004254
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004255 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[6], frag_off );
4256 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[9],
4257 cur_hs_frag_len );
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004258
4259 MBEDTLS_SSL_DEBUG_BUF( 3, "handshake header", ssl->out_msg, 12 );
4260
Hanno Becker3f7b9732018-08-28 09:53:25 +01004261 /* Copy the handshake message content and set records fields */
Teppo Järvelin91d79382019-10-02 09:09:31 +03004262 mbedtls_platform_memcpy( ssl->out_msg + 12, p, cur_hs_frag_len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01004263 ssl->out_msglen = cur_hs_frag_len + 12;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004264 ssl->out_msgtype = cur->type;
4265
4266 /* Update position inside current message */
Hanno Becker67bc7c32018-08-06 11:33:50 +01004267 ssl->handshake->cur_msg_p += cur_hs_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004268 }
4269
4270 /* If done with the current message move to the next one if any */
4271 if( ssl->handshake->cur_msg_p >= cur->p + cur->len )
4272 {
4273 if( cur->next != NULL )
4274 {
4275 ssl->handshake->cur_msg = cur->next;
4276 ssl->handshake->cur_msg_p = cur->next->p + 12;
4277 }
4278 else
4279 {
4280 ssl->handshake->cur_msg = NULL;
4281 ssl->handshake->cur_msg_p = NULL;
4282 }
4283 }
4284
4285 /* Actually send the message out */
Hanno Becker04da1892018-08-14 13:22:10 +01004286 if( ( ret = mbedtls_ssl_write_record( ssl, force_flush ) ) != 0 )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004287 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004288 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004289 return( ret );
4290 }
4291 }
4292
Hanno Becker67bc7c32018-08-06 11:33:50 +01004293 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4294 return( ret );
4295
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02004296 /* Update state and set timer */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004297 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
4298 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard23b7b702014-09-25 13:50:12 +02004299 else
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004300 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004301 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02004302 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
4303 }
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004304
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004305 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004306
4307 return( 0 );
4308}
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004309
4310/*
4311 * To be called when the last message of an incoming flight is received.
4312 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004313void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004314{
4315 /* We won't need to resend that one any more */
4316 ssl_flight_free( ssl->handshake->flight );
4317 ssl->handshake->flight = NULL;
4318 ssl->handshake->cur_msg = NULL;
4319
4320 /* The next incoming flight will start with this msg_seq */
4321 ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq;
4322
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004323 /* We don't want to remember CCS's across flight boundaries. */
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01004324 ssl->handshake->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004325
Hanno Becker0271f962018-08-16 13:23:47 +01004326 /* Clear future message buffering structure. */
4327 ssl_buffering_free( ssl );
4328
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02004329 /* Cancel timer */
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004330 ssl_set_timer( ssl, 0 );
4331
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004332 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4333 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004334 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004335 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004336 }
4337 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004338 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004339}
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004340
4341/*
4342 * To be called when the last message of an outgoing flight is send.
4343 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004344void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004345{
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02004346 ssl_reset_retransmit_timeout( ssl );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02004347 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004348
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004349 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4350 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004351 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004352 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004353 }
4354 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004355 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02004356}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004357#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004358
Paul Bakker5121ce52009-01-03 21:22:43 +00004359/*
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004360 * Handshake layer functions
Paul Bakker5121ce52009-01-03 21:22:43 +00004361 */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004362
4363/*
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004364 * Write (DTLS: or queue) current handshake (including CCS) message.
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004365 *
4366 * - fill in handshake headers
4367 * - update handshake checksum
4368 * - DTLS: save message for resending
4369 * - then pass to the record layer
4370 *
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004371 * DTLS: except for HelloRequest, messages are only queued, and will only be
4372 * actually sent when calling flight_transmit() or resend().
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004373 *
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004374 * Inputs:
4375 * - ssl->out_msglen: 4 + actual handshake message len
4376 * (4 is the size of handshake headers for TLS)
4377 * - ssl->out_msg[0]: the handshake type (ClientHello, ServerHello, etc)
4378 * - ssl->out_msg + 4: the handshake message body
4379 *
Manuel Pégourié-Gonnard065a2a32018-08-20 11:09:26 +02004380 * Outputs, ie state before passing to flight_append() or write_record():
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004381 * - ssl->out_msglen: the length of the record contents
4382 * (including handshake headers but excluding record headers)
4383 * - ssl->out_msg: the record contents (handshake headers + content)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004384 */
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004385int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004386{
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004387 int ret;
4388 const size_t hs_len = ssl->out_msglen - 4;
4389 const unsigned char hs_type = ssl->out_msg[0];
Paul Bakker5121ce52009-01-03 21:22:43 +00004390
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004391 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write handshake message" ) );
4392
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004393 /*
4394 * Sanity checks
4395 */
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004396 if( ssl->out_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE &&
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004397 ssl->out_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
4398 {
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004399 /* In SSLv3, the client might send a NoCertificate alert. */
4400#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2881d802019-05-22 14:44:53 +01004401 if( ! ( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 &&
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004402 ssl->out_msgtype == MBEDTLS_SSL_MSG_ALERT &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01004403 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
4404 MBEDTLS_SSL_IS_CLIENT ) )
Hanno Beckerc83d2b32018-08-22 16:05:47 +01004405#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
4406 {
4407 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4408 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4409 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004410 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004411
Hanno Beckerf6d6e302018-11-07 11:57:51 +00004412 /* Whenever we send anything different from a
4413 * HelloRequest we should be in a handshake - double check. */
4414 if( ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4415 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) &&
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004416 ssl->handshake == NULL )
4417 {
4418 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4419 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4420 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004421
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004422#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004423 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004424 ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004425 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004426 {
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004427 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4428 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004429 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004430#endif
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004431
Hanno Beckerb50a2532018-08-06 11:52:54 +01004432 /* Double-check that we did not exceed the bounds
4433 * of the outgoing record buffer.
4434 * This should never fail as the various message
4435 * writing functions must obey the bounds of the
4436 * outgoing record buffer, but better be safe.
4437 *
4438 * Note: We deliberately do not check for the MTU or MFL here.
4439 */
4440 if( ssl->out_msglen > MBEDTLS_SSL_OUT_CONTENT_LEN )
4441 {
4442 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record too large: "
4443 "size %u, maximum %u",
4444 (unsigned) ssl->out_msglen,
4445 (unsigned) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
4446 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4447 }
4448
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004449 /*
4450 * Fill handshake headers
4451 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004452 if( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00004453 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004454 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[1], hs_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00004455
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004456 /*
4457 * DTLS has additional fields in the Handshake layer,
4458 * between the length field and the actual payload:
4459 * uint16 message_seq;
4460 * uint24 fragment_offset;
4461 * uint24 fragment_length;
4462 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004463#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004464 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004465 {
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01004466 /* Make room for the additional DTLS fields */
Angus Grattond8213d02016-05-25 20:56:48 +10004467 if( MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen < 8 )
Hanno Becker9648f8b2017-09-18 10:55:54 +01004468 {
4469 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS handshake message too large: "
4470 "size %u, maximum %u",
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004471 (unsigned) ( hs_len ),
Angus Grattond8213d02016-05-25 20:56:48 +10004472 (unsigned) ( MBEDTLS_SSL_OUT_CONTENT_LEN - 12 ) ) );
Hanno Becker9648f8b2017-09-18 10:55:54 +01004473 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4474 }
4475
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004476 memmove( ssl->out_msg + 12, ssl->out_msg + 4, hs_len );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004477 ssl->out_msglen += 8;
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004478
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004479 /* Write message_seq and update it, except for HelloRequest */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004480 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004481 {
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004482 (void)mbedtls_platform_put_uint16_be( &ssl->out_msg[4],
4483 ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardd9ba0d92014-09-02 18:30:26 +02004484 ++( ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02004485 }
4486 else
4487 {
4488 ssl->out_msg[4] = 0;
4489 ssl->out_msg[5] = 0;
4490 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01004491
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004492 /* Handshake hashes are computed without fragmentation,
4493 * so set frag_offset = 0 and frag_len = hs_len for now */
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02004494 mbedtls_platform_memset( ssl->out_msg + 6, 0x00, 3 );
Teppo Järvelin91d79382019-10-02 09:09:31 +03004495 mbedtls_platform_memcpy( ssl->out_msg + 9, ssl->out_msg + 1, 3 );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004496 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004497#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004498
Hanno Becker0207e532018-08-28 10:28:28 +01004499 /* Update running hashes of handshake messages seen */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02004500 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Hanno Becker8a4b5902019-08-15 17:04:57 +01004501 mbedtls_ssl_update_checksum( ssl, ssl->out_msg, ssl->out_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00004502 }
4503
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004504 /* Either send now, or just save to be sent (and resent) later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004505#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004506 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckerf6d6e302018-11-07 11:57:51 +00004507 ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4508 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004509 {
4510 if( ( ret = ssl_flight_append( ssl ) ) != 0 )
4511 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004512 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004513 return( ret );
4514 }
4515 }
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004516 else
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004517#endif
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004518 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004519 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004520 {
4521 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_record", ret );
4522 return( ret );
4523 }
4524 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004525
4526 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write handshake message" ) );
4527
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004528 return( 0 );
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004529}
4530
4531/*
4532 * Record layer functions
4533 */
4534
4535/*
4536 * Write current record.
4537 *
4538 * Uses:
4539 * - ssl->out_msgtype: type of the message (AppData, Handshake, Alert, CCS)
4540 * - ssl->out_msglen: length of the record content (excl headers)
4541 * - ssl->out_msg: record content
4542 */
Hanno Becker67bc7c32018-08-06 11:33:50 +01004543int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush )
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004544{
4545 int ret, done = 0;
4546 size_t len = ssl->out_msglen;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004547 uint8_t flush = force_flush;
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004548
4549 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02004550
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004551#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00004552 if( ssl->transform_out != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004553 ssl->session_out->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00004554 {
4555 if( ( ret = ssl_compress_buf( ssl ) ) != 0 )
4556 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004557 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compress_buf", ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00004558 return( ret );
4559 }
4560
4561 len = ssl->out_msglen;
4562 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004563#endif /*MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00004564
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004565#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4566 if( mbedtls_ssl_hw_record_write != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004567 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004568 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_write()" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004569
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004570 ret = mbedtls_ssl_hw_record_write( ssl );
4571 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00004572 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004573 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_write", ret );
4574 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00004575 }
Paul Bakkerc7878112012-12-19 14:41:14 +01004576
4577 if( ret == 0 )
4578 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00004579 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004580#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00004581 if( !done )
4582 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01004583 unsigned i;
4584 size_t protected_record_size;
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004585 volatile int encrypted_fi = 0;
Hanno Becker2b1e3542018-08-06 11:19:13 +01004586
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004587 /* Skip writing the record content type to after the encryption,
4588 * as it may change when using the CID extension. */
4589
Hanno Becker2881d802019-05-22 14:44:53 +01004590 mbedtls_ssl_write_version( mbedtls_ssl_get_major_ver( ssl ),
4591 mbedtls_ssl_get_minor_ver( ssl ),
4592 ssl->conf->transport, ssl->out_hdr + 1 );
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01004593
Teppo Järvelin91d79382019-10-02 09:09:31 +03004594 mbedtls_platform_memcpy( ssl->out_ctr, ssl->cur_out_ctr, 8 );
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004595 (void)mbedtls_platform_put_uint16_be( ssl->out_len, len );
Paul Bakker05ef8352012-05-08 09:17:57 +00004596
Paul Bakker48916f92012-09-16 19:57:18 +00004597 if( ssl->transform_out != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00004598 {
Hanno Becker3307b532017-12-27 21:37:21 +00004599 mbedtls_record rec;
4600
4601 rec.buf = ssl->out_iv;
4602 rec.buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN -
4603 ( ssl->out_iv - ssl->out_buf );
4604 rec.data_len = ssl->out_msglen;
4605 rec.data_offset = ssl->out_msg - rec.buf;
4606
Teppo Järvelin91d79382019-10-02 09:09:31 +03004607 mbedtls_platform_memcpy( &rec.ctr[0], ssl->out_ctr, 8 );
Hanno Becker2881d802019-05-22 14:44:53 +01004608 mbedtls_ssl_write_version( mbedtls_ssl_get_major_ver( ssl ),
4609 mbedtls_ssl_get_minor_ver( ssl ),
Hanno Becker3307b532017-12-27 21:37:21 +00004610 ssl->conf->transport, rec.ver );
4611 rec.type = ssl->out_msgtype;
4612
Hanno Beckera5a2b082019-05-15 14:03:01 +01004613#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker505089d2019-05-01 09:45:57 +01004614 /* The CID is set by mbedtls_ssl_encrypt_buf(). */
Hanno Beckere83efe62019-04-29 13:52:53 +01004615 rec.cid_len = 0;
Hanno Beckera5a2b082019-05-15 14:03:01 +01004616#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckere83efe62019-04-29 13:52:53 +01004617
Hanno Becker611a83b2018-01-03 14:27:32 +00004618 if( ( ret = mbedtls_ssl_encrypt_buf( ssl, ssl->transform_out, &rec,
Hanno Beckerece325c2019-06-13 15:39:27 +01004619 mbedtls_ssl_conf_get_frng( ssl->conf ),
Hanno Becker9a122432019-07-23 13:24:02 +01004620 mbedtls_ssl_conf_get_prng( ssl->conf ) ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00004621 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004622 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
Paul Bakker05ef8352012-05-08 09:17:57 +00004623 return( ret );
4624 }
4625
Hanno Becker3307b532017-12-27 21:37:21 +00004626 if( rec.data_offset != 0 )
4627 {
4628 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4629 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4630 }
4631
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004632 /* Update the record content type and CID. */
4633 ssl->out_msgtype = rec.type;
Hanno Beckera5a2b082019-05-15 14:03:01 +01004634#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID )
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03004635 /* Not using more secure mbedtls_platform_memcpy as cid is public */
4636 memcpy( ssl->out_cid, rec.cid, rec.cid_len );
Hanno Beckera5a2b082019-05-15 14:03:01 +01004637#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc5aee962019-03-14 12:56:23 +00004638 ssl->out_msglen = len = rec.data_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03004639 (void)mbedtls_platform_put_uint16_be( ssl->out_len, rec.data_len );
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004640 encrypted_fi = 1;
4641 }
4642
Jarno Lamsa88db2ae2019-12-19 14:51:34 +02004643 /* Double check to ensure the encryption has been done */
Jarno Lamsaacb5eb02019-11-14 14:13:10 +02004644 if( ssl->transform_out != NULL && encrypted_fi == 0 )
4645 {
Jarno Lamsa88db2ae2019-12-19 14:51:34 +02004646 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker05ef8352012-05-08 09:17:57 +00004647 }
4648
Hanno Becker43395762019-05-03 14:46:38 +01004649 protected_record_size = len + mbedtls_ssl_out_hdr_len( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01004650
4651#if defined(MBEDTLS_SSL_PROTO_DTLS)
4652 /* In case of DTLS, double-check that we don't exceed
4653 * the remaining space in the datagram. */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004654 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker2b1e3542018-08-06 11:19:13 +01004655 {
Hanno Becker554b0af2018-08-22 20:33:41 +01004656 ret = ssl_get_remaining_space_in_datagram( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01004657 if( ret < 0 )
4658 return( ret );
4659
4660 if( protected_record_size > (size_t) ret )
4661 {
4662 /* Should never happen */
4663 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4664 }
4665 }
4666#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker05ef8352012-05-08 09:17:57 +00004667
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004668 /* Now write the potentially updated record content type. */
4669 ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
4670
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004671 MBEDTLS_SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01004672 "version = [%d:%d], msglen = %d",
4673 ssl->out_hdr[0], ssl->out_hdr[1],
4674 ssl->out_hdr[2], len ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00004675
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004676 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01004677 ssl->out_hdr, protected_record_size );
Hanno Becker2b1e3542018-08-06 11:19:13 +01004678
4679 ssl->out_left += protected_record_size;
4680 ssl->out_hdr += protected_record_size;
4681 ssl_update_out_pointers( ssl, ssl->transform_out );
4682
Hanno Becker04484622018-08-06 09:49:38 +01004683 for( i = 8; i > ssl_ep_len( ssl ); i-- )
4684 if( ++ssl->cur_out_ctr[i - 1] != 0 )
4685 break;
4686
4687 /* The loop goes to its end iff the counter is wrapping */
4688 if( i == ssl_ep_len( ssl ) )
4689 {
4690 MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
4691 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
4692 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004693 }
4694
Hanno Becker67bc7c32018-08-06 11:33:50 +01004695#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004696 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker47db8772018-08-21 13:32:13 +01004697 flush == SSL_DONT_FORCE_FLUSH )
Hanno Becker67bc7c32018-08-06 11:33:50 +01004698 {
Hanno Becker1f5a15d2018-08-21 13:31:31 +01004699 size_t remaining;
4700 ret = ssl_get_remaining_payload_in_datagram( ssl );
4701 if( ret < 0 )
4702 {
4703 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_remaining_payload_in_datagram",
4704 ret );
4705 return( ret );
4706 }
4707
4708 remaining = (size_t) ret;
Hanno Becker67bc7c32018-08-06 11:33:50 +01004709 if( remaining == 0 )
Hanno Beckerf0da6672018-08-28 09:55:10 +01004710 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01004711 flush = SSL_FORCE_FLUSH;
Hanno Beckerf0da6672018-08-28 09:55:10 +01004712 }
Hanno Becker67bc7c32018-08-06 11:33:50 +01004713 else
4714 {
Hanno Becker513815a2018-08-20 11:56:09 +01004715 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Still %u bytes available in current datagram", (unsigned) remaining ) );
Hanno Becker67bc7c32018-08-06 11:33:50 +01004716 }
4717 }
4718#endif /* MBEDTLS_SSL_PROTO_DTLS */
4719
4720 if( ( flush == SSL_FORCE_FLUSH ) &&
4721 ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004722 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004723 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004724 return( ret );
4725 }
4726
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004727 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004728
4729 return( 0 );
4730}
4731
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004732#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckere25e3b72018-08-16 09:30:53 +01004733
4734static int ssl_hs_is_proper_fragment( mbedtls_ssl_context *ssl )
4735{
4736 if( ssl->in_msglen < ssl->in_hslen ||
Teppo Järvelin61f412e2019-10-03 12:25:22 +03004737 mbedtls_platform_memcmp( ssl->in_msg + 6, "\0\0\0", 3 ) != 0 ||
4738 mbedtls_platform_memcmp( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 )
Hanno Beckere25e3b72018-08-16 09:30:53 +01004739 {
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04004740 return( PROPER_HS_FRAGMENT );
Hanno Beckere25e3b72018-08-16 09:30:53 +01004741 }
4742 return( 0 );
4743}
Hanno Becker44650b72018-08-16 12:51:11 +01004744
Hanno Beckercd9dcda2018-08-28 17:18:56 +01004745static uint32_t ssl_get_hs_frag_len( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01004746{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03004747 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[9] ) );
Hanno Becker44650b72018-08-16 12:51:11 +01004748}
4749
Hanno Beckercd9dcda2018-08-28 17:18:56 +01004750static uint32_t ssl_get_hs_frag_off( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01004751{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03004752 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[6] ) );
Hanno Becker44650b72018-08-16 12:51:11 +01004753}
4754
Hanno Beckercd9dcda2018-08-28 17:18:56 +01004755static int ssl_check_hs_header( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01004756{
4757 uint32_t msg_len, frag_off, frag_len;
4758
4759 msg_len = ssl_get_hs_total_len( ssl );
4760 frag_off = ssl_get_hs_frag_off( ssl );
4761 frag_len = ssl_get_hs_frag_len( ssl );
4762
4763 if( frag_off > msg_len )
4764 return( -1 );
4765
4766 if( frag_len > msg_len - frag_off )
4767 return( -1 );
4768
4769 if( frag_len + 12 > ssl->in_msglen )
4770 return( -1 );
4771
4772 return( 0 );
4773}
4774
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004775/*
4776 * Mark bits in bitmask (used for DTLS HS reassembly)
4777 */
4778static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len )
4779{
4780 unsigned int start_bits, end_bits;
4781
4782 start_bits = 8 - ( offset % 8 );
4783 if( start_bits != 8 )
4784 {
4785 size_t first_byte_idx = offset / 8;
4786
Manuel Pégourié-Gonnardac030522014-09-02 14:23:40 +02004787 /* Special case */
4788 if( len <= start_bits )
4789 {
4790 for( ; len != 0; len-- )
4791 mask[first_byte_idx] |= 1 << ( start_bits - len );
4792
4793 /* Avoid potential issues with offset or len becoming invalid */
4794 return;
4795 }
4796
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004797 offset += start_bits; /* Now offset % 8 == 0 */
4798 len -= start_bits;
4799
4800 for( ; start_bits != 0; start_bits-- )
4801 mask[first_byte_idx] |= 1 << ( start_bits - 1 );
4802 }
4803
4804 end_bits = len % 8;
4805 if( end_bits != 0 )
4806 {
4807 size_t last_byte_idx = ( offset + len ) / 8;
4808
4809 len -= end_bits; /* Now len % 8 == 0 */
4810
4811 for( ; end_bits != 0; end_bits-- )
4812 mask[last_byte_idx] |= 1 << ( 8 - end_bits );
4813 }
4814
4815 memset( mask + offset / 8, 0xFF, len / 8 );
4816}
4817
Andrzej Kurek0919b142020-07-06 15:28:59 -04004818#define BITMASK_CHECK_FAILED 0x75555555
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004819/*
4820 * Check that bitmask is full
4821 */
4822static int ssl_bitmask_check( unsigned char *mask, size_t len )
4823{
4824 size_t i;
4825
4826 for( i = 0; i < len / 8; i++ )
4827 if( mask[i] != 0xFF )
Andrzej Kurek0919b142020-07-06 15:28:59 -04004828 return( BITMASK_CHECK_FAILED );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004829
4830 for( i = 0; i < len % 8; i++ )
4831 if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 )
Andrzej Kurek0919b142020-07-06 15:28:59 -04004832 return( BITMASK_CHECK_FAILED );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004833
4834 return( 0 );
4835}
4836
Hanno Becker56e205e2018-08-16 09:06:12 +01004837/* msg_len does not include the handshake header */
Hanno Becker65dc8852018-08-23 09:40:49 +01004838static size_t ssl_get_reassembly_buffer_size( size_t msg_len,
Hanno Becker2a97b0e2018-08-21 15:47:49 +01004839 unsigned add_bitmap )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004840{
Hanno Becker56e205e2018-08-16 09:06:12 +01004841 size_t alloc_len;
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004842
Hanno Becker56e205e2018-08-16 09:06:12 +01004843 alloc_len = 12; /* Handshake header */
4844 alloc_len += msg_len; /* Content buffer */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004845
Hanno Beckerd07df862018-08-16 09:14:58 +01004846 if( add_bitmap )
4847 alloc_len += msg_len / 8 + ( msg_len % 8 != 0 ); /* Bitmap */
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02004848
Hanno Becker2a97b0e2018-08-21 15:47:49 +01004849 return( alloc_len );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004850}
Hanno Becker56e205e2018-08-16 09:06:12 +01004851
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004852#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004853
Hanno Beckercd9dcda2018-08-28 17:18:56 +01004854static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl )
Hanno Becker12555c62018-08-16 12:47:53 +01004855{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03004856 return( (uint32_t)mbedtls_platform_get_uint24_be( &ssl->in_msg[1] ) );
Hanno Becker12555c62018-08-16 12:47:53 +01004857}
Hanno Beckere25e3b72018-08-16 09:30:53 +01004858
Simon Butcher99000142016-10-13 17:21:01 +01004859int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004860{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004861 if( ssl->in_msglen < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02004862 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004863 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %d",
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02004864 ssl->in_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004865 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02004866 }
4867
Hanno Becker12555c62018-08-16 12:47:53 +01004868 ssl->in_hslen = mbedtls_ssl_hs_hdr_len( ssl ) + ssl_get_hs_total_len( ssl );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004869
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004870 MBEDTLS_SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004871 " %d, type = %d, hslen = %d",
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01004872 ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004873
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004874#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004875 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004876 {
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004877 int ret;
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03004878 unsigned int recv_msg_seq = (unsigned int)
4879 mbedtls_platform_get_uint16_be( &ssl->in_msg[4] );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004880
Hanno Becker44650b72018-08-16 12:51:11 +01004881 if( ssl_check_hs_header( ssl ) != 0 )
4882 {
4883 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid handshake header" ) );
4884 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4885 }
4886
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004887 if( ssl->handshake != NULL &&
Hanno Beckerc76c6192017-06-06 10:03:17 +01004888 ( ( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER &&
4889 recv_msg_seq != ssl->handshake->in_msg_seq ) ||
4890 ( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
4891 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO ) ) )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004892 {
Hanno Becker9e1ec222018-08-15 15:54:43 +01004893 if( recv_msg_seq > ssl->handshake->in_msg_seq )
4894 {
4895 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received future handshake message of sequence number %u (next %u)",
4896 recv_msg_seq,
4897 ssl->handshake->in_msg_seq ) );
4898 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
4899 }
4900
Manuel Pégourié-Gonnardfc572dd2014-10-09 17:56:57 +02004901 /* Retransmit only on last message from previous flight, to avoid
4902 * too many retransmissions.
4903 * Besides, No sane server ever retransmits HelloVerifyRequest */
4904 if( recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004905 ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004906 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004907 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received message from last flight, "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004908 "message_seq = %d, start_of_flight = %d",
4909 recv_msg_seq,
4910 ssl->handshake->in_flight_start_seq ) );
4911
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004912 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004913 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004914 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004915 return( ret );
4916 }
4917 }
4918 else
4919 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004920 MBEDTLS_SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004921 "message_seq = %d, expected = %d",
4922 recv_msg_seq,
4923 ssl->handshake->in_msg_seq ) );
4924 }
4925
Hanno Becker90333da2017-10-10 11:27:13 +01004926 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004927 }
4928 /* Wait until message completion to increment in_msg_seq */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004929
Hanno Becker6d97ef52018-08-16 13:09:04 +01004930 /* Message reassembly is handled alongside buffering of future
4931 * messages; the commonality is that both handshake fragments and
Hanno Becker83ab41c2018-08-28 17:19:38 +01004932 * future messages cannot be forwarded immediately to the
Hanno Becker6d97ef52018-08-16 13:09:04 +01004933 * handshake logic layer. */
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04004934 if( ssl_hs_is_proper_fragment( ssl ) == PROPER_HS_FRAGMENT )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004935 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004936 MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
Hanno Becker6d97ef52018-08-16 13:09:04 +01004937 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004938 }
4939 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004940 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004941#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004942#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004943 {
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02004944 /* With TLS we don't handle fragmentation (for now) */
4945 if( ssl->in_msglen < ssl->in_hslen )
4946 {
4947 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
4948 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
4949 }
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004950 }
Manuel Pégourié-Gonnardec1c2222019-06-12 10:18:26 +02004951#endif /* MBEDTLS_SSL_PROTO_TLS */
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004952
Simon Butcher99000142016-10-13 17:21:01 +01004953 return( 0 );
4954}
4955
4956void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl )
4957{
Hanno Becker0271f962018-08-16 13:23:47 +01004958 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Simon Butcher99000142016-10-13 17:21:01 +01004959
Hanno Becker0271f962018-08-16 13:23:47 +01004960 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER && hs != NULL )
Hanno Becker8a4b5902019-08-15 17:04:57 +01004961 mbedtls_ssl_update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004962
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004963 /* Handshake message is complete, increment counter */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004964#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004965 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004966 ssl->handshake != NULL )
4967 {
Hanno Becker0271f962018-08-16 13:23:47 +01004968 unsigned offset;
4969 mbedtls_ssl_hs_buffer *hs_buf;
Hanno Beckere25e3b72018-08-16 09:30:53 +01004970
Hanno Becker0271f962018-08-16 13:23:47 +01004971 /* Increment handshake sequence number */
4972 hs->in_msg_seq++;
4973
4974 /*
4975 * Clear up handshake buffering and reassembly structure.
4976 */
4977
4978 /* Free first entry */
Hanno Beckere605b192018-08-21 15:59:07 +01004979 ssl_buffering_free_slot( ssl, 0 );
Hanno Becker0271f962018-08-16 13:23:47 +01004980
4981 /* Shift all other entries */
Hanno Beckere605b192018-08-21 15:59:07 +01004982 for( offset = 0, hs_buf = &hs->buffering.hs[0];
4983 offset + 1 < MBEDTLS_SSL_MAX_BUFFERED_HS;
Hanno Becker0271f962018-08-16 13:23:47 +01004984 offset++, hs_buf++ )
4985 {
4986 *hs_buf = *(hs_buf + 1);
4987 }
4988
4989 /* Create a fresh last entry */
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02004990 mbedtls_platform_memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004991 }
4992#endif
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004993}
4994
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004995/*
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004996 * DTLS anti-replay: RFC 6347 4.1.2.6
4997 *
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02004998 * in_window is a field of bits numbered from 0 (lsb) to 63 (msb).
4999 * Bit n is set iff record number in_window_top - n has been seen.
5000 *
5001 * Usually, in_window_top is the last record number seen and the lsb of
5002 * in_window is set. The only exception is the initial state (record number 0
5003 * not seen yet).
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005004 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005005#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5006static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005007{
5008 ssl->in_window_top = 0;
5009 ssl->in_window = 0;
5010}
5011
5012static inline uint64_t ssl_load_six_bytes( unsigned char *buf )
5013{
5014 return( ( (uint64_t) buf[0] << 40 ) |
5015 ( (uint64_t) buf[1] << 32 ) |
5016 ( (uint64_t) buf[2] << 24 ) |
5017 ( (uint64_t) buf[3] << 16 ) |
5018 ( (uint64_t) buf[4] << 8 ) |
5019 ( (uint64_t) buf[5] ) );
5020}
5021
Arto Kinnunen8a8488c2019-10-29 11:13:33 +02005022static int mbedtls_ssl_dtls_record_replay_check( mbedtls_ssl_context *ssl, uint8_t *record_in_ctr )
5023{
5024 int ret;
5025 unsigned char *original_in_ctr;
5026
5027 // save original in_ctr
5028 original_in_ctr = ssl->in_ctr;
5029
5030 // use counter from record
5031 ssl->in_ctr = record_in_ctr;
5032
5033 ret = mbedtls_ssl_dtls_replay_check( (mbedtls_ssl_context const *) ssl );
5034
5035 // restore the counter
5036 ssl->in_ctr = original_in_ctr;
5037
5038 return ret;
5039}
5040
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005041/*
5042 * Return 0 if sequence number is acceptable, -1 otherwise
5043 */
Hanno Beckerfc551722019-07-12 08:50:37 +01005044int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context const *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005045{
5046 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
5047 uint64_t bit;
5048
Hanno Becker7f376f42019-06-12 16:20:48 +01005049 if( mbedtls_ssl_conf_get_anti_replay( ssl->conf ) ==
5050 MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
5051 {
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005052 return( 0 );
Hanno Becker7f376f42019-06-12 16:20:48 +01005053 }
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005054
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005055 if( rec_seqnum > ssl->in_window_top )
5056 return( 0 );
5057
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005058 bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005059
5060 if( bit >= 64 )
5061 return( -1 );
5062
5063 if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 )
5064 return( -1 );
5065
5066 return( 0 );
5067}
5068
5069/*
5070 * Update replay window on new validated record
5071 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005072void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005073{
5074 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
5075
Hanno Becker7f376f42019-06-12 16:20:48 +01005076 if( mbedtls_ssl_conf_get_anti_replay( ssl->conf ) ==
5077 MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
5078 {
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005079 return;
Hanno Becker7f376f42019-06-12 16:20:48 +01005080 }
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02005081
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005082 if( rec_seqnum > ssl->in_window_top )
5083 {
5084 /* Update window_top and the contents of the window */
5085 uint64_t shift = rec_seqnum - ssl->in_window_top;
5086
5087 if( shift >= 64 )
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005088 ssl->in_window = 1;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005089 else
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005090 {
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005091 ssl->in_window <<= shift;
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005092 ssl->in_window |= 1;
5093 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005094
5095 ssl->in_window_top = rec_seqnum;
5096 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005097 else
5098 {
5099 /* Mark that number as seen in the current window */
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02005100 uint64_t bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005101
5102 if( bit < 64 ) /* Always true, but be extra sure */
5103 ssl->in_window |= (uint64_t) 1 << bit;
5104 }
5105}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005106#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005107
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02005108#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005109/* Forward declaration */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02005110static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial );
5111
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005112/*
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005113 * Without any SSL context, check if a datagram looks like a ClientHello with
5114 * a valid cookie, and if it doesn't, generate a HelloVerifyRequest message.
Simon Butcher0789aed2015-09-11 17:15:17 +01005115 * Both input and output include full DTLS headers.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005116 *
5117 * - if cookie is valid, return 0
5118 * - if ClientHello looks superficially valid but cookie is not,
5119 * fill obuf and set olen, then
5120 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
5121 * - otherwise return a specific error code
5122 */
5123static int ssl_check_dtls_clihlo_cookie(
5124 mbedtls_ssl_cookie_write_t *f_cookie_write,
5125 mbedtls_ssl_cookie_check_t *f_cookie_check,
5126 void *p_cookie,
5127 const unsigned char *cli_id, size_t cli_id_len,
5128 const unsigned char *in, size_t in_len,
5129 unsigned char *obuf, size_t buf_len, size_t *olen )
5130{
5131 size_t sid_len, cookie_len;
5132 unsigned char *p;
5133
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005134 /*
5135 * Structure of ClientHello with record and handshake headers,
5136 * and expected values. We don't need to check a lot, more checks will be
5137 * done when actually parsing the ClientHello - skipping those checks
5138 * avoids code duplication and does not make cookie forging any easier.
5139 *
5140 * 0-0 ContentType type; copied, must be handshake
5141 * 1-2 ProtocolVersion version; copied
5142 * 3-4 uint16 epoch; copied, must be 0
5143 * 5-10 uint48 sequence_number; copied
5144 * 11-12 uint16 length; (ignored)
5145 *
5146 * 13-13 HandshakeType msg_type; (ignored)
5147 * 14-16 uint24 length; (ignored)
5148 * 17-18 uint16 message_seq; copied
5149 * 19-21 uint24 fragment_offset; copied, must be 0
5150 * 22-24 uint24 fragment_length; (ignored)
5151 *
5152 * 25-26 ProtocolVersion client_version; (ignored)
5153 * 27-58 Random random; (ignored)
5154 * 59-xx SessionID session_id; 1 byte len + sid_len content
5155 * 60+ opaque cookie<0..2^8-1>; 1 byte len + content
5156 * ...
5157 *
5158 * Minimum length is 61 bytes.
5159 */
5160 if( in_len < 61 ||
5161 in[0] != MBEDTLS_SSL_MSG_HANDSHAKE ||
5162 in[3] != 0 || in[4] != 0 ||
5163 in[19] != 0 || in[20] != 0 || in[21] != 0 )
5164 {
5165 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5166 }
5167
5168 sid_len = in[59];
5169 if( sid_len > in_len - 61 )
5170 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5171
5172 cookie_len = in[60 + sid_len];
5173 if( cookie_len > in_len - 60 )
5174 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
5175
5176 if( f_cookie_check( p_cookie, in + sid_len + 61, cookie_len,
5177 cli_id, cli_id_len ) == 0 )
5178 {
5179 /* Valid cookie */
5180 return( 0 );
5181 }
5182
5183 /*
5184 * If we get here, we've got an invalid cookie, let's prepare HVR.
5185 *
5186 * 0-0 ContentType type; copied
5187 * 1-2 ProtocolVersion version; copied
5188 * 3-4 uint16 epoch; copied
5189 * 5-10 uint48 sequence_number; copied
5190 * 11-12 uint16 length; olen - 13
5191 *
5192 * 13-13 HandshakeType msg_type; hello_verify_request
5193 * 14-16 uint24 length; olen - 25
5194 * 17-18 uint16 message_seq; copied
5195 * 19-21 uint24 fragment_offset; copied
5196 * 22-24 uint24 fragment_length; olen - 25
5197 *
5198 * 25-26 ProtocolVersion server_version; 0xfe 0xff
5199 * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie
5200 *
5201 * Minimum length is 28.
5202 */
5203 if( buf_len < 28 )
5204 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
5205
5206 /* Copy most fields and adapt others */
Teppo Järvelin91d79382019-10-02 09:09:31 +03005207 mbedtls_platform_memcpy( obuf, in, 25 );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005208 obuf[13] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
5209 obuf[25] = 0xfe;
5210 obuf[26] = 0xff;
5211
5212 /* Generate and write actual cookie */
5213 p = obuf + 28;
5214 if( f_cookie_write( p_cookie,
5215 &p, obuf + buf_len, cli_id, cli_id_len ) != 0 )
5216 {
5217 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5218 }
5219
5220 *olen = p - obuf;
5221
5222 /* Go back and fill length fields */
5223 obuf[27] = (unsigned char)( *olen - 28 );
5224
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03005225 (void)mbedtls_platform_put_uint24_be( &obuf[14], ( *olen - 25 ) );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03005226 obuf[22] = obuf[14];
5227 obuf[23] = obuf[15];
5228 obuf[24] = obuf[16];
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005229
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03005230 (void)mbedtls_platform_put_uint16_be( &obuf[11], ( *olen - 13 ) );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005231
5232 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
5233}
5234
5235/*
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005236 * Handle possible client reconnect with the same UDP quadruplet
5237 * (RFC 6347 Section 4.2.8).
5238 *
5239 * Called by ssl_parse_record_header() in case we receive an epoch 0 record
5240 * that looks like a ClientHello.
5241 *
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005242 * - if the input looks like a ClientHello without cookies,
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005243 * send back HelloVerifyRequest, then return 0
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005244 * - if the input looks like a ClientHello with a valid cookie,
5245 * reset the session of the current context, and
Manuel Pégourié-Gonnardbe619c12015-09-08 11:21:21 +02005246 * return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005247 * - if anything goes wrong, return a specific error code
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005248 *
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005249 * This function is called (through ssl_check_client_reconnect()) when an
5250 * unexpected record is found in ssl_get_next_record(), which will discard the
5251 * record if we return 0, and bubble up the return value otherwise (this
5252 * includes the case of MBEDTLS_ERR_SSL_CLIENT_RECONNECT and of unexpected
5253 * errors, and is the right thing to do in both cases).
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005254 */
5255static int ssl_handle_possible_reconnect( mbedtls_ssl_context *ssl )
5256{
5257 int ret;
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005258 size_t len;
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005259
Hanno Becker87b56262019-07-10 14:37:41 +01005260 if( ssl->conf->f_cookie_write == NULL ||
5261 ssl->conf->f_cookie_check == NULL )
5262 {
5263 /* If we can't use cookies to verify reachability of the peer,
5264 * drop the record. */
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005265 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no cookie callbacks, "
5266 "can't check reconnect validity" ) );
Hanno Becker87b56262019-07-10 14:37:41 +01005267 return( 0 );
5268 }
5269
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005270 ret = ssl_check_dtls_clihlo_cookie(
5271 ssl->conf->f_cookie_write,
5272 ssl->conf->f_cookie_check,
5273 ssl->conf->p_cookie,
5274 ssl->cli_id, ssl->cli_id_len,
5275 ssl->in_buf, ssl->in_left,
Angus Grattond8213d02016-05-25 20:56:48 +10005276 ssl->out_buf, MBEDTLS_SSL_OUT_CONTENT_LEN, &len );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005277
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005278 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_dtls_clihlo_cookie", ret );
5279
5280 if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005281 {
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005282 int send_ret;
5283 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sending HelloVerifyRequest" ) );
5284 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
5285 ssl->out_buf, len );
Brian J Murray1903fb32016-11-06 04:45:15 -08005286 /* Don't check write errors as we can't do anything here.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005287 * If the error is permanent we'll catch it later,
5288 * if it's not, then hopefully it'll work next time. */
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005289 send_ret = mbedtls_ssl_get_send( ssl )( ssl->p_bio, ssl->out_buf, len );
5290 MBEDTLS_SSL_DEBUG_RET( 2, "mbedtls_ssl_get_send", send_ret );
5291 (void) send_ret;
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02005292 return( 0 );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005293 }
5294
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005295 if( ret == 0 )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005296 {
Andrzej Kurek825ebd42020-05-18 11:47:25 -04005297 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cookie is valid, resetting context" ) );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02005298 if( ( ret = ssl_session_reset_int( ssl, 1 ) ) != 0 )
5299 {
5300 MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret );
5301 return( ret );
5302 }
5303
5304 return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005305 }
5306
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005307 return( ret );
5308}
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02005309#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02005310
Hanno Becker46483f12019-05-03 13:25:54 +01005311static int ssl_check_record_type( uint8_t record_type )
5312{
5313 if( record_type != MBEDTLS_SSL_MSG_HANDSHAKE &&
5314 record_type != MBEDTLS_SSL_MSG_ALERT &&
5315 record_type != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
5316 record_type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
5317 {
5318 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5319 }
5320
5321 return( 0 );
5322}
5323
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02005324/*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005325 * ContentType type;
5326 * ProtocolVersion version;
5327 * uint16 epoch; // DTLS only
5328 * uint48 sequence_number; // DTLS only
5329 * uint16 length;
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005330 *
5331 * Return 0 if header looks sane (and, for DTLS, the record is expected)
Simon Butcher207990d2015-12-16 01:51:30 +00005332 * MBEDTLS_ERR_SSL_INVALID_RECORD if the header looks bad,
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005333 * MBEDTLS_ERR_SSL_UNEXPECTED_RECORD (DTLS only) if sane but unexpected.
5334 *
5335 * With DTLS, mbedtls_ssl_read_record() will:
Simon Butcher207990d2015-12-16 01:51:30 +00005336 * 1. proceed with the record if this function returns 0
5337 * 2. drop only the current record if this function returns UNEXPECTED_RECORD
5338 * 3. return CLIENT_RECONNECT if this function return that value
5339 * 4. drop the whole datagram if this function returns anything else.
5340 * Point 2 is needed when the peer is resending, and we have already received
5341 * the first record from a datagram but are still waiting for the others.
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005342 */
Hanno Becker21fc61c2019-07-12 11:10:16 +01005343static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005344 unsigned char *buf,
5345 size_t len,
5346 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00005347{
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01005348 int major_ver, minor_ver;
Paul Bakker5121ce52009-01-03 21:22:43 +00005349
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005350 size_t const rec_hdr_type_offset = 0;
5351 size_t const rec_hdr_type_len = 1;
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02005352
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005353 size_t const rec_hdr_version_offset = rec_hdr_type_offset +
5354 rec_hdr_type_len;
5355 size_t const rec_hdr_version_len = 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00005356
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005357 size_t const rec_hdr_ctr_len = 8;
5358#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker61817612019-07-25 10:13:02 +01005359 uint32_t rec_epoch;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005360 size_t const rec_hdr_ctr_offset = rec_hdr_version_offset +
5361 rec_hdr_version_len;
5362
Hanno Beckera5a2b082019-05-15 14:03:01 +01005363#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005364 size_t const rec_hdr_cid_offset = rec_hdr_ctr_offset +
5365 rec_hdr_ctr_len;
Hanno Becker61817612019-07-25 10:13:02 +01005366 size_t rec_hdr_cid_len = 0;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005367#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
5368#endif /* MBEDTLS_SSL_PROTO_DTLS */
5369
5370 size_t rec_hdr_len_offset; /* To be determined */
5371 size_t const rec_hdr_len_len = 2;
5372
5373 /*
5374 * Check minimum lengths for record header.
5375 */
5376
5377#if defined(MBEDTLS_SSL_PROTO_DTLS)
5378 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
5379 {
5380 rec_hdr_len_offset = rec_hdr_ctr_offset + rec_hdr_ctr_len;
5381 }
5382 MBEDTLS_SSL_TRANSPORT_ELSE
5383#endif /* MBEDTLS_SSL_PROTO_DTLS */
5384#if defined(MBEDTLS_SSL_PROTO_TLS)
5385 {
5386 rec_hdr_len_offset = rec_hdr_version_offset + rec_hdr_version_len;
5387 }
5388#endif /* MBEDTLS_SSL_PROTO_DTLS */
5389
5390 if( len < rec_hdr_len_offset + rec_hdr_len_len )
5391 {
5392 MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header of length %u",
5393 (unsigned) len,
5394 (unsigned)( rec_hdr_len_len + rec_hdr_len_len ) ) );
5395 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5396 }
5397
5398 /*
5399 * Parse and validate record content type
5400 */
5401
5402 rec->type = buf[ rec_hdr_type_offset ];
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005403
5404 /* Check record content type */
5405#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
5406 rec->cid_len = 0;
5407
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005408 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005409 mbedtls_ssl_conf_get_cid_len( ssl->conf ) != 0 &&
5410 rec->type == MBEDTLS_SSL_MSG_CID )
Hanno Becker8b09b732019-05-08 12:03:28 +01005411 {
5412 /* Shift pointers to account for record header including CID
5413 * struct {
5414 * ContentType special_type = tls12_cid;
5415 * ProtocolVersion version;
5416 * uint16 epoch;
5417 * uint48 sequence_number;
Hanno Becker3b2bf5b2019-05-23 17:03:19 +01005418 * opaque cid[cid_length]; // Additional field compared to
5419 * // default DTLS record format
Hanno Becker8b09b732019-05-08 12:03:28 +01005420 * uint16 length;
5421 * opaque enc_content[DTLSCiphertext.length];
5422 * } DTLSCiphertext;
5423 */
5424
5425 /* So far, we only support static CID lengths
5426 * fixed in the configuration. */
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005427 rec_hdr_cid_len = mbedtls_ssl_conf_get_cid_len( ssl->conf );
5428 rec_hdr_len_offset += rec_hdr_cid_len;
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005429
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005430 if( len < rec_hdr_len_offset + rec_hdr_len_len )
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005431 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005432 MBEDTLS_SSL_DEBUG_MSG( 1, ( "datagram of length %u too small to hold DTLS record header including CID, length %u",
5433 (unsigned) len,
5434 (unsigned)( rec_hdr_len_offset + rec_hdr_len_len ) ) );
Hanno Becker29823462019-07-10 14:53:43 +01005435 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Beckerde7d6d32019-07-10 14:50:10 +01005436 }
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005437
Manuel Pégourié-Gonnardf3a15b32019-08-02 10:17:15 +02005438 /* configured CID len is guaranteed at most 255, see
5439 * MBEDTLS_SSL_CID_OUT_LEN_MAX in check_config.h */
5440 rec->cid_len = (uint8_t) rec_hdr_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005441 /* Not using more secure mbedtls_platform_memcpy as cid is public */
5442 memcpy( rec->cid, buf + rec_hdr_cid_offset, rec_hdr_cid_len );
Hanno Becker8b09b732019-05-08 12:03:28 +01005443 }
5444 else
Hanno Beckera5a2b082019-05-15 14:03:01 +01005445#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02005446 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005447 if( ssl_check_record_type( rec->type ) )
5448 {
Hanno Becker03e2db62019-07-12 14:40:00 +01005449 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type %u",
5450 (unsigned) rec->type ) );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005451 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5452 }
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02005453 }
5454
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005455 /*
5456 * Parse and validate record version
5457 */
5458
Hanno Becker8061c6e2019-07-26 08:07:03 +01005459 rec->ver[0] = buf[ rec_hdr_version_offset + 0 ];
5460 rec->ver[1] = buf[ rec_hdr_version_offset + 1 ];
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005461 mbedtls_ssl_read_version( &major_ver, &minor_ver,
5462 ssl->conf->transport,
Hanno Becker8061c6e2019-07-26 08:07:03 +01005463 &rec->ver[0] );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005464
Hanno Becker2881d802019-05-22 14:44:53 +01005465 if( major_ver != mbedtls_ssl_get_major_ver( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00005466 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005467 MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
5468 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00005469 }
5470
Hanno Becker7bcf2b52019-07-26 09:02:40 +01005471 if( mbedtls_ssl_ver_gt( minor_ver,
5472 mbedtls_ssl_conf_get_max_minor_ver( ssl->conf ) ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00005473 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005474 MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
5475 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00005476 }
5477
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005478 /*
5479 * Parse/Copy record sequence number.
5480 */
Hanno Becker8b09b732019-05-08 12:03:28 +01005481
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005482#if defined(MBEDTLS_SSL_PROTO_DTLS)
5483 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
5484 {
5485 /* Copy explicit record sequence number from input buffer. */
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005486 /* Not using more secure mbedtls_platform_memcpy as sequence number is public */
5487 memcpy( &rec->ctr[0], buf + rec_hdr_ctr_offset,
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005488 rec_hdr_ctr_len );
5489 }
5490 MBEDTLS_SSL_TRANSPORT_ELSE
5491#endif /* MBEDTLS_SSL_PROTO_DTLS */
5492#if defined(MBEDTLS_SSL_PROTO_TLS)
5493 {
5494 /* Copy implicit record sequence number from SSL context structure. */
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03005495 /* Not using more secure mbedtls_platform_memcpy as sequence number is public */
5496 memcpy( &rec->ctr[0], ssl->in_ctr, rec_hdr_ctr_len );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005497 }
5498#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker8b09b732019-05-08 12:03:28 +01005499
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005500 /*
5501 * Parse record length.
5502 */
5503
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005504 rec->data_offset = rec_hdr_len_offset + rec_hdr_len_len;
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03005505 rec->data_len = mbedtls_platform_get_uint16_be( &buf[rec_hdr_len_offset] );
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005506 MBEDTLS_SSL_DEBUG_BUF( 4, "input record header", buf, rec->data_offset );
5507
Hanno Becker8b09b732019-05-08 12:03:28 +01005508 MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
Hanno Beckerd8f7c4a2019-05-23 17:03:44 +01005509 "version = [%d:%d], msglen = %d",
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005510 rec->type,
5511 major_ver, minor_ver, rec->data_len ) );
5512
5513 rec->buf = buf;
5514 rec->buf_len = rec->data_offset + rec->data_len;
Hanno Becker8b09b732019-05-08 12:03:28 +01005515
Hanno Beckerec014082019-07-26 08:20:27 +01005516 if( rec->data_len == 0 )
5517 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5518
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005519 /*
Hanno Becker52c6dc62017-05-26 16:07:36 +01005520 * DTLS-related tests.
5521 * Check epoch before checking length constraint because
5522 * the latter varies with the epoch. E.g., if a ChangeCipherSpec
5523 * message gets duplicated before the corresponding Finished message,
5524 * the second ChangeCipherSpec should be discarded because it belongs
5525 * to an old epoch, but not because its length is shorter than
5526 * the minimum record length for packets using the new record transform.
5527 * Note that these two kinds of failures are handled differently,
5528 * as an unexpected record is silently skipped but an invalid
5529 * record leads to the entire datagram being dropped.
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005530 */
5531#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005532 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005533 {
Arto Kinnunena3fa06e2019-09-09 12:22:51 +03005534 rec_epoch = (uint32_t)mbedtls_platform_get_uint16_be( rec->ctr );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005535
Hanno Beckere0452772019-07-10 17:12:07 +01005536 /* Check that the datagram is large enough to contain a record
5537 * of the advertised length. */
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005538 if( len < rec->data_offset + rec->data_len )
Hanno Beckere0452772019-07-10 17:12:07 +01005539 {
Hanno Beckerc6e7c572019-07-11 12:29:35 +01005540 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Datagram of length %u too small to contain record of advertised length %u.",
5541 (unsigned) len,
5542 (unsigned)( rec->data_offset + rec->data_len ) ) );
Hanno Beckere0452772019-07-10 17:12:07 +01005543 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5544 }
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005545
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005546 /* Records from other, non-matching epochs are silently discarded.
5547 * (The case of same-port Client reconnects must be considered in
5548 * the caller). */
Hanno Beckerc1c173c2019-07-19 10:59:12 +01005549 if( rec_epoch != ssl->in_epoch )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005550 {
5551 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: "
5552 "expected %d, received %d",
5553 ssl->in_epoch, rec_epoch ) );
Hanno Beckerc1c173c2019-07-19 10:59:12 +01005554
5555 /* Records from the next epoch are considered for buffering
5556 * (concretely: early Finished messages). */
5557 if( rec_epoch == (unsigned) ssl->in_epoch + 1 )
5558 {
5559 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Consider record for buffering" ) );
5560 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
5561 }
5562
Hanno Becker87b56262019-07-10 14:37:41 +01005563 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005564 }
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005565#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Hanno Becker6c0e53c2019-07-10 17:20:01 +01005566 /* For records from the correct epoch, check whether their
5567 * sequence number has been seen before. */
Arto Kinnunen8a8488c2019-10-29 11:13:33 +02005568 else if( mbedtls_ssl_dtls_record_replay_check( (mbedtls_ssl_context *) ssl,
5569 &rec->ctr[0] ) != 0 )
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005570 {
5571 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
5572 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
5573 }
5574#endif
5575 }
5576#endif /* MBEDTLS_SSL_PROTO_DTLS */
5577
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005578 return( 0 );
5579}
Paul Bakker5121ce52009-01-03 21:22:43 +00005580
Hanno Becker87b56262019-07-10 14:37:41 +01005581
5582#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
5583static int ssl_check_client_reconnect( mbedtls_ssl_context *ssl )
5584{
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03005585 unsigned int rec_epoch = (unsigned int)
5586 mbedtls_platform_get_uint16_be( &ssl->in_ctr[0] );
Hanno Becker87b56262019-07-10 14:37:41 +01005587
5588 /*
5589 * Check for an epoch 0 ClientHello. We can't use in_msg here to
5590 * access the first byte of record content (handshake type), as we
5591 * have an active transform (possibly iv_len != 0), so use the
5592 * fact that the record header len is 13 instead.
5593 */
5594 if( rec_epoch == 0 &&
5595 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
5596 MBEDTLS_SSL_IS_SERVER &&
5597 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
5598 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
5599 ssl->in_left > 13 &&
5600 ssl->in_buf[13] == MBEDTLS_SSL_HS_CLIENT_HELLO )
5601 {
5602 MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect "
5603 "from the same port" ) );
5604 return( ssl_handle_possible_reconnect( ssl ) );
5605 }
5606
5607 return( 0 );
5608}
5609#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
5610
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005611/*
Manuel Pégourié-Gonnardae48d862020-01-03 12:18:49 +01005612 * If applicable, decrypt record content
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005613 */
Hanno Beckera89610a2019-07-11 13:07:45 +01005614static int ssl_prepare_record_content( mbedtls_ssl_context *ssl,
5615 mbedtls_record *rec )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005616{
5617 int ret, done = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02005618
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005619 MBEDTLS_SSL_DEBUG_BUF( 4, "input record from network",
Hanno Beckera89610a2019-07-11 13:07:45 +01005620 rec->buf, rec->buf_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00005621
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005622#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
5623 if( mbedtls_ssl_hw_record_read != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00005624 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005625 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_read()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00005626
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005627 ret = mbedtls_ssl_hw_record_read( ssl );
5628 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00005629 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005630 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_read", ret );
5631 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00005632 }
Paul Bakkerc7878112012-12-19 14:41:14 +01005633
5634 if( ret == 0 )
5635 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00005636 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005637#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker48916f92012-09-16 19:57:18 +00005638 if( !done && ssl->transform_in != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005639 {
Hanno Becker106f3da2019-07-12 09:35:58 +01005640 unsigned char const old_msg_type = rec->type;
5641
Hanno Becker611a83b2018-01-03 14:27:32 +00005642 if( ( ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in,
Hanno Beckera89610a2019-07-11 13:07:45 +01005643 rec ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005644 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005645 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005646
Hanno Beckera5a2b082019-05-15 14:03:01 +01005647#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005648 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID &&
Hanno Beckere0200da2019-06-13 09:23:43 +01005649 mbedtls_ssl_conf_get_ignore_unexpected_cid( ssl->conf )
5650 == MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005651 {
Hanno Becker675c4d62019-05-24 10:11:06 +01005652 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ignoring unexpected CID" ) );
Hanno Becker687e0fb2019-05-08 13:02:55 +01005653 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
Hanno Beckere8eff9a2019-05-14 11:30:10 +01005654 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01005655#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker687e0fb2019-05-08 13:02:55 +01005656
Paul Bakker5121ce52009-01-03 21:22:43 +00005657 return( ret );
5658 }
5659
Hanno Becker106f3da2019-07-12 09:35:58 +01005660 if( old_msg_type != rec->type )
Hanno Becker93012fe2018-08-07 14:30:18 +01005661 {
Hanno Beckerff3e9c22019-05-08 11:57:13 +01005662 MBEDTLS_SSL_DEBUG_MSG( 4, ( "record type after decrypt (before %d): %d",
Hanno Becker106f3da2019-07-12 09:35:58 +01005663 old_msg_type, rec->type ) );
Hanno Becker93012fe2018-08-07 14:30:18 +01005664 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005665
Paul Bakker5121ce52009-01-03 21:22:43 +00005666 MBEDTLS_SSL_DEBUG_BUF( 4, "input payload after decrypt",
Hanno Becker106f3da2019-07-12 09:35:58 +01005667 rec->buf + rec->data_offset, rec->data_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00005668
Hanno Beckera5a2b082019-05-15 14:03:01 +01005669#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerff3e9c22019-05-08 11:57:13 +01005670 /* We have already checked the record content type
5671 * in ssl_parse_record_header(), failing or silently
5672 * dropping the record in the case of an unknown type.
5673 *
5674 * Since with the use of CIDs, the record content type
5675 * might change during decryption, re-check the record
5676 * content type, but treat a failure as fatal this time. */
Hanno Becker106f3da2019-07-12 09:35:58 +01005677 if( ssl_check_record_type( rec->type ) )
Hanno Beckerff3e9c22019-05-08 11:57:13 +01005678 {
5679 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
5680 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5681 }
Hanno Beckera5a2b082019-05-15 14:03:01 +01005682#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerff3e9c22019-05-08 11:57:13 +01005683
Hanno Becker106f3da2019-07-12 09:35:58 +01005684 if( rec->data_len == 0 )
Hanno Becker4c6876b2017-12-27 21:28:58 +00005685 {
5686#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker2881d802019-05-22 14:44:53 +01005687 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_3
Hanno Becker106f3da2019-07-12 09:35:58 +01005688 && rec->type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Hanno Becker4c6876b2017-12-27 21:28:58 +00005689 {
5690 /* TLS v1.2 explicitly disallows zero-length messages which are not application data */
5691 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid zero-length message type: %d", ssl->in_msgtype ) );
5692 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5693 }
5694#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5695
5696 ssl->nb_zero++;
5697
5698 /*
5699 * Three or more empty messages may be a DoS attack
5700 * (excessive CPU consumption).
5701 */
5702 if( ssl->nb_zero > 3 )
5703 {
5704 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
Hanno Becker70463db2019-05-08 10:38:32 +01005705 "messages, possible DoS attack" ) );
5706 /* Treat the records as if they were not properly authenticated,
5707 * thereby failing the connection if we see more than allowed
5708 * by the configured bad MAC threshold. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00005709 return( MBEDTLS_ERR_SSL_INVALID_MAC );
5710 }
5711 }
5712 else
5713 ssl->nb_zero = 0;
5714
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005715 /* Only needed for TLS, as with DTLS in_ctr is read from the header */
5716#if defined(MBEDTLS_SSL_PROTO_TLS)
5717 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker4c6876b2017-12-27 21:28:58 +00005718 {
5719 unsigned i;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005720 for( i = 8; i > 0; i-- )
Hanno Becker4c6876b2017-12-27 21:28:58 +00005721 if( ++ssl->in_ctr[i - 1] != 0 )
5722 break;
5723
Manuel Pégourié-Gonnard8794a422019-06-11 10:04:57 +02005724 /* The loop goes to its end only if the counter is wrapping around */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005725 if( i == 0 )
Hanno Becker4c6876b2017-12-27 21:28:58 +00005726 {
5727 MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
5728 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
5729 }
5730 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02005731#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker4c6876b2017-12-27 21:28:58 +00005732
Paul Bakker5121ce52009-01-03 21:22:43 +00005733 }
5734
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005735#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005736 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02005737 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005738 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02005739 }
5740#endif
5741
Hanno Beckerf0242852019-07-09 17:30:02 +01005742 /* Check actual (decrypted) record content length against
5743 * configured maximum. */
5744 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
5745 {
5746 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
5747 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5748 }
5749
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005750 return( 0 );
5751}
5752
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005753static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005754
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005755/*
5756 * Read a record.
5757 *
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02005758 * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
5759 * RFC 6347 4.1.2.7) and continue reading until a valid record is found.
5760 *
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005761 */
Hanno Becker1097b342018-08-15 14:09:41 +01005762
5763/* Helper functions for mbedtls_ssl_read_record(). */
5764static int ssl_consume_current_message( mbedtls_ssl_context *ssl );
Hanno Beckere74d5562018-08-15 14:26:08 +01005765static int ssl_get_next_record( mbedtls_ssl_context *ssl );
5766static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl );
Hanno Becker4162b112018-08-15 14:05:04 +01005767
Hanno Becker327c93b2018-08-15 13:56:18 +01005768int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl,
Hanno Becker3a0aad12018-08-20 09:44:02 +01005769 unsigned update_hs_digest )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005770{
5771 int ret;
5772
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005773 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read record" ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005774
Hanno Beckeraf0665d2017-05-24 09:16:26 +01005775 if( ssl->keep_current_message == 0 )
5776 {
5777 do {
Simon Butcher99000142016-10-13 17:21:01 +01005778
Hanno Becker26994592018-08-15 14:14:59 +01005779 ret = ssl_consume_current_message( ssl );
Hanno Becker90333da2017-10-10 11:27:13 +01005780 if( ret != 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01005781 return( ret );
Hanno Becker26994592018-08-15 14:14:59 +01005782
Hanno Beckere74d5562018-08-15 14:26:08 +01005783 if( ssl_record_is_in_progress( ssl ) == 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01005784 {
Hanno Becker40f50842018-08-15 14:48:01 +01005785#if defined(MBEDTLS_SSL_PROTO_DTLS)
5786 int have_buffered = 0;
Hanno Beckere74d5562018-08-15 14:26:08 +01005787
Hanno Becker40f50842018-08-15 14:48:01 +01005788 /* We only check for buffered messages if the
5789 * current datagram is fully consumed. */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02005790 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckeref7afdf2018-08-28 17:16:31 +01005791 ssl_next_record_is_in_datagram( ssl ) == 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01005792 {
Hanno Becker40f50842018-08-15 14:48:01 +01005793 if( ssl_load_buffered_message( ssl ) == 0 )
5794 have_buffered = 1;
5795 }
5796
5797 if( have_buffered == 0 )
5798#endif /* MBEDTLS_SSL_PROTO_DTLS */
5799 {
5800 ret = ssl_get_next_record( ssl );
5801 if( ret == MBEDTLS_ERR_SSL_CONTINUE_PROCESSING )
5802 continue;
5803
5804 if( ret != 0 )
5805 {
Hanno Beckerc573ac32018-08-28 17:15:25 +01005806 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_get_next_record" ), ret );
Hanno Becker42a6b042019-07-26 07:25:20 +01005807 ssl_send_pending_fatal_alert( ssl );
Hanno Becker40f50842018-08-15 14:48:01 +01005808 return( ret );
5809 }
Hanno Beckere74d5562018-08-15 14:26:08 +01005810 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01005811 }
5812
5813 ret = mbedtls_ssl_handle_message_type( ssl );
5814
Hanno Becker40f50842018-08-15 14:48:01 +01005815#if defined(MBEDTLS_SSL_PROTO_DTLS)
5816 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
5817 {
5818 /* Buffer future message */
5819 ret = ssl_buffer_message( ssl );
5820 if( ret != 0 )
5821 return( ret );
5822
5823 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
5824 }
5825#endif /* MBEDTLS_SSL_PROTO_DTLS */
5826
Hanno Becker90333da2017-10-10 11:27:13 +01005827 } while( MBEDTLS_ERR_SSL_NON_FATAL == ret ||
5828 MBEDTLS_ERR_SSL_CONTINUE_PROCESSING == ret );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01005829
5830 if( 0 != ret )
Simon Butcher99000142016-10-13 17:21:01 +01005831 {
Hanno Becker05c4fc82017-11-09 14:34:06 +00005832 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_handle_message_type" ), ret );
Simon Butcher99000142016-10-13 17:21:01 +01005833 return( ret );
5834 }
5835
Hanno Becker327c93b2018-08-15 13:56:18 +01005836 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
Hanno Becker3a0aad12018-08-20 09:44:02 +01005837 update_hs_digest == 1 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01005838 {
5839 mbedtls_ssl_update_handshake_status( ssl );
5840 }
Simon Butcher99000142016-10-13 17:21:01 +01005841 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01005842 else
Simon Butcher99000142016-10-13 17:21:01 +01005843 {
Hanno Becker02f59072018-08-15 14:00:24 +01005844 MBEDTLS_SSL_DEBUG_MSG( 2, ( "reuse previously read message" ) );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01005845 ssl->keep_current_message = 0;
Simon Butcher99000142016-10-13 17:21:01 +01005846 }
5847
5848 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );
5849
5850 return( 0 );
5851}
5852
Hanno Becker40f50842018-08-15 14:48:01 +01005853#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckeref7afdf2018-08-28 17:16:31 +01005854static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl )
Simon Butcher99000142016-10-13 17:21:01 +01005855{
Hanno Becker40f50842018-08-15 14:48:01 +01005856 if( ssl->in_left > ssl->next_record_offset )
5857 return( 1 );
Simon Butcher99000142016-10-13 17:21:01 +01005858
Hanno Becker40f50842018-08-15 14:48:01 +01005859 return( 0 );
5860}
5861
5862static int ssl_load_buffered_message( mbedtls_ssl_context *ssl )
5863{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005864 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker37f95322018-08-16 13:55:32 +01005865 mbedtls_ssl_hs_buffer * hs_buf;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005866 int ret = 0;
5867
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005868 if( hs == NULL )
5869 return( -1 );
5870
Hanno Beckere00ae372018-08-20 09:39:42 +01005871 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_messsage" ) );
5872
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005873 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC ||
5874 ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
5875 {
5876 /* Check if we have seen a ChangeCipherSpec before.
5877 * If yes, synthesize a CCS record. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01005878 if( !hs->buffering.seen_ccs )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005879 {
5880 MBEDTLS_SSL_DEBUG_MSG( 2, ( "CCS not seen in the current flight" ) );
5881 ret = -1;
Hanno Becker0d4b3762018-08-20 09:36:59 +01005882 goto exit;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005883 }
5884
Hanno Becker39b8bc92018-08-28 17:17:13 +01005885 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Injecting buffered CCS message" ) );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005886 ssl->in_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
5887 ssl->in_msglen = 1;
5888 ssl->in_msg[0] = 1;
5889
5890 /* As long as they are equal, the exact value doesn't matter. */
5891 ssl->in_left = 0;
5892 ssl->next_record_offset = 0;
5893
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01005894 hs->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005895 goto exit;
5896 }
Hanno Becker37f95322018-08-16 13:55:32 +01005897
Hanno Beckerb8f50142018-08-28 10:01:34 +01005898#if defined(MBEDTLS_DEBUG_C)
Hanno Becker37f95322018-08-16 13:55:32 +01005899 /* Debug only */
5900 {
5901 unsigned offset;
5902 for( offset = 1; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
5903 {
5904 hs_buf = &hs->buffering.hs[offset];
5905 if( hs_buf->is_valid == 1 )
5906 {
5907 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Future message with sequence number %u %s buffered.",
5908 hs->in_msg_seq + offset,
Hanno Beckera591c482018-08-28 17:20:00 +01005909 hs_buf->is_complete ? "fully" : "partially" ) );
Hanno Becker37f95322018-08-16 13:55:32 +01005910 }
5911 }
5912 }
Hanno Beckerb8f50142018-08-28 10:01:34 +01005913#endif /* MBEDTLS_DEBUG_C */
Hanno Becker37f95322018-08-16 13:55:32 +01005914
5915 /* Check if we have buffered and/or fully reassembled the
5916 * next handshake message. */
5917 hs_buf = &hs->buffering.hs[0];
5918 if( ( hs_buf->is_valid == 1 ) && ( hs_buf->is_complete == 1 ) )
5919 {
5920 /* Synthesize a record containing the buffered HS message. */
Arto Kinnunen84eeb4f2019-09-10 10:32:30 +03005921 size_t msg_len = mbedtls_platform_get_uint24_be( &hs_buf->data[1] );
Hanno Becker37f95322018-08-16 13:55:32 +01005922
5923 /* Double-check that we haven't accidentally buffered
5924 * a message that doesn't fit into the input buffer. */
5925 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
5926 {
5927 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5928 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5929 }
5930
5931 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message has been buffered - load" ) );
5932 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered handshake message (incl. header)",
5933 hs_buf->data, msg_len + 12 );
5934
5935 ssl->in_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5936 ssl->in_hslen = msg_len + 12;
5937 ssl->in_msglen = msg_len + 12;
Teppo Järvelin91d79382019-10-02 09:09:31 +03005938 mbedtls_platform_memcpy( ssl->in_msg, hs_buf->data, ssl->in_hslen );
Hanno Becker37f95322018-08-16 13:55:32 +01005939
5940 ret = 0;
5941 goto exit;
5942 }
5943 else
5944 {
5945 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message %u not or only partially bufffered",
5946 hs->in_msg_seq ) );
5947 }
5948
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005949 ret = -1;
5950
5951exit:
5952
5953 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_message" ) );
5954 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01005955}
5956
Hanno Beckera02b0b42018-08-21 17:20:27 +01005957static int ssl_buffer_make_space( mbedtls_ssl_context *ssl,
5958 size_t desired )
5959{
5960 int offset;
5961 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker6e12c1e2018-08-24 14:39:15 +01005962 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Attempt to free buffered messages to have %u bytes available",
5963 (unsigned) desired ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01005964
Hanno Becker01315ea2018-08-21 17:22:17 +01005965 /* Get rid of future records epoch first, if such exist. */
5966 ssl_free_buffered_record( ssl );
5967
5968 /* Check if we have enough space available now. */
5969 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
5970 hs->buffering.total_bytes_buffered ) )
5971 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01005972 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing future epoch record" ) );
Hanno Becker01315ea2018-08-21 17:22:17 +01005973 return( 0 );
5974 }
Hanno Beckera02b0b42018-08-21 17:20:27 +01005975
Hanno Becker4f432ad2018-08-28 10:02:32 +01005976 /* We don't have enough space to buffer the next expected handshake
5977 * message. Remove buffers used for future messages to gain space,
5978 * starting with the most distant one. */
Hanno Beckera02b0b42018-08-21 17:20:27 +01005979 for( offset = MBEDTLS_SSL_MAX_BUFFERED_HS - 1;
5980 offset >= 0; offset-- )
5981 {
5982 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Free buffering slot %d to make space for reassembly of next handshake message",
5983 offset ) );
5984
Hanno Beckerb309b922018-08-23 13:18:05 +01005985 ssl_buffering_free_slot( ssl, (uint8_t) offset );
Hanno Beckera02b0b42018-08-21 17:20:27 +01005986
5987 /* Check if we have enough space available now. */
5988 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
5989 hs->buffering.total_bytes_buffered ) )
5990 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01005991 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing buffered HS messages" ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01005992 return( 0 );
5993 }
5994 }
5995
5996 return( -1 );
5997}
5998
Hanno Becker40f50842018-08-15 14:48:01 +01005999static int ssl_buffer_message( mbedtls_ssl_context *ssl )
6000{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006001 int ret = 0;
6002 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6003
6004 if( hs == NULL )
6005 return( 0 );
6006
6007 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_buffer_message" ) );
6008
6009 switch( ssl->in_msgtype )
6010 {
6011 case MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC:
6012 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Remember CCS message" ) );
Hanno Beckere678eaa2018-08-21 14:57:46 +01006013
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01006014 hs->buffering.seen_ccs = 1;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006015 break;
6016
6017 case MBEDTLS_SSL_MSG_HANDSHAKE:
Hanno Becker37f95322018-08-16 13:55:32 +01006018 {
6019 unsigned recv_msg_seq_offset;
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03006020 unsigned recv_msg_seq = (unsigned)
6021 mbedtls_platform_get_uint16_be( &ssl->in_msg[4] );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03006022
Hanno Becker37f95322018-08-16 13:55:32 +01006023 mbedtls_ssl_hs_buffer *hs_buf;
6024 size_t msg_len = ssl->in_hslen - 12;
6025
6026 /* We should never receive an old handshake
6027 * message - double-check nonetheless. */
6028 if( recv_msg_seq < ssl->handshake->in_msg_seq )
6029 {
6030 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6031 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6032 }
6033
6034 recv_msg_seq_offset = recv_msg_seq - ssl->handshake->in_msg_seq;
6035 if( recv_msg_seq_offset >= MBEDTLS_SSL_MAX_BUFFERED_HS )
6036 {
6037 /* Silently ignore -- message too far in the future */
6038 MBEDTLS_SSL_DEBUG_MSG( 2,
6039 ( "Ignore future HS message with sequence number %u, "
6040 "buffering window %u - %u",
6041 recv_msg_seq, ssl->handshake->in_msg_seq,
6042 ssl->handshake->in_msg_seq + MBEDTLS_SSL_MAX_BUFFERED_HS - 1 ) );
6043
6044 goto exit;
6045 }
6046
6047 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering HS message with sequence number %u, offset %u ",
6048 recv_msg_seq, recv_msg_seq_offset ) );
6049
6050 hs_buf = &hs->buffering.hs[ recv_msg_seq_offset ];
6051
6052 /* Check if the buffering for this seq nr has already commenced. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01006053 if( !hs_buf->is_valid )
Hanno Becker37f95322018-08-16 13:55:32 +01006054 {
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006055 size_t reassembly_buf_sz;
6056
Hanno Becker37f95322018-08-16 13:55:32 +01006057 hs_buf->is_fragmented =
Andrzej Kurek8f52a8a2020-06-08 11:02:22 -04006058 ( ssl_hs_is_proper_fragment( ssl ) == PROPER_HS_FRAGMENT );
Hanno Becker37f95322018-08-16 13:55:32 +01006059
6060 /* We copy the message back into the input buffer
6061 * after reassembly, so check that it's not too large.
6062 * This is an implementation-specific limitation
6063 * and not one from the standard, hence it is not
6064 * checked in ssl_check_hs_header(). */
Hanno Becker96a6c692018-08-21 15:56:03 +01006065 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
Hanno Becker37f95322018-08-16 13:55:32 +01006066 {
6067 /* Ignore message */
6068 goto exit;
6069 }
6070
Hanno Beckere0b150f2018-08-21 15:51:03 +01006071 /* Check if we have enough space to buffer the message. */
6072 if( hs->buffering.total_bytes_buffered >
6073 MBEDTLS_SSL_DTLS_MAX_BUFFERING )
6074 {
6075 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6076 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6077 }
6078
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006079 reassembly_buf_sz = ssl_get_reassembly_buffer_size( msg_len,
6080 hs_buf->is_fragmented );
Hanno Beckere0b150f2018-08-21 15:51:03 +01006081
6082 if( reassembly_buf_sz > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
6083 hs->buffering.total_bytes_buffered ) )
6084 {
6085 if( recv_msg_seq_offset > 0 )
6086 {
6087 /* If we can't buffer a future message because
6088 * of space limitations -- ignore. */
6089 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
6090 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
6091 (unsigned) hs->buffering.total_bytes_buffered ) );
6092 goto exit;
6093 }
Hanno Beckere1801392018-08-21 16:51:05 +01006094 else
6095 {
6096 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- attempt to make space by freeing buffered future messages\n",
6097 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
6098 (unsigned) hs->buffering.total_bytes_buffered ) );
6099 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006100
Hanno Beckera02b0b42018-08-21 17:20:27 +01006101 if( ssl_buffer_make_space( ssl, reassembly_buf_sz ) != 0 )
Hanno Becker55e9e2a2018-08-21 16:07:55 +01006102 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01006103 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reassembly of next message of size %u (%u with bitmap) would exceed the compile-time limit %u (already %u bytes buffered) -- fail\n",
6104 (unsigned) msg_len,
6105 (unsigned) reassembly_buf_sz,
6106 MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Hanno Beckere0b150f2018-08-21 15:51:03 +01006107 (unsigned) hs->buffering.total_bytes_buffered ) );
Hanno Becker55e9e2a2018-08-21 16:07:55 +01006108 ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
6109 goto exit;
6110 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006111 }
6112
6113 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %d",
6114 msg_len ) );
6115
Hanno Becker2a97b0e2018-08-21 15:47:49 +01006116 hs_buf->data = mbedtls_calloc( 1, reassembly_buf_sz );
6117 if( hs_buf->data == NULL )
Hanno Becker37f95322018-08-16 13:55:32 +01006118 {
Hanno Beckere0b150f2018-08-21 15:51:03 +01006119 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
Hanno Becker37f95322018-08-16 13:55:32 +01006120 goto exit;
6121 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01006122 hs_buf->data_len = reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01006123
6124 /* Prepare final header: copy msg_type, length and message_seq,
6125 * then add standardised fragment_offset and fragment_length */
Teppo Järvelin91d79382019-10-02 09:09:31 +03006126 mbedtls_platform_memcpy( hs_buf->data, ssl->in_msg, 6 );
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02006127 mbedtls_platform_memset( hs_buf->data + 6, 0, 3 );
Teppo Järvelin91d79382019-10-02 09:09:31 +03006128 mbedtls_platform_memcpy( hs_buf->data + 9, hs_buf->data + 1, 3 );
Hanno Becker37f95322018-08-16 13:55:32 +01006129
6130 hs_buf->is_valid = 1;
Hanno Beckere0b150f2018-08-21 15:51:03 +01006131
6132 hs->buffering.total_bytes_buffered += reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01006133 }
6134 else
6135 {
6136 /* Make sure msg_type and length are consistent */
Teppo Järvelin0efac532019-10-04 13:21:08 +03006137 if( memcmp( hs_buf->data, ssl->in_msg, 4 ) != 0 ) // use regular memcmp as msg type is public
Hanno Becker37f95322018-08-16 13:55:32 +01006138 {
6139 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Fragment header mismatch - ignore" ) );
6140 /* Ignore */
6141 goto exit;
6142 }
6143 }
6144
Hanno Becker4422bbb2018-08-20 09:40:19 +01006145 if( !hs_buf->is_complete )
Hanno Becker37f95322018-08-16 13:55:32 +01006146 {
6147 size_t frag_len, frag_off;
6148 unsigned char * const msg = hs_buf->data + 12;
6149
6150 /*
6151 * Check and copy current fragment
6152 */
6153
6154 /* Validation of header fields already done in
6155 * mbedtls_ssl_prepare_handshake_record(). */
6156 frag_off = ssl_get_hs_frag_off( ssl );
6157 frag_len = ssl_get_hs_frag_len( ssl );
6158
6159 MBEDTLS_SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %d, length = %d",
6160 frag_off, frag_len ) );
Teppo Järvelin91d79382019-10-02 09:09:31 +03006161 mbedtls_platform_memcpy( msg + frag_off, ssl->in_msg + 12, frag_len );
Hanno Becker37f95322018-08-16 13:55:32 +01006162
6163 if( hs_buf->is_fragmented )
6164 {
6165 unsigned char * const bitmask = msg + msg_len;
6166 ssl_bitmask_set( bitmask, frag_off, frag_len );
6167 hs_buf->is_complete = ( ssl_bitmask_check( bitmask,
6168 msg_len ) == 0 );
6169 }
6170 else
6171 {
6172 hs_buf->is_complete = 1;
6173 }
6174
6175 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message %scomplete",
6176 hs_buf->is_complete ? "" : "not yet " ) );
6177 }
6178
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006179 break;
Hanno Becker37f95322018-08-16 13:55:32 +01006180 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006181
6182 default:
Hanno Becker360bef32018-08-28 10:04:33 +01006183 /* We don't buffer other types of messages. */
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006184 break;
6185 }
6186
6187exit:
6188
6189 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_buffer_message" ) );
6190 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01006191}
6192#endif /* MBEDTLS_SSL_PROTO_DTLS */
6193
Hanno Becker1097b342018-08-15 14:09:41 +01006194static int ssl_consume_current_message( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006195{
Hanno Becker4a810fb2017-05-24 16:27:30 +01006196 /*
Hanno Becker4a810fb2017-05-24 16:27:30 +01006197 * Consume last content-layer message and potentially
6198 * update in_msglen which keeps track of the contents'
6199 * consumption state.
6200 *
6201 * (1) Handshake messages:
6202 * Remove last handshake message, move content
6203 * and adapt in_msglen.
6204 *
6205 * (2) Alert messages:
6206 * Consume whole record content, in_msglen = 0.
6207 *
Hanno Becker4a810fb2017-05-24 16:27:30 +01006208 * (3) Change cipher spec:
6209 * Consume whole record content, in_msglen = 0.
6210 *
6211 * (4) Application data:
6212 * Don't do anything - the record layer provides
6213 * the application data as a stream transport
6214 * and consumes through mbedtls_ssl_read only.
6215 *
6216 */
6217
6218 /* Case (1): Handshake messages */
6219 if( ssl->in_hslen != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006220 {
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01006221 /* Hard assertion to be sure that no application data
6222 * is in flight, as corrupting ssl->in_msglen during
6223 * ssl->in_offt != NULL is fatal. */
6224 if( ssl->in_offt != NULL )
6225 {
6226 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6227 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6228 }
6229
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006230 /*
6231 * Get next Handshake message in the current record
6232 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006233
Hanno Becker4a810fb2017-05-24 16:27:30 +01006234 /* Notes:
Hanno Beckere72489d2017-10-23 13:23:50 +01006235 * (1) in_hslen is not necessarily the size of the
Hanno Becker4a810fb2017-05-24 16:27:30 +01006236 * current handshake content: If DTLS handshake
6237 * fragmentation is used, that's the fragment
6238 * size instead. Using the total handshake message
Hanno Beckere72489d2017-10-23 13:23:50 +01006239 * size here is faulty and should be changed at
6240 * some point.
Hanno Becker4a810fb2017-05-24 16:27:30 +01006241 * (2) While it doesn't seem to cause problems, one
6242 * has to be very careful not to assume that in_hslen
6243 * is always <= in_msglen in a sensible communication.
6244 * Again, it's wrong for DTLS handshake fragmentation.
6245 * The following check is therefore mandatory, and
6246 * should not be treated as a silently corrected assertion.
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01006247 * Additionally, ssl->in_hslen might be arbitrarily out of
6248 * bounds after handling a DTLS message with an unexpected
6249 * sequence number, see mbedtls_ssl_prepare_handshake_record.
Hanno Becker4a810fb2017-05-24 16:27:30 +01006250 */
6251 if( ssl->in_hslen < ssl->in_msglen )
6252 {
6253 ssl->in_msglen -= ssl->in_hslen;
6254 memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
6255 ssl->in_msglen );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006256
Hanno Becker4a810fb2017-05-24 16:27:30 +01006257 MBEDTLS_SSL_DEBUG_BUF( 4, "remaining content in record",
6258 ssl->in_msg, ssl->in_msglen );
6259 }
6260 else
6261 {
6262 ssl->in_msglen = 0;
6263 }
Manuel Pégourié-Gonnard4a175362014-09-09 17:45:31 +02006264
Hanno Becker4a810fb2017-05-24 16:27:30 +01006265 ssl->in_hslen = 0;
6266 }
6267 /* Case (4): Application data */
6268 else if( ssl->in_offt != NULL )
6269 {
6270 return( 0 );
6271 }
6272 /* Everything else (CCS & Alerts) */
6273 else
6274 {
6275 ssl->in_msglen = 0;
6276 }
6277
Hanno Becker1097b342018-08-15 14:09:41 +01006278 return( 0 );
6279}
Hanno Becker4a810fb2017-05-24 16:27:30 +01006280
Hanno Beckere74d5562018-08-15 14:26:08 +01006281static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl )
6282{
Hanno Becker4a810fb2017-05-24 16:27:30 +01006283 if( ssl->in_msglen > 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01006284 return( 1 );
6285
6286 return( 0 );
6287}
6288
Hanno Becker5f066e72018-08-16 14:56:31 +01006289#if defined(MBEDTLS_SSL_PROTO_DTLS)
6290
6291static void ssl_free_buffered_record( mbedtls_ssl_context *ssl )
6292{
6293 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6294 if( hs == NULL )
6295 return;
6296
Hanno Becker01315ea2018-08-21 17:22:17 +01006297 if( hs->buffering.future_record.data != NULL )
Hanno Becker4a810fb2017-05-24 16:27:30 +01006298 {
Hanno Becker01315ea2018-08-21 17:22:17 +01006299 hs->buffering.total_bytes_buffered -=
6300 hs->buffering.future_record.len;
6301
6302 mbedtls_free( hs->buffering.future_record.data );
6303 hs->buffering.future_record.data = NULL;
6304 }
Hanno Becker5f066e72018-08-16 14:56:31 +01006305}
6306
6307static int ssl_load_buffered_record( mbedtls_ssl_context *ssl )
6308{
6309 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
6310 unsigned char * rec;
6311 size_t rec_len;
6312 unsigned rec_epoch;
6313
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006314 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Becker5f066e72018-08-16 14:56:31 +01006315 return( 0 );
6316
6317 if( hs == NULL )
6318 return( 0 );
6319
Hanno Becker5f066e72018-08-16 14:56:31 +01006320 rec = hs->buffering.future_record.data;
6321 rec_len = hs->buffering.future_record.len;
6322 rec_epoch = hs->buffering.future_record.epoch;
6323
6324 if( rec == NULL )
6325 return( 0 );
6326
Hanno Becker4cb782d2018-08-20 11:19:05 +01006327 /* Only consider loading future records if the
6328 * input buffer is empty. */
Hanno Beckeref7afdf2018-08-28 17:16:31 +01006329 if( ssl_next_record_is_in_datagram( ssl ) == 1 )
Hanno Becker4cb782d2018-08-20 11:19:05 +01006330 return( 0 );
6331
Hanno Becker5f066e72018-08-16 14:56:31 +01006332 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_record" ) );
6333
6334 if( rec_epoch != ssl->in_epoch )
6335 {
6336 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffered record not from current epoch." ) );
6337 goto exit;
6338 }
6339
6340 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Found buffered record from current epoch - load" ) );
6341
6342 /* Double-check that the record is not too large */
6343 if( rec_len > MBEDTLS_SSL_IN_BUFFER_LEN -
6344 (size_t)( ssl->in_hdr - ssl->in_buf ) )
6345 {
6346 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6347 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
6348 }
6349
Teppo Järvelin91d79382019-10-02 09:09:31 +03006350 mbedtls_platform_memcpy( ssl->in_hdr, rec, rec_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006351 ssl->in_left = rec_len;
6352 ssl->next_record_offset = 0;
6353
6354 ssl_free_buffered_record( ssl );
6355
6356exit:
6357 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_record" ) );
6358 return( 0 );
6359}
6360
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006361static int ssl_buffer_future_record( mbedtls_ssl_context *ssl,
6362 mbedtls_record const *rec )
Hanno Becker5f066e72018-08-16 14:56:31 +01006363{
6364 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker5f066e72018-08-16 14:56:31 +01006365
6366 /* Don't buffer future records outside handshakes. */
6367 if( hs == NULL )
6368 return( 0 );
6369
6370 /* Only buffer handshake records (we are only interested
6371 * in Finished messages). */
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006372 if( rec->type != MBEDTLS_SSL_MSG_HANDSHAKE )
Hanno Becker5f066e72018-08-16 14:56:31 +01006373 return( 0 );
6374
6375 /* Don't buffer more than one future epoch record. */
6376 if( hs->buffering.future_record.data != NULL )
6377 return( 0 );
6378
Hanno Becker01315ea2018-08-21 17:22:17 +01006379 /* Don't buffer record if there's not enough buffering space remaining. */
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006380 if( rec->buf_len > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
Hanno Becker01315ea2018-08-21 17:22:17 +01006381 hs->buffering.total_bytes_buffered ) )
6382 {
6383 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future epoch record of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006384 (unsigned) rec->buf_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Hanno Becker01315ea2018-08-21 17:22:17 +01006385 (unsigned) hs->buffering.total_bytes_buffered ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006386 return( 0 );
6387 }
6388
Hanno Becker5f066e72018-08-16 14:56:31 +01006389 /* Buffer record */
6390 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffer record from epoch %u",
6391 ssl->in_epoch + 1 ) );
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006392 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered record", rec->buf, rec->buf_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006393
6394 /* ssl_parse_record_header() only considers records
6395 * of the next epoch as candidates for buffering. */
6396 hs->buffering.future_record.epoch = ssl->in_epoch + 1;
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006397 hs->buffering.future_record.len = rec->buf_len;
Hanno Becker5f066e72018-08-16 14:56:31 +01006398
6399 hs->buffering.future_record.data =
6400 mbedtls_calloc( 1, hs->buffering.future_record.len );
6401 if( hs->buffering.future_record.data == NULL )
6402 {
6403 /* If we run out of RAM trying to buffer a
6404 * record from the next epoch, just ignore. */
6405 return( 0 );
6406 }
6407
Teppo Järvelin91d79382019-10-02 09:09:31 +03006408 mbedtls_platform_memcpy( hs->buffering.future_record.data, rec->buf, rec->buf_len );
Hanno Becker5f066e72018-08-16 14:56:31 +01006409
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006410 hs->buffering.total_bytes_buffered += rec->buf_len;
Hanno Becker5f066e72018-08-16 14:56:31 +01006411 return( 0 );
6412}
6413
6414#endif /* MBEDTLS_SSL_PROTO_DTLS */
6415
Hanno Beckere74d5562018-08-15 14:26:08 +01006416static int ssl_get_next_record( mbedtls_ssl_context *ssl )
Hanno Becker1097b342018-08-15 14:09:41 +01006417{
6418 int ret;
Hanno Beckerc6e7c572019-07-11 12:29:35 +01006419 mbedtls_record rec;
Hanno Becker1097b342018-08-15 14:09:41 +01006420
Hanno Becker5f066e72018-08-16 14:56:31 +01006421#if defined(MBEDTLS_SSL_PROTO_DTLS)
6422 /* We might have buffered a future record; if so,
6423 * and if the epoch matches now, load it.
6424 * On success, this call will set ssl->in_left to
6425 * the length of the buffered record, so that
6426 * the calls to ssl_fetch_input() below will
6427 * essentially be no-ops. */
6428 ret = ssl_load_buffered_record( ssl );
6429 if( ret != 0 )
6430 return( ret );
6431#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Becker4a810fb2017-05-24 16:27:30 +01006432
Hanno Becker8b09b732019-05-08 12:03:28 +01006433 /* Ensure that we have enough space available for the default form
6434 * of TLS / DTLS record headers (5 Bytes for TLS, 13 Bytes for DTLS,
6435 * with no space for CIDs counted in). */
6436 ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_in_hdr_len( ssl ) );
6437 if( ret != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006438 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006439 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006440 return( ret );
6441 }
6442
Hanno Beckerc6e7c572019-07-11 12:29:35 +01006443 ret = ssl_parse_record_header( ssl, ssl->in_hdr, ssl->in_left, &rec );
6444 if( ret != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006445 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006446#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker87b56262019-07-10 14:37:41 +01006447 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006448 {
Hanno Becker5f066e72018-08-16 14:56:31 +01006449 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
6450 {
Hanno Beckeraf5bcfc2019-07-11 12:43:20 +01006451 ret = ssl_buffer_future_record( ssl, &rec );
Hanno Becker5f066e72018-08-16 14:56:31 +01006452 if( ret != 0 )
6453 return( ret );
6454
6455 /* Fall through to handling of unexpected records */
6456 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
6457 }
6458
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006459 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD )
6460 {
Hanno Becker87b56262019-07-10 14:37:41 +01006461#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker68379722019-07-12 09:23:47 +01006462 /* Reset in pointers to default state for TLS/DTLS records,
6463 * assuming no CID and no offset between record content and
6464 * record plaintext. */
6465 ssl_update_in_pointers( ssl );
6466
Hanno Becker69412452019-07-12 08:33:49 +01006467 /* Setup internal message pointers from record structure. */
6468 ssl->in_msgtype = rec.type;
6469#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6470 ssl->in_len = ssl->in_cid + rec.cid_len;
6471#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01006472 ssl->in_msg = ssl->in_len + 2;
Hanno Becker69412452019-07-12 08:33:49 +01006473 ssl->in_msglen = rec.data_len;
6474
Hanno Becker87b56262019-07-10 14:37:41 +01006475 ret = ssl_check_client_reconnect( ssl );
Manuel Pégourié-Gonnard731d7c02020-04-01 09:58:39 +02006476 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_client_reconnect", ret );
Hanno Becker87b56262019-07-10 14:37:41 +01006477 if( ret != 0 )
6478 return( ret );
6479#endif
6480
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006481 /* Skip unexpected record (but not whole datagram) */
Hanno Becker2528ee02019-07-11 12:48:53 +01006482 ssl->next_record_offset = rec.buf_len;
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006483
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01006484 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding unexpected record "
6485 "(header)" ) );
6486 }
6487 else
6488 {
6489 /* Skip invalid record and the rest of the datagram */
6490 ssl->next_record_offset = 0;
6491 ssl->in_left = 0;
6492
6493 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record "
6494 "(header)" ) );
6495 }
6496
6497 /* Get next record */
Hanno Becker90333da2017-10-10 11:27:13 +01006498 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006499 }
Hanno Becker87b56262019-07-10 14:37:41 +01006500 else
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006501#endif
Hanno Becker87b56262019-07-10 14:37:41 +01006502 {
6503 return( ret );
6504 }
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006505 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006506
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006507#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006508 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Beckere65ce782017-05-22 14:47:48 +01006509 {
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006510 /* Remember offset of next record within datagram. */
Hanno Becker2720f4c2019-07-11 12:50:10 +01006511 ssl->next_record_offset = rec.buf_len;
Hanno Beckere65ce782017-05-22 14:47:48 +01006512 if( ssl->next_record_offset < ssl->in_left )
6513 {
6514 MBEDTLS_SSL_DEBUG_MSG( 3, ( "more than one record within datagram" ) );
6515 }
6516 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006517 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006518#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006519#if defined(MBEDTLS_SSL_PROTO_TLS)
6520 {
Hanno Beckere0452772019-07-10 17:12:07 +01006521 /*
6522 * Fetch record contents from underlying transport.
6523 */
Hanno Becker9babbf72019-07-11 12:50:29 +01006524 ret = mbedtls_ssl_fetch_input( ssl, rec.buf_len );
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006525 if( ret != 0 )
6526 {
6527 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
6528 return( ret );
6529 }
6530
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006531 ssl->in_left = 0;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006532 }
Hanno Beckerdc4d6272019-07-10 15:01:45 +01006533#endif /* MBEDTLS_SSL_PROTO_TLS */
6534
6535 /*
6536 * Decrypt record contents.
6537 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006538
Hanno Beckera89610a2019-07-11 13:07:45 +01006539 if( ( ret = ssl_prepare_record_content( ssl, &rec ) ) != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006540 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006541#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006542 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006543 {
6544 /* Silently discard invalid records */
Hanno Becker16e9ae22019-05-03 16:36:59 +01006545 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006546 {
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02006547 /* Except when waiting for Finished as a bad mac here
6548 * probably means something went wrong in the handshake
6549 * (eg wrong psk used, mitm downgrade attempt, etc.) */
6550 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED ||
6551 ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
6552 {
6553#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
6554 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
6555 {
Hanno Beckerde62da92019-07-24 13:23:50 +01006556 mbedtls_ssl_pend_fatal_alert( ssl,
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02006557 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
6558 }
6559#endif
6560 return( ret );
6561 }
6562
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006563#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Hanno Beckerde671542019-06-12 16:30:46 +01006564 if( mbedtls_ssl_conf_get_badmac_limit( ssl->conf ) != 0 &&
6565 ++ssl->badmac_seen >= mbedtls_ssl_conf_get_badmac_limit( ssl->conf ) )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02006566 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006567 MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
6568 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02006569 }
6570#endif
6571
Hanno Becker4a810fb2017-05-24 16:27:30 +01006572 /* As above, invalid records cause
6573 * dismissal of the whole datagram. */
6574
6575 ssl->next_record_offset = 0;
6576 ssl->in_left = 0;
6577
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006578 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
Hanno Becker90333da2017-10-10 11:27:13 +01006579 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006580 }
6581
6582 return( ret );
6583 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006584 MBEDTLS_SSL_TRANSPORT_ELSE
6585#endif /* MBEDTLS_SSL_PROTO_DTLS */
6586#if defined(MBEDTLS_SSL_PROTO_TLS)
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006587 {
6588 /* Error out (and send alert) on invalid records */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006589#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
6590 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006591 {
Hanno Beckerde62da92019-07-24 13:23:50 +01006592 mbedtls_ssl_pend_fatal_alert( ssl,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006593 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006594 }
6595#endif
6596 return( ret );
6597 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02006598#endif /* MBEDTLS_SSL_PROTO_TLS */
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02006599 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006600
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006601
6602 /* Reset in pointers to default state for TLS/DTLS records,
6603 * assuming no CID and no offset between record content and
6604 * record plaintext. */
6605 ssl_update_in_pointers( ssl );
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006606#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
6607 ssl->in_len = ssl->in_cid + rec.cid_len;
6608#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01006609 ssl->in_msg = ssl->in_len + 2;
Hanno Beckerbd70c8e2019-07-12 09:40:44 +01006610
Hanno Beckerbf256cd2019-07-12 09:37:30 +01006611 /* The record content type may change during decryption,
6612 * so re-read it. */
6613 ssl->in_msgtype = rec.type;
6614 /* Also update the input buffer, because unfortunately
6615 * the server-side ssl_parse_client_hello() reparses the
6616 * record header when receiving a ClientHello initiating
6617 * a renegotiation. */
6618 ssl->in_hdr[0] = rec.type;
6619 ssl->in_msg = rec.buf + rec.data_offset;
6620 ssl->in_msglen = rec.data_len;
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03006621 (void)mbedtls_platform_put_uint16_be( ssl->in_len, rec.data_len );
Hanno Beckerbf256cd2019-07-12 09:37:30 +01006622
Manuel Pégourié-Gonnardae48d862020-01-03 12:18:49 +01006623#if defined(MBEDTLS_ZLIB_SUPPORT)
6624 if( ssl->transform_in != NULL &&
6625 ssl->session_in->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
6626 {
6627 if( ( ret = ssl_decompress_buf( ssl ) ) != 0 )
6628 {
6629 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret );
6630 return( ret );
6631 }
6632
6633 /* Check actual (decompress) record content length against
6634 * configured maximum. */
6635 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
6636 {
6637 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
6638 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6639 }
6640 }
6641#endif /* MBEDTLS_ZLIB_SUPPORT */
6642
Simon Butcher99000142016-10-13 17:21:01 +01006643 return( 0 );
6644}
6645
6646int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl )
6647{
6648 int ret;
6649
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006650 /*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02006651 * Handle particular types of records
6652 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006653 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00006654 {
Simon Butcher99000142016-10-13 17:21:01 +01006655 if( ( ret = mbedtls_ssl_prepare_handshake_record( ssl ) ) != 0 )
6656 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01006657 return( ret );
Simon Butcher99000142016-10-13 17:21:01 +01006658 }
Paul Bakker5121ce52009-01-03 21:22:43 +00006659 }
6660
Hanno Beckere678eaa2018-08-21 14:57:46 +01006661 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006662 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01006663 if( ssl->in_msglen != 1 )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006664 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01006665 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, len: %d",
6666 ssl->in_msglen ) );
6667 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006668 }
6669
Hanno Beckere678eaa2018-08-21 14:57:46 +01006670 if( ssl->in_msg[0] != 1 )
6671 {
6672 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, content: %02x",
6673 ssl->in_msg[0] ) );
6674 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6675 }
6676
6677#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006678 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Beckere678eaa2018-08-21 14:57:46 +01006679 ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
6680 ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
6681 {
6682 if( ssl->handshake == NULL )
6683 {
6684 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping ChangeCipherSpec outside handshake" ) );
6685 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
6686 }
6687
6688 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received out-of-order ChangeCipherSpec - remember" ) );
6689 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
6690 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006691#endif
Hanno Beckere678eaa2018-08-21 14:57:46 +01006692 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01006693
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006694 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Paul Bakker5121ce52009-01-03 21:22:43 +00006695 {
Angus Gratton1a7a17e2018-06-20 15:43:50 +10006696 if( ssl->in_msglen != 2 )
6697 {
6698 /* Note: Standard allows for more than one 2 byte alert
6699 to be packed in a single message, but Mbed TLS doesn't
6700 currently support this. */
6701 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid alert message, len: %d",
6702 ssl->in_msglen ) );
6703 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
6704 }
6705
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006706 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]",
Paul Bakker5121ce52009-01-03 21:22:43 +00006707 ssl->in_msg[0], ssl->in_msg[1] ) );
6708
6709 /*
Simon Butcher459a9502015-10-27 16:09:03 +00006710 * Ignore non-fatal alerts, except close_notify and no_renegotiation
Paul Bakker5121ce52009-01-03 21:22:43 +00006711 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006712 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL )
Paul Bakker5121ce52009-01-03 21:22:43 +00006713 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006714 MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
Paul Bakker2770fbd2012-07-03 13:30:23 +00006715 ssl->in_msg[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006716 return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00006717 }
6718
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006719 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
6720 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00006721 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006722 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
6723 return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00006724 }
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02006725
6726#if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
6727 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
6728 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION )
6729 {
Hanno Becker90333da2017-10-10 11:27:13 +01006730 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no renegotiation alert" ) );
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02006731 /* Will be handled when trying to parse ServerHello */
6732 return( 0 );
6733 }
6734#endif
6735
6736#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2881d802019-05-22 14:44:53 +01006737 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01006738 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
6739 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02006740 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
6741 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
6742 {
6743 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
6744 /* Will be handled in mbedtls_ssl_parse_certificate() */
6745 return( 0 );
6746 }
6747#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
6748
6749 /* Silently ignore: fetch new message */
Simon Butcher99000142016-10-13 17:21:01 +01006750 return MBEDTLS_ERR_SSL_NON_FATAL;
Paul Bakker5121ce52009-01-03 21:22:43 +00006751 }
6752
Hanno Beckerc76c6192017-06-06 10:03:17 +01006753#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02006754 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Beckerc76c6192017-06-06 10:03:17 +01006755 {
Hanno Becker74dd3a72019-05-03 16:54:26 +01006756 /* Drop unexpected ApplicationData records,
6757 * except at the beginning of renegotiations */
6758 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA &&
6759 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER
6760#if defined(MBEDTLS_SSL_RENEGOTIATION)
6761 && ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
6762 ssl->state == MBEDTLS_SSL_SERVER_HELLO )
Hanno Beckerc76c6192017-06-06 10:03:17 +01006763#endif
Hanno Becker74dd3a72019-05-03 16:54:26 +01006764 )
6765 {
6766 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
6767 return( MBEDTLS_ERR_SSL_NON_FATAL );
6768 }
6769
6770 if( ssl->handshake != NULL &&
6771 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
6772 {
6773 ssl_handshake_wrapup_free_hs_transform( ssl );
6774 }
6775 }
Hanno Beckerf65ad822019-05-08 16:26:21 +01006776#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Beckerc76c6192017-06-06 10:03:17 +01006777
Paul Bakker5121ce52009-01-03 21:22:43 +00006778 return( 0 );
6779}
6780
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006781int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00006782{
6783 int ret;
6784
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006785 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
6786 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6787 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00006788 {
6789 return( ret );
6790 }
6791
6792 return( 0 );
6793}
6794
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006795int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
Hanno Becker1facd552019-07-03 13:57:23 +01006796 unsigned char level,
6797 unsigned char message )
Paul Bakker0a925182012-04-16 06:46:41 +00006798{
6799 int ret;
6800
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02006801 if( ssl == NULL || ssl->conf == NULL )
6802 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
6803
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006804 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006805 MBEDTLS_SSL_DEBUG_MSG( 3, ( "send alert level=%u message=%u", level, message ));
Paul Bakker0a925182012-04-16 06:46:41 +00006806
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006807 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
Paul Bakker0a925182012-04-16 06:46:41 +00006808 ssl->out_msglen = 2;
6809 ssl->out_msg[0] = level;
6810 ssl->out_msg[1] = message;
6811
Hanno Becker67bc7c32018-08-06 11:33:50 +01006812 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Paul Bakker0a925182012-04-16 06:46:41 +00006813 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006814 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker0a925182012-04-16 06:46:41 +00006815 return( ret );
6816 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006817 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
Paul Bakker0a925182012-04-16 06:46:41 +00006818
6819 return( 0 );
6820}
6821
Hanno Becker17572472019-02-08 07:19:04 +00006822#if defined(MBEDTLS_X509_CRT_PARSE_C)
6823static void ssl_clear_peer_cert( mbedtls_ssl_session *session )
6824{
6825#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
6826 if( session->peer_cert != NULL )
6827 {
6828 mbedtls_x509_crt_free( session->peer_cert );
6829 mbedtls_free( session->peer_cert );
6830 session->peer_cert = NULL;
6831 }
Hanno Becker5882dd02019-06-06 16:25:57 +01006832#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker17572472019-02-08 07:19:04 +00006833 if( session->peer_cert_digest != NULL )
6834 {
6835 /* Zeroization is not necessary. */
6836 mbedtls_free( session->peer_cert_digest );
6837 session->peer_cert_digest = NULL;
6838 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
6839 session->peer_cert_digest_len = 0;
6840 }
Hanno Becker5882dd02019-06-06 16:25:57 +01006841#else
6842 ((void) session);
6843#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker17572472019-02-08 07:19:04 +00006844}
6845#endif /* MBEDTLS_X509_CRT_PARSE_C */
6846
Paul Bakker5121ce52009-01-03 21:22:43 +00006847/*
6848 * Handshake functions
6849 */
Hanno Beckerb71e90a2019-02-05 13:20:55 +00006850#if !defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Gilles Peskinef9828522017-05-03 12:28:43 +02006851/* No certificate support -> dummy functions */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006852int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00006853{
Hanno Beckerdf645962019-06-26 13:02:22 +01006854 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
6855 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker5121ce52009-01-03 21:22:43 +00006856
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006857 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006858
Hanno Becker5097cba2019-02-05 13:36:46 +00006859 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02006860 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006861 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02006862 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
6863 {
6864 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
6865 }
6866 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
6867 {
6868 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
6869 }
Jarno Lamsab0180092019-11-12 15:46:46 +02006870 else
6871 {
6872 ssl->state = MBEDTLS_SSL_INVALID;
6873 }
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02006874 return( 0 );
6875 }
6876
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006877 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6878 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006879}
6880
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006881int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006882{
Hanno Beckerdf645962019-06-26 13:02:22 +01006883 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
6884 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006885
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006886 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006887
Hanno Becker5097cba2019-02-05 13:36:46 +00006888 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006889 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006890 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02006891 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
6892 {
6893 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
6894 }
6895 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
6896 {
6897 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
6898 }
Jarno Lamsab0180092019-11-12 15:46:46 +02006899 else
6900 {
6901 ssl->state = MBEDTLS_SSL_INVALID;
6902 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006903 return( 0 );
6904 }
6905
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006906 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6907 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006908}
Gilles Peskinef9828522017-05-03 12:28:43 +02006909
Hanno Beckerb71e90a2019-02-05 13:20:55 +00006910#else /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Gilles Peskinef9828522017-05-03 12:28:43 +02006911/* Some certificate support -> implement write and parse */
6912
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006913int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006914{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006915 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006916 size_t i, n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006917 const mbedtls_x509_crt *crt;
Hanno Beckerdf645962019-06-26 13:02:22 +01006918 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
6919 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006920
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006921 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006922
Hanno Becker5097cba2019-02-05 13:36:46 +00006923 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006924 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006925 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02006926 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
6927 {
6928 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
6929 }
6930 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
6931 {
6932 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
6933 }
Jarno Lamsab0180092019-11-12 15:46:46 +02006934 else
6935 {
6936 ssl->state = MBEDTLS_SSL_INVALID;
6937 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02006938 return( 0 );
6939 }
6940
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006941#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01006942 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
6943 MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00006944 {
6945 if( ssl->client_auth == 0 )
6946 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006947 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Jarno Lamsa2b205162019-11-12 15:36:21 +02006948 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
6949 {
6950 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
6951 }
6952 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
6953 {
6954 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
6955 }
Jarno Lamsab0180092019-11-12 15:46:46 +02006956 else
6957 {
6958 ssl->state = MBEDTLS_SSL_INVALID;
6959 }
Paul Bakker5121ce52009-01-03 21:22:43 +00006960 return( 0 );
6961 }
6962
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006963#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00006964 /*
6965 * If using SSLv3 and got no cert, send an Alert message
6966 * (otherwise an empty Certificate message will be sent).
6967 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006968 if( mbedtls_ssl_own_cert( ssl ) == NULL &&
Hanno Becker2881d802019-05-22 14:44:53 +01006969 mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006970 {
6971 ssl->out_msglen = 2;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006972 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
6973 ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING;
6974 ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT;
Paul Bakker5121ce52009-01-03 21:22:43 +00006975
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006976 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006977 goto write_msg;
6978 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006979#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00006980 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006981#endif /* MBEDTLS_SSL_CLI_C */
6982#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01006983 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00006984 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006985 if( mbedtls_ssl_own_cert( ssl ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00006986 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006987 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
6988 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED );
Paul Bakker5121ce52009-01-03 21:22:43 +00006989 }
6990 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01006991#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00006992
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006993 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006994
6995 /*
6996 * 0 . 0 handshake type
6997 * 1 . 3 handshake length
6998 * 4 . 6 length of all certs
6999 * 7 . 9 length of cert. 1
7000 * 10 . n-1 peer certificate
7001 * n . n+2 length of cert. 2
7002 * n+3 . ... upper level cert, etc.
7003 */
7004 i = 7;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007005 crt = mbedtls_ssl_own_cert( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00007006
Paul Bakker29087132010-03-21 21:03:34 +00007007 while( crt != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007008 {
7009 n = crt->raw.len;
Angus Grattond8213d02016-05-25 20:56:48 +10007010 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
Paul Bakker5121ce52009-01-03 21:22:43 +00007011 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007012 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
Angus Grattond8213d02016-05-25 20:56:48 +10007013 i + 3 + n, MBEDTLS_SSL_OUT_CONTENT_LEN ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007014 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007015 }
7016
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03007017 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[i], n );
Paul Bakker5121ce52009-01-03 21:22:43 +00007018
Teppo Järvelin91d79382019-10-02 09:09:31 +03007019 i += 3; mbedtls_platform_memcpy( ssl->out_msg + i, crt->raw.p, n );
Paul Bakker5121ce52009-01-03 21:22:43 +00007020 i += n; crt = crt->next;
7021 }
7022
Arto Kinnunen3d7439e2019-09-10 11:30:40 +03007023 (void)mbedtls_platform_put_uint24_be( &ssl->out_msg[4], ( i - 7 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007024
7025 ssl->out_msglen = i;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007026 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
7027 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
Paul Bakker5121ce52009-01-03 21:22:43 +00007028
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02007029#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00007030write_msg:
Paul Bakkerd2f068e2013-08-27 21:19:20 +02007031#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00007032
Jarno Lamsa2b205162019-11-12 15:36:21 +02007033 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7034 {
7035 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7036 }
7037 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7038 {
7039 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7040 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007041 else
7042 {
7043 ssl->state = MBEDTLS_SSL_INVALID;
7044 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007045
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007046 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007047 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007048 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007049 return( ret );
7050 }
7051
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007052 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007053
Paul Bakkered27a042013-04-18 22:46:23 +02007054 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007055}
7056
Hanno Becker285ff0c2019-01-31 07:44:03 +00007057#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Hanno Beckerdf759382019-02-05 17:02:46 +00007058
7059#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Andrzej Kurek0919b142020-07-06 15:28:59 -04007060#define PEER_CRT_CHANGED 0x75555555
Hanno Becker33c3dc82019-01-30 14:46:46 +00007061static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
7062 unsigned char *crt_buf,
7063 size_t crt_buf_len )
7064{
7065 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
7066
7067 if( peer_crt == NULL )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007068 return( PEER_CRT_CHANGED );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007069
7070 if( peer_crt->raw.len != crt_buf_len )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007071 return( PEER_CRT_CHANGED );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007072
Teppo Järvelin61f412e2019-10-03 12:25:22 +03007073 return( mbedtls_platform_memcmp( peer_crt->raw.p, crt_buf, crt_buf_len ) );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007074}
Hanno Becker5882dd02019-06-06 16:25:57 +01007075#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Andrzej Kurek0919b142020-07-06 15:28:59 -04007076#define PEER_CRT_CHANGED 0x75555555
Hanno Beckerdf759382019-02-05 17:02:46 +00007077static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl,
7078 unsigned char *crt_buf,
7079 size_t crt_buf_len )
7080{
7081 int ret;
7082 unsigned char const * const peer_cert_digest =
7083 ssl->session->peer_cert_digest;
7084 mbedtls_md_type_t const peer_cert_digest_type =
7085 ssl->session->peer_cert_digest_type;
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007086 mbedtls_md_handle_t digest_info =
Hanno Beckerdf759382019-02-05 17:02:46 +00007087 mbedtls_md_info_from_type( peer_cert_digest_type );
7088 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
7089 size_t digest_len;
7090
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007091 if( peer_cert_digest == NULL ||
7092 digest_info == MBEDTLS_MD_INVALID_HANDLE )
7093 {
Andrzej Kurek0919b142020-07-06 15:28:59 -04007094 return( PEER_CRT_CHANGED );
Hanno Beckera5cedbc2019-07-17 11:21:02 +01007095 }
Hanno Beckerdf759382019-02-05 17:02:46 +00007096
7097 digest_len = mbedtls_md_get_size( digest_info );
7098 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN )
Andrzej Kurek45e71992020-07-08 10:09:44 -04007099 return( PEER_CRT_CHANGED );
Hanno Beckerdf759382019-02-05 17:02:46 +00007100
7101 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest );
7102 if( ret != 0 )
Andrzej Kurek0919b142020-07-06 15:28:59 -04007103 return( PEER_CRT_CHANGED );
Hanno Beckerdf759382019-02-05 17:02:46 +00007104
Teppo Järvelin61f412e2019-10-03 12:25:22 +03007105 return( mbedtls_platform_memcmp( tmp_digest, peer_cert_digest, digest_len ) );
Hanno Beckerdf759382019-02-05 17:02:46 +00007106}
Hanno Becker5882dd02019-06-06 16:25:57 +01007107#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker285ff0c2019-01-31 07:44:03 +00007108#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
Hanno Becker33c3dc82019-01-30 14:46:46 +00007109
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007110/*
7111 * Once the certificate message is read, parse it into a cert chain and
7112 * perform basic checks, but leave actual verification to the caller
7113 */
Hanno Becker35e41772019-02-05 15:37:23 +00007114static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl,
7115 mbedtls_x509_crt *chain )
Paul Bakker5121ce52009-01-03 21:22:43 +00007116{
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007117 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Hanno Becker35e41772019-02-05 15:37:23 +00007118#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
7119 int crt_cnt=0;
7120#endif
Paul Bakker23986e52011-04-24 08:57:21 +00007121 size_t i, n;
Gilles Peskine064a85c2017-05-10 10:46:40 +02007122 uint8_t alert;
Paul Bakker5121ce52009-01-03 21:22:43 +00007123
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007124 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00007125 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007126 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007127 mbedtls_ssl_pend_fatal_alert( ssl,
7128 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007129 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007130 }
7131
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007132 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE ||
7133 ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007134 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007135 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007136 mbedtls_ssl_pend_fatal_alert( ssl,
7137 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007138 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007139 }
7140
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007141 i = mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00007142
Paul Bakker5121ce52009-01-03 21:22:43 +00007143 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007144 * Same message structure as in mbedtls_ssl_write_certificate()
Paul Bakker5121ce52009-01-03 21:22:43 +00007145 */
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03007146 n = mbedtls_platform_get_uint16_be( &ssl->in_msg[i + 1] );
Paul Bakker5121ce52009-01-03 21:22:43 +00007147
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00007148 if( ssl->in_msg[i] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007149 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00007150 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007151 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007152 mbedtls_ssl_pend_fatal_alert( ssl,
7153 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007154 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007155 }
7156
Hanno Becker33c3dc82019-01-30 14:46:46 +00007157 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
7158 i += 3;
7159
Hanno Becker33c3dc82019-01-30 14:46:46 +00007160 /* Iterate through and parse the CRTs in the provided chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00007161 while( i < ssl->in_hslen )
7162 {
Hanno Becker33c3dc82019-01-30 14:46:46 +00007163 /* Check that there's room for the next CRT's length fields. */
Philippe Antoine747fd532018-05-30 09:13:21 +02007164 if ( i + 3 > ssl->in_hslen ) {
7165 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007166 mbedtls_ssl_pend_fatal_alert( ssl,
7167 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Philippe Antoine747fd532018-05-30 09:13:21 +02007168 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
7169 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007170 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
7171 * anything beyond 2**16 ~ 64K. */
Paul Bakker5121ce52009-01-03 21:22:43 +00007172 if( ssl->in_msg[i] != 0 )
7173 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007174 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007175 mbedtls_ssl_pend_fatal_alert( ssl,
7176 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007177 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007178 }
7179
Hanno Becker33c3dc82019-01-30 14:46:46 +00007180 /* Read length of the next CRT in the chain. */
Arto Kinnunen0b62ce82019-09-04 14:04:57 +03007181 n = mbedtls_platform_get_uint16_be( &ssl->in_msg[i + 1] );
Paul Bakker5121ce52009-01-03 21:22:43 +00007182 i += 3;
7183
7184 if( n < 128 || i + n > ssl->in_hslen )
7185 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007186 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007187 mbedtls_ssl_pend_fatal_alert( ssl,
7188 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007189 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007190 }
7191
Hanno Becker33c3dc82019-01-30 14:46:46 +00007192 /* Check if we're handling the first CRT in the chain. */
Hanno Becker35e41772019-02-05 15:37:23 +00007193#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
7194 if( crt_cnt++ == 0 &&
Hanno Becker2d9623f2019-06-13 12:07:05 +01007195 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7196 MBEDTLS_SSL_IS_CLIENT &&
Hanno Becker35e41772019-02-05 15:37:23 +00007197 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Hanno Becker33c3dc82019-01-30 14:46:46 +00007198 {
Hanno Becker68b856d2019-02-08 14:00:04 +00007199 /* During client-side renegotiation, check that the server's
7200 * end-CRTs hasn't changed compared to the initial handshake,
7201 * mitigating the triple handshake attack. On success, reuse
7202 * the original end-CRT instead of parsing it again. */
Hanno Becker35e41772019-02-05 15:37:23 +00007203 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) );
7204 if( ssl_check_peer_crt_unchanged( ssl,
7205 &ssl->in_msg[i],
7206 n ) != 0 )
Hanno Becker33c3dc82019-01-30 14:46:46 +00007207 {
Hanno Becker35e41772019-02-05 15:37:23 +00007208 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007209 mbedtls_ssl_pend_fatal_alert( ssl,
7210 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
Hanno Becker35e41772019-02-05 15:37:23 +00007211 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007212 }
Hanno Becker35e41772019-02-05 15:37:23 +00007213
7214 /* Now we can safely free the original chain. */
7215 ssl_clear_peer_cert( ssl->session );
7216 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007217#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
7218
Hanno Becker33c3dc82019-01-30 14:46:46 +00007219 /* Parse the next certificate in the chain. */
Hanno Becker0cc7af52019-02-08 14:39:16 +00007220#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Becker35e41772019-02-05 15:37:23 +00007221 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n );
Hanno Becker0cc7af52019-02-08 14:39:16 +00007222#else
Hanno Becker42de8f82019-02-26 11:51:34 +00007223 /* If we don't need to store the CRT chain permanently, parse
Hanno Becker0cc7af52019-02-08 14:39:16 +00007224 * it in-place from the input buffer instead of making a copy. */
7225 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n );
7226#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007227 switch( ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00007228 {
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007229 case 0: /* ok */
7230 mbedtls_platform_random_delay();
7231 if( ret != 0 )
7232 {
7233 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7234 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
7235 goto crt_parse_der_failed;
7236 }
7237 break;
Hanno Becker33c3dc82019-01-30 14:46:46 +00007238 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
7239 /* Ignore certificate with an unknown algorithm: maybe a
Piotr Nowicki78fc1392020-06-19 10:04:27 +02007240 * prior certificate was already trusted. */
7241 mbedtls_platform_random_delay();
7242 if( ret != MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND )
7243 {
7244 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7245 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
7246 goto crt_parse_der_failed;
7247 }
Hanno Becker33c3dc82019-01-30 14:46:46 +00007248 break;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007249
Hanno Becker33c3dc82019-01-30 14:46:46 +00007250 case MBEDTLS_ERR_X509_ALLOC_FAILED:
7251 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7252 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007253
Hanno Becker33c3dc82019-01-30 14:46:46 +00007254 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
7255 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7256 goto crt_parse_der_failed;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007257
Hanno Becker33c3dc82019-01-30 14:46:46 +00007258 default:
7259 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
7260 crt_parse_der_failed:
Hanno Beckerde62da92019-07-24 13:23:50 +01007261 mbedtls_ssl_pend_fatal_alert( ssl, alert );
Hanno Becker33c3dc82019-01-30 14:46:46 +00007262 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
7263 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007264 }
7265
7266 i += n;
7267 }
7268
Hanno Becker35e41772019-02-05 15:37:23 +00007269 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007270 return( 0 );
7271}
7272
Hanno Beckerb8a08572019-02-05 12:49:06 +00007273#if defined(MBEDTLS_SSL_SRV_C)
7274static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl )
7275{
Hanno Becker2d9623f2019-06-13 12:07:05 +01007276 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Hanno Beckerb8a08572019-02-05 12:49:06 +00007277 return( -1 );
7278
7279#if defined(MBEDTLS_SSL_PROTO_SSL3)
7280 /*
7281 * Check if the client sent an empty certificate
7282 */
Hanno Becker2881d802019-05-22 14:44:53 +01007283 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Beckerb8a08572019-02-05 12:49:06 +00007284 {
7285 if( ssl->in_msglen == 2 &&
7286 ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT &&
7287 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
7288 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
7289 {
7290 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
7291 return( 0 );
7292 }
7293
7294 return( -1 );
7295 }
7296#endif /* MBEDTLS_SSL_PROTO_SSL3 */
7297
7298#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
7299 defined(MBEDTLS_SSL_PROTO_TLS1_2)
7300 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
7301 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
7302 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
Teppo Järvelin0efac532019-10-04 13:21:08 +03007303 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 ) // use regular memcmp as comparing public data
Hanno Beckerb8a08572019-02-05 12:49:06 +00007304 {
7305 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
7306 return( 0 );
7307 }
7308
Hanno Beckerb8a08572019-02-05 12:49:06 +00007309#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
7310 MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker17daaa52019-06-18 12:31:45 +01007311
7312 return( -1 );
Hanno Beckerb8a08572019-02-05 12:49:06 +00007313}
7314#endif /* MBEDTLS_SSL_SRV_C */
7315
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007316/* Check if a certificate message is expected.
7317 * Return either
7318 * - SSL_CERTIFICATE_EXPECTED, or
7319 * - SSL_CERTIFICATE_SKIP
7320 * indicating whether a Certificate message is expected or not.
7321 */
7322#define SSL_CERTIFICATE_EXPECTED 0
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02007323#define SSL_CERTIFICATE_SKIP 0xff
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007324static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl,
7325 int authmode )
7326{
Hanno Becker473f98f2019-06-26 10:27:32 +01007327 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Beckerdf645962019-06-26 13:02:22 +01007328 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007329
7330 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) )
7331 return( SSL_CERTIFICATE_SKIP );
7332
7333#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01007334 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007335 {
Hanno Becker473f98f2019-06-26 10:27:32 +01007336 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
7337 MBEDTLS_KEY_EXCHANGE_RSA_PSK )
7338 {
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007339 return( SSL_CERTIFICATE_SKIP );
Hanno Becker473f98f2019-06-26 10:27:32 +01007340 }
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007341
7342 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
7343 {
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007344 ssl->session_negotiate->verify_result =
7345 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
7346 return( SSL_CERTIFICATE_SKIP );
7347 }
7348 }
Hanno Beckerfd5dc8a2019-03-01 08:10:46 +00007349#else
7350 ((void) authmode);
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007351#endif /* MBEDTLS_SSL_SRV_C */
7352
7353 return( SSL_CERTIFICATE_EXPECTED );
7354}
7355
Hanno Becker3cf50612019-02-05 14:36:34 +00007356static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl,
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007357 volatile int authmode,
Hanno Becker3cf50612019-02-05 14:36:34 +00007358 mbedtls_x509_crt *chain,
7359 void *rs_ctx )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007360{
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007361 volatile int verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Andrzej Kurekfd56f402020-05-25 11:52:05 -04007362 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007363 volatile int flow_counter = 0;
Hanno Becker473f98f2019-06-26 10:27:32 +01007364 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Beckerdf645962019-06-26 13:02:22 +01007365 mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake );
Hanno Becker3cf50612019-02-05 14:36:34 +00007366 mbedtls_x509_crt *ca_chain;
7367 mbedtls_x509_crl *ca_crl;
7368
7369 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
Jarno Lamsae1621d42019-12-19 08:58:56 +02007370 {
Hanno Becker3cf50612019-02-05 14:36:34 +00007371 return( 0 );
Jarno Lamsae1621d42019-12-19 08:58:56 +02007372 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007373
Jarno Lamsae1621d42019-12-19 08:58:56 +02007374 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Hanno Becker3cf50612019-02-05 14:36:34 +00007375#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7376 if( ssl->handshake->sni_ca_chain != NULL )
7377 {
7378 ca_chain = ssl->handshake->sni_ca_chain;
7379 ca_crl = ssl->handshake->sni_ca_crl;
7380 }
7381 else
7382#endif
7383 {
7384 ca_chain = ssl->conf->ca_chain;
7385 ca_crl = ssl->conf->ca_crl;
7386 }
7387
7388 /*
7389 * Main check: verify certificate
7390 */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007391 verify_ret = mbedtls_x509_crt_verify_restartable(
Hanno Becker3cf50612019-02-05 14:36:34 +00007392 chain,
7393 ca_chain, ca_crl,
7394 ssl->conf->cert_profile,
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03007395#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Hanno Becker3cf50612019-02-05 14:36:34 +00007396 ssl->hostname,
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03007397#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
Hanno Becker3cf50612019-02-05 14:36:34 +00007398 &ssl->session_negotiate->verify_result,
Hanno Becker9ec3fe02019-07-01 17:36:12 +01007399#if !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
7400 ssl->conf->f_vrfy, ssl->conf->p_vrfy,
7401#endif /* MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
7402 rs_ctx );
Hanno Becker3cf50612019-02-05 14:36:34 +00007403
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007404 if( verify_ret == 0 )
7405 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007406 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007407 if( verify_ret == 0 )
7408 {
7409 flow_counter++;
7410 }
7411 else
7412 {
7413 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7414 }
7415 }
Hanno Becker8c13ee62019-02-26 16:48:17 +00007416 if( verify_ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007417 {
Hanno Becker8c13ee62019-02-26 16:48:17 +00007418 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", verify_ret );
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007419 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007420 }
7421
7422#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Hanno Becker8c13ee62019-02-26 16:48:17 +00007423 if( verify_ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
Hanno Becker3cf50612019-02-05 14:36:34 +00007424 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
7425#endif
7426
7427 /*
7428 * Secondary checks: always done, but change 'ret' only if it was 0
7429 */
7430
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007431#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
Hanno Becker3cf50612019-02-05 14:36:34 +00007432 {
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007433#if defined(MBEDTLS_USE_TINYCRYPT)
Hanno Beckeree902df2019-08-23 13:47:47 +01007434 ret = mbedtls_ssl_check_curve_uecc( ssl, MBEDTLS_UECC_DP_SECP256R1 );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007435#else /* MBEDTLS_USE_TINYCRYPT */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007436 mbedtls_pk_context *pk;
7437 ret = mbedtls_x509_crt_pk_acquire( chain, &pk );
7438 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +01007439 {
7440 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_pk_acquire", ret );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007441 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +01007442 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007443
7444 /* If certificate uses an EC key, make sure the curve is OK */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007445 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) )
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007446 {
Hanno Becker8c13ee62019-02-26 16:48:17 +00007447 ret = mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007448 }
Hanno Becker8c13ee62019-02-26 16:48:17 +00007449
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00007450 mbedtls_x509_crt_pk_release( chain );
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007451#endif /* MBEDTLS_USE_TINYCRYPT */
Hanno Becker8c13ee62019-02-26 16:48:17 +00007452
7453 if( ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007454 {
7455 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
7456
7457 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007458 if( verify_ret == 0 )
7459 verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007460 flow_counter++;
7461 }
7462 if( ret == 0 )
7463 {
7464 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007465 }
7466 }
Hanno Becker7e9c2e02019-08-21 17:05:20 +01007467#endif /* MBEDTLS_ECP_C || MEDTLS_USE_TINYCRYPT */
Hanno Becker3cf50612019-02-05 14:36:34 +00007468
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007469 ret = mbedtls_ssl_check_cert_usage( chain,
Hanno Becker3cf50612019-02-05 14:36:34 +00007470 ciphersuite_info,
Hanno Becker2d9623f2019-06-13 12:07:05 +01007471 ( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
7472 MBEDTLS_SSL_IS_CLIENT ),
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007473 &ssl->session_negotiate->verify_result );
7474 if( ret == 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007475 {
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007476 flow_counter++;
7477 }
7478 else
7479 {
7480 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007481 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007482 if( verify_ret == 0 )
7483 verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Hanno Becker3cf50612019-02-05 14:36:34 +00007484 }
7485
7486 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
7487 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
7488 * with details encoded in the verification flags. All other kinds
7489 * of error codes, including those from the user provided f_vrfy
7490 * functions, are treated as fatal and lead to a failure of
7491 * ssl_parse_certificate even if verification was optional. */
7492 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
Hanno Becker8c13ee62019-02-26 16:48:17 +00007493 ( verify_ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7494 verify_ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
Hanno Becker3cf50612019-02-05 14:36:34 +00007495 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007496 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007497 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
7498 ( verify_ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7499 verify_ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
7500 {
7501 verify_ret = 0;
7502 flow_counter++;
7503 }
7504 else
7505 {
7506 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7507 }
7508 } else {
7509 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007510 }
7511
7512 if( ca_chain == NULL && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
7513 {
7514 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
Hanno Becker8c13ee62019-02-26 16:48:17 +00007515 verify_ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007516 flow_counter++;
Hanno Becker3cf50612019-02-05 14:36:34 +00007517 }
Jarno Lamsae1621d42019-12-19 08:58:56 +02007518 else
7519 {
7520 flow_counter++;
7521 }
Hanno Becker3cf50612019-02-05 14:36:34 +00007522
Hanno Becker8c13ee62019-02-26 16:48:17 +00007523 if( verify_ret != 0 )
Hanno Becker3cf50612019-02-05 14:36:34 +00007524 {
7525 uint8_t alert;
7526
7527 /* The certificate may have been rejected for several reasons.
7528 Pick one and send the corresponding alert. Which alert to send
7529 may be a subject of debate in some cases. */
7530 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
7531 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
7532 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
7533 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
7534 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
7535 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7536 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
7537 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7538 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
7539 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7540 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
7541 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7542 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
7543 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7544 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
7545 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
7546 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
7547 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
7548 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
7549 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
7550 else
7551 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
Hanno Beckerde62da92019-07-24 13:23:50 +01007552 mbedtls_ssl_pend_fatal_alert( ssl, alert );
Hanno Becker3cf50612019-02-05 14:36:34 +00007553 }
7554
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007555 if( verify_ret == 0 &&
7556#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
7557 flow_counter == 5 )
7558#else
7559 flow_counter == 4 )
7560#endif
7561 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02007562 mbedtls_platform_random_delay();
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007563 if( verify_ret == 0 &&
7564#if defined(MBEDTLS_ECP_C) || defined(MBEDTLS_USE_TINYCRYPT)
7565 flow_counter == 5 )
7566#else
7567 flow_counter == 4 )
7568#endif
7569 {
Jarno Lamsae1621d42019-12-19 08:58:56 +02007570 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PEER AUTHENTICATED" ) );
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007571 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
7572 }
7573 else
7574 {
7575 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
7576 }
Jarno Lamsae1621d42019-12-19 08:58:56 +02007577 } else {
7578 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PEER NOT AUTHENTICATED, %d", flow_counter));
Jarno Lamsaba4730f2019-12-19 08:42:03 +02007579 }
7580
Hanno Becker3cf50612019-02-05 14:36:34 +00007581#if defined(MBEDTLS_DEBUG_C)
7582 if( ssl->session_negotiate->verify_result != 0 )
7583 {
7584 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %x",
7585 ssl->session_negotiate->verify_result ) );
7586 }
7587 else
7588 {
7589 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
7590 }
7591#endif /* MBEDTLS_DEBUG_C */
7592
Hanno Becker8c13ee62019-02-26 16:48:17 +00007593 return( verify_ret );
Hanno Becker3cf50612019-02-05 14:36:34 +00007594}
7595
Hanno Becker34106f62019-02-08 14:59:05 +00007596#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Becker5882dd02019-06-06 16:25:57 +01007597
7598#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker34106f62019-02-08 14:59:05 +00007599static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl,
7600 unsigned char *start, size_t len )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007601{
7602 int ret;
Hanno Becker34106f62019-02-08 14:59:05 +00007603 /* Remember digest of the peer's end-CRT. */
7604 ssl->session_negotiate->peer_cert_digest =
7605 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
7606 if( ssl->session_negotiate->peer_cert_digest == NULL )
7607 {
7608 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
7609 sizeof( MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007610 mbedtls_ssl_pend_fatal_alert( ssl,
7611 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Hanno Becker34106f62019-02-08 14:59:05 +00007612
7613 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
7614 }
7615
7616 ret = mbedtls_md( mbedtls_md_info_from_type(
7617 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
7618 start, len,
7619 ssl->session_negotiate->peer_cert_digest );
7620
7621 ssl->session_negotiate->peer_cert_digest_type =
7622 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
7623 ssl->session_negotiate->peer_cert_digest_len =
7624 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
7625
7626 return( ret );
7627}
Hanno Becker5882dd02019-06-06 16:25:57 +01007628#endif /* MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker34106f62019-02-08 14:59:05 +00007629
7630static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
7631 unsigned char *start, size_t len )
7632{
7633 unsigned char *end = start + len;
7634 int ret;
7635
7636 /* Make a copy of the peer's raw public key. */
7637 mbedtls_pk_init( &ssl->handshake->peer_pubkey );
7638 ret = mbedtls_pk_parse_subpubkey( &start, end,
7639 &ssl->handshake->peer_pubkey );
7640 if( ret != 0 )
7641 {
7642 /* We should have parsed the public key before. */
7643 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
7644 }
7645
Manuel Pégourié-Gonnard2829bbf2019-09-19 10:45:14 +02007646 ssl->handshake->got_peer_pubkey = 1;
Hanno Becker34106f62019-02-08 14:59:05 +00007647 return( 0 );
7648}
7649#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7650
Hanno Becker3cf50612019-02-05 14:36:34 +00007651int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
7652{
7653 int ret = 0;
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007654 int crt_expected;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007655#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7656 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
7657 ? ssl->handshake->sni_authmode
Hanno Beckeracd4fc02019-06-12 16:40:50 +01007658 : mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007659#else
Hanno Beckeracd4fc02019-06-12 16:40:50 +01007660 const int authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007661#endif
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02007662 void *rs_ctx = NULL;
Hanno Beckere4aeb762019-02-05 17:19:52 +00007663 mbedtls_x509_crt *chain = NULL;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007664
7665 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
7666
Hanno Becker6b9a6f32019-02-07 10:11:07 +00007667 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
7668 if( crt_expected == SSL_CERTIFICATE_SKIP )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007669 {
7670 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Hanno Becker613d4902019-02-05 13:11:17 +00007671 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007672 }
7673
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02007674#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
7675 if( ssl->handshake->ecrs_enabled &&
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02007676 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02007677 {
Hanno Beckere4aeb762019-02-05 17:19:52 +00007678 chain = ssl->handshake->ecrs_peer_cert;
7679 ssl->handshake->ecrs_peer_cert = NULL;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02007680 goto crt_verify;
7681 }
7682#endif
7683
Manuel Pégourié-Gonnard125af942018-09-11 11:08:12 +02007684 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007685 {
7686 /* mbedtls_ssl_read_record may have sent an alert already. We
7687 let it decide whether to alert. */
7688 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Hanno Beckere4aeb762019-02-05 17:19:52 +00007689 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007690 }
7691
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007692#if defined(MBEDTLS_SSL_SRV_C)
Hanno Beckerb8a08572019-02-05 12:49:06 +00007693 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 )
7694 {
7695 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007696
Hanno Beckerb8a08572019-02-05 12:49:06 +00007697 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
Hanno Becker613d4902019-02-05 13:11:17 +00007698 ret = 0;
7699 else
7700 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
Hanno Beckerb8a08572019-02-05 12:49:06 +00007701
Hanno Becker613d4902019-02-05 13:11:17 +00007702 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007703 }
Hanno Beckerb8a08572019-02-05 12:49:06 +00007704#endif /* MBEDTLS_SSL_SRV_C */
7705
Hanno Becker35e41772019-02-05 15:37:23 +00007706 /* Clear existing peer CRT structure in case we tried to
7707 * reuse a session but it failed, and allocate a new one. */
Hanno Beckera46c2872019-02-05 13:08:01 +00007708 ssl_clear_peer_cert( ssl->session_negotiate );
Hanno Beckere4aeb762019-02-05 17:19:52 +00007709
7710 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
7711 if( chain == NULL )
Hanno Becker35e41772019-02-05 15:37:23 +00007712 {
7713 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
7714 sizeof( mbedtls_x509_crt ) ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007715 mbedtls_ssl_pend_fatal_alert( ssl,
7716 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Hanno Beckera46c2872019-02-05 13:08:01 +00007717
Hanno Beckere4aeb762019-02-05 17:19:52 +00007718 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
7719 goto exit;
7720 }
7721 mbedtls_x509_crt_init( chain );
7722
7723 ret = ssl_parse_certificate_chain( ssl, chain );
Hanno Becker35e41772019-02-05 15:37:23 +00007724 if( ret != 0 )
Hanno Beckere4aeb762019-02-05 17:19:52 +00007725 goto exit;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007726
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02007727#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
7728 if( ssl->handshake->ecrs_enabled)
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02007729 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02007730
7731crt_verify:
7732 if( ssl->handshake->ecrs_enabled)
7733 rs_ctx = &ssl->handshake->ecrs_ctx;
7734#endif
7735
Hanno Becker3cf50612019-02-05 14:36:34 +00007736 ret = ssl_parse_certificate_verify( ssl, authmode,
Hanno Beckere4aeb762019-02-05 17:19:52 +00007737 chain, rs_ctx );
Hanno Becker3cf50612019-02-05 14:36:34 +00007738 if( ret != 0 )
Hanno Beckere4aeb762019-02-05 17:19:52 +00007739 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00007740
Hanno Becker3008d282019-02-05 17:02:28 +00007741#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakker5121ce52009-01-03 21:22:43 +00007742 {
Hanno Becker5882dd02019-06-06 16:25:57 +01007743 size_t pk_len;
7744 unsigned char *pk_start;
Paul Bakker5121ce52009-01-03 21:22:43 +00007745
Hanno Becker34106f62019-02-08 14:59:05 +00007746 /* We parse the CRT chain without copying, so
7747 * these pointers point into the input buffer,
7748 * and are hence still valid after freeing the
7749 * CRT chain. */
Paul Bakker5121ce52009-01-03 21:22:43 +00007750
Hanno Becker5882dd02019-06-06 16:25:57 +01007751#if defined(MBEDTLS_SSL_RENEGOTIATION)
7752 unsigned char *crt_start;
7753 size_t crt_len;
7754
Hanno Becker34106f62019-02-08 14:59:05 +00007755 crt_start = chain->raw.p;
7756 crt_len = chain->raw.len;
Hanno Becker5882dd02019-06-06 16:25:57 +01007757#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00007758
Hanno Becker8c13ee62019-02-26 16:48:17 +00007759 pk_start = chain->cache->pk_raw.p;
7760 pk_len = chain->cache->pk_raw.len;
Hanno Becker34106f62019-02-08 14:59:05 +00007761
7762 /* Free the CRT structures before computing
7763 * digest and copying the peer's public key. */
7764 mbedtls_x509_crt_free( chain );
7765 mbedtls_free( chain );
7766 chain = NULL;
7767
Hanno Becker5882dd02019-06-06 16:25:57 +01007768#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker34106f62019-02-08 14:59:05 +00007769 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00007770 if( ret != 0 )
Hanno Beckercf291d62019-02-06 16:19:04 +00007771 goto exit;
Hanno Becker5882dd02019-06-06 16:25:57 +01007772#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00007773
Hanno Becker34106f62019-02-08 14:59:05 +00007774 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00007775 if( ret != 0 )
Hanno Becker34106f62019-02-08 14:59:05 +00007776 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00007777 }
Hanno Becker34106f62019-02-08 14:59:05 +00007778#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7779 /* Pass ownership to session structure. */
Hanno Beckere4aeb762019-02-05 17:19:52 +00007780 ssl->session_negotiate->peer_cert = chain;
7781 chain = NULL;
Hanno Becker34106f62019-02-08 14:59:05 +00007782#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02007783
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007784 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007785
Hanno Becker613d4902019-02-05 13:11:17 +00007786exit:
7787
Hanno Beckere4aeb762019-02-05 17:19:52 +00007788 if( ret == 0 )
Jarno Lamsa2b205162019-11-12 15:36:21 +02007789 {
7790 if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )
7791 {
7792 ssl->state = MBEDTLS_SSL_CLIENT_KEY_EXCHANGE;
7793 }
7794 else if( ssl->state == MBEDTLS_SSL_SERVER_CERTIFICATE )
7795 {
7796 ssl->state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
7797 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007798 else
7799 {
7800 ssl->state = MBEDTLS_SSL_INVALID;
7801 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02007802 }
Hanno Beckere4aeb762019-02-05 17:19:52 +00007803
7804#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
7805 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS )
7806 {
7807 ssl->handshake->ecrs_peer_cert = chain;
7808 chain = NULL;
7809 }
7810#endif
7811
7812 if( chain != NULL )
7813 {
7814 mbedtls_x509_crt_free( chain );
7815 mbedtls_free( chain );
7816 }
7817
Paul Bakker5121ce52009-01-03 21:22:43 +00007818 return( ret );
7819}
Hanno Beckerb71e90a2019-02-05 13:20:55 +00007820#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00007821
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007822int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007823{
7824 int ret;
7825
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007826 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007827
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007828 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
Paul Bakker5121ce52009-01-03 21:22:43 +00007829 ssl->out_msglen = 1;
7830 ssl->out_msg[0] = 1;
7831
Jarno Lamsa2b205162019-11-12 15:36:21 +02007832 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC )
7833 {
7834 ssl->state = MBEDTLS_SSL_CLIENT_FINISHED;
7835 }
7836 else if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
7837 {
7838 ssl->state = MBEDTLS_SSL_SERVER_FINISHED;
7839 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007840 else
7841 {
7842 ssl->state = MBEDTLS_SSL_INVALID;
7843 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007844
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007845 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007846 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007847 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007848 return( ret );
7849 }
7850
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007851 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007852
7853 return( 0 );
7854}
7855
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007856int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007857{
7858 int ret;
7859
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007860 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007861
Hanno Becker327c93b2018-08-15 13:56:18 +01007862 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007863 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007864 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007865 return( ret );
7866 }
7867
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007868 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Paul Bakker5121ce52009-01-03 21:22:43 +00007869 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007870 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01007871 mbedtls_ssl_pend_fatal_alert( ssl,
7872 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007873 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007874 }
7875
Hanno Beckere678eaa2018-08-21 14:57:46 +01007876 /* CCS records are only accepted if they have length 1 and content '1',
7877 * so we don't need to check this here. */
Paul Bakker5121ce52009-01-03 21:22:43 +00007878
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02007879 /*
7880 * Switch to our negotiated transform and session parameters for inbound
7881 * data.
7882 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007883 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02007884 ssl->transform_in = ssl->transform_negotiate;
7885 ssl->session_in = ssl->session_negotiate;
7886
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007887#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02007888 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02007889 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007890#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02007891 ssl_dtls_replay_reset( ssl );
7892#endif
7893
7894 /* Increment epoch */
7895 if( ++ssl->in_epoch == 0 )
7896 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007897 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007898 /* This is highly unlikely to happen for legitimate reasons, so
7899 treat it as an attack and don't send an alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007900 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02007901 }
7902 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02007903 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007904#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02007905#if defined(MBEDTLS_SSL_PROTO_TLS)
7906 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02007907 mbedtls_platform_memset( ssl->in_ctr, 0, 8 );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02007908 }
7909#endif
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02007910
Hanno Beckerf5970a02019-05-08 09:38:41 +01007911 ssl_update_in_pointers( ssl );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02007912
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007913#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
7914 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02007915 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007916 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_INBOUND ) ) != 0 )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02007917 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007918 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
Hanno Beckerde62da92019-07-24 13:23:50 +01007919 mbedtls_ssl_pend_fatal_alert( ssl,
7920 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007921 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02007922 }
7923 }
7924#endif
7925
Jarno Lamsa2b205162019-11-12 15:36:21 +02007926 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC )
7927 {
7928 ssl->state = MBEDTLS_SSL_CLIENT_FINISHED;
7929 }
7930 else if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
7931 {
7932 ssl->state = MBEDTLS_SSL_SERVER_FINISHED;
7933 }
Jarno Lamsab0180092019-11-12 15:46:46 +02007934 else
7935 {
7936 ssl->state = MBEDTLS_SSL_INVALID;
7937 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007938
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007939 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007940
7941 return( 0 );
7942}
7943
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007944void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02007945{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007946#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
7947 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker533f5b12019-08-15 16:56:35 +01007948 mbedtls_md5_starts_ret( &ssl->handshake->fin_md5 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01007949 mbedtls_sha1_starts_ret( &ssl->handshake->fin_sha1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02007950#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007951#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
7952#if defined(MBEDTLS_SHA256_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01007953 mbedtls_sha256_starts_ret( &ssl->handshake->fin_sha256, 0 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02007954#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007955#if defined(MBEDTLS_SHA512_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01007956 mbedtls_sha512_starts_ret( &ssl->handshake->fin_sha512, 1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02007957#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007958#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02007959}
7960
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007961static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00007962{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007963 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00007964
7965 /*
7966 * Free our handshake params
7967 */
Gilles Peskine9b562d52018-04-25 20:32:43 +02007968 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007969 mbedtls_free( ssl->handshake );
Paul Bakker48916f92012-09-16 19:57:18 +00007970 ssl->handshake = NULL;
7971
7972 /*
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02007973 * Free the previous transform and swith in the current one
Paul Bakker48916f92012-09-16 19:57:18 +00007974 */
7975 if( ssl->transform )
7976 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007977 mbedtls_ssl_transform_free( ssl->transform );
7978 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00007979 }
7980 ssl->transform = ssl->transform_negotiate;
7981 ssl->transform_negotiate = NULL;
7982
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007983 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02007984}
7985
Jarno Lamsae1621d42019-12-19 08:58:56 +02007986int mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02007987{
Andrzej Kurekfd56f402020-05-25 11:52:05 -04007988 volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa489dccd2019-12-19 15:11:16 +02007989
7990#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Jarno Lamsa015aa442019-12-20 12:09:37 +02007991 volatile const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
Jarno Lamsa489dccd2019-12-19 15:11:16 +02007992 ? ssl->handshake->sni_authmode
7993 : mbedtls_ssl_conf_get_authmode( ssl->conf );
7994#else
Jarno Lamsa015aa442019-12-20 12:09:37 +02007995 volatile const int authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Jarno Lamsa489dccd2019-12-19 15:11:16 +02007996#endif
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02007997#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
7998 volatile int crt_expected = SSL_CERTIFICATE_EXPECTED;
7999 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
8000#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008001 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008002
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008003#if defined(MBEDTLS_SSL_RENEGOTIATION)
8004 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008005 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008006 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008007 ssl->renego_records_seen = 0;
8008 }
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008009#endif
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008010
8011 /*
8012 * Free the previous session and switch in the current one
8013 */
Paul Bakker0a597072012-09-25 21:55:46 +00008014 if( ssl->session )
8015 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008016#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard1a034732014-11-04 17:36:18 +01008017 /* RFC 7366 3.1: keep the EtM state */
8018 ssl->session_negotiate->encrypt_then_mac =
8019 ssl->session->encrypt_then_mac;
8020#endif
8021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008022 mbedtls_ssl_session_free( ssl->session );
8023 mbedtls_free( ssl->session );
Paul Bakker0a597072012-09-25 21:55:46 +00008024 }
8025 ssl->session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00008026 ssl->session_negotiate = NULL;
8027
Manuel Pégourié-Gonnard7b80c642019-07-02 16:21:30 +02008028#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Paul Bakker0a597072012-09-25 21:55:46 +00008029 /*
8030 * Add cache entry
8031 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008032 if( ssl->conf->f_set_cache != NULL &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02008033 ssl->session->id_len != 0 &&
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008034 ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_UNSET )
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02008035 {
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01008036 if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008037 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02008038 }
Manuel Pégourié-Gonnard7b80c642019-07-02 16:21:30 +02008039#endif /* MBEDTLS_SSL_SRV_C && !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker0a597072012-09-25 21:55:46 +00008040
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008041 if( authmode == MBEDTLS_SSL_VERIFY_NONE ||
8042 authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ||
8043#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8044 crt_expected == SSL_CERTIFICATE_SKIP )
8045#else
8046 1 )
8047#endif
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008048 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008049 mbedtls_platform_random_delay();
Jarno Lamsaaf60cd72019-12-19 16:45:23 +02008050 if( authmode == MBEDTLS_SSL_VERIFY_NONE ||
8051 authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ||
8052#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8053 crt_expected == SSL_CERTIFICATE_SKIP )
8054#else
8055 1 )
8056#endif
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008057 {
8058 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
8059 }
8060 else
8061 {
8062 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
8063 goto cleanup;
8064 }
8065 }
8066
Jarno Lamsae1621d42019-12-19 08:58:56 +02008067#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008068 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Jarno Lamsae1621d42019-12-19 08:58:56 +02008069 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008070 mbedtls_platform_random_delay();
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008071 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Jarno Lamsae1621d42019-12-19 08:58:56 +02008072 {
Jarno Lamsa06164052019-12-19 14:40:36 +02008073 /* When doing session resume, no premaster or peer authentication */
Jarno Lamsae1621d42019-12-19 08:58:56 +02008074 ssl->handshake->peer_authenticated = MBEDTLS_SSL_FI_FLAG_SET;
Jarno Lamsa06164052019-12-19 14:40:36 +02008075 ssl->handshake->premaster_generated = MBEDTLS_SSL_FI_FLAG_SET;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008076 }
8077 else
8078 {
8079 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa489dccd2019-12-19 15:11:16 +02008080 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008081 }
8082 }
8083#endif
8084
8085 if( ssl->handshake->peer_authenticated == MBEDTLS_SSL_FI_FLAG_SET )
8086 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008087 mbedtls_platform_random_delay();
Jarno Lamsae1621d42019-12-19 08:58:56 +02008088 if( ssl->handshake->peer_authenticated == MBEDTLS_SSL_FI_FLAG_SET )
8089 {
8090 ret = 0;
8091 }
8092 else
8093 {
8094 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
Jarno Lamsa06164052019-12-19 14:40:36 +02008095 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008096 }
8097 }
8098 else
8099 {
8100 ret = MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED;
Jarno Lamsa06164052019-12-19 14:40:36 +02008101 goto cleanup;
Jarno Lamsae1621d42019-12-19 08:58:56 +02008102 }
8103
Jarno Lamsa06164052019-12-19 14:40:36 +02008104 if( ssl->handshake->hello_random_set == MBEDTLS_SSL_FI_FLAG_SET &&
8105 ssl->handshake->key_derivation_done == MBEDTLS_SSL_FI_FLAG_SET &&
8106 ssl->handshake->premaster_generated == MBEDTLS_SSL_FI_FLAG_SET )
8107 {
Arto Kinnunenac6d2262020-01-09 10:11:20 +02008108 mbedtls_platform_random_delay();
Jarno Lamsa06164052019-12-19 14:40:36 +02008109 if( ssl->handshake->hello_random_set == MBEDTLS_SSL_FI_FLAG_SET &&
8110 ssl->handshake->key_derivation_done == MBEDTLS_SSL_FI_FLAG_SET &&
8111 ssl->handshake->premaster_generated == MBEDTLS_SSL_FI_FLAG_SET )
8112 {
8113 ret = 0;
8114 }
8115 else
8116 {
8117 ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
8118 goto cleanup;
8119 }
8120 }
8121 else
8122 {
8123 MBEDTLS_SSL_DEBUG_MSG( 3, ( "hello random %d", ssl->handshake->hello_random_set ) );
8124 MBEDTLS_SSL_DEBUG_MSG( 3, ( "key_derivation_done %d", ssl->handshake->key_derivation_done ) );
8125 MBEDTLS_SSL_DEBUG_MSG( 3, ( "premaster_generated %d", ssl->handshake->premaster_generated ) );
8126 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
8127 }
8128
8129cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008130#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008131 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008132 ssl->handshake->flight != NULL )
8133 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02008134 /* Cancel handshake timer */
8135 ssl_set_timer( ssl, 0 );
8136
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008137 /* Keep last flight around in case we need to resend it:
8138 * we need the handshake and transform structures for that */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008139 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008140 }
8141 else
8142#endif
8143 ssl_handshake_wrapup_free_hs_transform( ssl );
8144
Jarno Lamsa2b205162019-11-12 15:36:21 +02008145 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Paul Bakker48916f92012-09-16 19:57:18 +00008146
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008147 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
Jarno Lamsae1621d42019-12-19 08:58:56 +02008148 return ret;
Paul Bakker48916f92012-09-16 19:57:18 +00008149}
8150
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008151int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
Paul Bakker1ef83d62012-04-11 12:09:53 +00008152{
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008153 int ret, hash_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00008154
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008155 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00008156
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008157 ssl_update_out_pointers( ssl, ssl->transform_negotiate );
Paul Bakker92be97b2013-01-02 17:30:03 +01008158
Hanno Beckerc2fb7592019-08-15 16:31:23 +01008159 ssl_calc_finished( mbedtls_ssl_get_minor_ver( ssl ),
8160 mbedtls_ssl_suite_get_mac(
8161 mbedtls_ssl_ciphersuite_from_id(
8162 mbedtls_ssl_session_get_ciphersuite(
8163 ssl->session_negotiate ) ) ),
8164 ssl, ssl->out_msg + 4,
8165 mbedtls_ssl_conf_get_endpoint( ssl->conf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00008166
Manuel Pégourié-Gonnard214a8482016-02-22 11:27:26 +01008167 /*
8168 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
8169 * may define some other value. Currently (early 2016), no defined
8170 * ciphersuite does this (and this is unlikely to change as activity has
8171 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
8172 */
Hanno Becker2881d802019-05-22 14:44:53 +01008173 hash_len = ( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00008174
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008175#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00008176 ssl->verify_data_len = hash_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008177 mbedtls_platform_memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008178#endif
Paul Bakker48916f92012-09-16 19:57:18 +00008179
Paul Bakker5121ce52009-01-03 21:22:43 +00008180 ssl->out_msglen = 4 + hash_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008181 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
8182 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
Paul Bakker5121ce52009-01-03 21:22:43 +00008183
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008184#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Paul Bakker5121ce52009-01-03 21:22:43 +00008185 /*
8186 * In case of session resuming, invert the client and server
8187 * ChangeCipherSpec messages order.
8188 */
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008189 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Paul Bakker5121ce52009-01-03 21:22:43 +00008190 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008191#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008192 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
8193 MBEDTLS_SSL_IS_CLIENT )
8194 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008195 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Hanno Becker2d9623f2019-06-13 12:07:05 +01008196 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008197#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008198#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008199 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
8200 MBEDTLS_SSL_IS_SERVER )
8201 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008202 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Hanno Becker2d9623f2019-06-13 12:07:05 +01008203 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008204#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008205 }
8206 else
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008207#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Jarno Lamsa2b205162019-11-12 15:36:21 +02008208 {
8209 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED )
8210 {
8211 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
8212 }
8213 else if( ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
8214 {
8215 ssl->state = MBEDTLS_SSL_FLUSH_BUFFERS;
8216 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008217 else
8218 {
8219 ssl->state = MBEDTLS_SSL_INVALID;
8220 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008221 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008222
Paul Bakker48916f92012-09-16 19:57:18 +00008223 /*
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02008224 * Switch to our negotiated transform and session parameters for outbound
8225 * data.
Paul Bakker48916f92012-09-16 19:57:18 +00008226 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008227 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01008228
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008229#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008230 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008231 {
8232 unsigned char i;
8233
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008234 /* Remember current epoch settings for resending */
8235 ssl->handshake->alt_transform_out = ssl->transform_out;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008236 mbedtls_platform_memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008237
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008238 /* Set sequence_number to zero */
Hanno Becker19859472018-08-06 09:40:20 +01008239 memset( ssl->cur_out_ctr + 2, 0, 6 );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008240
8241 /* Increment epoch */
8242 for( i = 2; i > 0; i-- )
Hanno Becker19859472018-08-06 09:40:20 +01008243 if( ++ssl->cur_out_ctr[i - 1] != 0 )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008244 break;
8245
8246 /* The loop goes to its end iff the counter is wrapping */
8247 if( i == 0 )
8248 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008249 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
8250 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008251 }
8252 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008253 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008254#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008255#if defined(MBEDTLS_SSL_PROTO_TLS)
8256 {
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02008257 mbedtls_platform_memset( ssl->cur_out_ctr, 0, 8 );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008258 }
8259#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008260
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008261 ssl->transform_out = ssl->transform_negotiate;
8262 ssl->session_out = ssl->session_negotiate;
8263
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008264#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
8265 if( mbedtls_ssl_hw_record_activate != NULL )
Paul Bakker07eb38b2012-12-19 14:42:06 +01008266 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008267 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Paul Bakker07eb38b2012-12-19 14:42:06 +01008268 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008269 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
8270 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker07eb38b2012-12-19 14:42:06 +01008271 }
8272 }
8273#endif
8274
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008275#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008276 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008277 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02008278#endif
8279
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008280 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008281 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008282 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008283 return( ret );
8284 }
8285
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02008286#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008287 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02008288 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
8289 {
8290 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
8291 return( ret );
8292 }
8293#endif
8294
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008295 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008296
8297 return( 0 );
8298}
8299
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008300#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008301#define SSL_MAX_HASH_LEN 36
8302#else
8303#define SSL_MAX_HASH_LEN 12
8304#endif
8305
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008306int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008307{
Paul Bakker23986e52011-04-24 08:57:21 +00008308 int ret;
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02008309 unsigned int hash_len;
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008310 unsigned char buf[SSL_MAX_HASH_LEN];
Paul Bakker5121ce52009-01-03 21:22:43 +00008311
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008312 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008313
Hanno Beckerc2fb7592019-08-15 16:31:23 +01008314 ssl_calc_finished( mbedtls_ssl_get_minor_ver( ssl ),
8315 mbedtls_ssl_suite_get_mac(
8316 mbedtls_ssl_ciphersuite_from_id(
8317 mbedtls_ssl_session_get_ciphersuite(
8318 ssl->session_negotiate ) ) ),
8319 ssl, buf,
8320 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ^ 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00008321
Hanno Becker327c93b2018-08-15 13:56:18 +01008322 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008323 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008324 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008325 return( ret );
8326 }
8327
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008328 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00008329 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008330 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008331 mbedtls_ssl_pend_fatal_alert( ssl,
8332 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008333 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00008334 }
8335
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008336 /* There is currently no ciphersuite using another length with TLS 1.2 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008337#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2881d802019-05-22 14:44:53 +01008338 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00008339 hash_len = 36;
8340 else
8341#endif
8342 hash_len = 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00008343
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008344 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED ||
8345 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
Paul Bakker5121ce52009-01-03 21:22:43 +00008346 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008347 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008348 mbedtls_ssl_pend_fatal_alert( ssl,
8349 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008350 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00008351 }
8352
Teppo Järvelin707ceb82019-10-04 07:49:39 +03008353 if( mbedtls_platform_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
Manuel Pégourié-Gonnard4abc3272014-09-10 12:02:46 +00008354 buf, hash_len ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008355 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008356 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Hanno Beckerde62da92019-07-24 13:23:50 +01008357 mbedtls_ssl_pend_fatal_alert( ssl,
8358 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008359 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00008360 }
8361
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008362#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00008363 ssl->verify_data_len = hash_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03008364 mbedtls_platform_memcpy( ssl->peer_verify_data, buf, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008365#endif
Paul Bakker48916f92012-09-16 19:57:18 +00008366
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008367#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Jarno Lamsa8d09e572019-12-19 15:20:19 +02008368 if( ssl->handshake->resume == MBEDTLS_SSL_FI_FLAG_SET )
Paul Bakker5121ce52009-01-03 21:22:43 +00008369 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008370#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008371 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008372 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008373#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008374#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +01008375 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008376 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01008377#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008378 }
8379 else
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03008380#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Jarno Lamsa2b205162019-11-12 15:36:21 +02008381 {
8382 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED )
8383 {
8384 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
8385 }
8386 else if( ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
8387 {
8388 ssl->state = MBEDTLS_SSL_FLUSH_BUFFERS;
8389 }
Jarno Lamsab0180092019-11-12 15:46:46 +02008390 else
8391 {
8392 ssl->state = MBEDTLS_SSL_INVALID;
8393 }
Jarno Lamsa2b205162019-11-12 15:36:21 +02008394 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008395
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008396#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008397 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008398 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008399#endif
8400
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008401 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008402
8403 return( 0 );
8404}
8405
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008406static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008407{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008408 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008409
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008410#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
8411 defined(MBEDTLS_SSL_PROTO_TLS1_1)
8412 mbedtls_md5_init( &handshake->fin_md5 );
8413 mbedtls_sha1_init( &handshake->fin_sha1 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008414 mbedtls_md5_starts_ret( &handshake->fin_md5 );
8415 mbedtls_sha1_starts_ret( &handshake->fin_sha1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008416#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008417#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
8418#if defined(MBEDTLS_SHA256_C)
8419 mbedtls_sha256_init( &handshake->fin_sha256 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008420 mbedtls_sha256_starts_ret( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008421#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008422#if defined(MBEDTLS_SHA512_C)
8423 mbedtls_sha512_init( &handshake->fin_sha512 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01008424 mbedtls_sha512_starts_ret( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008425#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008426#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008427
Hanno Becker7e5437a2017-04-28 17:15:26 +01008428#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
8429 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
8430 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
8431#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008432
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008433#if defined(MBEDTLS_DHM_C)
8434 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008435#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008436#if defined(MBEDTLS_ECDH_C)
8437 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008438#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02008439#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02008440 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02008441#if defined(MBEDTLS_SSL_CLI_C)
8442 handshake->ecjpake_cache = NULL;
8443 handshake->ecjpake_cache_len = 0;
8444#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02008445#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02008446
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02008447#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02008448 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02008449#endif
8450
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02008451#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
8452 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
8453#endif
Hanno Becker3bf8cdf2019-02-06 16:18:31 +00008454
8455#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
8456 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8457 mbedtls_pk_init( &handshake->peer_pubkey );
8458#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008459}
8460
Hanno Becker611a83b2018-01-03 14:27:32 +00008461void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008462{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008463 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Paul Bakker84bbeb52014-07-01 14:53:22 +02008464
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008465 mbedtls_cipher_init( &transform->cipher_ctx_enc );
8466 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Paul Bakker84bbeb52014-07-01 14:53:22 +02008467
Hanno Becker92231322018-01-03 15:32:51 +00008468#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008469 mbedtls_md_init( &transform->md_ctx_enc );
8470 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Becker92231322018-01-03 15:32:51 +00008471#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008472}
8473
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008474void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008475{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008476 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008477}
8478
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008479static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00008480{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008481 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +00008482 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008483 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008484 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008485 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008486 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +02008487 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008488
8489 /*
8490 * Either the pointers are now NULL or cleared properly and can be freed.
8491 * Now allocate missing structures.
8492 */
8493 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008494 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008495 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008496 }
Paul Bakker48916f92012-09-16 19:57:18 +00008497
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008498 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008499 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008500 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008501 }
Paul Bakker48916f92012-09-16 19:57:18 +00008502
Paul Bakker82788fb2014-10-20 13:59:19 +02008503 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008504 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02008505 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02008506 }
Paul Bakker48916f92012-09-16 19:57:18 +00008507
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008508 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +00008509 if( ssl->handshake == NULL ||
8510 ssl->transform_negotiate == NULL ||
8511 ssl->session_negotiate == NULL )
8512 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02008513 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008514
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008515 mbedtls_free( ssl->handshake );
8516 mbedtls_free( ssl->transform_negotiate );
8517 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008518
8519 ssl->handshake = NULL;
8520 ssl->transform_negotiate = NULL;
8521 ssl->session_negotiate = NULL;
8522
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02008523 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +00008524 }
8525
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008526 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008527 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Becker611a83b2018-01-03 14:27:32 +00008528 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +02008529 ssl_handshake_params_init( ssl->handshake );
8530
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008531#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02008532 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02008533 {
8534 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008535
Hanno Becker2d9623f2019-06-13 12:07:05 +01008536 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02008537 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
8538 else
8539 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
8540 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02008541#endif
8542
Paul Bakker48916f92012-09-16 19:57:18 +00008543 return( 0 );
8544}
8545
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02008546#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008547/* Dummy cookie callbacks for defaults */
8548static int ssl_cookie_write_dummy( void *ctx,
8549 unsigned char **p, unsigned char *end,
8550 const unsigned char *cli_id, size_t cli_id_len )
8551{
8552 ((void) ctx);
8553 ((void) p);
8554 ((void) end);
8555 ((void) cli_id);
8556 ((void) cli_id_len);
8557
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008558 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008559}
8560
8561static int ssl_cookie_check_dummy( void *ctx,
8562 const unsigned char *cookie, size_t cookie_len,
8563 const unsigned char *cli_id, size_t cli_id_len )
8564{
8565 ((void) ctx);
8566 ((void) cookie);
8567 ((void) cookie_len);
8568 ((void) cli_id);
8569 ((void) cli_id_len);
8570
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008571 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008572}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02008573#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02008574
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008575/* Once ssl->out_hdr as the address of the beginning of the
8576 * next outgoing record is set, deduce the other pointers.
8577 *
8578 * Note: For TLS, we save the implicit record sequence number
8579 * (entering MAC computation) in the 8 bytes before ssl->out_hdr,
8580 * and the caller has to make sure there's space for this.
8581 */
8582
8583static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
8584 mbedtls_ssl_transform *transform )
8585{
8586#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008587 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008588 {
8589 ssl->out_ctr = ssl->out_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008590#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker70e79282019-05-03 14:34:53 +01008591 ssl->out_cid = ssl->out_ctr + 8;
8592 ssl->out_len = ssl->out_cid;
8593 if( transform != NULL )
8594 ssl->out_len += transform->out_cid_len;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008595#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01008596 ssl->out_len = ssl->out_ctr + 8;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008597#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01008598 ssl->out_iv = ssl->out_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008599 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008600 MBEDTLS_SSL_TRANSPORT_ELSE
8601#endif /* MBEDTLS_SSL_PROTO_DTLS */
8602#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008603 {
8604 ssl->out_ctr = ssl->out_hdr - 8;
8605 ssl->out_len = ssl->out_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008606#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker9bf10ea2019-05-08 16:43:21 +01008607 ssl->out_cid = ssl->out_len;
8608#endif
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008609 ssl->out_iv = ssl->out_hdr + 5;
8610 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008611#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008612
8613 /* Adjust out_msg to make space for explicit IV, if used. */
8614 if( transform != NULL &&
Hanno Becker7bcf2b52019-07-26 09:02:40 +01008615 mbedtls_ssl_ver_geq(
8616 mbedtls_ssl_get_minor_ver( ssl ),
8617 MBEDTLS_SSL_MINOR_VERSION_2 ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008618 {
8619 ssl->out_msg = ssl->out_iv + transform->ivlen - transform->fixed_ivlen;
8620 }
8621 else
8622 ssl->out_msg = ssl->out_iv;
8623}
8624
8625/* Once ssl->in_hdr as the address of the beginning of the
8626 * next incoming record is set, deduce the other pointers.
8627 *
8628 * Note: For TLS, we save the implicit record sequence number
8629 * (entering MAC computation) in the 8 bytes before ssl->in_hdr,
8630 * and the caller has to make sure there's space for this.
8631 */
8632
Hanno Beckerf5970a02019-05-08 09:38:41 +01008633static void ssl_update_in_pointers( mbedtls_ssl_context *ssl )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008634{
Hanno Beckerf5970a02019-05-08 09:38:41 +01008635 /* This function sets the pointers to match the case
Hanno Beckerc360dcc2019-07-12 10:00:45 +01008636 * of unprotected TLS/DTLS records, with ssl->in_msg
8637 * pointing to the beginning of the record content.
Hanno Beckerf5970a02019-05-08 09:38:41 +01008638 *
8639 * When decrypting a protected record, ssl->in_msg
8640 * will be shifted to point to the beginning of the
8641 * record plaintext.
8642 */
8643
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008644#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008645 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008646 {
Hanno Becker70e79282019-05-03 14:34:53 +01008647 /* This sets the header pointers to match records
8648 * without CID. When we receive a record containing
8649 * a CID, the fields are shifted accordingly in
8650 * ssl_parse_record_header(). */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008651 ssl->in_ctr = ssl->in_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008652#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker70e79282019-05-03 14:34:53 +01008653 ssl->in_cid = ssl->in_ctr + 8;
8654 ssl->in_len = ssl->in_cid; /* Default: no CID */
Hanno Beckera5a2b082019-05-15 14:03:01 +01008655#else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker70e79282019-05-03 14:34:53 +01008656 ssl->in_len = ssl->in_ctr + 8;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008657#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc360dcc2019-07-12 10:00:45 +01008658 ssl->in_msg = ssl->in_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008659 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008660 MBEDTLS_SSL_TRANSPORT_ELSE
8661#endif /* MBEDTLS_SSL_PROTO_DTLS */
8662#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008663 {
8664 ssl->in_ctr = ssl->in_hdr - 8;
8665 ssl->in_len = ssl->in_hdr + 3;
Hanno Beckera5a2b082019-05-15 14:03:01 +01008666#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker9bf10ea2019-05-08 16:43:21 +01008667 ssl->in_cid = ssl->in_len;
8668#endif
Hanno Beckerc360dcc2019-07-12 10:00:45 +01008669 ssl->in_msg = ssl->in_hdr + 5;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008670 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008671#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01008672}
8673
Paul Bakker5121ce52009-01-03 21:22:43 +00008674/*
8675 * Initialize an SSL context
8676 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02008677void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
8678{
8679 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
8680}
8681
8682/*
8683 * Setup an SSL context
8684 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01008685
8686static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl )
8687{
8688 /* Set the incoming and outgoing record pointers. */
8689#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008690 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker2a43f6f2018-08-10 11:12:52 +01008691 {
8692 ssl->out_hdr = ssl->out_buf;
8693 ssl->in_hdr = ssl->in_buf;
8694 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008695 MBEDTLS_SSL_TRANSPORT_ELSE
Hanno Becker2a43f6f2018-08-10 11:12:52 +01008696#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008697#if defined(MBEDTLS_SSL_PROTO_TLS)
Hanno Becker2a43f6f2018-08-10 11:12:52 +01008698 {
8699 ssl->out_hdr = ssl->out_buf + 8;
8700 ssl->in_hdr = ssl->in_buf + 8;
8701 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02008702#endif /* MBEDTLS_SSL_PROTO_TLS */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01008703
8704 /* Derive other internal pointers. */
8705 ssl_update_out_pointers( ssl, NULL /* no transform enabled */ );
Hanno Beckerf5970a02019-05-08 09:38:41 +01008706 ssl_update_in_pointers ( ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +01008707}
8708
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02008709int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02008710 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00008711{
Paul Bakker48916f92012-09-16 19:57:18 +00008712 int ret;
Paul Bakker5121ce52009-01-03 21:22:43 +00008713
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02008714 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00008715
Hanno Beckeref982d52019-07-23 15:56:18 +01008716#if defined(MBEDTLS_USE_TINYCRYPT)
8717 uECC_set_rng( &uecc_rng_wrapper );
8718#endif
8719
Paul Bakker62f2dee2012-09-28 07:31:51 +00008720 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01008721 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00008722 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02008723
8724 /* Set to NULL in case of an error condition */
8725 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02008726
Angus Grattond8213d02016-05-25 20:56:48 +10008727 ssl->in_buf = mbedtls_calloc( 1, MBEDTLS_SSL_IN_BUFFER_LEN );
8728 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00008729 {
Angus Grattond8213d02016-05-25 20:56:48 +10008730 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", MBEDTLS_SSL_IN_BUFFER_LEN) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02008731 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02008732 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10008733 }
8734
8735 ssl->out_buf = mbedtls_calloc( 1, MBEDTLS_SSL_OUT_BUFFER_LEN );
8736 if( ssl->out_buf == NULL )
8737 {
8738 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", MBEDTLS_SSL_OUT_BUFFER_LEN) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02008739 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02008740 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00008741 }
8742
Hanno Becker2a43f6f2018-08-10 11:12:52 +01008743 ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02008744
Paul Bakker48916f92012-09-16 19:57:18 +00008745 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02008746 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00008747
Hanno Beckerc8f52992019-07-25 11:15:08 +01008748 ssl->pending_fatal_alert_msg = MBEDTLS_SSL_ALERT_MSG_NONE;
Hanno Beckerf46e1ce2019-07-03 13:56:59 +01008749
Paul Bakker5121ce52009-01-03 21:22:43 +00008750 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02008751
8752error:
8753 mbedtls_free( ssl->in_buf );
8754 mbedtls_free( ssl->out_buf );
8755
8756 ssl->conf = NULL;
8757
8758 ssl->in_buf = NULL;
8759 ssl->out_buf = NULL;
8760
8761 ssl->in_hdr = NULL;
8762 ssl->in_ctr = NULL;
8763 ssl->in_len = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02008764 ssl->in_msg = NULL;
8765
8766 ssl->out_hdr = NULL;
8767 ssl->out_ctr = NULL;
8768 ssl->out_len = NULL;
8769 ssl->out_iv = NULL;
8770 ssl->out_msg = NULL;
8771
k-stachowiak9f7798e2018-07-31 16:52:32 +02008772 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008773}
8774
8775/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00008776 * Reset an initialized and used SSL context for re-use while retaining
8777 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02008778 *
8779 * If partial is non-zero, keep data in the input buffer and client ID.
8780 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00008781 */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02008782static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00008783{
Paul Bakker48916f92012-09-16 19:57:18 +00008784 int ret;
8785
Hanno Becker7e772132018-08-10 12:38:21 +01008786#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || \
8787 !defined(MBEDTLS_SSL_SRV_C)
8788 ((void) partial);
8789#endif
8790
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008791 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008792
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02008793 /* Cancel any possibly running timer */
8794 ssl_set_timer( ssl, 0 );
8795
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008796#if defined(MBEDTLS_SSL_RENEGOTIATION)
8797 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008798 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00008799
8800 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02008801 mbedtls_platform_memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
8802 mbedtls_platform_memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008803#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008804 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00008805
Paul Bakker7eb013f2011-10-06 12:37:39 +00008806 ssl->in_offt = NULL;
Hanno Beckerf29d4702018-08-10 11:31:15 +01008807 ssl_reset_in_out_pointers( ssl );
Paul Bakker7eb013f2011-10-06 12:37:39 +00008808
8809 ssl->in_msgtype = 0;
8810 ssl->in_msglen = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008811#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02008812 ssl->next_record_offset = 0;
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02008813 ssl->in_epoch = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02008814#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008815#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02008816 ssl_dtls_replay_reset( ssl );
8817#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00008818
8819 ssl->in_hslen = 0;
8820 ssl->nb_zero = 0;
Hanno Beckeraf0665d2017-05-24 09:16:26 +01008821
8822 ssl->keep_current_message = 0;
Paul Bakker7eb013f2011-10-06 12:37:39 +00008823
8824 ssl->out_msgtype = 0;
8825 ssl->out_msglen = 0;
8826 ssl->out_left = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008827#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
8828 if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01008829 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01008830#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00008831
Hanno Becker19859472018-08-06 09:40:20 +01008832 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
8833
Paul Bakker48916f92012-09-16 19:57:18 +00008834 ssl->transform_in = NULL;
8835 ssl->transform_out = NULL;
Paul Bakker7eb013f2011-10-06 12:37:39 +00008836
Hanno Becker78640902018-08-13 16:35:15 +01008837 ssl->session_in = NULL;
8838 ssl->session_out = NULL;
8839
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02008840 mbedtls_platform_memset( ssl->out_buf, 0, MBEDTLS_SSL_OUT_BUFFER_LEN );
Hanno Becker4ccbf062018-08-10 11:20:38 +01008841
8842#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02008843 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01008844#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
8845 {
8846 ssl->in_left = 0;
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +02008847 mbedtls_platform_memset( ssl->in_buf, 0, MBEDTLS_SSL_IN_BUFFER_LEN );
Hanno Becker4ccbf062018-08-10 11:20:38 +01008848 }
Paul Bakker05ef8352012-05-08 09:17:57 +00008849
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008850#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
8851 if( mbedtls_ssl_hw_record_reset != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00008852 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008853 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) );
8854 if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 )
Paul Bakker2770fbd2012-07-03 13:30:23 +00008855 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008856 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret );
8857 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00008858 }
Paul Bakker05ef8352012-05-08 09:17:57 +00008859 }
8860#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00008861
Paul Bakker48916f92012-09-16 19:57:18 +00008862 if( ssl->transform )
Paul Bakker2770fbd2012-07-03 13:30:23 +00008863 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008864 mbedtls_ssl_transform_free( ssl->transform );
8865 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00008866 ssl->transform = NULL;
Paul Bakker2770fbd2012-07-03 13:30:23 +00008867 }
Paul Bakker48916f92012-09-16 19:57:18 +00008868
Paul Bakkerc0463502013-02-14 11:19:38 +01008869 if( ssl->session )
8870 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008871 mbedtls_ssl_session_free( ssl->session );
8872 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01008873 ssl->session = NULL;
8874 }
8875
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008876#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02008877 ssl->alpn_chosen = NULL;
8878#endif
8879
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02008880#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01008881#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02008882 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01008883#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02008884 {
8885 mbedtls_free( ssl->cli_id );
8886 ssl->cli_id = NULL;
8887 ssl->cli_id_len = 0;
8888 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02008889#endif
8890
Paul Bakker48916f92012-09-16 19:57:18 +00008891 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
8892 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00008893
8894 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00008895}
8896
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02008897/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02008898 * Reset an initialized and used SSL context for re-use while retaining
8899 * all application-set variables, function pointers and data.
8900 */
8901int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
8902{
8903 return( ssl_session_reset_int( ssl, 0 ) );
8904}
8905
8906/*
Paul Bakker5121ce52009-01-03 21:22:43 +00008907 * SSL set accessors
8908 */
Hanno Becker2d9623f2019-06-13 12:07:05 +01008909#if !defined(MBEDTLS_SSL_CONF_ENDPOINT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008910void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00008911{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008912 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00008913}
Hanno Becker2d9623f2019-06-13 12:07:05 +01008914#endif /* MBEDTLS_SSL_CONF_ENDPOINT */
Paul Bakker5121ce52009-01-03 21:22:43 +00008915
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02008916void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01008917{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008918 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01008919}
8920
Hanno Becker7f376f42019-06-12 16:20:48 +01008921#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
8922 !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008923void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02008924{
Hanno Becker7f376f42019-06-12 16:20:48 +01008925 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02008926}
Hanno Becker7f376f42019-06-12 16:20:48 +01008927#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY && !MBEDTLS_SSL_CONF_ANTI_REPLAY */
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02008928
Hanno Beckerde671542019-06-12 16:30:46 +01008929#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \
8930 !defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
8931void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf,
8932 unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02008933{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008934 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02008935}
Hanno Beckerde671542019-06-12 16:30:46 +01008936#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT && !MBEDTLS_SSL_CONF_BADMAC_LIMIT */
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02008937
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008938#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01008939
Hanno Becker1841b0a2018-08-24 11:13:57 +01008940void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
8941 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01008942{
8943 ssl->disable_datagram_packing = !allow_packing;
8944}
8945
Hanno Becker1f835fa2019-06-13 10:14:59 +01008946#if !( defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX) && \
8947 defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN) )
Hanno Becker04da1892018-08-14 13:22:10 +01008948void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
8949 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02008950{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008951 conf->hs_timeout_min = min;
8952 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02008953}
Hanno Becker1f835fa2019-06-13 10:14:59 +01008954#else /* !( MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN &&
8955 MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX ) */
8956void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
8957 uint32_t min, uint32_t max )
8958{
8959 ((void) conf);
8960 ((void) min);
8961 ((void) max);
8962}
8963#endif /* MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN &&
8964 MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX */
8965
8966#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02008967
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008968void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00008969{
Hanno Beckeracd4fc02019-06-12 16:40:50 +01008970#if !defined(MBEDTLS_SSL_CONF_AUTHMODE)
8971 conf->authmode = authmode;
8972#else
8973 ((void) conf);
8974 ((void) authmode);
8975#endif /* MBEDTLS_SSL_CONF_AUTHMODE */
Paul Bakker5121ce52009-01-03 21:22:43 +00008976}
8977
Hanno Becker9ec3fe02019-07-01 17:36:12 +01008978#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
8979 !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008980void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02008981 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00008982 void *p_vrfy )
8983{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008984 conf->f_vrfy = f_vrfy;
8985 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00008986}
Hanno Becker9ec3fe02019-07-01 17:36:12 +01008987#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00008988
Hanno Beckerece325c2019-06-13 15:39:27 +01008989#if !defined(MBEDTLS_SSL_CONF_RNG)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008990void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00008991 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00008992 void *p_rng )
8993{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01008994 conf->f_rng = f_rng;
8995 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00008996}
Hanno Beckerece325c2019-06-13 15:39:27 +01008997#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00008998
Hanno Becker14a4a442019-07-02 17:00:34 +01008999#if defined(MBEDTLS_DEBUG_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009000void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02009001 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00009002 void *p_dbg )
9003{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009004 conf->f_dbg = f_dbg;
9005 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00009006}
Hanno Becker14a4a442019-07-02 17:00:34 +01009007#endif /* MBEDTLS_DEBUG_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00009008
Hanno Beckera58a8962019-06-13 16:11:15 +01009009#if !defined(MBEDTLS_SSL_CONF_RECV) && \
9010 !defined(MBEDTLS_SSL_CONF_SEND) && \
9011 !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009012void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009013 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00009014 mbedtls_ssl_send_t *f_send,
9015 mbedtls_ssl_recv_t *f_recv,
9016 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009017{
Hanno Beckera58a8962019-06-13 16:11:15 +01009018 ssl->p_bio = p_bio;
9019 ssl->f_send = f_send;
9020 ssl->f_recv = f_recv;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009021 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009022}
Hanno Beckera58a8962019-06-13 16:11:15 +01009023#else
9024void mbedtls_ssl_set_bio_ctx( mbedtls_ssl_context *ssl,
9025 void *p_bio )
9026{
9027 ssl->p_bio = p_bio;
9028}
9029#endif
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009030
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02009031#if defined(MBEDTLS_SSL_PROTO_DTLS)
9032void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
9033{
9034 ssl->mtu = mtu;
9035}
9036#endif
9037
Hanno Becker1f835fa2019-06-13 10:14:59 +01009038#if !defined(MBEDTLS_SSL_CONF_READ_TIMEOUT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009039void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01009040{
9041 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009042}
Hanno Becker1f835fa2019-06-13 10:14:59 +01009043#endif /* MBEDTLS_SSL_CONF_READ_TIMEOUT */
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02009044
Hanno Becker0ae6b242019-06-13 16:45:36 +01009045#if !defined(MBEDTLS_SSL_CONF_SET_TIMER) && \
9046 !defined(MBEDTLS_SSL_CONF_GET_TIMER)
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009047void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
9048 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00009049 mbedtls_ssl_set_timer_t *f_set_timer,
9050 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009051{
9052 ssl->p_timer = p_timer;
9053 ssl->f_set_timer = f_set_timer;
9054 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02009055 /* Make sure we start with no timer running */
9056 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009057}
Hanno Becker0ae6b242019-06-13 16:45:36 +01009058#else
9059void mbedtls_ssl_set_timer_cb_ctx( mbedtls_ssl_context *ssl,
9060 void *p_timer )
9061{
9062 ssl->p_timer = p_timer;
9063 /* Make sure we start with no timer running */
9064 ssl_set_timer( ssl, 0 );
9065}
9066#endif
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02009067
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009068#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009069void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01009070 void *p_cache,
9071 int (*f_get_cache)(void *, mbedtls_ssl_session *),
9072 int (*f_set_cache)(void *, const mbedtls_ssl_session *) )
Paul Bakker5121ce52009-01-03 21:22:43 +00009073{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01009074 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009075 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009076 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00009077}
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009078#endif /* MBEDTLS_SSL_SRV_C && !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009079
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009080#if defined(MBEDTLS_SSL_CLI_C) && !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009081int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00009082{
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009083 int ret;
9084
9085 if( ssl == NULL ||
9086 session == NULL ||
9087 ssl->session_negotiate == NULL ||
Hanno Becker2d9623f2019-06-13 12:07:05 +01009088 mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009089 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009090 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009091 }
9092
Hanno Becker58fccf22019-02-06 14:30:46 +00009093 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate,
9094 session ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009095 return( ret );
9096
Jarno Lamsa8d09e572019-12-19 15:20:19 +02009097 ssl->handshake->resume = MBEDTLS_SSL_FI_FLAG_SET;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02009098
9099 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00009100}
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03009101#endif /* MBEDTLS_SSL_CLI_C && !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Paul Bakker5121ce52009-01-03 21:22:43 +00009102
Hanno Becker73f4cb12019-06-27 13:51:07 +01009103#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009104void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009105 const int *ciphersuites )
Paul Bakker5121ce52009-01-03 21:22:43 +00009106{
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009107 conf->ciphersuite_list[0] = ciphersuites;
9108 conf->ciphersuite_list[1] = ciphersuites;
9109 conf->ciphersuite_list[2] = ciphersuites;
9110 conf->ciphersuite_list[3] = ciphersuites;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009111}
9112
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009113void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02009114 const int *ciphersuites,
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009115 int major, int minor )
9116{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009117 if( major != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009118 return;
9119
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009120 if( mbedtls_ssl_ver_lt( minor, MBEDTLS_SSL_MINOR_VERSION_0 ) ||
9121 mbedtls_ssl_ver_gt( minor, MBEDTLS_SSL_MINOR_VERSION_3 ) )
9122 {
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009123 return;
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009124 }
Paul Bakker8f4ddae2013-04-15 15:09:54 +02009125
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009126 conf->ciphersuite_list[mbedtls_ssl_minor_ver_index( minor )] =
9127 ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00009128}
Hanno Becker73f4cb12019-06-27 13:51:07 +01009129#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Paul Bakker5121ce52009-01-03 21:22:43 +00009130
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009131#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02009132void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01009133 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02009134{
9135 conf->cert_profile = profile;
9136}
9137
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009138/* Append a new keycert entry to a (possibly empty) list */
9139static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
9140 mbedtls_x509_crt *cert,
9141 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009142{
niisato8ee24222018-06-25 19:05:48 +09009143 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009144
niisato8ee24222018-06-25 19:05:48 +09009145 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
9146 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009147 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009148
niisato8ee24222018-06-25 19:05:48 +09009149 new_cert->cert = cert;
9150 new_cert->key = key;
9151 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009152
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009153 /* Update head is the list was null, else add to the end */
9154 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01009155 {
niisato8ee24222018-06-25 19:05:48 +09009156 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01009157 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009158 else
9159 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009160 mbedtls_ssl_key_cert *cur = *head;
9161 while( cur->next != NULL )
9162 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09009163 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009164 }
9165
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009166 return( 0 );
9167}
9168
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009169int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02009170 mbedtls_x509_crt *own_cert,
9171 mbedtls_pk_context *pk_key )
9172{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02009173 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02009174}
9175
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009176void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009177 mbedtls_x509_crt *ca_chain,
9178 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00009179{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009180 conf->ca_chain = ca_chain;
9181 conf->ca_crl = ca_crl;
Paul Bakker5121ce52009-01-03 21:22:43 +00009182}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009183#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00009184
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02009185#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
9186int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
9187 mbedtls_x509_crt *own_cert,
9188 mbedtls_pk_context *pk_key )
9189{
9190 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
9191 own_cert, pk_key ) );
9192}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02009193
9194void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
9195 mbedtls_x509_crt *ca_chain,
9196 mbedtls_x509_crl *ca_crl )
9197{
9198 ssl->handshake->sni_ca_chain = ca_chain;
9199 ssl->handshake->sni_ca_crl = ca_crl;
9200}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02009201
9202void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
9203 int authmode )
9204{
9205 ssl->handshake->sni_authmode = authmode;
9206}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02009207#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
9208
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02009209#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009210/*
9211 * Set EC J-PAKE password for current handshake
9212 */
9213int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
9214 const unsigned char *pw,
9215 size_t pw_len )
9216{
9217 mbedtls_ecjpake_role role;
9218
Janos Follath8eb64132016-06-03 15:40:57 +01009219 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009220 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9221
Hanno Becker2d9623f2019-06-13 12:07:05 +01009222 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009223 role = MBEDTLS_ECJPAKE_SERVER;
9224 else
9225 role = MBEDTLS_ECJPAKE_CLIENT;
9226
9227 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
9228 role,
9229 MBEDTLS_MD_SHA256,
9230 MBEDTLS_ECP_DP_SECP256R1,
9231 pw, pw_len ) );
9232}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02009233#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02009234
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009235#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009236int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009237 const unsigned char *psk, size_t psk_len,
9238 const unsigned char *psk_identity, size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02009239{
Paul Bakker6db455e2013-09-18 17:29:31 +02009240 if( psk == NULL || psk_identity == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009241 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker6db455e2013-09-18 17:29:31 +02009242
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009243 if( psk_len > MBEDTLS_PSK_MAX_LEN )
9244 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01009245
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02009246 /* Identity len will be encoded on two bytes */
9247 if( ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10009248 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02009249 {
9250 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9251 }
9252
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009253 if( conf->psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02009254 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009255 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009256
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009257 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02009258 conf->psk = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009259 conf->psk_len = 0;
9260 }
9261 if( conf->psk_identity != NULL )
9262 {
9263 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02009264 conf->psk_identity = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009265 conf->psk_identity_len = 0;
Paul Bakker6db455e2013-09-18 17:29:31 +02009266 }
9267
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02009268 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
9269 ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
Mansour Moufidf81088b2015-02-17 13:10:21 -05009270 {
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009271 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02009272 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009273 conf->psk = NULL;
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02009274 conf->psk_identity = NULL;
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009275 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Mansour Moufidf81088b2015-02-17 13:10:21 -05009276 }
Paul Bakker6db455e2013-09-18 17:29:31 +02009277
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01009278 conf->psk_len = psk_len;
9279 conf->psk_identity_len = psk_identity_len;
Paul Bakker6db455e2013-09-18 17:29:31 +02009280
Teppo Järvelin91d79382019-10-02 09:09:31 +03009281 mbedtls_platform_memcpy( conf->psk, psk, conf->psk_len );
9282 mbedtls_platform_memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker6db455e2013-09-18 17:29:31 +02009283
9284 return( 0 );
9285}
9286
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009287int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
9288 const unsigned char *psk, size_t psk_len )
9289{
9290 if( psk == NULL || ssl->handshake == NULL )
9291 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9292
9293 if( psk_len > MBEDTLS_PSK_MAX_LEN )
9294 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9295
9296 if( ssl->handshake->psk != NULL )
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01009297 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009298 mbedtls_platform_zeroize( ssl->handshake->psk,
9299 ssl->handshake->psk_len );
Simon Butcher5b8d1d62015-10-04 22:06:51 +01009300 mbedtls_free( ssl->handshake->psk );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01009301 ssl->handshake->psk_len = 0;
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01009302 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009303
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02009304 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02009305 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009306
9307 ssl->handshake->psk_len = psk_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +03009308 mbedtls_platform_memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009309
9310 return( 0 );
9311}
9312
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009313void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009314 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
Paul Bakker6db455e2013-09-18 17:29:31 +02009315 size_t),
9316 void *p_psk )
9317{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009318 conf->f_psk = f_psk;
9319 conf->p_psk = p_psk;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02009320}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009321#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakker43b7e352011-01-18 15:27:19 +00009322
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02009323#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker470a8c42017-10-04 15:28:46 +01009324
9325#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009326int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G )
Paul Bakker5121ce52009-01-03 21:22:43 +00009327{
9328 int ret;
9329
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009330 if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 ||
9331 ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
9332 {
9333 mbedtls_mpi_free( &conf->dhm_P );
9334 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker5121ce52009-01-03 21:22:43 +00009335 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009336 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009337
9338 return( 0 );
9339}
Hanno Becker470a8c42017-10-04 15:28:46 +01009340#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker5121ce52009-01-03 21:22:43 +00009341
Hanno Beckera90658f2017-10-04 15:29:08 +01009342int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
9343 const unsigned char *dhm_P, size_t P_len,
9344 const unsigned char *dhm_G, size_t G_len )
9345{
9346 int ret;
9347
9348 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
9349 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
9350 {
9351 mbedtls_mpi_free( &conf->dhm_P );
9352 mbedtls_mpi_free( &conf->dhm_G );
9353 return( ret );
9354 }
9355
9356 return( 0 );
9357}
Paul Bakker5121ce52009-01-03 21:22:43 +00009358
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009359int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00009360{
9361 int ret;
9362
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009363 if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 ||
9364 ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
9365 {
9366 mbedtls_mpi_free( &conf->dhm_P );
9367 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00009368 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01009369 }
Paul Bakker1b57b062011-01-06 15:48:19 +00009370
9371 return( 0 );
9372}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02009373#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00009374
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02009375#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
9376/*
9377 * Set the minimum length for Diffie-Hellman parameters
9378 */
9379void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
9380 unsigned int bitlen )
9381{
9382 conf->dhm_min_bitlen = bitlen;
9383}
9384#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
9385
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009386#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009387/*
9388 * Set allowed/preferred hashes for handshake signatures
9389 */
9390void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
9391 const int *hashes )
9392{
Hanno Becker56595f42019-06-19 16:31:38 +01009393#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009394 conf->sig_hashes = hashes;
Hanno Becker56595f42019-06-19 16:31:38 +01009395#else
9396 ((void) conf);
9397 ((void) hashes);
9398#endif /* MBEDTLS_SSL_CONF_SINGLE_SIG_HASH */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009399}
Hanno Becker947194e2017-04-07 13:25:49 +01009400#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02009401
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02009402#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +01009403#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009404/*
9405 * Set the allowed elliptic curves
9406 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009407void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009408 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009409{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009410 conf->curve_list = curve_list;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009411}
Hanno Beckerc1096e72019-06-19 12:30:41 +01009412#endif /* MBEDTLS_SSL_CONF_SINGLE_EC */
Hanno Becker947194e2017-04-07 13:25:49 +01009413#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01009414
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03009415#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009416int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00009417{
Hanno Becker947194e2017-04-07 13:25:49 +01009418 /* Initialize to suppress unnecessary compiler warning */
9419 size_t hostname_len = 0;
9420
9421 /* Check if new hostname is valid before
9422 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01009423 if( hostname != NULL )
9424 {
9425 hostname_len = strlen( hostname );
9426
9427 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
9428 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9429 }
9430
9431 /* Now it's clear that we will overwrite the old hostname,
9432 * so we can free it safely */
9433
9434 if( ssl->hostname != NULL )
9435 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009436 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01009437 mbedtls_free( ssl->hostname );
9438 }
9439
9440 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01009441
Paul Bakker5121ce52009-01-03 21:22:43 +00009442 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01009443 {
9444 ssl->hostname = NULL;
9445 }
9446 else
9447 {
9448 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01009449 if( ssl->hostname == NULL )
9450 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02009451
Teppo Järvelin6f4e0302019-10-04 13:53:53 +03009452 /* Not using more secure mbedtls_platform_memcpy as hostname is public in initial handshake */
9453 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02009454
Hanno Becker947194e2017-04-07 13:25:49 +01009455 ssl->hostname[hostname_len] = '\0';
9456 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009457
9458 return( 0 );
9459}
Teppo Järvelin4009d8f2019-08-19 14:48:09 +03009460#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00009461
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01009462#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009463void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009464 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00009465 const unsigned char *, size_t),
9466 void *p_sni )
9467{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009468 conf->f_sni = f_sni;
9469 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00009470}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009471#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00009472
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009473#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009474int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009475{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009476 size_t cur_len, tot_len;
9477 const char **p;
9478
9479 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08009480 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
9481 * MUST NOT be truncated."
9482 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009483 */
9484 tot_len = 0;
9485 for( p = protos; *p != NULL; p++ )
9486 {
9487 cur_len = strlen( *p );
9488 tot_len += cur_len;
9489
9490 if( cur_len == 0 || cur_len > 255 || tot_len > 65535 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009491 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009492 }
9493
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009494 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02009495
9496 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009497}
9498
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009499const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009500{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02009501 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009502}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009503#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02009504
Hanno Becker33b9b252019-07-05 11:23:25 +01009505#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER) || \
9506 !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
9507void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf,
9508 int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00009509{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009510 conf->max_major_ver = major;
9511 conf->max_minor_ver = minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00009512}
Hanno Becker33b9b252019-07-05 11:23:25 +01009513#endif /* MBEDTLS_SSL_CONF_MAX_MINOR_VER ||
9514 MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
Paul Bakker490ecc82011-10-06 13:04:09 +00009515
Hanno Becker33b9b252019-07-05 11:23:25 +01009516#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER) || \
9517 !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
9518void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf,
9519 int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00009520{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009521 conf->min_major_ver = major;
9522 conf->min_minor_ver = minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00009523}
Hanno Becker33b9b252019-07-05 11:23:25 +01009524#endif /* MBEDTLS_SSL_CONF_MIN_MINOR_VER ||
9525 MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
Paul Bakker1d29fb52012-09-28 13:28:45 +00009526
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009527#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009528void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback )
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02009529{
Manuel Pégourié-Gonnard684b0592015-05-06 09:27:31 +01009530 conf->fallback = fallback;
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02009531}
9532#endif
9533
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +01009534#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST)
Janos Follath088ce432017-04-10 12:42:31 +01009535void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
9536 char cert_req_ca_list )
9537{
9538 conf->cert_req_ca_list = cert_req_ca_list;
9539}
9540#endif
9541
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009542#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009543void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01009544{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009545 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01009546}
9547#endif
9548
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009549#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckerf765ce62019-06-21 13:17:14 +01009550#if !defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009551void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009552{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009553 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009554}
Hanno Beckerf765ce62019-06-21 13:17:14 +01009555#endif /* !MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET */
9556#if !defined(MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET)
Jarno Lamsa7a5e2be2019-06-10 10:13:03 +03009557void mbedtls_ssl_conf_extended_master_secret_enforce( mbedtls_ssl_config *conf,
Jarno Lamsa842be162019-06-10 15:05:33 +03009558 char ems_enf )
Jarno Lamsa7a5e2be2019-06-10 10:13:03 +03009559{
9560 conf->enforce_extended_master_secret = ems_enf;
9561}
Hanno Beckerf765ce62019-06-21 13:17:14 +01009562#endif /* !MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET */
Hanno Beckeraabbb582019-06-11 13:43:27 +01009563#endif /* !MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02009564
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009565#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009566void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 )
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009567{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009568 conf->arc4_disabled = arc4;
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009569}
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009570#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01009571
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009572#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009573int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009574{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009575 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10009576 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009577 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009578 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009579 }
9580
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01009581 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009582
9583 return( 0 );
9584}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009585#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02009586
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009587#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02009588void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate )
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009589{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009590 conf->trunc_hmac = truncate;
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009591}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009592#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02009593
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009594#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009595void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009596{
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01009597 conf->cbc_record_splitting = split;
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009598}
9599#endif
9600
Hanno Beckerb0b2b672019-06-12 16:58:10 +01009601#if !defined(MBEDTLS_SSL_CONF_ALLOW_LEGACY_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009602void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00009603{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009604 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00009605}
Hanno Beckerb0b2b672019-06-12 16:58:10 +01009606#endif /* !MBEDTLS_SSL_CONF_ALLOW_LEGACY_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +00009607
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009608#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009609void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009610{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009611 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01009612}
9613
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009614void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02009615{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02009616 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02009617}
9618
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02009619void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01009620 const unsigned char period[8] )
9621{
Teppo Järvelin91d79382019-10-02 09:09:31 +03009622 mbedtls_platform_memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01009623}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009624#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00009625
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009626#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02009627#if defined(MBEDTLS_SSL_CLI_C)
9628void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02009629{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01009630 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02009631}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02009632#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02009633
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02009634#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02009635void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
9636 mbedtls_ssl_ticket_write_t *f_ticket_write,
9637 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
9638 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +02009639{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02009640 conf->f_ticket_write = f_ticket_write;
9641 conf->f_ticket_parse = f_ticket_parse;
9642 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02009643}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02009644#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009645#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02009646
Robert Cragie4feb7ae2015-10-02 13:33:37 +01009647#if defined(MBEDTLS_SSL_EXPORT_KEYS)
9648void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
9649 mbedtls_ssl_export_keys_t *f_export_keys,
9650 void *p_export_keys )
9651{
9652 conf->f_export_keys = f_export_keys;
9653 conf->p_export_keys = p_export_keys;
9654}
9655#endif
9656
Gilles Peskineb74a1c72018-04-24 13:09:22 +02009657#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01009658void mbedtls_ssl_conf_async_private_cb(
9659 mbedtls_ssl_config *conf,
9660 mbedtls_ssl_async_sign_t *f_async_sign,
9661 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
9662 mbedtls_ssl_async_resume_t *f_async_resume,
9663 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02009664 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +01009665{
9666 conf->f_async_sign_start = f_async_sign;
9667 conf->f_async_decrypt_start = f_async_decrypt;
9668 conf->f_async_resume = f_async_resume;
9669 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02009670 conf->p_async_config_data = async_config_data;
9671}
9672
Gilles Peskine8f97af72018-04-26 11:46:10 +02009673void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
9674{
9675 return( conf->p_async_config_data );
9676}
9677
Gilles Peskine1febfef2018-04-30 11:54:39 +02009678void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02009679{
9680 if( ssl->handshake == NULL )
9681 return( NULL );
9682 else
9683 return( ssl->handshake->user_async_ctx );
9684}
9685
Gilles Peskine1febfef2018-04-30 11:54:39 +02009686void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02009687 void *ctx )
9688{
9689 if( ssl->handshake != NULL )
9690 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +01009691}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02009692#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01009693
Paul Bakker5121ce52009-01-03 21:22:43 +00009694/*
9695 * SSL get accessors
9696 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009697size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00009698{
9699 return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
9700}
9701
Hanno Becker8b170a02017-10-10 11:51:19 +01009702int mbedtls_ssl_check_pending( const mbedtls_ssl_context *ssl )
9703{
9704 /*
9705 * Case A: We're currently holding back
9706 * a message for further processing.
9707 */
9708
9709 if( ssl->keep_current_message == 1 )
9710 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01009711 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: record held back for processing" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01009712 return( 1 );
9713 }
9714
9715 /*
9716 * Case B: Further records are pending in the current datagram.
9717 */
9718
9719#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02009720 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker8b170a02017-10-10 11:51:19 +01009721 ssl->in_left > ssl->next_record_offset )
9722 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01009723 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more records within current datagram" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01009724 return( 1 );
9725 }
9726#endif /* MBEDTLS_SSL_PROTO_DTLS */
9727
9728 /*
9729 * Case C: A handshake message is being processed.
9730 */
9731
Hanno Becker8b170a02017-10-10 11:51:19 +01009732 if( ssl->in_hslen > 0 && ssl->in_hslen < ssl->in_msglen )
9733 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01009734 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more handshake messages within current record" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01009735 return( 1 );
9736 }
9737
9738 /*
9739 * Case D: An application data message is being processed
9740 */
9741 if( ssl->in_offt != NULL )
9742 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01009743 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: application data record is being processed" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01009744 return( 1 );
9745 }
9746
9747 /*
9748 * In all other cases, the rest of the message can be dropped.
Hanno Beckerc573ac32018-08-28 17:15:25 +01009749 * As in ssl_get_next_record, this needs to be adapted if
Hanno Becker8b170a02017-10-10 11:51:19 +01009750 * we implement support for multiple alerts in single records.
9751 */
9752
9753 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: nothing pending" ) );
9754 return( 0 );
9755}
9756
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02009757uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00009758{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00009759 if( ssl->session != NULL )
9760 return( ssl->session->verify_result );
9761
9762 if( ssl->session_negotiate != NULL )
9763 return( ssl->session_negotiate->verify_result );
9764
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +02009765 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +00009766}
9767
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009768const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +00009769{
Hanno Beckere02758c2019-06-26 15:31:31 +01009770 int suite;
9771
Paul Bakker926c8e42013-03-06 10:23:34 +01009772 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02009773 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +01009774
Hanno Beckere02758c2019-06-26 15:31:31 +01009775 suite = mbedtls_ssl_session_get_ciphersuite( ssl->session );
9776 return( mbedtls_ssl_get_ciphersuite_name( suite ) );
Paul Bakker72f62662011-01-16 21:27:44 +00009777}
9778
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009779const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +00009780{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009781#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02009782 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01009783 {
Hanno Becker2881d802019-05-22 14:44:53 +01009784 switch( mbedtls_ssl_get_minor_ver( ssl ) )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01009785 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009786 case MBEDTLS_SSL_MINOR_VERSION_2:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01009787 return( "DTLSv1.0" );
9788
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009789 case MBEDTLS_SSL_MINOR_VERSION_3:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01009790 return( "DTLSv1.2" );
9791
9792 default:
9793 return( "unknown (DTLS)" );
9794 }
9795 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +02009796 MBEDTLS_SSL_TRANSPORT_ELSE
9797#endif /* MBEDTLS_SSL_PROTO_DTLS */
9798#if defined(MBEDTLS_SSL_PROTO_TLS)
Paul Bakker43ca69c2011-01-15 17:35:19 +00009799 {
Hanno Becker2881d802019-05-22 14:44:53 +01009800 switch( mbedtls_ssl_get_minor_ver( ssl ) )
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +02009801 {
9802 case MBEDTLS_SSL_MINOR_VERSION_0:
9803 return( "SSLv3.0" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00009804
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +02009805 case MBEDTLS_SSL_MINOR_VERSION_1:
9806 return( "TLSv1.0" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00009807
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +02009808 case MBEDTLS_SSL_MINOR_VERSION_2:
9809 return( "TLSv1.1" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00009810
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +02009811 case MBEDTLS_SSL_MINOR_VERSION_3:
9812 return( "TLSv1.2" );
Paul Bakker1ef83d62012-04-11 12:09:53 +00009813
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +02009814 default:
9815 return( "unknown" );
9816 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00009817 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +02009818#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakker43ca69c2011-01-15 17:35:19 +00009819}
9820
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009821int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02009822{
Hanno Becker3136ede2018-08-17 15:28:19 +01009823 size_t transform_expansion = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009824 const mbedtls_ssl_transform *transform = ssl->transform_out;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02009825
Hanno Becker43395762019-05-03 14:46:38 +01009826 size_t out_hdr_len = mbedtls_ssl_out_hdr_len( ssl );
9827
Hanno Becker78640902018-08-13 16:35:15 +01009828 if( transform == NULL )
Hanno Becker43395762019-05-03 14:46:38 +01009829 return( (int) out_hdr_len );
Hanno Becker78640902018-08-13 16:35:15 +01009830
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009831#if defined(MBEDTLS_ZLIB_SUPPORT)
9832 if( ssl->session_out->compression != MBEDTLS_SSL_COMPRESS_NULL )
9833 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02009834#endif
9835
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009836 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02009837 {
Hanno Beckera9d5c452019-07-25 16:47:12 +01009838#if defined(MBEDTLS_GCM_C) || \
9839 defined(MBEDTLS_CCM_C) || \
9840 defined(MBEDTLS_CHACHAPOLY_C)
9841#if defined(MBEDTLS_GCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009842 case MBEDTLS_MODE_GCM:
Hanno Beckera9d5c452019-07-25 16:47:12 +01009843#endif
9844#if defined(MBEDTLS_CCM_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009845 case MBEDTLS_MODE_CCM:
Hanno Beckera9d5c452019-07-25 16:47:12 +01009846#endif
9847#if defined(MBEDTLS_CHACHAPOLY_C)
Hanno Becker5b559ac2018-08-03 09:40:07 +01009848 case MBEDTLS_MODE_CHACHAPOLY:
Hanno Beckera9d5c452019-07-25 16:47:12 +01009849#endif
9850 transform_expansion =
9851 transform->ivlen - transform->fixed_ivlen + transform->taglen;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02009852 break;
9853
Hanno Beckera9d5c452019-07-25 16:47:12 +01009854#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C ||
9855 MBEDTLS_CHACHAPOLY_C */
9856
9857#if defined(MBEDTLS_CIPHER_MODE_STREAM)
9858 case MBEDTLS_MODE_STREAM:
9859 transform_expansion = transform->maclen;
9860 break;
9861#endif /* MBEDTLS_CIPHER_MODE_STREAM */
9862
9863#if defined(MBEDTLS_CIPHER_MODE_CBC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009864 case MBEDTLS_MODE_CBC:
Hanno Beckera9d5c452019-07-25 16:47:12 +01009865 {
9866 size_t block_size;
Hanno Becker5b559ac2018-08-03 09:40:07 +01009867
9868 block_size = mbedtls_cipher_get_block_size(
9869 &transform->cipher_ctx_enc );
9870
Hanno Becker3136ede2018-08-17 15:28:19 +01009871 /* Expansion due to the addition of the MAC. */
9872 transform_expansion += transform->maclen;
9873
9874 /* Expansion due to the addition of CBC padding;
9875 * Theoretically up to 256 bytes, but we never use
9876 * more than the block size of the underlying cipher. */
9877 transform_expansion += block_size;
9878
9879 /* For TLS 1.1 or higher, an explicit IV is added
9880 * after the record header. */
Hanno Becker5b559ac2018-08-03 09:40:07 +01009881#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009882 if( mbedtls_ssl_ver_geq(
9883 mbedtls_ssl_get_minor_ver( ssl ),
9884 MBEDTLS_SSL_MINOR_VERSION_2 ) )
9885 {
Hanno Becker3136ede2018-08-17 15:28:19 +01009886 transform_expansion += block_size;
Hanno Becker7bcf2b52019-07-26 09:02:40 +01009887 }
Hanno Becker5b559ac2018-08-03 09:40:07 +01009888#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker3136ede2018-08-17 15:28:19 +01009889
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02009890 break;
Hanno Beckera9d5c452019-07-25 16:47:12 +01009891 }
9892#endif /* MBEDTLS_CIPHER_MODE_CBC */
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02009893
9894 default:
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02009895 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009896 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02009897 }
9898
Hanno Beckera5a2b082019-05-15 14:03:01 +01009899#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckeradd01902019-05-08 15:40:11 +01009900 if( transform->out_cid_len != 0 )
9901 transform_expansion += MBEDTLS_SSL_MAX_CID_EXPANSION;
Hanno Beckera5a2b082019-05-15 14:03:01 +01009902#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckeradd01902019-05-08 15:40:11 +01009903
Hanno Becker43395762019-05-03 14:46:38 +01009904 return( (int)( out_hdr_len + transform_expansion ) );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02009905}
9906
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02009907#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
9908size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
9909{
9910 size_t max_len;
9911
9912 /*
9913 * Assume mfl_code is correct since it was checked when set
9914 */
Angus Grattond8213d02016-05-25 20:56:48 +10009915 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02009916
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02009917 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02009918 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +10009919 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02009920 {
Angus Grattond8213d02016-05-25 20:56:48 +10009921 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02009922 }
9923
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02009924 /* During a handshake, use the value being negotiated */
9925 if( ssl->session_negotiate != NULL &&
9926 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
9927 {
9928 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
9929 }
9930
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02009931 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02009932}
9933#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
9934
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02009935#if defined(MBEDTLS_SSL_PROTO_DTLS)
9936static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
9937{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04009938 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
Hanno Becker2d9623f2019-06-13 12:07:05 +01009939 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT &&
Andrzej Kurekef43ce62018-10-09 08:24:12 -04009940 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
9941 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
Arto Kinnunen4f4849a2019-09-09 10:21:18 +03009942 return( 0 );
Andrzej Kurekef43ce62018-10-09 08:24:12 -04009943
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02009944 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
9945 return( ssl->mtu );
9946
9947 if( ssl->mtu == 0 )
9948 return( ssl->handshake->mtu );
9949
9950 return( ssl->mtu < ssl->handshake->mtu ?
9951 ssl->mtu : ssl->handshake->mtu );
9952}
9953#endif /* MBEDTLS_SSL_PROTO_DTLS */
9954
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02009955int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
9956{
9957 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
9958
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02009959#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
9960 !defined(MBEDTLS_SSL_PROTO_DTLS)
9961 (void) ssl;
9962#endif
9963
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02009964#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
9965 const size_t mfl = mbedtls_ssl_get_max_frag_len( ssl );
9966
9967 if( max_len > mfl )
9968 max_len = mfl;
9969#endif
9970
9971#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02009972 if( ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02009973 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02009974 const size_t mtu = ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02009975 const int ret = mbedtls_ssl_get_record_expansion( ssl );
9976 const size_t overhead = (size_t) ret;
9977
9978 if( ret < 0 )
9979 return( ret );
9980
9981 if( mtu <= overhead )
9982 {
9983 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
9984 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
9985 }
9986
9987 if( max_len > mtu - overhead )
9988 max_len = mtu - overhead;
9989 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02009990#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02009991
Hanno Becker0defedb2018-08-10 12:35:02 +01009992#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
9993 !defined(MBEDTLS_SSL_PROTO_DTLS)
9994 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02009995#endif
9996
9997 return( (int) max_len );
9998}
9999
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010000#if defined(MBEDTLS_X509_CRT_PARSE_C)
10001const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +000010002{
10003 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010004 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +000010005
Hanno Beckerbfab9df2019-02-07 13:18:46 +000010006#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Paul Bakkerd8bb8262014-06-17 14:06:49 +020010007 return( ssl->session->peer_cert );
Hanno Beckerbfab9df2019-02-07 13:18:46 +000010008#else
10009 return( NULL );
10010#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +000010011}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010012#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +000010013
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010014#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker933b9fc2019-02-05 11:42:30 +000010015int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl,
10016 mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010017{
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010018 if( ssl == NULL ||
10019 dst == NULL ||
10020 ssl->session == NULL ||
Hanno Becker2d9623f2019-06-13 12:07:05 +010010021 mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010022 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010023 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010024 }
10025
Hanno Becker58fccf22019-02-06 14:30:46 +000010026 return( mbedtls_ssl_session_copy( dst, ssl->session ) );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010027}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010028#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +020010029
Manuel Pégourié-Gonnard37a53242019-05-20 11:12:28 +020010030const mbedtls_ssl_session *mbedtls_ssl_get_session_pointer( const mbedtls_ssl_context *ssl )
10031{
10032 if( ssl == NULL )
10033 return( NULL );
10034
10035 return( ssl->session );
10036}
10037
Paul Bakker5121ce52009-01-03 21:22:43 +000010038/*
Hanno Beckerb5352f02019-05-16 12:39:07 +010010039 * Define ticket header determining Mbed TLS version
10040 * and structure of the ticket.
10041 */
10042
Hanno Becker41527622019-05-16 12:50:45 +010010043/*
Hanno Becker26829e92019-05-28 14:30:45 +010010044 * Define bitflag determining compile-time settings influencing
10045 * structure of serialized SSL sessions.
Hanno Becker41527622019-05-16 12:50:45 +010010046 */
10047
Hanno Becker26829e92019-05-28 14:30:45 +010010048#if defined(MBEDTLS_HAVE_TIME)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010049#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker26829e92019-05-28 14:30:45 +010010050#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010051#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker41527622019-05-16 12:50:45 +010010052#endif /* MBEDTLS_HAVE_TIME */
10053
10054#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010055#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker41527622019-05-16 12:50:45 +010010056#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010057#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker41527622019-05-16 12:50:45 +010010058#endif /* MBEDTLS_X509_CRT_PARSE_C */
10059
10060#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010061#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker41527622019-05-16 12:50:45 +010010062#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010063#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker41527622019-05-16 12:50:45 +010010064#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
10065
10066#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010067#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker41527622019-05-16 12:50:45 +010010068#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010069#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker41527622019-05-16 12:50:45 +010010070#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
10071
10072#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010073#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 1
Hanno Becker41527622019-05-16 12:50:45 +010010074#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010075#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 0
Hanno Becker41527622019-05-16 12:50:45 +010010076#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
10077
10078#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010079#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker41527622019-05-16 12:50:45 +010010080#else
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010081#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker41527622019-05-16 12:50:45 +010010082#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
10083
Hanno Becker41527622019-05-16 12:50:45 +010010084#if defined(MBEDTLS_SSL_SESSION_TICKETS)
10085#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
10086#else
10087#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
10088#endif /* MBEDTLS_SSL_SESSION_TICKETS */
10089
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010090#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
10091#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT 1
10092#else
10093#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT 0
10094#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
10095
Hanno Becker88440552019-07-03 14:16:13 +010010096#if defined(MBEDTLS_ZLIB_SUPPORT)
10097#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION 1
10098#else
10099#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION 0
10100#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
10101
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010102#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
10103#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
10104#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
10105#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
10106#define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT 4
10107#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 5
10108#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 6
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010109#define SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT_BIT 7
Hanno Becker88440552019-07-03 14:16:13 +010010110#define SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION_BIT 8
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010111
Hanno Becker26829e92019-05-28 14:30:45 +010010112#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Hanno Beckerbaf968c2019-05-29 11:10:18 +010010113 ( (uint16_t) ( \
10114 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \
10115 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \
10116 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \
10117 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \
10118 ( SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC << SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT ) | \
10119 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010120 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) | \
Hanno Becker88440552019-07-03 14:16:13 +010010121 ( SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION << SSL_SERIALIZED_SESSION_CONFIG_COMPRESSION_BIT ) | \
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010122 ( SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT << SSL_SERIALIZED_SESSION_CONFIG_KEEP_CRT_BIT ) ) )
Hanno Becker41527622019-05-16 12:50:45 +010010123
Hanno Becker557fe9f2019-05-16 12:41:07 +010010124static unsigned char ssl_serialized_session_header[] = {
Hanno Becker41527622019-05-16 12:50:45 +010010125 MBEDTLS_VERSION_MAJOR,
10126 MBEDTLS_VERSION_MINOR,
10127 MBEDTLS_VERSION_PATCH,
Hanno Becker26829e92019-05-28 14:30:45 +010010128 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF,
10129 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF,
Hanno Becker557fe9f2019-05-16 12:41:07 +010010130};
Hanno Beckerb5352f02019-05-16 12:39:07 +010010131
10132/*
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010133 * Serialize a session in the following format:
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010134 * (in the presentation language of TLS, RFC 8446 section 3)
10135 *
Hanno Becker26829e92019-05-28 14:30:45 +010010136 * opaque mbedtls_version[3]; // major, minor, patch
10137 * opaque session_format[2]; // version-specific 16-bit field determining
10138 * // the format of the remaining
10139 * // serialized data.
Hanno Beckerb36db4f2019-05-29 11:08:00 +010010140 *
10141 * Note: When updating the format, remember to keep
10142 * these version+format bytes.
10143 *
Hanno Becker7bf77102019-06-04 09:43:16 +010010144 * // In this version, `session_format` determines
10145 * // the setting of those compile-time
10146 * // configuration options which influence
Hanno Becker26829e92019-05-28 14:30:45 +010010147 * // the structure of mbedtls_ssl_session.
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010148 * uint64 start_time;
Hanno Becker26829e92019-05-28 14:30:45 +010010149 * uint8 ciphersuite[2]; // defined by the standard
10150 * uint8 compression; // 0 or 1
10151 * uint8 session_id_len; // at most 32
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010152 * opaque session_id[32];
Hanno Becker26829e92019-05-28 14:30:45 +010010153 * opaque master[48]; // fixed length in the standard
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010154 * uint32 verify_result;
Hanno Becker0528f822019-06-18 12:45:31 +010010155 * select (MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) {
10156 * case enabled: opaque peer_cert<0..2^24-1>; // length 0 means no cert
10157 * case disabled: uint8_t peer_cert_digest_type;
10158 * opaque peer_cert_digest<0..2^8-1>;
10159 * }
Hanno Becker26829e92019-05-28 14:30:45 +010010160 * opaque ticket<0..2^24-1>; // length 0 means no ticket
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010161 * uint32 ticket_lifetime;
Hanno Becker26829e92019-05-28 14:30:45 +010010162 * uint8 mfl_code; // up to 255 according to standard
10163 * uint8 trunc_hmac; // 0 or 1
10164 * uint8 encrypt_then_mac; // 0 or 1
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010165 *
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010166 * The order is the same as in the definition of the structure, except
10167 * verify_result is put before peer_cert so that all mandatory fields come
10168 * together in one block.
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010169 */
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010170static int ssl_session_save( const mbedtls_ssl_session *session,
10171 unsigned char omit_header,
10172 unsigned char *buf,
10173 size_t buf_len,
10174 size_t *olen )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010175{
10176 unsigned char *p = buf;
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010177 size_t used = 0;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010178#if defined(MBEDTLS_HAVE_TIME)
10179 uint64_t start;
10180#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010181#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010182#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010183 size_t cert_len;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010184#endif
Hanno Becker2e6d3472019-02-06 15:40:27 +000010185#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010186
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010187 if( !omit_header )
Hanno Beckerb5352f02019-05-16 12:39:07 +010010188 {
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010189 /*
10190 * Add version identifier
10191 */
10192
10193 used += sizeof( ssl_serialized_session_header );
10194
10195 if( used <= buf_len )
10196 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010197 mbedtls_platform_memcpy( p, ssl_serialized_session_header,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010198 sizeof( ssl_serialized_session_header ) );
10199 p += sizeof( ssl_serialized_session_header );
10200 }
Hanno Beckerb5352f02019-05-16 12:39:07 +010010201 }
10202
10203 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010204 * Time
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010205 */
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010206#if defined(MBEDTLS_HAVE_TIME)
10207 used += 8;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010208
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010209 if( used <= buf_len )
10210 {
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010211 start = (uint64_t) session->start;
10212
10213 *p++ = (unsigned char)( ( start >> 56 ) & 0xFF );
10214 *p++ = (unsigned char)( ( start >> 48 ) & 0xFF );
10215 *p++ = (unsigned char)( ( start >> 40 ) & 0xFF );
10216 *p++ = (unsigned char)( ( start >> 32 ) & 0xFF );
10217 *p++ = (unsigned char)( ( start >> 24 ) & 0xFF );
10218 *p++ = (unsigned char)( ( start >> 16 ) & 0xFF );
10219 *p++ = (unsigned char)( ( start >> 8 ) & 0xFF );
10220 *p++ = (unsigned char)( ( start ) & 0xFF );
10221 }
10222#endif /* MBEDTLS_HAVE_TIME */
10223
10224 /*
10225 * Basic mandatory fields
10226 */
Hanno Becker88440552019-07-03 14:16:13 +010010227 {
10228 size_t const ciphersuite_len = 2;
10229#if defined(MBEDTLS_ZLIB_SUPPORT)
10230 size_t const compression_len = 1;
10231#else
10232 size_t const compression_len = 0;
10233#endif
10234 size_t const id_len_len = 1;
10235 size_t const id_len = 32;
10236 size_t const master_len = 48;
10237 size_t const verif_result_len = 4;
10238
10239 size_t const basic_len =
10240 ciphersuite_len +
10241 compression_len +
10242 id_len_len +
10243 id_len +
10244 master_len +
10245 verif_result_len;
10246
10247 used += basic_len;
10248 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010249
10250 if( used <= buf_len )
10251 {
Hanno Beckere02758c2019-06-26 15:31:31 +010010252 const int ciphersuite =
10253 mbedtls_ssl_session_get_ciphersuite( session );
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010254 p = mbedtls_platform_put_uint16_be( p, ciphersuite );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010255
Hanno Becker88440552019-07-03 14:16:13 +010010256#if defined(MBEDTLS_ZLIB_SUPPORT)
10257 *p++ = (unsigned char)(
10258 mbedtls_ssl_session_get_compression( session ) );
10259#endif
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010260
10261 *p++ = (unsigned char)( session->id_len & 0xFF );
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030010262 /* Not using more secure mbedtls_platform_memcpy as session id is public */
10263 memcpy( p, session->id, 32 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010264 p += 32;
10265
Teppo Järvelin91d79382019-10-02 09:09:31 +030010266 mbedtls_platform_memcpy( p, session->master, 48 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010267 p += 48;
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010268 p = mbedtls_platform_put_uint32_be( p, session->verify_result );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010269 }
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010270
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010271 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010272 * Peer's end-entity certificate
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010273 */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010274#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010275#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010276 if( session->peer_cert == NULL )
10277 cert_len = 0;
10278 else
10279 cert_len = session->peer_cert->raw.len;
10280
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010281 used += 3 + cert_len;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010282
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010283 if( used <= buf_len )
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010284 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010285 p = mbedtls_platform_put_uint24_be( p, cert_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010286
10287 if( session->peer_cert != NULL )
10288 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010289 mbedtls_platform_memcpy( p, session->peer_cert->raw.p, cert_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010290 p += cert_len;
10291 }
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010292 }
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010293
Hanno Becker5882dd02019-06-06 16:25:57 +010010294#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010295 /* Digest of peer certificate */
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010296 if( session->peer_cert_digest != NULL )
10297 {
10298 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
10299 if( used <= buf_len )
10300 {
10301 *p++ = (unsigned char) session->peer_cert_digest_type;
10302 *p++ = (unsigned char) session->peer_cert_digest_len;
Teppo Järvelin91d79382019-10-02 09:09:31 +030010303 mbedtls_platform_memcpy( p, session->peer_cert_digest,
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010304 session->peer_cert_digest_len );
10305 p += session->peer_cert_digest_len;
10306 }
10307 }
10308 else
10309 {
10310 used += 2;
10311 if( used <= buf_len )
10312 {
10313 *p++ = (unsigned char) MBEDTLS_MD_NONE;
10314 *p++ = 0;
10315 }
10316 }
Hanno Becker5882dd02019-06-06 16:25:57 +010010317#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010318#endif /* MBEDTLS_X509_CRT_PARSE_C */
10319
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010320 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010321 * Session ticket if any, plus associated data
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010322 */
10323#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010324 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010325
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010326 if( used <= buf_len )
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010327 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010328 p = mbedtls_platform_put_uint24_be( p, session->ticket_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010329
10330 if( session->ticket != NULL )
10331 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030010332 mbedtls_platform_memcpy( p, session->ticket, session->ticket_len );
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010333 p += session->ticket_len;
10334 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010335
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010336 p = mbedtls_platform_put_uint32_be( p, session->ticket_lifetime );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010337 }
10338#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
10339
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010340 /*
10341 * Misc extension-related info
10342 */
10343#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
10344 used += 1;
10345
10346 if( used <= buf_len )
10347 *p++ = session->mfl_code;
10348#endif
10349
10350#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
10351 used += 1;
10352
10353 if( used <= buf_len )
10354 *p++ = (unsigned char)( ( session->trunc_hmac ) & 0xFF );
10355#endif
10356
10357#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
10358 used += 1;
10359
10360 if( used <= buf_len )
10361 *p++ = (unsigned char)( ( session->encrypt_then_mac ) & 0xFF );
10362#endif
10363
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010364 /* Done */
Manuel Pégourié-Gonnard32ce5962019-05-21 11:01:32 +020010365 *olen = used;
10366
10367 if( used > buf_len )
10368 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010369
10370 return( 0 );
10371}
10372
10373/*
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010374 * Public wrapper for ssl_session_save()
10375 */
10376int mbedtls_ssl_session_save( const mbedtls_ssl_session *session,
10377 unsigned char *buf,
10378 size_t buf_len,
10379 size_t *olen )
10380{
10381 return( ssl_session_save( session, 0, buf, buf_len, olen ) );
10382}
10383
10384/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020010385 * Deserialize session, see mbedtls_ssl_session_save() for format.
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010386 *
10387 * This internal version is wrapped by a public function that cleans up in
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010388 * case of error, and has an extra option omit_header.
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010389 */
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010390static int ssl_session_load( mbedtls_ssl_session *session,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010391 unsigned char omit_header,
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010392 const unsigned char *buf,
10393 size_t len )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010394{
10395 const unsigned char *p = buf;
10396 const unsigned char * const end = buf + len;
Hanno Beckere02758c2019-06-26 15:31:31 +010010397 int ciphersuite;
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010398#if defined(MBEDTLS_HAVE_TIME)
10399 uint64_t start;
10400#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010401#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010402#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010403 size_t cert_len;
Hanno Becker2e6d3472019-02-06 15:40:27 +000010404#endif
10405#endif
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010406
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010407 if( !omit_header )
Hanno Beckerb5352f02019-05-16 12:39:07 +010010408 {
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010409 /*
10410 * Check version identifier
10411 */
10412
10413 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) )
10414 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10415
Teppo Järvelin0efac532019-10-04 13:21:08 +030010416 // use regular memcmp as session header is public data
Teppo Järvelin650343c2019-10-03 15:36:59 +030010417 if( memcmp( p, ssl_serialized_session_header,
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010418 sizeof( ssl_serialized_session_header ) ) != 0 )
10419 {
10420 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
10421 }
10422 p += sizeof( ssl_serialized_session_header );
Hanno Beckerb5352f02019-05-16 12:39:07 +010010423 }
Hanno Beckerb5352f02019-05-16 12:39:07 +010010424
10425 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010426 * Time
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010427 */
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010428#if defined(MBEDTLS_HAVE_TIME)
10429 if( 8 > (size_t)( end - p ) )
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010430 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10431
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010432 start = ( (uint64_t) p[0] << 56 ) |
10433 ( (uint64_t) p[1] << 48 ) |
10434 ( (uint64_t) p[2] << 40 ) |
10435 ( (uint64_t) p[3] << 32 ) |
10436 ( (uint64_t) p[4] << 24 ) |
10437 ( (uint64_t) p[5] << 16 ) |
10438 ( (uint64_t) p[6] << 8 ) |
10439 ( (uint64_t) p[7] );
10440 p += 8;
10441
10442 session->start = (time_t) start;
10443#endif /* MBEDTLS_HAVE_TIME */
10444
10445 /*
10446 * Basic mandatory fields
10447 */
Hanno Becker88440552019-07-03 14:16:13 +010010448 {
10449 size_t const ciphersuite_len = 2;
10450#if defined(MBEDTLS_ZLIB_SUPPORT)
10451 size_t const compression_len = 1;
10452#else
10453 size_t const compression_len = 0;
10454#endif
10455 size_t const id_len_len = 1;
10456 size_t const id_len = 32;
10457 size_t const master_len = 48;
10458 size_t const verif_result_len = 4;
Hanno Beckere02758c2019-06-26 15:31:31 +010010459
Hanno Becker88440552019-07-03 14:16:13 +010010460 size_t const basic_len =
10461 ciphersuite_len +
10462 compression_len +
10463 id_len_len +
10464 id_len +
10465 master_len +
10466 verif_result_len;
10467
10468 if( basic_len > (size_t)( end - p ) )
10469 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10470 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010471
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010472 ciphersuite = (int)mbedtls_platform_get_uint16_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010473 p += 2;
10474
Hanno Becker73f4cb12019-06-27 13:51:07 +010010475#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Beckere02758c2019-06-26 15:31:31 +010010476 session->ciphersuite = ciphersuite;
10477#else
10478 if( ciphersuite !=
Hanno Becker73f4cb12019-06-27 13:51:07 +010010479 MBEDTLS_SSL_SUITE_ID( MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE ) )
Hanno Beckere02758c2019-06-26 15:31:31 +010010480 {
10481 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
10482 }
10483#endif
10484
Hanno Becker88440552019-07-03 14:16:13 +010010485#if defined(MBEDTLS_ZLIB_SUPPORT)
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010486 session->compression = *p++;
Hanno Becker88440552019-07-03 14:16:13 +010010487#endif
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010488
10489 session->id_len = *p++;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030010490 /* Not using more secure mbedtls_platform_memcpy as session id is public */
10491 memcpy( session->id, p, 32 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010492 p += 32;
10493
Teppo Järvelin91d79382019-10-02 09:09:31 +030010494 mbedtls_platform_memcpy( session->master, p, 48 );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010495 p += 48;
10496
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010497 session->verify_result = (uint32_t)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010498 p += 4;
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010499
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010500 /* Immediately clear invalid pointer values that have been read, in case
10501 * we exit early before we replaced them with valid ones. */
10502#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010503#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010504 session->peer_cert = NULL;
Hanno Becker5882dd02019-06-06 16:25:57 +010010505#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010506 session->peer_cert_digest = NULL;
Hanno Becker5882dd02019-06-06 16:25:57 +010010507#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010508#endif
10509#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
10510 session->ticket = NULL;
10511#endif
10512
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010513 /*
10514 * Peer certificate
10515 */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010516#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker2e6d3472019-02-06 15:40:27 +000010517#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010518 if( 3 > (size_t)( end - p ) )
10519 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10520
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010521 cert_len = mbedtls_platform_get_uint24_be( &p[0] );
10522
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010523 p += 3;
10524
10525 if( cert_len == 0 )
10526 {
10527 session->peer_cert = NULL;
10528 }
10529 else
10530 {
10531 int ret;
10532
10533 if( cert_len > (size_t)( end - p ) )
10534 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10535
10536 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
10537
10538 if( session->peer_cert == NULL )
10539 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
10540
10541 mbedtls_x509_crt_init( session->peer_cert );
10542
10543 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert,
10544 p, cert_len ) ) != 0 )
10545 {
10546 mbedtls_x509_crt_free( session->peer_cert );
10547 mbedtls_free( session->peer_cert );
10548 session->peer_cert = NULL;
10549 return( ret );
10550 }
10551
10552 p += cert_len;
10553 }
Hanno Becker5882dd02019-06-06 16:25:57 +010010554#elif defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010555 /* Deserialize CRT digest from the end of the ticket. */
10556 if( 2 > (size_t)( end - p ) )
10557 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10558
10559 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
10560 session->peer_cert_digest_len = (size_t) *p++;
10561
10562 if( session->peer_cert_digest_len != 0 )
10563 {
Hanno Beckera5cedbc2019-07-17 11:21:02 +010010564 mbedtls_md_handle_t md_info =
Hanno Becker2326d202019-06-06 14:54:55 +010010565 mbedtls_md_info_from_type( session->peer_cert_digest_type );
Hanno Beckera5cedbc2019-07-17 11:21:02 +010010566 if( md_info == MBEDTLS_MD_INVALID_HANDLE )
Hanno Becker2326d202019-06-06 14:54:55 +010010567 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10568 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) )
10569 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10570
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010571 if( session->peer_cert_digest_len > (size_t)( end - p ) )
10572 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10573
10574 session->peer_cert_digest =
10575 mbedtls_calloc( 1, session->peer_cert_digest_len );
10576 if( session->peer_cert_digest == NULL )
10577 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
10578
Teppo Järvelin91d79382019-10-02 09:09:31 +030010579 mbedtls_platform_memcpy( session->peer_cert_digest, p,
Hanno Becker4a2f8e52019-02-06 15:23:38 +000010580 session->peer_cert_digest_len );
10581 p += session->peer_cert_digest_len;
10582 }
Hanno Becker5882dd02019-06-06 16:25:57 +010010583#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010584#endif /* MBEDTLS_X509_CRT_PARSE_C */
10585
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010586 /*
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010587 * Session ticket and associated data
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010588 */
10589#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
10590 if( 3 > (size_t)( end - p ) )
10591 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10592
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030010593 session->ticket_len = mbedtls_platform_get_uint24_be( &p[0] );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010594 p += 3;
10595
10596 if( session->ticket_len != 0 )
10597 {
10598 if( session->ticket_len > (size_t)( end - p ) )
10599 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10600
10601 session->ticket = mbedtls_calloc( 1, session->ticket_len );
10602 if( session->ticket == NULL )
10603 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
10604
Teppo Järvelin91d79382019-10-02 09:09:31 +030010605 mbedtls_platform_memcpy( session->ticket, p, session->ticket_len );
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010606 p += session->ticket_len;
10607 }
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010608
10609 if( 4 > (size_t)( end - p ) )
10610 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10611
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030010612 session->ticket_lifetime = (uint32_t)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010613 p += 4;
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010614#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
10615
Manuel Pégourié-Gonnard60a42992019-05-24 12:06:29 +020010616 /*
10617 * Misc extension-related info
10618 */
10619#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
10620 if( 1 > (size_t)( end - p ) )
10621 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10622
10623 session->mfl_code = *p++;
10624#endif
10625
10626#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
10627 if( 1 > (size_t)( end - p ) )
10628 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10629
10630 session->trunc_hmac = *p++;
10631#endif
10632
10633#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
10634 if( 1 > (size_t)( end - p ) )
10635 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10636
10637 session->encrypt_then_mac = *p++;
10638#endif
10639
Manuel Pégourié-Gonnardef4ae612019-05-16 11:11:08 +020010640 /* Done, should have consumed entire buffer */
Manuel Pégourié-Gonnard91f4ca22019-05-16 10:08:35 +020010641 if( p != end )
10642 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10643
10644 return( 0 );
10645}
10646
10647/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020010648 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010649 */
10650int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
10651 const unsigned char *buf,
10652 size_t len )
10653{
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020010654 int ret = ssl_session_load( session, 0, buf, len );
Manuel Pégourié-Gonnard57098112019-05-23 12:28:45 +020010655
10656 if( ret != 0 )
10657 mbedtls_ssl_session_free( session );
10658
10659 return( ret );
10660}
10661
10662/*
Paul Bakker1961b702013-01-25 14:49:24 +010010663 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +000010664 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010665int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000010666{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010667 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker5121ce52009-01-03 21:22:43 +000010668
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020010669 if( ssl == NULL || ssl->conf == NULL )
10670 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10671
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010672#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010010673 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010674 ret = mbedtls_ssl_handshake_client_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +000010675#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010676#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010010677 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010678 ret = mbedtls_ssl_handshake_server_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +000010679#endif
10680
Hanno Beckerb82350b2019-07-26 07:24:05 +010010681 ssl_send_pending_fatal_alert( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +010010682 return( ret );
10683}
10684
10685/*
10686 * Perform the SSL handshake
10687 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010688int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +010010689{
10690 int ret = 0;
10691
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020010692 if( ssl == NULL || ssl->conf == NULL )
10693 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10694
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010695 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +010010696
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010697 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker1961b702013-01-25 14:49:24 +010010698 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010699 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +010010700
10701 if( ret != 0 )
10702 break;
10703 }
10704
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010705 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000010706
10707 return( ret );
10708}
10709
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010710#if defined(MBEDTLS_SSL_RENEGOTIATION)
10711#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000010712/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010713 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +000010714 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010715static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010716{
10717 int ret;
10718
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010719 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010720
10721 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010722 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
10723 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010724
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +020010725 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010726 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +020010727 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010728 return( ret );
10729 }
10730
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010731 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010732
10733 return( 0 );
10734}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010735#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010736
10737/*
10738 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010739 * - any side: calling mbedtls_ssl_renegotiate(),
10740 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
10741 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +020010742 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010743 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010744 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010745 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010746static int ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +000010747{
10748 int ret;
10749
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010750 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000010751
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010752 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
10753 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +000010754
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020010755 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
10756 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010757#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020010758 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010759 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020010760 {
Hanno Becker2d9623f2019-06-13 12:07:05 +010010761 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
10762 MBEDTLS_SSL_IS_SERVER )
10763 {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020010764 ssl->handshake->out_msg_seq = 1;
Hanno Becker2d9623f2019-06-13 12:07:05 +010010765 }
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020010766 else
Hanno Becker2d9623f2019-06-13 12:07:05 +010010767 {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +020010768 ssl->handshake->in_msg_seq = 1;
Hanno Becker2d9623f2019-06-13 12:07:05 +010010769 }
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +020010770 }
10771#endif
10772
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010773 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
10774 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +000010775
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010776 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +000010777 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010778 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +000010779 return( ret );
10780 }
10781
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010782 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000010783
10784 return( 0 );
10785}
10786
10787/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010788 * Renegotiate current connection on client,
10789 * or request renegotiation on server
10790 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010791int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010792{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010793 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010794
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020010795 if( ssl == NULL || ssl->conf == NULL )
10796 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10797
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010798#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010799 /* On server, just send the request */
Hanno Becker2d9623f2019-06-13 12:07:05 +010010800 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010801 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010802 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
10803 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010804
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010805 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +020010806
10807 /* Did we already try/start sending HelloRequest? */
10808 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010809 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +020010810
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010811 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010812 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010813#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010814
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010815#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010816 /*
10817 * On client, either start the renegotiation process or,
10818 * if already in progress, continue the handshake
10819 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010820 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010821 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010822 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
10823 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010824
10825 if( ( ret = ssl_start_renegotiation( ssl ) ) != 0 )
10826 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010827 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010828 return( ret );
10829 }
10830 }
10831 else
10832 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010833 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010834 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010835 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010836 return( ret );
10837 }
10838 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010839#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +010010840
Paul Bakker37ce0ff2013-10-31 14:32:04 +010010841 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +010010842}
10843
10844/*
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010010845 * Check record counters and renegotiate if they're above the limit.
10846 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010847static int ssl_check_ctr_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010010848{
Andres AG2196c7f2016-12-15 17:01:16 +000010849 size_t ep_len = ssl_ep_len( ssl );
10850 int in_ctr_cmp;
10851 int out_ctr_cmp;
10852
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010853 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ||
10854 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ||
Manuel Pégourié-Gonnard18332c52019-07-29 12:17:52 +020010855 ! mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010010856 {
10857 return( 0 );
10858 }
10859
Teppo Järvelin0efac532019-10-04 13:21:08 +030010860 // use regular memcmp as counters are public data
Teppo Järvelin650343c2019-10-03 15:36:59 +030010861 in_ctr_cmp = memcmp( ssl->in_ctr + ep_len,
Andres AG2196c7f2016-12-15 17:01:16 +000010862 ssl->conf->renego_period + ep_len, 8 - ep_len );
Teppo Järvelin650343c2019-10-03 15:36:59 +030010863 out_ctr_cmp = memcmp( ssl->cur_out_ctr + ep_len,
Andres AG2196c7f2016-12-15 17:01:16 +000010864 ssl->conf->renego_period + ep_len, 8 - ep_len );
10865
10866 if( in_ctr_cmp <= 0 && out_ctr_cmp <= 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010010867 {
10868 return( 0 );
10869 }
10870
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +020010871 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010872 return( mbedtls_ssl_renegotiate( ssl ) );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010010873}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010874#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +000010875
10876/*
10877 * Receive application data decrypted from the SSL layer
10878 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010879int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +000010880{
Hanno Becker4a810fb2017-05-24 16:27:30 +010010881 int ret;
Paul Bakker23986e52011-04-24 08:57:21 +000010882 size_t n;
Andrzej Kurek84bde412020-07-06 15:27:34 -040010883 volatile unsigned char *buf_dup = buf;
10884 volatile size_t len_dup = len;
Paul Bakker5121ce52009-01-03 21:22:43 +000010885
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020010886 if( ssl == NULL || ssl->conf == NULL )
10887 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
10888
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010889 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000010890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010891#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020010892 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020010893 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010894 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020010895 return( ret );
10896
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020010897 if( ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010898 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020010899 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +020010900 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020010901 return( ret );
10902 }
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +020010903 }
10904#endif
10905
Hanno Becker4a810fb2017-05-24 16:27:30 +010010906 /*
10907 * Check if renegotiation is necessary and/or handshake is
10908 * in process. If yes, perform/continue, and fall through
10909 * if an unexpected packet is received while the client
10910 * is waiting for the ServerHello.
10911 *
10912 * (There is no equivalent to the last condition on
10913 * the server-side as it is not treated as within
10914 * a handshake while waiting for the ClientHello
10915 * after a renegotiation request.)
10916 */
10917
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010918#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +010010919 ret = ssl_check_ctr_renegotiate( ssl );
10920 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
10921 ret != 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010010922 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010923 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +010010924 return( ret );
10925 }
10926#endif
10927
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010928 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +000010929 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010930 ret = mbedtls_ssl_handshake( ssl );
Hanno Becker4a810fb2017-05-24 16:27:30 +010010931 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
10932 ret != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000010933 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010934 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000010935 return( ret );
10936 }
10937 }
10938
Hanno Beckere41158b2017-10-23 13:30:32 +010010939 /* Loop as long as no application data record is available */
Hanno Becker90333da2017-10-10 11:27:13 +010010940 while( ssl->in_offt == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000010941 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020010942 /* Start timer if not already running */
Hanno Becker0ae6b242019-06-13 16:45:36 +010010943 if( mbedtls_ssl_get_get_timer( ssl ) != NULL &&
10944 mbedtls_ssl_get_get_timer( ssl )( ssl->p_timer ) == -1 )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +020010945 {
Hanno Becker1f835fa2019-06-13 10:14:59 +010010946 ssl_set_timer( ssl,
10947 mbedtls_ssl_conf_get_read_timeout( ssl->conf ) );
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +020010948 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020010949
Hanno Becker327c93b2018-08-15 13:56:18 +010010950 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000010951 {
Hanno Becker4a810fb2017-05-24 16:27:30 +010010952 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
10953 return( 0 );
Paul Bakker831a7552011-05-18 13:32:51 +000010954
Hanno Becker4a810fb2017-05-24 16:27:30 +010010955 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
10956 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000010957 }
10958
10959 if( ssl->in_msglen == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010960 ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +000010961 {
10962 /*
10963 * OpenSSL sends empty messages to randomize the IV
10964 */
Hanno Becker327c93b2018-08-15 13:56:18 +010010965 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000010966 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010967 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
Paul Bakker831a7552011-05-18 13:32:51 +000010968 return( 0 );
10969
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010970 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000010971 return( ret );
10972 }
10973 }
10974
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010975 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker48916f92012-09-16 19:57:18 +000010976 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010977 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received handshake message" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000010978
Hanno Becker4a810fb2017-05-24 16:27:30 +010010979 /*
10980 * - For client-side, expect SERVER_HELLO_REQUEST.
10981 * - For server-side, expect CLIENT_HELLO.
10982 * - Fail (TLS) or silently drop record (DTLS) in other cases.
10983 */
10984
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010985#if defined(MBEDTLS_SSL_CLI_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010010986 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
10987 MBEDTLS_SSL_IS_CLIENT &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010988 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST ||
Hanno Becker4a810fb2017-05-24 16:27:30 +010010989 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ) )
Paul Bakker48916f92012-09-16 19:57:18 +000010990 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010991 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020010992
10993 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010994#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020010995 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker90333da2017-10-10 11:27:13 +010010996 {
10997 continue;
10998 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020010999 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011000#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011001#if defined(MBEDTLS_SSL_PROTO_TLS)
11002 {
11003 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
11004 }
11005#endif
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011006 }
Hanno Becker4a810fb2017-05-24 16:27:30 +010011007#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011008
Hanno Becker4a810fb2017-05-24 16:27:30 +010011009#if defined(MBEDTLS_SSL_SRV_C)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011010 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11011 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011012 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011013 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011014 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011015
11016 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011017#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011018 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Hanno Becker90333da2017-10-10 11:27:13 +010011019 {
11020 continue;
11021 }
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011022 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +020011023#endif
Manuel Pégourié-Gonnard889bbc72019-06-18 10:56:09 +020011024#if defined(MBEDTLS_SSL_PROTO_TLS)
11025 {
11026 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
11027 }
11028#endif
Paul Bakker48916f92012-09-16 19:57:18 +000011029 }
Hanno Becker4a810fb2017-05-24 16:27:30 +010011030#endif /* MBEDTLS_SSL_SRV_C */
11031
Hanno Becker21df7f92017-10-17 11:03:26 +010011032#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +010011033 /* Determine whether renegotiation attempt should be accepted */
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011034 if( ! ( ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
11035 ( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +010011036 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf ) ==
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011037 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) ) )
11038 {
11039 /*
11040 * Accept renegotiation request
11041 */
Paul Bakker48916f92012-09-16 19:57:18 +000011042
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011043 /* DTLS clients need to know renego is server-initiated */
11044#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020011045 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker2d9623f2019-06-13 12:07:05 +010011046 mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11047 MBEDTLS_SSL_IS_CLIENT )
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +010011048 {
11049 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
11050 }
11051#endif
11052 ret = ssl_start_renegotiation( ssl );
11053 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
11054 ret != 0 )
11055 {
11056 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
11057 return( ret );
11058 }
11059 }
11060 else
Hanno Becker21df7f92017-10-17 11:03:26 +010011061#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +000011062 {
Hanno Becker4a810fb2017-05-24 16:27:30 +010011063 /*
11064 * Refuse renegotiation
11065 */
11066
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011067 MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011068
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011069#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker2881d802019-05-22 14:44:53 +010011070 if( mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker48916f92012-09-16 19:57:18 +000011071 {
Gilles Peskine92e44262017-05-10 17:27:49 +020011072 /* SSLv3 does not have a "no_renegotiation" warning, so
11073 we send a fatal alert and abort the connection. */
11074 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
11075 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
11076 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +000011077 }
11078 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011079#endif /* MBEDTLS_SSL_PROTO_SSL3 */
11080#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
11081 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010011082 if( mbedtls_ssl_ver_geq(
11083 mbedtls_ssl_get_minor_ver( ssl ),
11084 MBEDTLS_SSL_MINOR_VERSION_1 ) )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +000011085 {
Hanno Becker2e8d1332019-07-25 10:27:36 +010011086 ret = mbedtls_ssl_send_alert_message( ssl,
11087 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
11088 MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION );
11089 if( ret != 0 )
11090 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +000011091 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +020011092 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011093#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 ||
11094 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +020011095 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011096 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
11097 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +020011098 }
Paul Bakker48916f92012-09-16 19:57:18 +000011099 }
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011100
Hanno Becker90333da2017-10-10 11:27:13 +010011101 /* At this point, we don't know whether the renegotiation has been
11102 * completed or not. The cases to consider are the following:
11103 * 1) The renegotiation is complete. In this case, no new record
11104 * has been read yet.
11105 * 2) The renegotiation is incomplete because the client received
11106 * an application data record while awaiting the ServerHello.
11107 * 3) The renegotiation is incomplete because the client received
11108 * a non-handshake, non-application data message while awaiting
11109 * the ServerHello.
11110 * In each of these case, looping will be the proper action:
11111 * - For 1), the next iteration will read a new record and check
11112 * if it's application data.
11113 * - For 2), the loop condition isn't satisfied as application data
11114 * is present, hence continue is the same as break
11115 * - For 3), the loop condition is satisfied and read_record
11116 * will re-deliver the message that was held back by the client
11117 * when expecting the ServerHello.
11118 */
11119 continue;
Paul Bakker48916f92012-09-16 19:57:18 +000011120 }
Hanno Becker21df7f92017-10-17 11:03:26 +010011121#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011122 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +010011123 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020011124 if( ssl->conf->renego_max_records >= 0 )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020011125 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020011126 if( ++ssl->renego_records_seen > ssl->conf->renego_max_records )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011127 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011128 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011129 "but not honored by client" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011130 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011131 }
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +020011132 }
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +010011133 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011134#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011135
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011136 /* Fatal and closure alerts handled by mbedtls_ssl_read_record() */
11137 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011138 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011139 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +010011140 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +020011141 }
11142
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011143 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +000011144 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011145 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
11146 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +000011147 }
11148
11149 ssl->in_offt = ssl->in_msg;
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020011150
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +020011151 /* We're going to return something now, cancel timer,
11152 * except if handshake (renegotiation) is in progress */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011153 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +020011154 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011155
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020011156#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011157 /* If we requested renego but received AppData, resend HelloRequest.
11158 * Do it now, after setting in_offt, to avoid taking this branch
11159 * again if ssl_write_hello_request() returns WANT_WRITE */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011160#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker2d9623f2019-06-13 12:07:05 +010011161 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) ==
11162 MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011163 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011164 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +020011165 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011166 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011167 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +020011168 return( ret );
11169 }
11170 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011171#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker4a810fb2017-05-24 16:27:30 +010011172#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker5121ce52009-01-03 21:22:43 +000011173 }
11174
11175 n = ( len < ssl->in_msglen )
11176 ? len : ssl->in_msglen;
11177
Teppo Järvelin91d79382019-10-02 09:09:31 +030011178 mbedtls_platform_memcpy( buf, ssl->in_offt, n );
Paul Bakker5121ce52009-01-03 21:22:43 +000011179 ssl->in_msglen -= n;
11180
Teppo Järvelincafb6c92020-01-08 09:19:07 +020011181 // clear incoming data after it's copied to buffer
11182 mbedtls_platform_memset(ssl->in_offt, 0, n);
11183
Paul Bakker5121ce52009-01-03 21:22:43 +000011184 if( ssl->in_msglen == 0 )
Hanno Becker4a810fb2017-05-24 16:27:30 +010011185 {
11186 /* all bytes consumed */
Paul Bakker5121ce52009-01-03 21:22:43 +000011187 ssl->in_offt = NULL;
Hanno Beckerbdf39052017-06-09 10:42:03 +010011188 ssl->keep_current_message = 0;
Hanno Becker4a810fb2017-05-24 16:27:30 +010011189 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011190 else
Hanno Becker4a810fb2017-05-24 16:27:30 +010011191 {
Paul Bakker5121ce52009-01-03 21:22:43 +000011192 /* more data available */
11193 ssl->in_offt += n;
Hanno Becker4a810fb2017-05-24 16:27:30 +010011194 }
Paul Bakker5121ce52009-01-03 21:22:43 +000011195
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011196 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011197
Andrzej Kurek84bde412020-07-06 15:27:34 -040011198 /* Secure against buffer substitution */
11199 if( buf_dup == buf && len_dup == len )
11200 {
11201 return( (int) n );
11202 }
11203 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
Paul Bakker5121ce52009-01-03 21:22:43 +000011204}
11205
11206/*
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011207 * Send application data to be encrypted by the SSL layer, taking care of max
11208 * fragment length and buffer size.
11209 *
11210 * According to RFC 5246 Section 6.2.1:
11211 *
11212 * Zero-length fragments of Application data MAY be sent as they are
11213 * potentially useful as a traffic analysis countermeasure.
11214 *
11215 * Therefore, it is possible that the input message length is 0 and the
11216 * corresponding return code is 0 on success.
Paul Bakker5121ce52009-01-03 21:22:43 +000011217 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011218static int ssl_write_real( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011219 const unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +000011220{
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +020011221 int ret = mbedtls_ssl_get_max_out_record_payload( ssl );
11222 const size_t max_len = (size_t) ret;
11223
11224 if( ret < 0 )
11225 {
11226 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_max_out_record_payload", ret );
11227 return( ret );
11228 }
11229
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011230 if( len > max_len )
11231 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011232#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011233 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011234 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011235 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011236 "maximum fragment length: %d > %d",
11237 len, max_len ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011238 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011239 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011240 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011241#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011242#if defined(MBEDTLS_SSL_PROTO_TLS)
11243 {
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011244 len = max_len;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +020011245 }
11246#endif
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +020011247 }
Paul Bakker887bd502011-06-08 13:10:54 +000011248
Paul Bakker5121ce52009-01-03 21:22:43 +000011249 if( ssl->out_left != 0 )
11250 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011251 /*
11252 * The user has previously tried to send the data and
11253 * MBEDTLS_ERR_SSL_WANT_WRITE or the message was only partially
11254 * written. In this case, we expect the high-level write function
11255 * (e.g. mbedtls_ssl_write()) to be called with the same parameters
11256 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011257 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011258 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011259 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011260 return( ret );
11261 }
11262 }
Paul Bakker887bd502011-06-08 13:10:54 +000011263 else
Paul Bakker1fd00bf2011-03-14 20:50:15 +000011264 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +010011265 /*
11266 * The user is trying to send a message the first time, so we need to
11267 * copy the data into the internal buffers and setup the data structure
11268 * to keep track of partial writes
11269 */
shelib014062d6c2020-07-21 11:54:52 +030011270 ssl->out_msglen = len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011271 ssl->out_msgtype = MBEDTLS_SSL_MSG_APPLICATION_DATA;
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011272 mbedtls_platform_memcpy( ssl->out_msg, buf, len );
Paul Bakker887bd502011-06-08 13:10:54 +000011273
shelib014062d6c2020-07-21 11:54:52 +030011274#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011275 /*
11276 * Buffer pointer and size duplication cannot be supported with MBEDTLS_SSL_CBC_RECORD_SPLITTING.
11277 * After splitting pointers and data size will not be the same as initaly provides by user.
11278 */
shelib014062d6c2020-07-21 11:54:52 +030011279 /* Secure against buffer substitution */
Shelly Liberman3799fc12020-08-05 15:52:58 +030011280 if( buf == ssl->out_msg_dup &&
shelib014062d6c2020-07-21 11:54:52 +030011281 ssl->out_msglen == ssl->out_msglen_dup &&
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011282 ssl->out_msg_dup[0] == ssl->out_msg[0] )
shelib014062d6c2020-07-21 11:54:52 +030011283 {/*write record only if data was copied from correct user pointer */
11284#endif
Shelly Liberman3799fc12020-08-05 15:52:58 +030011285 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
shelib014062d6c2020-07-21 11:54:52 +030011286 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011287 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
11288 return( ret );
shelib014062d6c2020-07-21 11:54:52 +030011289 }
11290
11291#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Paul Bakker887bd502011-06-08 13:10:54 +000011292 }
shelib014062d6c2020-07-21 11:54:52 +030011293 else
11294 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011295 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
shelib014062d6c2020-07-21 11:54:52 +030011296 }
11297#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000011298 }
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011299 if ( ret == 0 )
Andrzej Kurek84bde412020-07-06 15:27:34 -040011300 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011301 return( (int) len );
Andrzej Kurek84bde412020-07-06 15:27:34 -040011302 }
shelib014062d6c2020-07-21 11:54:52 +030011303 else
11304 {
Shelly Libermanc6a7e6b2020-08-05 15:26:10 +030011305 return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
shelib014062d6c2020-07-21 11:54:52 +030011306 }
11307
Paul Bakker5121ce52009-01-03 21:22:43 +000011308}
11309
11310/*
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011311 * Write application data, doing 1/n-1 splitting if necessary.
11312 *
11313 * With non-blocking I/O, ssl_write_real() may return WANT_WRITE,
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +010011314 * then the caller will call us again with the same arguments, so
Hanno Becker2b187c42017-09-18 14:58:11 +010011315 * remember whether we already did the split or not.
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011316 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011317#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011318static int ssl_write_split( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011319 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011320{
11321 int ret;
11322
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +010011323 if( ssl->conf->cbc_record_splitting ==
11324 MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED ||
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +010011325 len <= 1 ||
Hanno Becker7bcf2b52019-07-26 09:02:40 +010011326 mbedtls_ssl_ver_gt(
11327 mbedtls_ssl_get_minor_ver( ssl ),
11328 MBEDTLS_SSL_MINOR_VERSION_1 ) ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011329 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc )
11330 != MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011331 {
11332 return( ssl_write_real( ssl, buf, len ) );
11333 }
11334
11335 if( ssl->split_done == 0 )
11336 {
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011337 if( ( ret = ssl_write_real( ssl, buf, 1 ) ) <= 0 )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011338 return( ret );
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011339 ssl->split_done = 1;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011340 }
11341
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +010011342 if( ( ret = ssl_write_real( ssl, buf + 1, len - 1 ) ) <= 0 )
11343 return( ret );
11344 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011345
11346 return( ret + 1 );
11347}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011348#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +010011349
11350/*
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011351 * Write application data (public-facing wrapper)
11352 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011353int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011354{
shelib014062d6c2020-07-21 11:54:52 +030011355 int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
11356#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011357 /*
11358 * Buffer pointer and size duplication cannot be supported with MBEDTLS_SSL_CBC_RECORD_SPLITTING.
11359 * After splitting pointers and data size will not be the same as initaly provides by user.
11360 */
Andrzej Kurek84bde412020-07-06 15:27:34 -040011361 volatile const unsigned char *buf_dup = buf;
11362 volatile size_t len_dup = len;
shelib014062d6c2020-07-21 11:54:52 +030011363#endif
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011364 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011365
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011366 if( ssl == NULL || ssl->conf == NULL )
11367 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11368
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011369#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011370 if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
11371 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011372 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011373 return( ret );
11374 }
11375#endif
11376
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011377 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011378 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011379 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011380 {
Manuel Pégourié-Gonnard151dc772015-05-14 13:55:51 +020011381 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011382 return( ret );
11383 }
11384 }
11385
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011386#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011387 ret = ssl_write_split( ssl, buf, len );
11388#else
shelib014062d6c2020-07-21 11:54:52 +030011389#if defined(MBEDTLS_FI_COUNTERMEASURES)
Shelly Liberman3799fc12020-08-05 15:52:58 +030011390 /* Add const user pointers to context. We will be able to check its validity before copy to context */
shelib014062d6c2020-07-21 11:54:52 +030011391 ssl->out_msg_dup = (unsigned char*)buf_dup;
11392 ssl->out_msglen_dup = len_dup;
11393#endif //MBEDTLS_FI_COUNTERMEASURES
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011394 ret = ssl_write_real( ssl, buf, len );
11395#endif
11396
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +020011397 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011398
shelib014062d6c2020-07-21 11:54:52 +030011399
11400 return( ret );
11401
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +020011402}
11403
11404/*
Paul Bakker5121ce52009-01-03 21:22:43 +000011405 * Notify the peer that the connection is being closed
11406 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011407int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000011408{
11409 int ret;
11410
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +020011411 if( ssl == NULL || ssl->conf == NULL )
11412 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11413
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011414 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011415
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +020011416 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011417 return( mbedtls_ssl_flush_output( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011418
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011419 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +000011420 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011421 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
11422 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
11423 MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +000011424 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011425 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +000011426 return( ret );
11427 }
11428 }
11429
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011430 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000011431
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +020011432 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +000011433}
11434
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011435void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform )
Paul Bakker48916f92012-09-16 19:57:18 +000011436{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020011437 if( transform == NULL )
11438 return;
11439
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011440#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +000011441 deflateEnd( &transform->ctx_deflate );
11442 inflateEnd( &transform->ctx_inflate );
11443#endif
11444
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011445 mbedtls_cipher_free( &transform->cipher_ctx_enc );
11446 mbedtls_cipher_free( &transform->cipher_ctx_dec );
Manuel Pégourié-Gonnardf71e5872013-09-23 17:12:43 +020011447
Hanno Becker92231322018-01-03 15:32:51 +000011448#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011449 mbedtls_md_free( &transform->md_ctx_enc );
11450 mbedtls_md_free( &transform->md_ctx_dec );
Hanno Becker92231322018-01-03 15:32:51 +000011451#endif
Paul Bakker61d113b2013-07-04 11:51:43 +020011452
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050011453 mbedtls_platform_zeroize( transform, sizeof( mbedtls_ssl_transform ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011454}
11455
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011456#if defined(MBEDTLS_X509_CRT_PARSE_C)
11457static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011458{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011459 mbedtls_ssl_key_cert *cur = key_cert, *next;
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011460
11461 while( cur != NULL )
11462 {
11463 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011464 mbedtls_free( cur );
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011465 cur = next;
11466 }
11467}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011468#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011469
Hanno Becker0271f962018-08-16 13:23:47 +010011470#if defined(MBEDTLS_SSL_PROTO_DTLS)
11471
11472static void ssl_buffering_free( mbedtls_ssl_context *ssl )
11473{
11474 unsigned offset;
11475 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
11476
11477 if( hs == NULL )
11478 return;
11479
Hanno Becker283f5ef2018-08-24 09:34:47 +010011480 ssl_free_buffered_record( ssl );
11481
Hanno Becker0271f962018-08-16 13:23:47 +010011482 for( offset = 0; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
Hanno Beckere605b192018-08-21 15:59:07 +010011483 ssl_buffering_free_slot( ssl, offset );
11484}
11485
11486static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
11487 uint8_t slot )
11488{
11489 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
11490 mbedtls_ssl_hs_buffer * const hs_buf = &hs->buffering.hs[slot];
Hanno Beckerb309b922018-08-23 13:18:05 +010011491
11492 if( slot >= MBEDTLS_SSL_MAX_BUFFERED_HS )
11493 return;
11494
Hanno Beckere605b192018-08-21 15:59:07 +010011495 if( hs_buf->is_valid == 1 )
Hanno Becker0271f962018-08-16 13:23:47 +010011496 {
Hanno Beckere605b192018-08-21 15:59:07 +010011497 hs->buffering.total_bytes_buffered -= hs_buf->data_len;
Hanno Becker805f2e12018-10-12 16:31:41 +010011498 mbedtls_platform_zeroize( hs_buf->data, hs_buf->data_len );
Hanno Beckere605b192018-08-21 15:59:07 +010011499 mbedtls_free( hs_buf->data );
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +020011500 mbedtls_platform_memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Hanno Becker0271f962018-08-16 13:23:47 +010011501 }
11502}
11503
11504#endif /* MBEDTLS_SSL_PROTO_DTLS */
11505
Gilles Peskine9b562d52018-04-25 20:32:43 +020011506void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +000011507{
Gilles Peskine9b562d52018-04-25 20:32:43 +020011508 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
11509
Paul Bakkeraccaffe2014-06-26 13:37:14 +020011510 if( handshake == NULL )
11511 return;
11512
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020011513#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
11514 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
11515 {
Gilles Peskine8f97af72018-04-26 11:46:10 +020011516 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +020011517 handshake->async_in_progress = 0;
11518 }
11519#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
11520
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +020011521#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
11522 defined(MBEDTLS_SSL_PROTO_TLS1_1)
11523 mbedtls_md5_free( &handshake->fin_md5 );
11524 mbedtls_sha1_free( &handshake->fin_sha1 );
11525#endif
11526#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
11527#if defined(MBEDTLS_SHA256_C)
11528 mbedtls_sha256_free( &handshake->fin_sha256 );
11529#endif
11530#if defined(MBEDTLS_SHA512_C)
11531 mbedtls_sha512_free( &handshake->fin_sha512 );
11532#endif
11533#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
11534
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011535#if defined(MBEDTLS_DHM_C)
11536 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +000011537#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011538#if defined(MBEDTLS_ECDH_C)
11539 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +020011540#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +020011541#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +020011542 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +020011543#if defined(MBEDTLS_SSL_CLI_C)
11544 mbedtls_free( handshake->ecjpake_cache );
11545 handshake->ecjpake_cache = NULL;
11546 handshake->ecjpake_cache_len = 0;
11547#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +020011548#endif
Paul Bakker61d113b2013-07-04 11:51:43 +020011549
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +010011550#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
11551 if( handshake->psk != NULL )
11552 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050011553 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +010011554 mbedtls_free( handshake->psk );
11555 }
11556#endif
11557
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011558#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
11559 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020011560 /*
11561 * Free only the linked list wrapper, not the keys themselves
11562 * since the belong to the SNI callback
11563 */
11564 if( handshake->sni_key_cert != NULL )
11565 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011566 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020011567
11568 while( cur != NULL )
11569 {
11570 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011571 mbedtls_free( cur );
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +020011572 cur = next;
11573 }
11574 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011575#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +020011576
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +020011577#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +020011578 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Hanno Beckere4aeb762019-02-05 17:19:52 +000011579 if( handshake->ecrs_peer_cert != NULL )
11580 {
11581 mbedtls_x509_crt_free( handshake->ecrs_peer_cert );
11582 mbedtls_free( handshake->ecrs_peer_cert );
11583 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +020011584#endif
11585
Hanno Becker3bf8cdf2019-02-06 16:18:31 +000011586#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
11587 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
11588 mbedtls_pk_free( &handshake->peer_pubkey );
11589#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
11590
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011591#if defined(MBEDTLS_SSL_PROTO_DTLS)
11592 mbedtls_free( handshake->verify_cookie );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +020011593 ssl_flight_free( handshake->flight );
Hanno Becker0271f962018-08-16 13:23:47 +010011594 ssl_buffering_free( ssl );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +020011595#endif
11596
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050011597 mbedtls_platform_zeroize( handshake,
11598 sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011599}
11600
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011601void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +000011602{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020011603 if( session == NULL )
11604 return;
11605
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011606#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker22141592019-02-05 12:38:15 +000011607 ssl_clear_peer_cert( session );
Paul Bakkered27a042013-04-18 22:46:23 +020011608#endif
Paul Bakker0a597072012-09-25 21:55:46 +000011609
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +020011610#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020011611 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +020011612#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +020011613
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050011614 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +000011615}
11616
Manuel Pégourié-Gonnard4c1d06e2019-07-23 16:13:17 +020011617#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020011618
11619#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
11620#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
11621#else
11622#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
11623#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
11624
11625#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
11626#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
11627#else
11628#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 0u
11629#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
11630
11631#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
11632#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
11633#else
11634#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
11635#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
11636
11637#if defined(MBEDTLS_SSL_ALPN)
11638#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
11639#else
11640#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
11641#endif /* MBEDTLS_SSL_ALPN */
11642
11643#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
11644#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
11645#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
11646#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
11647
11648#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
11649 ( (uint32_t) ( \
11650 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \
11651 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \
11652 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \
11653 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \
11654 0u ) )
11655
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011656static unsigned char ssl_serialized_context_header[] = {
11657 MBEDTLS_VERSION_MAJOR,
11658 MBEDTLS_VERSION_MINOR,
11659 MBEDTLS_VERSION_PATCH,
11660 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF,
11661 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF,
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020011662 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 16 ) & 0xFF,
11663 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 8 ) & 0xFF,
11664 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 0 ) & 0xFF,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011665};
11666
Paul Bakker5121ce52009-01-03 21:22:43 +000011667/*
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020011668 * Serialize a full SSL context
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020011669 *
11670 * The format of the serialized data is:
11671 * (in the presentation language of TLS, RFC 8446 section 3)
11672 *
11673 * // header
11674 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011675 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020011676 * // the format of the remaining
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011677 * // serialized data.
Manuel Pégourié-Gonnarda7cd4832019-07-23 16:31:16 +020011678 * Note: When updating the format, remember to keep these
11679 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnardb6163ef2019-07-10 14:58:45 +020011680 *
11681 * // session sub-structure
11682 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
11683 * // transform sub-structure
11684 * uint8 random[64]; // ServerHello.random+ClientHello.random
11685 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
11686 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
11687 * // fields from ssl_context
11688 * uint32 badmac_seen; // DTLS: number of records with failing MAC
11689 * uint64 in_window_top; // DTLS: last validated record seq_num
11690 * uint64 in_window; // DTLS: bitmask for replay protection
11691 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
11692 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
11693 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
11694 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
11695 *
11696 * Note that many fields of the ssl_context or sub-structures are not
11697 * serialized, as they fall in one of the following categories:
11698 *
11699 * 1. forced value (eg in_left must be 0)
11700 * 2. pointer to dynamically-allocated memory (eg session, transform)
11701 * 3. value can be re-derived from other data (eg session keys from MS)
11702 * 4. value was temporary (eg content of input buffer)
11703 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020011704 */
11705int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl,
11706 unsigned char *buf,
11707 size_t buf_len,
11708 size_t *olen )
11709{
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011710 unsigned char *p = buf;
11711 size_t used = 0;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011712 size_t session_len;
11713 int ret = 0;
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020011714
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020011715 /*
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020011716 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
11717 * this function's documentation.
11718 *
11719 * These are due to assumptions/limitations in the implementation. Some of
11720 * them are likely to stay (no handshake in progress) some might go away
11721 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020011722 */
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020011723 /* The initial handshake must be over */
11724 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard569ed6b2019-07-10 14:14:05 +020011725 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard69a3e412019-07-29 12:28:52 +020011726 if( ssl->handshake != NULL )
11727 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11728 /* Double-check that sub-structures are indeed ready */
11729 if( ssl->transform == NULL || ssl->session == NULL )
11730 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11731 /* There must be no pending incoming or outgoing data */
11732 if( mbedtls_ssl_check_pending( ssl ) != 0 )
11733 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11734 if( ssl->out_left != 0 )
11735 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11736 /* Protocol must be DLTS, not TLS */
11737 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
11738 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11739 /* Version must be 1.2 */
11740 if( mbedtls_ssl_get_major_ver( ssl ) != MBEDTLS_SSL_MAJOR_VERSION_3 )
11741 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11742 if( mbedtls_ssl_get_minor_ver( ssl ) != MBEDTLS_SSL_MINOR_VERSION_3 )
11743 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11744 /* We must be using an AEAD ciphersuite */
11745 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 )
11746 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11747 /* Renegotiation must not be enabled */
11748 if( mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
11749 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020011750
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011751 /*
11752 * Version and format identifier
11753 */
11754 used += sizeof( ssl_serialized_context_header );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020011755
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011756 if( used <= buf_len )
11757 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030011758 mbedtls_platform_memcpy( p, ssl_serialized_context_header,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011759 sizeof( ssl_serialized_context_header ) );
11760 p += sizeof( ssl_serialized_context_header );
11761 }
11762
11763 /*
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011764 * Session (length + data)
11765 */
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020011766 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011767 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL )
11768 return( ret );
11769
11770 used += 4 + session_len;
11771 if( used <= buf_len )
11772 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030011773 p = mbedtls_platform_put_uint32_be( p, session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011774
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020011775 ret = ssl_session_save( ssl->session, 1,
11776 p, session_len, &session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011777 if( ret != 0 )
11778 return( ret );
11779
11780 p += session_len;
11781 }
11782
11783 /*
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020011784 * Transform
11785 */
11786 used += sizeof( ssl->transform->randbytes );
11787 if( used <= buf_len )
11788 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030011789 mbedtls_platform_memcpy( p, ssl->transform->randbytes,
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020011790 sizeof( ssl->transform->randbytes ) );
11791 p += sizeof( ssl->transform->randbytes );
11792 }
11793
11794#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
11795 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
11796 if( used <= buf_len )
11797 {
11798 *p++ = ssl->transform->in_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030011799 /* Not using more secure mbedtls_platform_memcpy as cid is public */
11800 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020011801 p += ssl->transform->in_cid_len;
11802
11803 *p++ = ssl->transform->out_cid_len;
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030011804 /* Not using more secure mbedtls_platform_memcpy as cid is public */
11805 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020011806 p += ssl->transform->out_cid_len;
11807 }
11808#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
11809
11810 /*
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020011811 * Saved fields from top-level ssl_context structure
11812 */
11813#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
11814 used += 4;
11815 if( used <= buf_len )
11816 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030011817 p = mbedtls_platform_put_uint32_be( p, ssl->badmac_seen );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020011818 }
11819#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
11820
11821#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
11822 used += 16;
11823 if( used <= buf_len )
11824 {
11825 *p++ = (unsigned char)( ( ssl->in_window_top >> 56 ) & 0xFF );
11826 *p++ = (unsigned char)( ( ssl->in_window_top >> 48 ) & 0xFF );
11827 *p++ = (unsigned char)( ( ssl->in_window_top >> 40 ) & 0xFF );
11828 *p++ = (unsigned char)( ( ssl->in_window_top >> 32 ) & 0xFF );
11829 *p++ = (unsigned char)( ( ssl->in_window_top >> 24 ) & 0xFF );
11830 *p++ = (unsigned char)( ( ssl->in_window_top >> 16 ) & 0xFF );
11831 *p++ = (unsigned char)( ( ssl->in_window_top >> 8 ) & 0xFF );
11832 *p++ = (unsigned char)( ( ssl->in_window_top ) & 0xFF );
11833
11834 *p++ = (unsigned char)( ( ssl->in_window >> 56 ) & 0xFF );
11835 *p++ = (unsigned char)( ( ssl->in_window >> 48 ) & 0xFF );
11836 *p++ = (unsigned char)( ( ssl->in_window >> 40 ) & 0xFF );
11837 *p++ = (unsigned char)( ( ssl->in_window >> 32 ) & 0xFF );
11838 *p++ = (unsigned char)( ( ssl->in_window >> 24 ) & 0xFF );
11839 *p++ = (unsigned char)( ( ssl->in_window >> 16 ) & 0xFF );
11840 *p++ = (unsigned char)( ( ssl->in_window >> 8 ) & 0xFF );
11841 *p++ = (unsigned char)( ( ssl->in_window ) & 0xFF );
11842 }
11843#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
11844
11845#if defined(MBEDTLS_SSL_PROTO_DTLS)
11846 used += 1;
11847 if( used <= buf_len )
11848 {
11849 *p++ = ssl->disable_datagram_packing;
11850 }
11851#endif /* MBEDTLS_SSL_PROTO_DTLS */
11852
11853 used += 8;
11854 if( used <= buf_len )
11855 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030011856 mbedtls_platform_memcpy( p, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020011857 p += 8;
11858 }
11859
11860#if defined(MBEDTLS_SSL_PROTO_DTLS)
11861 used += 2;
11862 if( used <= buf_len )
11863 {
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030011864 p = mbedtls_platform_put_uint16_be( p, ssl->mtu );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020011865 }
11866#endif /* MBEDTLS_SSL_PROTO_DTLS */
11867
11868#if defined(MBEDTLS_SSL_ALPN)
11869 {
11870 const uint8_t alpn_len = ssl->alpn_chosen
Manuel Pégourié-Gonnard7af73752019-07-24 00:58:27 +020011871 ? (uint8_t) strlen( ssl->alpn_chosen )
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020011872 : 0;
11873
11874 used += 1 + alpn_len;
11875 if( used <= buf_len )
11876 {
11877 *p++ = alpn_len;
11878
11879 if( ssl->alpn_chosen != NULL )
11880 {
Teppo Järvelin91d79382019-10-02 09:09:31 +030011881 mbedtls_platform_memcpy( p, ssl->alpn_chosen, alpn_len );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020011882 p += alpn_len;
11883 }
11884 }
11885 }
11886#endif /* MBEDTLS_SSL_ALPN */
11887
11888 /*
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011889 * Done
11890 */
11891 *olen = used;
11892
11893 if( used > buf_len )
11894 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020011895
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011896 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used );
11897
Manuel Pégourié-Gonnardbc847ca2019-07-23 14:51:09 +020011898 return( ssl_session_reset_int( ssl, 0 ) );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020011899}
11900
11901/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020011902 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011903 *
11904 * This internal version is wrapped by a public function that cleans up in
11905 * case of error.
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020011906 */
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011907static int ssl_context_load( mbedtls_ssl_context *ssl,
11908 const unsigned char *buf,
11909 size_t len )
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020011910{
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011911 const unsigned char *p = buf;
11912 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011913 size_t session_len;
11914 int ret;
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011915
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020011916 /*
11917 * The context should have been freshly setup or reset.
11918 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard14e2a8a2019-07-26 16:31:53 +020011919 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020011920 * renegotiating, or if the user mistakenly loaded a session first.)
11921 */
11922 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
11923 ssl->session != NULL )
11924 {
11925 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11926 }
11927
11928 /*
11929 * We can't check that the config matches the initial one, but we can at
11930 * least check it matches the requirements for serializing.
11931 */
11932 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) ||
Hanno Becker7bcf2b52019-07-26 09:02:40 +010011933 mbedtls_ssl_ver_lt(
11934 mbedtls_ssl_conf_get_max_major_ver( ssl->conf ),
11935 MBEDTLS_SSL_MAJOR_VERSION_3 ) ||
11936 mbedtls_ssl_ver_gt(
11937 mbedtls_ssl_conf_get_min_major_ver( ssl->conf ),
11938 MBEDTLS_SSL_MAJOR_VERSION_3 ) ||
11939 mbedtls_ssl_ver_lt(
11940 mbedtls_ssl_conf_get_max_minor_ver( ssl->conf ),
11941 MBEDTLS_SSL_MINOR_VERSION_3 ) ||
11942 mbedtls_ssl_ver_gt(
11943 mbedtls_ssl_conf_get_min_minor_ver( ssl->conf ),
11944 MBEDTLS_SSL_MINOR_VERSION_3 ) ||
Manuel Pégourié-Gonnard18332c52019-07-29 12:17:52 +020011945 mbedtls_ssl_conf_is_renegotiation_enabled( ssl->conf ) )
Manuel Pégourié-Gonnard5e534ba2019-07-11 09:56:30 +020011946 {
11947 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11948 }
11949
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011950 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len );
11951
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011952 /*
11953 * Check version identifier
11954 */
11955 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) )
11956 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11957
Teppo Järvelin650343c2019-10-03 15:36:59 +030011958 // use regular memcmp as header is not that critical
11959 if( memcmp( p, ssl_serialized_context_header,
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020011960 sizeof( ssl_serialized_context_header ) ) != 0 )
11961 {
11962 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH );
11963 }
11964 p += sizeof( ssl_serialized_context_header );
11965
11966 /*
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011967 * Session
11968 */
11969 if( (size_t)( end - p ) < 4 )
11970 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11971
Arto Kinnunen0b62ce82019-09-04 14:04:57 +030011972 session_len = mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011973 p += 4;
11974
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020011975 /* This has been allocated by ssl_handshake_init(), called by
11976 * by either ssl_session_reset_int() or mbedtls_ssl_setup(). */
11977 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011978 ssl->session_in = ssl->session;
11979 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020011980 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011981
11982 if( (size_t)( end - p ) < session_len )
11983 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
11984
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020011985 ret = ssl_session_load( ssl->session, 1, p, session_len );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011986 if( ret != 0 )
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020011987 {
11988 mbedtls_ssl_session_free( ssl->session );
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011989 return( ret );
Manuel Pégourié-Gonnard7ce94462019-07-23 16:52:45 +020011990 }
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020011991
11992 p += session_len;
11993
11994 /*
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020011995 * Transform
11996 */
11997
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020011998 /* This has been allocated by ssl_handshake_init(), called by
11999 * by either ssl_session_reset_int() or mbedtls_ssl_setup(). */
12000 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012001 ssl->transform_in = ssl->transform;
12002 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnardff222002019-07-23 14:43:30 +020012003 ssl->transform_negotiate = NULL;
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012004
12005 /* Read random bytes and populate structure */
12006 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) )
12007 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12008
12009 ret = ssl_populate_transform( ssl->transform,
12010 mbedtls_ssl_session_get_ciphersuite( ssl->session ),
12011 ssl->session->master,
12012#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
12013#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
12014 ssl->session->encrypt_then_mac,
12015#endif
12016#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
12017 ssl->session->trunc_hmac,
12018#endif
12019#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
12020#if defined(MBEDTLS_ZLIB_SUPPORT)
12021 ssl->session->compression,
12022#endif
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012023 p, /* currently pointing to randbytes */
12024 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */
12025 mbedtls_ssl_conf_get_endpoint( ssl->conf ),
12026 ssl );
12027 if( ret != 0 )
12028 return( ret );
12029
12030 p += sizeof( ssl->transform->randbytes );
12031
12032#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
12033 /* Read connection IDs and store them */
12034 if( (size_t)( end - p ) < 1 )
12035 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12036
12037 ssl->transform->in_cid_len = *p++;
12038
Manuel Pégourié-Gonnard2f3fa622019-07-23 15:02:54 +020012039 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u )
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012040 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12041
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012042 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12043 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012044 p += ssl->transform->in_cid_len;
12045
12046 ssl->transform->out_cid_len = *p++;
12047
12048 if( (size_t)( end - p ) < ssl->transform->out_cid_len )
12049 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12050
Teppo Järvelin6f4e0302019-10-04 13:53:53 +030012051 /* Not using more secure mbedtls_platform_memcpy as cid is public */
12052 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len );
Manuel Pégourié-Gonnard322f3c72019-07-15 09:04:11 +020012053 p += ssl->transform->out_cid_len;
12054#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
12055
12056 /*
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012057 * Saved fields from top-level ssl_context structure
12058 */
12059#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
12060 if( (size_t)( end - p ) < 4 )
12061 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12062
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030012063 ssl->badmac_seen = (unsigned)mbedtls_platform_get_uint32_be( p );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012064 p += 4;
12065#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
12066
12067#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
12068 if( (size_t)( end - p ) < 16 )
12069 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12070
12071 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) |
12072 ( (uint64_t) p[1] << 48 ) |
12073 ( (uint64_t) p[2] << 40 ) |
12074 ( (uint64_t) p[3] << 32 ) |
12075 ( (uint64_t) p[4] << 24 ) |
12076 ( (uint64_t) p[5] << 16 ) |
12077 ( (uint64_t) p[6] << 8 ) |
12078 ( (uint64_t) p[7] );
12079 p += 8;
12080
12081 ssl->in_window = ( (uint64_t) p[0] << 56 ) |
12082 ( (uint64_t) p[1] << 48 ) |
12083 ( (uint64_t) p[2] << 40 ) |
12084 ( (uint64_t) p[3] << 32 ) |
12085 ( (uint64_t) p[4] << 24 ) |
12086 ( (uint64_t) p[5] << 16 ) |
12087 ( (uint64_t) p[6] << 8 ) |
12088 ( (uint64_t) p[7] );
12089 p += 8;
12090#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
12091
12092#if defined(MBEDTLS_SSL_PROTO_DTLS)
12093 if( (size_t)( end - p ) < 1 )
12094 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12095
12096 ssl->disable_datagram_packing = *p++;
12097#endif /* MBEDTLS_SSL_PROTO_DTLS */
12098
12099 if( (size_t)( end - p ) < 8 )
12100 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12101
Teppo Järvelin91d79382019-10-02 09:09:31 +030012102 mbedtls_platform_memcpy( ssl->cur_out_ctr, p, 8 );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012103 p += 8;
12104
12105#if defined(MBEDTLS_SSL_PROTO_DTLS)
12106 if( (size_t)( end - p ) < 2 )
12107 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Arto Kinnunen4f4849a2019-09-09 10:21:18 +030012108 ssl->mtu = (uint16_t)mbedtls_platform_get_uint16_be( p );
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012109 p += 2;
12110#endif /* MBEDTLS_SSL_PROTO_DTLS */
12111
12112#if defined(MBEDTLS_SSL_ALPN)
12113 {
12114 uint8_t alpn_len;
12115 const char **cur;
12116
12117 if( (size_t)( end - p ) < 1 )
12118 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12119
12120 alpn_len = *p++;
12121
12122 if( alpn_len != 0 && ssl->conf->alpn_list != NULL )
12123 {
12124 /* alpn_chosen should point to an item in the configured list */
12125 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
12126 {
12127 if( strlen( *cur ) == alpn_len &&
Teppo Järvelin61f412e2019-10-03 12:25:22 +030012128 mbedtls_platform_memcmp( p, cur, alpn_len ) == 0 )
Manuel Pégourié-Gonnard16d14852019-07-15 11:23:03 +020012129 {
12130 ssl->alpn_chosen = *cur;
12131 break;
12132 }
12133 }
12134 }
12135
12136 /* can only happen on conf mismatch */
12137 if( alpn_len != 0 && ssl->alpn_chosen == NULL )
12138 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
12139
12140 p += alpn_len;
12141 }
12142#endif /* MBEDTLS_SSL_ALPN */
12143
12144 /*
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012145 * Forced fields from top-level ssl_context structure
12146 *
12147 * Most of them already set to the correct value by mbedtls_ssl_init() and
12148 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
12149 */
12150 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
12151
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012152#if !defined(MBEDTLS_SSL_CONF_FIXED_MAJOR_VER)
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012153 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012154#endif /* !MBEDTLS_SSL_CONF_FIXED_MAJOR_VER */
12155#if !defined(MBEDTLS_SSL_CONF_FIXED_MINOR_VER)
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012156 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
Manuel Pégourié-Gonnard2cc92232019-07-23 17:11:24 +020012157#endif /* !MBEDTLS_SSL_CONF_FIXED_MINOR_VER */
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012158
Hanno Becker83985822019-08-30 10:42:49 +010012159 /* Adjust pointers for header fields of outgoing records to
12160 * the given transform, accounting for explicit IV and CID. */
12161 ssl_update_out_pointers( ssl, ssl->transform );
12162
Manuel Pégourié-Gonnard138079d2019-07-15 11:53:51 +020012163#if defined(MBEDTLS_SSL_PROTO_DTLS)
12164 ssl->in_epoch = 1;
12165#endif
12166
12167 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
12168 * which we don't want - otherwise we'd end up freeing the wrong transform
12169 * by calling ssl_handshake_wrapup_free_hs_transform() inappropriately. */
12170 if( ssl->handshake != NULL )
12171 {
12172 mbedtls_ssl_handshake_free( ssl );
12173 mbedtls_free( ssl->handshake );
12174 ssl->handshake = NULL;
12175 }
12176
12177 /*
Manuel Pégourié-Gonnardd0dd1042019-07-11 10:58:10 +020012178 * Done - should have consumed entire buffer
12179 */
12180 if( p != end )
12181 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012182
12183 return( 0 );
12184}
12185
12186/*
Manuel Pégourié-Gonnard81758162019-07-12 10:50:19 +020012187 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012188 */
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012189int mbedtls_ssl_context_load( mbedtls_ssl_context *context,
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012190 const unsigned char *buf,
12191 size_t len )
12192{
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012193 int ret = ssl_context_load( context, buf, len );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012194
Manuel Pégourié-Gonnardf1f3e522019-07-11 12:50:53 +020012195 if( ret != 0 )
12196 mbedtls_ssl_free( context );
12197
12198 return( ret );
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012199}
Manuel Pégourié-Gonnard4c1d06e2019-07-23 16:13:17 +020012200#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnardd87601e2019-05-28 13:02:16 +020012201
12202/*
Paul Bakker5121ce52009-01-03 21:22:43 +000012203 * Free an SSL context
12204 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012205void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +000012206{
Paul Bakkeraccaffe2014-06-26 13:37:14 +020012207 if( ssl == NULL )
12208 return;
12209
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012210 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000012211
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +010012212 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012213 {
Angus Grattond8213d02016-05-25 20:56:48 +100012214 mbedtls_platform_zeroize( ssl->out_buf, MBEDTLS_SSL_OUT_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012215 mbedtls_free( ssl->out_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +000012216 }
12217
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +010012218 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012219 {
Angus Grattond8213d02016-05-25 20:56:48 +100012220 mbedtls_platform_zeroize( ssl->in_buf, MBEDTLS_SSL_IN_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012221 mbedtls_free( ssl->in_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +000012222 }
12223
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012224#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker16770332013-10-11 09:59:44 +020012225 if( ssl->compress_buf != NULL )
12226 {
Angus Grattond8213d02016-05-25 20:56:48 +100012227 mbedtls_platform_zeroize( ssl->compress_buf, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012228 mbedtls_free( ssl->compress_buf );
Paul Bakker16770332013-10-11 09:59:44 +020012229 }
12230#endif
12231
Paul Bakker48916f92012-09-16 19:57:18 +000012232 if( ssl->transform )
12233 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012234 mbedtls_ssl_transform_free( ssl->transform );
12235 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +000012236 }
12237
12238 if( ssl->handshake )
12239 {
Gilles Peskine9b562d52018-04-25 20:32:43 +020012240 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012241 mbedtls_ssl_transform_free( ssl->transform_negotiate );
12242 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +000012243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012244 mbedtls_free( ssl->handshake );
12245 mbedtls_free( ssl->transform_negotiate );
12246 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +000012247 }
12248
Paul Bakkerc0463502013-02-14 11:19:38 +010012249 if( ssl->session )
12250 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012251 mbedtls_ssl_session_free( ssl->session );
12252 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +010012253 }
12254
Teppo Järvelin4009d8f2019-08-19 14:48:09 +030012255#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
Paul Bakker66d5d072014-06-17 16:39:18 +020012256 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +000012257 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012258 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012259 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +000012260 }
Paul Bakker0be444a2013-08-27 21:55:01 +020012261#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000012262
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012263#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
12264 if( mbedtls_ssl_hw_record_finish != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +000012265 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012266 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) );
12267 mbedtls_ssl_hw_record_finish( ssl );
Paul Bakker05ef8352012-05-08 09:17:57 +000012268 }
12269#endif
12270
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +020012271#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012272 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020012273#endif
12274
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012275 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +000012276
Paul Bakker86f04f42013-02-14 11:20:09 +010012277 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012278 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +000012279}
12280
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012281/*
12282 * Initialze mbedtls_ssl_config
12283 */
12284void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
12285{
12286 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnarde744eab2019-03-18 10:51:18 +010012287
12288#if !defined(MBEDTLS_SSL_PROTO_TLS)
12289 conf->transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM;
12290#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012291}
12292
Simon Butcherc97b6972015-12-27 23:48:17 +000012293#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012294#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012295static int ssl_preset_default_hashes[] = {
12296#if defined(MBEDTLS_SHA512_C)
12297 MBEDTLS_MD_SHA512,
12298 MBEDTLS_MD_SHA384,
12299#endif
12300#if defined(MBEDTLS_SHA256_C)
12301 MBEDTLS_MD_SHA256,
12302 MBEDTLS_MD_SHA224,
12303#endif
Gilles Peskine5d2511c2017-05-12 13:16:40 +020012304#if defined(MBEDTLS_SHA1_C) && defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012305 MBEDTLS_MD_SHA1,
12306#endif
12307 MBEDTLS_MD_NONE
12308};
Simon Butcherc97b6972015-12-27 23:48:17 +000012309#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012310#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012311
Hanno Becker73f4cb12019-06-27 13:51:07 +010012312#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012313static int ssl_preset_suiteb_ciphersuites[] = {
12314 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
12315 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
12316 0
12317};
Hanno Becker73f4cb12019-06-27 13:51:07 +010012318#endif /* !MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012319
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020012320#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012321#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012322static int ssl_preset_suiteb_hashes[] = {
12323 MBEDTLS_MD_SHA256,
12324 MBEDTLS_MD_SHA384,
12325 MBEDTLS_MD_NONE
12326};
12327#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012328#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012329
Hanno Beckerc1096e72019-06-19 12:30:41 +010012330#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012331static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = {
Jaeden Amero16529b22019-06-03 08:27:16 +010012332#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012333 MBEDTLS_ECP_DP_SECP256R1,
Jaeden Amero16529b22019-06-03 08:27:16 +010012334#endif
12335#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012336 MBEDTLS_ECP_DP_SECP384R1,
Jaeden Amero16529b22019-06-03 08:27:16 +010012337#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012338 MBEDTLS_ECP_DP_NONE
12339};
12340#endif
12341
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012342/*
Tillmann Karras588ad502015-09-25 04:27:22 +020012343 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012344 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012345int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012346 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012347{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +020012348#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012349 int ret;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +020012350#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012351
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +020012352 /* Use the functions here so that they are covered in tests,
12353 * but otherwise access member directly for efficiency */
12354 mbedtls_ssl_conf_endpoint( conf, endpoint );
12355 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012356
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012357 /*
12358 * Things that are common to all presets
12359 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012360#if defined(MBEDTLS_SSL_CLI_C)
12361 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
12362 {
Hanno Beckeracd4fc02019-06-12 16:40:50 +010012363#if !defined(MBEDTLS_SSL_CONF_AUTHMODE)
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012364 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
Hanno Beckeracd4fc02019-06-12 16:40:50 +010012365#endif /* !MBEDTLS_SSL_CONF_AUTHMODE */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +020012366#if defined(MBEDTLS_SSL_SESSION_TICKETS)
12367 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
12368#endif
12369 }
12370#endif
12371
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +020012372#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012373 conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED;
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +020012374#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012375
12376#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
12377 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
12378#endif
12379
12380#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckeraabbb582019-06-11 13:43:27 +010012381#if !defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012382 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Hanno Beckeraabbb582019-06-11 13:43:27 +010012383#endif /* !MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET */
12384#if !defined(MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET)
Jarno Lamsad9382f82019-06-10 10:27:14 +030012385 conf->enforce_extended_master_secret =
Jarno Lamsa18b9a492019-06-10 15:23:29 +030012386 MBEDTLS_SSL_EXTENDED_MS_ENFORCE_DISABLED;
Hanno Beckeraabbb582019-06-11 13:43:27 +010012387#endif /* !MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012388#endif
12389
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +010012390#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
12391 conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED;
12392#endif
12393
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +020012394#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012395 conf->f_cookie_write = ssl_cookie_write_dummy;
12396 conf->f_cookie_check = ssl_cookie_check_dummy;
12397#endif
12398
Hanno Becker7f376f42019-06-12 16:20:48 +010012399#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
12400 !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012401 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
12402#endif
12403
Janos Follath088ce432017-04-10 12:42:31 +010012404#if defined(MBEDTLS_SSL_SRV_C)
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +010012405#if !defined(MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST)
Janos Follath088ce432017-04-10 12:42:31 +010012406 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +010012407#endif /* !MBEDTLS_SSL_CONF_CERT_REQ_CA_LIST */
12408#endif /* MBEDTLS_SSL_SRV_C */
Janos Follath088ce432017-04-10 12:42:31 +010012409
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012410#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker1f835fa2019-06-13 10:14:59 +010012411#if !defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012412 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
Hanno Becker1f835fa2019-06-13 10:14:59 +010012413#endif /* !MBEDTLS_SSL_CONF_HS_TIMEOUT_MIN */
12414#if !defined(MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012415 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
Hanno Becker1f835fa2019-06-13 10:14:59 +010012416#endif /* !MBEDTLS_SSL_CONF_HS_TIMEOUT_MAX */
12417#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012418
12419#if defined(MBEDTLS_SSL_RENEGOTIATION)
12420 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Manuel Pégourié-Gonnard7a346b82019-10-02 14:47:01 +020012421 mbedtls_platform_memset( conf->renego_period, 0x00, 2 );
12422 mbedtls_platform_memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012423#endif
12424
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012425#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
12426 if( endpoint == MBEDTLS_SSL_IS_SERVER )
12427 {
Hanno Becker00d0a682017-10-04 13:14:29 +010012428 const unsigned char dhm_p[] =
12429 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
12430 const unsigned char dhm_g[] =
12431 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
12432
Hanno Beckera90658f2017-10-04 15:29:08 +010012433 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
12434 dhm_p, sizeof( dhm_p ),
12435 dhm_g, sizeof( dhm_g ) ) ) != 0 )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012436 {
12437 return( ret );
12438 }
12439 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +020012440#endif
12441
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012442 /*
12443 * Preset-specific defaults
12444 */
12445 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012446 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012447 /*
12448 * NSA Suite B
12449 */
12450 case MBEDTLS_SSL_PRESET_SUITEB:
Hanno Beckere965bd32019-06-12 14:04:34 +010012451#if !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012452 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Hanno Beckere965bd32019-06-12 14:04:34 +010012453#endif /* !MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
12454#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012455 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
Hanno Beckere965bd32019-06-12 14:04:34 +010012456#endif /* !MBEDTLS_SSL_CONF_MIN_MINOR_VER */
12457#if !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012458 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012459#endif /* !MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
12460#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012461 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012462#endif /* !MBEDTLS_SSL_CONF_MAX_MINOR_VER */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012463
Hanno Becker73f4cb12019-06-27 13:51:07 +010012464#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010012465 conf->ciphersuite_list[0] =
12466 conf->ciphersuite_list[1] =
12467 conf->ciphersuite_list[2] =
12468 conf->ciphersuite_list[3] =
12469 ssl_preset_suiteb_ciphersuites;
Hanno Becker73f4cb12019-06-27 13:51:07 +010012470#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012471
12472#if defined(MBEDTLS_X509_CRT_PARSE_C)
12473 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012474#endif
12475
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020012476#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012477#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012478 conf->sig_hashes = ssl_preset_suiteb_hashes;
12479#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012480#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012481
12482#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +010012483#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012484 conf->curve_list = ssl_preset_suiteb_curves;
12485#endif
Hanno Beckerc1096e72019-06-19 12:30:41 +010012486#endif
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +020012487 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012488
12489 /*
12490 * Default
12491 */
12492 default:
Hanno Beckere965bd32019-06-12 14:04:34 +010012493#if !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
Ron Eldor5e9f14d2017-05-28 10:46:38 +030012494 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
12495 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
12496 MBEDTLS_SSL_MIN_MAJOR_VERSION :
12497 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
Hanno Beckere965bd32019-06-12 14:04:34 +010012498#endif /* !MBEDTLS_SSL_CONF_MIN_MAJOR_VER */
12499#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER)
Ron Eldor5e9f14d2017-05-28 10:46:38 +030012500 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
12501 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
12502 MBEDTLS_SSL_MIN_MINOR_VERSION :
12503 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012504#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +020012505 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( transport ) )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012506 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
12507#endif
Hanno Beckere965bd32019-06-12 14:04:34 +010012508#endif /* !MBEDTLS_SSL_CONF_MIN_MINOR_VER */
12509#if !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
12510 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
12511#endif /* !MBEDTLS_SSL_CONF_MAX_MAJOR_VER */
12512#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER)
12513 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
12514#endif /* !MBEDTLS_SSL_CONF_MAX_MINOR_VER */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012515
Hanno Becker73f4cb12019-06-27 13:51:07 +010012516#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
Hanno Becker7bcf2b52019-07-26 09:02:40 +010012517 conf->ciphersuite_list[0] =
12518 conf->ciphersuite_list[1] =
12519 conf->ciphersuite_list[2] =
12520 conf->ciphersuite_list[3] =
12521 mbedtls_ssl_list_ciphersuites();
Hanno Becker73f4cb12019-06-27 13:51:07 +010012522#endif /* MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012523
12524#if defined(MBEDTLS_X509_CRT_PARSE_C)
12525 conf->cert_profile = &mbedtls_x509_crt_profile_default;
12526#endif
12527
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020012528#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker56595f42019-06-19 16:31:38 +010012529#if !defined(MBEDTLS_SSL_CONF_SINGLE_SIG_HASH)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +010012530 conf->sig_hashes = ssl_preset_default_hashes;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012531#endif
Hanno Becker56595f42019-06-19 16:31:38 +010012532#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012533
12534#if defined(MBEDTLS_ECP_C)
Hanno Beckerc1096e72019-06-19 12:30:41 +010012535#if !defined(MBEDTLS_SSL_CONF_SINGLE_EC)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012536 conf->curve_list = mbedtls_ecp_grp_id_list();
12537#endif
Hanno Beckerc1096e72019-06-19 12:30:41 +010012538#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +020012539
12540#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
12541 conf->dhm_min_bitlen = 1024;
12542#endif
12543 }
12544
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012545 return( 0 );
12546}
12547
12548/*
12549 * Free mbedtls_ssl_config
12550 */
12551void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
12552{
12553#if defined(MBEDTLS_DHM_C)
12554 mbedtls_mpi_free( &conf->dhm_P );
12555 mbedtls_mpi_free( &conf->dhm_G );
12556#endif
12557
12558#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
12559 if( conf->psk != NULL )
12560 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012561 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012562 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +000012563 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012564 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +090012565 }
12566
12567 if( conf->psk_identity != NULL )
12568 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012569 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +090012570 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +000012571 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012572 conf->psk_identity_len = 0;
12573 }
12574#endif
12575
12576#if defined(MBEDTLS_X509_CRT_PARSE_C)
12577 ssl_key_cert_free( conf->key_cert );
12578#endif
12579
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050012580 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +020012581}
12582
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +020012583#if defined(MBEDTLS_PK_C) && \
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030012584 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) ) || \
12585 ( defined(MBEDTLS_USE_TINYCRYPT) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020012586/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012587 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020012588 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012589unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020012590{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012591#if defined(MBEDTLS_RSA_C)
12592 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
12593 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020012594#endif
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030012595#if defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012596 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
12597 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020012598#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012599 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +020012600}
12601
Hanno Becker7e5437a2017-04-28 17:15:26 +010012602unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
12603{
12604 switch( type ) {
12605 case MBEDTLS_PK_RSA:
12606 return( MBEDTLS_SSL_SIG_RSA );
12607 case MBEDTLS_PK_ECDSA:
12608 case MBEDTLS_PK_ECKEY:
12609 return( MBEDTLS_SSL_SIG_ECDSA );
12610 default:
12611 return( MBEDTLS_SSL_SIG_ANON );
12612 }
12613}
12614
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012615mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020012616{
12617 switch( sig )
12618 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012619#if defined(MBEDTLS_RSA_C)
12620 case MBEDTLS_SSL_SIG_RSA:
12621 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020012622#endif
Jarno Lamsa7cb5c112019-04-23 15:54:56 +030012623#if defined(MBEDTLS_ECDSA_C) || defined(MBEDTLS_USE_TINYCRYPT)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012624 case MBEDTLS_SSL_SIG_ECDSA:
12625 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020012626#endif
12627 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012628 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020012629 }
12630}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +020012631#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020012632
Hanno Becker7e5437a2017-04-28 17:15:26 +010012633#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
12634 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
12635
12636/* Find an entry in a signature-hash set matching a given hash algorithm. */
12637mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
12638 mbedtls_pk_type_t sig_alg )
12639{
12640 switch( sig_alg )
12641 {
12642 case MBEDTLS_PK_RSA:
12643 return( set->rsa );
12644 case MBEDTLS_PK_ECDSA:
12645 return( set->ecdsa );
12646 default:
12647 return( MBEDTLS_MD_NONE );
12648 }
12649}
12650
12651/* Add a signature-hash-pair to a signature-hash set */
12652void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
12653 mbedtls_pk_type_t sig_alg,
12654 mbedtls_md_type_t md_alg )
12655{
12656 switch( sig_alg )
12657 {
12658 case MBEDTLS_PK_RSA:
12659 if( set->rsa == MBEDTLS_MD_NONE )
12660 set->rsa = md_alg;
12661 break;
12662
12663 case MBEDTLS_PK_ECDSA:
12664 if( set->ecdsa == MBEDTLS_MD_NONE )
12665 set->ecdsa = md_alg;
12666 break;
12667
12668 default:
12669 break;
12670 }
12671}
12672
12673/* Allow exactly one hash algorithm for each signature. */
12674void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
12675 mbedtls_md_type_t md_alg )
12676{
12677 set->rsa = md_alg;
12678 set->ecdsa = md_alg;
12679}
12680
12681#endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
12682 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
12683
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +020012684/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020012685 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +020012686 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012687mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020012688{
12689 switch( hash )
12690 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012691#if defined(MBEDTLS_MD5_C)
12692 case MBEDTLS_SSL_HASH_MD5:
12693 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020012694#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012695#if defined(MBEDTLS_SHA1_C)
12696 case MBEDTLS_SSL_HASH_SHA1:
12697 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020012698#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012699#if defined(MBEDTLS_SHA256_C)
12700 case MBEDTLS_SSL_HASH_SHA224:
12701 return( MBEDTLS_MD_SHA224 );
12702 case MBEDTLS_SSL_HASH_SHA256:
12703 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020012704#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012705#if defined(MBEDTLS_SHA512_C)
12706 case MBEDTLS_SSL_HASH_SHA384:
12707 return( MBEDTLS_MD_SHA384 );
12708 case MBEDTLS_SSL_HASH_SHA512:
12709 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020012710#endif
12711 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012712 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +020012713 }
12714}
12715
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020012716/*
12717 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
12718 */
12719unsigned char mbedtls_ssl_hash_from_md_alg( int md )
12720{
12721 switch( md )
12722 {
12723#if defined(MBEDTLS_MD5_C)
12724 case MBEDTLS_MD_MD5:
12725 return( MBEDTLS_SSL_HASH_MD5 );
12726#endif
12727#if defined(MBEDTLS_SHA1_C)
12728 case MBEDTLS_MD_SHA1:
12729 return( MBEDTLS_SSL_HASH_SHA1 );
12730#endif
12731#if defined(MBEDTLS_SHA256_C)
12732 case MBEDTLS_MD_SHA224:
12733 return( MBEDTLS_SSL_HASH_SHA224 );
12734 case MBEDTLS_MD_SHA256:
12735 return( MBEDTLS_SSL_HASH_SHA256 );
12736#endif
12737#if defined(MBEDTLS_SHA512_C)
12738 case MBEDTLS_MD_SHA384:
12739 return( MBEDTLS_SSL_HASH_SHA384 );
12740 case MBEDTLS_MD_SHA512:
12741 return( MBEDTLS_SSL_HASH_SHA512 );
12742#endif
12743 default:
12744 return( MBEDTLS_SSL_HASH_NONE );
12745 }
12746}
12747
Hanno Beckeree902df2019-08-23 13:47:47 +010012748#if defined(MBEDTLS_USE_TINYCRYPT)
12749/*
12750 * Check if a curve proposed by the peer is in our list.
12751 * Return 0 if we're willing to use it, -1 otherwise.
12752 */
12753int mbedtls_ssl_check_curve_uecc( const mbedtls_ssl_context *ssl,
12754 mbedtls_uecc_group_id grp_id )
12755{
12756 MBEDTLS_SSL_BEGIN_FOR_EACH_SUPPORTED_UECC_GRP_ID( own_ec_id )
12757 if( own_ec_id == grp_id )
12758 return( 0 );
12759 MBEDTLS_SSL_END_FOR_EACH_SUPPORTED_UECC_GRP_ID
12760
12761 return( -1 );
12762}
12763#endif /* MBEDTLS_USE_TINYCRYPT */
12764
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +020012765#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010012766/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020012767 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020012768 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010012769 */
Hanno Beckeree902df2019-08-23 13:47:47 +010012770int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl,
12771 mbedtls_ecp_group_id grp_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010012772{
Hanno Beckera4a9c692019-06-18 16:55:47 +010012773 MBEDTLS_SSL_BEGIN_FOR_EACH_SUPPORTED_EC_GRP_ID( own_ec_id )
12774 if( own_ec_id == grp_id )
12775 return( 0 );
12776 MBEDTLS_SSL_END_FOR_EACH_SUPPORTED_EC_GRP_ID
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010012777
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020012778 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010012779}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +020012780#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012781
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020012782#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020012783/*
12784 * Check if a hash proposed by the peer is in our list.
12785 * Return 0 if we're willing to use it, -1 otherwise.
12786 */
12787int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
12788 mbedtls_md_type_t md )
12789{
Hanno Beckerf1bc9e12019-06-19 16:23:21 +010012790 MBEDTLS_SSL_BEGIN_FOR_EACH_SIG_HASH( md_alg )
12791 if( md_alg == md )
12792 return( 0 );
12793 MBEDTLS_SSL_END_FOR_EACH_SIG_HASH
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020012794
12795 return( -1 );
12796}
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020012797#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020012798
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012799#if defined(MBEDTLS_X509_CRT_PARSE_C)
12800int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
Hanno Becker473f98f2019-06-26 10:27:32 +010012801 mbedtls_ssl_ciphersuite_handle_t ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010012802 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +020012803 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012804{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010012805 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012806#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012807 int usage = 0;
12808#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012809#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020012810 const char *ext_oid;
12811 size_t ext_len;
12812#endif
12813
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012814#if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \
12815 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020012816 ((void) cert);
12817 ((void) cert_endpoint);
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010012818 ((void) flags);
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020012819#endif
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012820
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012821#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
12822 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012823 {
12824 /* Server part of the key exchange */
Hanno Becker473f98f2019-06-26 10:27:32 +010012825 switch( mbedtls_ssl_suite_get_key_exchange( ciphersuite ) )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012826 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012827 case MBEDTLS_KEY_EXCHANGE_RSA:
12828 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010012829 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012830 break;
12831
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012832 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
12833 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
12834 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
12835 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012836 break;
12837
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012838 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
12839 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010012840 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012841 break;
12842
12843 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012844 case MBEDTLS_KEY_EXCHANGE_NONE:
12845 case MBEDTLS_KEY_EXCHANGE_PSK:
12846 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
12847 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +020012848 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012849 usage = 0;
12850 }
12851 }
12852 else
12853 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012854 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
12855 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012856 }
12857
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012858 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010012859 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010012860 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010012861 ret = -1;
12862 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020012863#else
12864 ((void) ciphersuite);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012865#endif /* MBEDTLS_X509_CHECK_KEY_USAGE */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012866
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012867#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
12868 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020012869 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012870 ext_oid = MBEDTLS_OID_SERVER_AUTH;
12871 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020012872 }
12873 else
12874 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012875 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
12876 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020012877 }
12878
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012879 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010012880 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010012881 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010012882 ret = -1;
12883 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012884#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020012885
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010012886 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020012887}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020012888#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +020012889
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012890#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
12891 defined(MBEDTLS_SSL_PROTO_TLS1_1)
12892int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
12893 unsigned char *output,
12894 unsigned char *data, size_t data_len )
12895{
12896 int ret = 0;
12897 mbedtls_md5_context mbedtls_md5;
12898 mbedtls_sha1_context mbedtls_sha1;
12899
12900 mbedtls_md5_init( &mbedtls_md5 );
12901 mbedtls_sha1_init( &mbedtls_sha1 );
12902
12903 /*
12904 * digitally-signed struct {
12905 * opaque md5_hash[16];
12906 * opaque sha_hash[20];
12907 * };
12908 *
12909 * md5_hash
12910 * MD5(ClientHello.random + ServerHello.random
12911 * + ServerParams);
12912 * sha_hash
12913 * SHA(ClientHello.random + ServerHello.random
12914 * + ServerParams);
12915 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012916 if( ( ret = mbedtls_md5_starts_ret( &mbedtls_md5 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012917 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012918 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012919 goto exit;
12920 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012921 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012922 ssl->handshake->randbytes, 64 ) ) != 0 )
12923 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012924 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012925 goto exit;
12926 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012927 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5, data, data_len ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012928 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012929 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012930 goto exit;
12931 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012932 if( ( ret = mbedtls_md5_finish_ret( &mbedtls_md5, output ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012933 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012934 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012935 goto exit;
12936 }
12937
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012938 if( ( ret = mbedtls_sha1_starts_ret( &mbedtls_sha1 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012939 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012940 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012941 goto exit;
12942 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012943 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012944 ssl->handshake->randbytes, 64 ) ) != 0 )
12945 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012946 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012947 goto exit;
12948 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012949 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1, data,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012950 data_len ) ) != 0 )
12951 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012952 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012953 goto exit;
12954 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012955 if( ( ret = mbedtls_sha1_finish_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012956 output + 16 ) ) != 0 )
12957 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010012958 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012959 goto exit;
12960 }
12961
12962exit:
12963 mbedtls_md5_free( &mbedtls_md5 );
12964 mbedtls_sha1_free( &mbedtls_sha1 );
12965
12966 if( ret != 0 )
Hanno Beckerde62da92019-07-24 13:23:50 +010012967 mbedtls_ssl_pend_fatal_alert( ssl,
12968 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012969
12970 return( ret );
12971
12972}
12973#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
12974 MBEDTLS_SSL_PROTO_TLS1_1 */
12975
12976#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
12977 defined(MBEDTLS_SSL_PROTO_TLS1_2)
12978int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
Gilles Peskineca1d7422018-04-24 11:53:22 +020012979 unsigned char *hash, size_t *hashlen,
12980 unsigned char *data, size_t data_len,
12981 mbedtls_md_type_t md_alg )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012982{
12983 int ret = 0;
12984 mbedtls_md_context_t ctx;
Andrzej Kurek84bde412020-07-06 15:27:34 -040012985
Hanno Beckera5cedbc2019-07-17 11:21:02 +010012986 mbedtls_md_handle_t md_info = mbedtls_md_info_from_type( md_alg );
Gilles Peskineca1d7422018-04-24 11:53:22 +020012987 *hashlen = mbedtls_md_get_size( md_info );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010012988
12989 mbedtls_md_init( &ctx );
12990
12991 /*
12992 * digitally-signed struct {
12993 * opaque client_random[32];
12994 * opaque server_random[32];
12995 * ServerDHParams params;
12996 * };
12997 */
12998 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
12999 {
13000 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
13001 goto exit;
13002 }
13003 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
13004 {
13005 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
13006 goto exit;
13007 }
13008 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
13009 {
13010 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
13011 goto exit;
13012 }
13013 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
13014 {
13015 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
13016 goto exit;
13017 }
Gilles Peskineca1d7422018-04-24 11:53:22 +020013018 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013019 {
13020 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
13021 goto exit;
13022 }
13023
13024exit:
13025 mbedtls_md_free( &ctx );
13026
13027 if( ret != 0 )
Hanno Beckerde62da92019-07-24 13:23:50 +010013028 mbedtls_ssl_pend_fatal_alert( ssl,
13029 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013030
Andrzej Kurekafec8852020-07-15 16:31:27 -040013031 return( ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010013032}
13033#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
13034 MBEDTLS_SSL_PROTO_TLS1_2 */
13035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020013036#endif /* MBEDTLS_SSL_TLS_C */