blob: 10c5f74b2e33489a6bffc77d44e9e9351d5c4e8d [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002 * TLS shared functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Dave Rodgman16799db2023-11-02 19:47:20 +00005 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
Paul Bakker5121ce52009-01-03 21:22:43 +00006 */
7/*
Paul Bakker5121ce52009-01-03 21:22:43 +00008 * http://www.ietf.org/rfc/rfc2246.txt
9 * http://www.ietf.org/rfc/rfc4346.txt
10 */
11
Gilles Peskinedb09ef62020-06-03 01:43:33 +020012#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000013
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020014#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000015
SimonBd5800b72016-04-26 07:43:27 +010016#include "mbedtls/platform.h"
SimonBd5800b72016-04-26 07:43:27 +010017
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000018#include "mbedtls/ssl.h"
Ronald Cron9f0fba32022-02-10 16:45:15 +010019#include "ssl_client.h"
Ronald Cron27c85e72022-03-08 11:37:55 +010020#include "ssl_debug_helpers.h"
Chris Jones84a773f2021-03-05 18:38:47 +000021#include "ssl_misc.h"
Andrzej Kurek25f27152022-08-17 16:09:31 -040022
Valerio Settib4f50762024-01-17 10:24:52 +010023#include "debug_internal.h"
Janos Follath73c616b2019-12-18 15:07:04 +000024#include "mbedtls/error.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050025#include "mbedtls/platform_util.h"
Hanno Beckera835da52019-05-16 12:39:07 +010026#include "mbedtls/version.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020027#include "mbedtls/constant_time.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020028
Rich Evans00ab4702015-02-06 13:43:58 +000029#include <string.h>
30
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050031#if defined(MBEDTLS_USE_PSA_CRYPTO)
Valerio Setti384fbde2024-01-02 13:26:40 +010032#include "mbedtls/psa_util.h"
Manuel Pégourié-Gonnard02b10d82023-03-28 12:33:20 +020033#include "md_psa.h"
Manuel Pégourié-Gonnard2be8c632023-06-07 13:07:21 +020034#include "psa_util_internal.h"
Andrzej Kurekd6db9be2019-01-10 05:27:10 -050035#include "psa/crypto.h"
36#endif
37
Janos Follath23bdca02016-10-07 14:47:14 +010038#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000039#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020040#endif
41
Andrzej Kurek8a045ce2022-12-23 11:00:06 -050042#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek00644842023-05-30 05:45:00 -040043/* Define local translating functions to save code size by not using too many
44 * arguments in each translating place. */
45static int local_err_translation(psa_status_t status)
46{
47 return psa_status_to_mbedtls(status, psa_to_ssl_errors,
Andrzej Kurek1e4a0302023-05-30 09:45:17 -040048 ARRAY_LENGTH(psa_to_ssl_errors),
Andrzej Kurek00644842023-05-30 05:45:00 -040049 psa_generic_status_to_mbedtls);
50}
51#define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status)
Andrzej Kurek8a045ce2022-12-23 11:00:06 -050052#endif
53
Ronald Cronad8c17b2022-06-10 17:18:09 +020054#if defined(MBEDTLS_TEST_HOOKS)
55static mbedtls_ssl_chk_buf_ptr_args chk_buf_ptr_fail_args;
56
57void mbedtls_ssl_set_chk_buf_ptr_fail_args(
Gilles Peskine449bd832023-01-11 14:50:10 +010058 const uint8_t *cur, const uint8_t *end, size_t need)
Ronald Cronad8c17b2022-06-10 17:18:09 +020059{
60 chk_buf_ptr_fail_args.cur = cur;
61 chk_buf_ptr_fail_args.end = end;
62 chk_buf_ptr_fail_args.need = need;
63}
64
Gilles Peskine449bd832023-01-11 14:50:10 +010065void mbedtls_ssl_reset_chk_buf_ptr_fail_args(void)
Ronald Cronad8c17b2022-06-10 17:18:09 +020066{
Gilles Peskine449bd832023-01-11 14:50:10 +010067 memset(&chk_buf_ptr_fail_args, 0, sizeof(chk_buf_ptr_fail_args));
Ronald Cronad8c17b2022-06-10 17:18:09 +020068}
69
Gilles Peskine449bd832023-01-11 14:50:10 +010070int mbedtls_ssl_cmp_chk_buf_ptr_fail_args(mbedtls_ssl_chk_buf_ptr_args *args)
Ronald Cronad8c17b2022-06-10 17:18:09 +020071{
Gilles Peskine449bd832023-01-11 14:50:10 +010072 return (chk_buf_ptr_fail_args.cur != args->cur) ||
73 (chk_buf_ptr_fail_args.end != args->end) ||
74 (chk_buf_ptr_fail_args.need != args->need);
Ronald Cronad8c17b2022-06-10 17:18:09 +020075}
76#endif /* MBEDTLS_TEST_HOOKS */
77
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020078#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +010079
Hanno Beckera0e20d02019-05-15 14:03:01 +010080#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerf8542cf2019-04-09 15:22:03 +010081/* Top-level Connection ID API */
82
Gilles Peskine449bd832023-01-11 14:50:10 +010083int mbedtls_ssl_conf_cid(mbedtls_ssl_config *conf,
84 size_t len,
85 int ignore_other_cid)
Hanno Beckerad4a1372019-05-03 13:06:44 +010086{
Gilles Peskine449bd832023-01-11 14:50:10 +010087 if (len > MBEDTLS_SSL_CID_IN_LEN_MAX) {
88 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
89 }
Hanno Beckerad4a1372019-05-03 13:06:44 +010090
Gilles Peskine449bd832023-01-11 14:50:10 +010091 if (ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL &&
92 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE) {
93 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Becker611ac772019-05-14 11:45:26 +010094 }
95
96 conf->ignore_unexpected_cid = ignore_other_cid;
Hanno Beckerad4a1372019-05-03 13:06:44 +010097 conf->cid_len = len;
Gilles Peskine449bd832023-01-11 14:50:10 +010098 return 0;
Hanno Beckerad4a1372019-05-03 13:06:44 +010099}
100
Gilles Peskine449bd832023-01-11 14:50:10 +0100101int mbedtls_ssl_set_cid(mbedtls_ssl_context *ssl,
102 int enable,
103 unsigned char const *own_cid,
104 size_t own_cid_len)
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100105{
Gilles Peskine449bd832023-01-11 14:50:10 +0100106 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
107 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
108 }
Hanno Becker76a79ab2019-05-03 14:38:32 +0100109
Hanno Beckerca092242019-04-25 16:01:49 +0100110 ssl->negotiate_cid = enable;
Gilles Peskine449bd832023-01-11 14:50:10 +0100111 if (enable == MBEDTLS_SSL_CID_DISABLED) {
112 MBEDTLS_SSL_DEBUG_MSG(3, ("Disable use of CID extension."));
113 return 0;
Hanno Beckerca092242019-04-25 16:01:49 +0100114 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100115 MBEDTLS_SSL_DEBUG_MSG(3, ("Enable use of CID extension."));
116 MBEDTLS_SSL_DEBUG_BUF(3, "Own CID", own_cid, own_cid_len);
Hanno Beckerca092242019-04-25 16:01:49 +0100117
Gilles Peskine449bd832023-01-11 14:50:10 +0100118 if (own_cid_len != ssl->conf->cid_len) {
119 MBEDTLS_SSL_DEBUG_MSG(3, ("CID length %u does not match CID length %u in config",
120 (unsigned) own_cid_len,
121 (unsigned) ssl->conf->cid_len));
122 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Beckerca092242019-04-25 16:01:49 +0100123 }
124
Gilles Peskine449bd832023-01-11 14:50:10 +0100125 memcpy(ssl->own_cid, own_cid, own_cid_len);
Hanno Beckerb7ee0cf2019-04-30 14:07:31 +0100126 /* Truncation is not an issue here because
127 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
128 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Beckerca092242019-04-25 16:01:49 +0100129
Gilles Peskine449bd832023-01-11 14:50:10 +0100130 return 0;
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100131}
132
Gilles Peskine449bd832023-01-11 14:50:10 +0100133int mbedtls_ssl_get_own_cid(mbedtls_ssl_context *ssl,
134 int *enabled,
135 unsigned char own_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],
136 size_t *own_cid_len)
Paul Elliott0113cf12022-03-11 20:26:47 +0000137{
138 *enabled = MBEDTLS_SSL_CID_DISABLED;
139
Gilles Peskine449bd832023-01-11 14:50:10 +0100140 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
141 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
142 }
Paul Elliott0113cf12022-03-11 20:26:47 +0000143
144 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID length is
145 * zero as this is indistinguishable from not requesting to use
146 * the CID extension. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100147 if (ssl->own_cid_len == 0 || ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED) {
148 return 0;
149 }
Paul Elliott0113cf12022-03-11 20:26:47 +0000150
Gilles Peskine449bd832023-01-11 14:50:10 +0100151 if (own_cid_len != NULL) {
Paul Elliott0113cf12022-03-11 20:26:47 +0000152 *own_cid_len = ssl->own_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100153 if (own_cid != NULL) {
154 memcpy(own_cid, ssl->own_cid, ssl->own_cid_len);
155 }
Paul Elliott0113cf12022-03-11 20:26:47 +0000156 }
157
158 *enabled = MBEDTLS_SSL_CID_ENABLED;
159
Gilles Peskine449bd832023-01-11 14:50:10 +0100160 return 0;
Paul Elliott0113cf12022-03-11 20:26:47 +0000161}
162
Gilles Peskine449bd832023-01-11 14:50:10 +0100163int mbedtls_ssl_get_peer_cid(mbedtls_ssl_context *ssl,
164 int *enabled,
165 unsigned char peer_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX],
166 size_t *peer_cid_len)
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100167{
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100168 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100169
Gilles Peskine449bd832023-01-11 14:50:10 +0100170 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
171 mbedtls_ssl_is_handshake_over(ssl) == 0) {
172 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Becker76a79ab2019-05-03 14:38:32 +0100173 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100174
Hanno Beckerc5f24222019-05-03 12:54:52 +0100175 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
176 * were used, but client and server requested the empty CID.
177 * This is indistinguishable from not using the CID extension
178 * in the first place. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100179 if (ssl->transform_in->in_cid_len == 0 &&
180 ssl->transform_in->out_cid_len == 0) {
181 return 0;
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100182 }
183
Gilles Peskine449bd832023-01-11 14:50:10 +0100184 if (peer_cid_len != NULL) {
Hanno Becker615ef172019-05-22 16:50:35 +0100185 *peer_cid_len = ssl->transform_in->out_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100186 if (peer_cid != NULL) {
187 memcpy(peer_cid, ssl->transform_in->out_cid,
188 ssl->transform_in->out_cid_len);
Hanno Becker615ef172019-05-22 16:50:35 +0100189 }
190 }
Hanno Beckerb1f89cd2019-04-26 17:08:02 +0100191
192 *enabled = MBEDTLS_SSL_CID_ENABLED;
193
Gilles Peskine449bd832023-01-11 14:50:10 +0100194 return 0;
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100195}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100196#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerf8542cf2019-04-09 15:22:03 +0100197
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200198#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200199
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200200#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200201/*
202 * Convert max_fragment_length codes to length.
203 * RFC 6066 says:
204 * enum{
205 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
206 * } MaxFragmentLength;
207 * and we add 0 -> extension unused
208 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100209static unsigned int ssl_mfl_code_to_length(int mfl)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200210{
Gilles Peskine449bd832023-01-11 14:50:10 +0100211 switch (mfl) {
212 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
213 return MBEDTLS_TLS_EXT_ADV_CONTENT_LEN;
214 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
215 return 512;
216 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
217 return 1024;
218 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
219 return 2048;
220 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
221 return 4096;
222 default:
223 return MBEDTLS_TLS_EXT_ADV_CONTENT_LEN;
Angus Grattond8213d02016-05-25 20:56:48 +1000224 }
225}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200226#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200227
Gilles Peskine449bd832023-01-11 14:50:10 +0100228int mbedtls_ssl_session_copy(mbedtls_ssl_session *dst,
229 const mbedtls_ssl_session *src)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200230{
Gilles Peskine449bd832023-01-11 14:50:10 +0100231 mbedtls_ssl_session_free(dst);
232 memcpy(dst, src, sizeof(mbedtls_ssl_session));
吴敬辉0b716112021-11-29 10:46:35 +0800233#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
234 dst->ticket = NULL;
Xiaokang Qian87306442022-10-12 09:47:38 +0000235#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
236 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000237 dst->hostname = NULL;
吴敬辉0b716112021-11-29 10:46:35 +0800238#endif
Xiaokang Qian87306442022-10-12 09:47:38 +0000239#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
吴敬辉0b716112021-11-29 10:46:35 +0800240
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200241#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker6d1986e2019-02-07 12:27:42 +0000242
243#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100244 if (src->peer_cert != NULL) {
Janos Follath865b3eb2019-12-16 11:46:15 +0000245 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker2292d1f2013-09-15 17:06:49 +0200246
Gilles Peskine449bd832023-01-11 14:50:10 +0100247 dst->peer_cert = mbedtls_calloc(1, sizeof(mbedtls_x509_crt));
248 if (dst->peer_cert == NULL) {
249 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
250 }
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200251
Gilles Peskine449bd832023-01-11 14:50:10 +0100252 mbedtls_x509_crt_init(dst->peer_cert);
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200253
Gilles Peskine449bd832023-01-11 14:50:10 +0100254 if ((ret = mbedtls_x509_crt_parse_der(dst->peer_cert, src->peer_cert->raw.p,
255 src->peer_cert->raw.len)) != 0) {
256 mbedtls_free(dst->peer_cert);
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200257 dst->peer_cert = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +0100258 return ret;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200259 }
260 }
Hanno Becker6d1986e2019-02-07 12:27:42 +0000261#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine449bd832023-01-11 14:50:10 +0100262 if (src->peer_cert_digest != NULL) {
Hanno Becker9198ad12019-02-05 17:00:50 +0000263 dst->peer_cert_digest =
Gilles Peskine449bd832023-01-11 14:50:10 +0100264 mbedtls_calloc(1, src->peer_cert_digest_len);
265 if (dst->peer_cert_digest == NULL) {
266 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
267 }
Hanno Becker9198ad12019-02-05 17:00:50 +0000268
Gilles Peskine449bd832023-01-11 14:50:10 +0100269 memcpy(dst->peer_cert_digest, src->peer_cert_digest,
270 src->peer_cert_digest_len);
Hanno Becker9198ad12019-02-05 17:00:50 +0000271 dst->peer_cert_digest_type = src->peer_cert_digest_type;
Hanno Beckeraccc5992019-02-25 10:06:59 +0000272 dst->peer_cert_digest_len = src->peer_cert_digest_len;
Hanno Becker9198ad12019-02-05 17:00:50 +0000273 }
274#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
275
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200276#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200277
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200278#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100279 if (src->ticket != NULL) {
280 dst->ticket = mbedtls_calloc(1, src->ticket_len);
281 if (dst->ticket == NULL) {
282 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
283 }
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200284
Gilles Peskine449bd832023-01-11 14:50:10 +0100285 memcpy(dst->ticket, src->ticket, src->ticket_len);
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200286 }
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000287
288#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
289 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +0100290 if (src->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000291 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +0100292 ret = mbedtls_ssl_session_set_hostname(dst, src->hostname);
293 if (ret != 0) {
294 return ret;
295 }
Xiaokang Qian126bf8e2022-10-13 02:22:40 +0000296 }
297#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
298 MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200299#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200300
Gilles Peskine449bd832023-01-11 14:50:10 +0100301 return 0;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200302}
303
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500304#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200305MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100306static int resize_buffer(unsigned char **buffer, size_t len_new, size_t *len_old)
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500307{
Gilles Peskine449bd832023-01-11 14:50:10 +0100308 unsigned char *resized_buffer = mbedtls_calloc(1, len_new);
309 if (resized_buffer == NULL) {
Yanray Wang365ee3e2023-11-22 10:28:28 +0800310 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
Gilles Peskine449bd832023-01-11 14:50:10 +0100311 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500312
313 /* We want to copy len_new bytes when downsizing the buffer, and
314 * len_old bytes when upsizing, so we choose the smaller of two sizes,
315 * to fit one buffer into another. Size checks, ensuring that no data is
316 * lost, are done outside of this function. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100317 memcpy(resized_buffer, *buffer,
318 (len_new < *len_old) ? len_new : *len_old);
Tom Cosgroveca8c61b2023-07-17 15:17:40 +0100319 mbedtls_zeroize_and_free(*buffer, *len_old);
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500320
321 *buffer = resized_buffer;
322 *len_old = len_new;
323
324 return 0;
325}
Andrzej Kurek4a063792020-10-21 15:08:44 +0200326
Gilles Peskine449bd832023-01-11 14:50:10 +0100327static void handle_buffer_resizing(mbedtls_ssl_context *ssl, int downsizing,
328 size_t in_buf_new_len,
329 size_t out_buf_new_len)
Andrzej Kurek4a063792020-10-21 15:08:44 +0200330{
331 int modified = 0;
332 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0;
333 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +0100334 if (ssl->in_buf != NULL) {
Andrzej Kurek4a063792020-10-21 15:08:44 +0200335 written_in = ssl->in_msg - ssl->in_buf;
336 iv_offset_in = ssl->in_iv - ssl->in_buf;
337 len_offset_in = ssl->in_len - ssl->in_buf;
Gilles Peskine449bd832023-01-11 14:50:10 +0100338 if (downsizing ?
Andrzej Kurek4a063792020-10-21 15:08:44 +0200339 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len :
Gilles Peskine449bd832023-01-11 14:50:10 +0100340 ssl->in_buf_len < in_buf_new_len) {
341 if (resize_buffer(&ssl->in_buf, in_buf_new_len, &ssl->in_buf_len) != 0) {
342 MBEDTLS_SSL_DEBUG_MSG(1, ("input buffer resizing failed - out of memory"));
343 } else {
344 MBEDTLS_SSL_DEBUG_MSG(2, ("Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET,
345 in_buf_new_len));
Andrzej Kurek4a063792020-10-21 15:08:44 +0200346 modified = 1;
347 }
348 }
349 }
350
Gilles Peskine449bd832023-01-11 14:50:10 +0100351 if (ssl->out_buf != NULL) {
Andrzej Kurek4a063792020-10-21 15:08:44 +0200352 written_out = ssl->out_msg - ssl->out_buf;
353 iv_offset_out = ssl->out_iv - ssl->out_buf;
354 len_offset_out = ssl->out_len - ssl->out_buf;
Gilles Peskine449bd832023-01-11 14:50:10 +0100355 if (downsizing ?
Andrzej Kurek4a063792020-10-21 15:08:44 +0200356 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len :
Gilles Peskine449bd832023-01-11 14:50:10 +0100357 ssl->out_buf_len < out_buf_new_len) {
358 if (resize_buffer(&ssl->out_buf, out_buf_new_len, &ssl->out_buf_len) != 0) {
359 MBEDTLS_SSL_DEBUG_MSG(1, ("output buffer resizing failed - out of memory"));
360 } else {
361 MBEDTLS_SSL_DEBUG_MSG(2, ("Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET,
362 out_buf_new_len));
Andrzej Kurek4a063792020-10-21 15:08:44 +0200363 modified = 1;
364 }
365 }
366 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100367 if (modified) {
Andrzej Kurek4a063792020-10-21 15:08:44 +0200368 /* Update pointers here to avoid doing it twice. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100369 mbedtls_ssl_reset_in_out_pointers(ssl);
Andrzej Kurek4a063792020-10-21 15:08:44 +0200370 /* Fields below might not be properly updated with record
371 * splitting or with CID, so they are manually updated here. */
372 ssl->out_msg = ssl->out_buf + written_out;
373 ssl->out_len = ssl->out_buf + len_offset_out;
374 ssl->out_iv = ssl->out_buf + iv_offset_out;
375
376 ssl->in_msg = ssl->in_buf + written_in;
377 ssl->in_len = ssl->in_buf + len_offset_in;
378 ssl->in_iv = ssl->in_buf + iv_offset_in;
379 }
380}
Andrzej Kurek0afa2a12020-03-03 10:39:58 -0500381#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */
382
Jerry Yudb8c48a2022-01-27 14:54:54 +0800383#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yued14c932022-02-17 13:40:45 +0800384
385#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Gilles Peskine449bd832023-01-11 14:50:10 +0100386typedef int (*tls_prf_fn)(const unsigned char *secret, size_t slen,
387 const char *label,
388 const unsigned char *random, size_t rlen,
389 unsigned char *dstbuf, size_t dlen);
Jerry Yued14c932022-02-17 13:40:45 +0800390
Gilles Peskine449bd832023-01-11 14:50:10 +0100391static tls_prf_fn ssl_tls12prf_from_cs(int ciphersuite_id);
Jerry Yued14c932022-02-17 13:40:45 +0800392
393#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
394
395/* Type for the TLS PRF */
396typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *,
397 const unsigned char *, size_t,
398 unsigned char *, size_t);
399
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200400MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100401static int ssl_tls12_populate_transform(mbedtls_ssl_transform *transform,
402 int ciphersuite,
403 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200404#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +0100405 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +0200406#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +0100407 ssl_tls_prf_t tls_prf,
408 const unsigned char randbytes[64],
409 mbedtls_ssl_protocol_version tls_version,
410 unsigned endpoint,
411 const mbedtls_ssl_context *ssl);
Jerry Yued14c932022-02-17 13:40:45 +0800412
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100413#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200414MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100415static int tls_prf_sha256(const unsigned char *secret, size_t slen,
Ron Eldor51d3ab52019-05-12 14:54:30 +0300416 const char *label,
417 const unsigned char *random, size_t rlen,
Gilles Peskine449bd832023-01-11 14:50:10 +0100418 unsigned char *dstbuf, size_t dlen);
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100419static int ssl_calc_verify_tls_sha256(const mbedtls_ssl_context *, unsigned char *, size_t *);
420static int ssl_calc_finished_tls_sha256(mbedtls_ssl_context *, unsigned char *, int);
Gilles Peskine449bd832023-01-11 14:50:10 +0100421
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100422#endif /* MBEDTLS_MD_CAN_SHA256*/
Gilles Peskine449bd832023-01-11 14:50:10 +0100423
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100424#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +0100425MBEDTLS_CHECK_RETURN_CRITICAL
426static int tls_prf_sha384(const unsigned char *secret, size_t slen,
427 const char *label,
428 const unsigned char *random, size_t rlen,
429 unsigned char *dstbuf, size_t dlen);
430
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100431static int ssl_calc_verify_tls_sha384(const mbedtls_ssl_context *, unsigned char *, size_t *);
432static int ssl_calc_finished_tls_sha384(mbedtls_ssl_context *, unsigned char *, int);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100433#endif /* MBEDTLS_MD_CAN_SHA384*/
Gilles Peskine449bd832023-01-11 14:50:10 +0100434
435static size_t ssl_tls12_session_save(const mbedtls_ssl_session *session,
436 unsigned char *buf,
437 size_t buf_len);
438
439MBEDTLS_CHECK_RETURN_CRITICAL
440static int ssl_tls12_session_load(mbedtls_ssl_session *session,
441 const unsigned char *buf,
442 size_t len);
443#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
444
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100445static int ssl_update_checksum_start(mbedtls_ssl_context *, const unsigned char *, size_t);
Gilles Peskine449bd832023-01-11 14:50:10 +0100446
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100447#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100448static int ssl_update_checksum_sha256(mbedtls_ssl_context *, const unsigned char *, size_t);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100449#endif /* MBEDTLS_MD_CAN_SHA256*/
Gilles Peskine449bd832023-01-11 14:50:10 +0100450
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100451#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100452static int ssl_update_checksum_sha384(mbedtls_ssl_context *, const unsigned char *, size_t);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100453#endif /* MBEDTLS_MD_CAN_SHA384*/
Gilles Peskine449bd832023-01-11 14:50:10 +0100454
455int mbedtls_ssl_tls_prf(const mbedtls_tls_prf_types prf,
456 const unsigned char *secret, size_t slen,
457 const char *label,
458 const unsigned char *random, size_t rlen,
459 unsigned char *dstbuf, size_t dlen)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300460{
461 mbedtls_ssl_tls_prf_cb *tls_prf = NULL;
462
Gilles Peskine449bd832023-01-11 14:50:10 +0100463 switch (prf) {
Ron Eldord2f25f72019-05-15 14:54:22 +0300464#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100465#if defined(MBEDTLS_MD_CAN_SHA384)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300466 case MBEDTLS_SSL_TLS_PRF_SHA384:
467 tls_prf = tls_prf_sha384;
Gilles Peskine449bd832023-01-11 14:50:10 +0100468 break;
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100469#endif /* MBEDTLS_MD_CAN_SHA384*/
470#if defined(MBEDTLS_MD_CAN_SHA256)
Ron Eldor51d3ab52019-05-12 14:54:30 +0300471 case MBEDTLS_SSL_TLS_PRF_SHA256:
472 tls_prf = tls_prf_sha256;
Gilles Peskine449bd832023-01-11 14:50:10 +0100473 break;
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100474#endif /* MBEDTLS_MD_CAN_SHA256*/
Ron Eldord2f25f72019-05-15 14:54:22 +0300475#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100476 default:
477 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Ron Eldor51d3ab52019-05-12 14:54:30 +0300478 }
479
Gilles Peskine449bd832023-01-11 14:50:10 +0100480 return tls_prf(secret, slen, label, random, rlen, dstbuf, dlen);
Ron Eldor51d3ab52019-05-12 14:54:30 +0300481}
482
Jerry Yuc73c6182022-02-08 20:29:25 +0800483#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100484static void ssl_clear_peer_cert(mbedtls_ssl_session *session)
Jerry Yuc73c6182022-02-08 20:29:25 +0800485{
486#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +0100487 if (session->peer_cert != NULL) {
488 mbedtls_x509_crt_free(session->peer_cert);
489 mbedtls_free(session->peer_cert);
Jerry Yuc73c6182022-02-08 20:29:25 +0800490 session->peer_cert = NULL;
491 }
492#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine449bd832023-01-11 14:50:10 +0100493 if (session->peer_cert_digest != NULL) {
Jerry Yuc73c6182022-02-08 20:29:25 +0800494 /* Zeroization is not necessary. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100495 mbedtls_free(session->peer_cert_digest);
Jerry Yuc73c6182022-02-08 20:29:25 +0800496 session->peer_cert_digest = NULL;
497 session->peer_cert_digest_type = MBEDTLS_MD_NONE;
498 session->peer_cert_digest_len = 0;
499 }
500#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
501}
502#endif /* MBEDTLS_X509_CRT_PARSE_C */
503
Gilles Peskine449bd832023-01-11 14:50:10 +0100504uint32_t mbedtls_ssl_get_extension_id(unsigned int extension_type)
Jerry Yu7a485c12022-10-31 13:08:18 +0800505{
Gilles Peskine449bd832023-01-11 14:50:10 +0100506 switch (extension_type) {
Jerry Yu7a485c12022-10-31 13:08:18 +0800507 case MBEDTLS_TLS_EXT_SERVERNAME:
Gilles Peskine449bd832023-01-11 14:50:10 +0100508 return MBEDTLS_SSL_EXT_ID_SERVERNAME;
Jerry Yu7a485c12022-10-31 13:08:18 +0800509
510 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100511 return MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH;
Jerry Yu7a485c12022-10-31 13:08:18 +0800512
513 case MBEDTLS_TLS_EXT_STATUS_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +0100514 return MBEDTLS_SSL_EXT_ID_STATUS_REQUEST;
Jerry Yu7a485c12022-10-31 13:08:18 +0800515
516 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100517 return MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS;
Jerry Yu7a485c12022-10-31 13:08:18 +0800518
519 case MBEDTLS_TLS_EXT_SIG_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100520 return MBEDTLS_SSL_EXT_ID_SIG_ALG;
Jerry Yu7a485c12022-10-31 13:08:18 +0800521
522 case MBEDTLS_TLS_EXT_USE_SRTP:
Gilles Peskine449bd832023-01-11 14:50:10 +0100523 return MBEDTLS_SSL_EXT_ID_USE_SRTP;
Jerry Yu7a485c12022-10-31 13:08:18 +0800524
525 case MBEDTLS_TLS_EXT_HEARTBEAT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100526 return MBEDTLS_SSL_EXT_ID_HEARTBEAT;
Jerry Yu7a485c12022-10-31 13:08:18 +0800527
528 case MBEDTLS_TLS_EXT_ALPN:
Gilles Peskine449bd832023-01-11 14:50:10 +0100529 return MBEDTLS_SSL_EXT_ID_ALPN;
Jerry Yu7a485c12022-10-31 13:08:18 +0800530
531 case MBEDTLS_TLS_EXT_SCT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100532 return MBEDTLS_SSL_EXT_ID_SCT;
Jerry Yu7a485c12022-10-31 13:08:18 +0800533
534 case MBEDTLS_TLS_EXT_CLI_CERT_TYPE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100535 return MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE;
Jerry Yu7a485c12022-10-31 13:08:18 +0800536
537 case MBEDTLS_TLS_EXT_SERV_CERT_TYPE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100538 return MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE;
Jerry Yu7a485c12022-10-31 13:08:18 +0800539
540 case MBEDTLS_TLS_EXT_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100541 return MBEDTLS_SSL_EXT_ID_PADDING;
Jerry Yu7a485c12022-10-31 13:08:18 +0800542
543 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100544 return MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY;
Jerry Yu7a485c12022-10-31 13:08:18 +0800545
546 case MBEDTLS_TLS_EXT_EARLY_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100547 return MBEDTLS_SSL_EXT_ID_EARLY_DATA;
Jerry Yu7a485c12022-10-31 13:08:18 +0800548
549 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100550 return MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS;
Jerry Yu7a485c12022-10-31 13:08:18 +0800551
552 case MBEDTLS_TLS_EXT_COOKIE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100553 return MBEDTLS_SSL_EXT_ID_COOKIE;
Jerry Yu7a485c12022-10-31 13:08:18 +0800554
555 case MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100556 return MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES;
Jerry Yu7a485c12022-10-31 13:08:18 +0800557
558 case MBEDTLS_TLS_EXT_CERT_AUTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100559 return MBEDTLS_SSL_EXT_ID_CERT_AUTH;
Jerry Yu7a485c12022-10-31 13:08:18 +0800560
561 case MBEDTLS_TLS_EXT_OID_FILTERS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100562 return MBEDTLS_SSL_EXT_ID_OID_FILTERS;
Jerry Yu7a485c12022-10-31 13:08:18 +0800563
564 case MBEDTLS_TLS_EXT_POST_HANDSHAKE_AUTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100565 return MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH;
Jerry Yu7a485c12022-10-31 13:08:18 +0800566
567 case MBEDTLS_TLS_EXT_SIG_ALG_CERT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100568 return MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT;
Jerry Yu7a485c12022-10-31 13:08:18 +0800569
570 case MBEDTLS_TLS_EXT_KEY_SHARE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100571 return MBEDTLS_SSL_EXT_ID_KEY_SHARE;
Jerry Yu7a485c12022-10-31 13:08:18 +0800572
573 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
Gilles Peskine449bd832023-01-11 14:50:10 +0100574 return MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC;
Jerry Yu7a485c12022-10-31 13:08:18 +0800575
576 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100577 return MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS;
Jerry Yu7a485c12022-10-31 13:08:18 +0800578
579 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
Gilles Peskine449bd832023-01-11 14:50:10 +0100580 return MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC;
Jerry Yu7a485c12022-10-31 13:08:18 +0800581
582 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +0100583 return MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET;
Jerry Yu7a485c12022-10-31 13:08:18 +0800584
Jan Bruckner151f6422023-02-10 12:45:19 +0100585 case MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT:
586 return MBEDTLS_SSL_EXT_ID_RECORD_SIZE_LIMIT;
587
Jerry Yu7a485c12022-10-31 13:08:18 +0800588 case MBEDTLS_TLS_EXT_SESSION_TICKET:
Gilles Peskine449bd832023-01-11 14:50:10 +0100589 return MBEDTLS_SSL_EXT_ID_SESSION_TICKET;
Jerry Yu7a485c12022-10-31 13:08:18 +0800590
591 }
592
Gilles Peskine449bd832023-01-11 14:50:10 +0100593 return MBEDTLS_SSL_EXT_ID_UNRECOGNIZED;
Jerry Yu7a485c12022-10-31 13:08:18 +0800594}
595
Gilles Peskine449bd832023-01-11 14:50:10 +0100596uint32_t mbedtls_ssl_get_extension_mask(unsigned int extension_type)
Jerry Yu7a485c12022-10-31 13:08:18 +0800597{
Gilles Peskine449bd832023-01-11 14:50:10 +0100598 return 1 << mbedtls_ssl_get_extension_id(extension_type);
Jerry Yu7a485c12022-10-31 13:08:18 +0800599}
600
Jerry Yud25cab02022-10-31 12:48:30 +0800601#if defined(MBEDTLS_DEBUG_C)
602static const char *extension_name_table[] = {
Jerry Yuea52ed92022-11-08 21:01:17 +0800603 [MBEDTLS_SSL_EXT_ID_UNRECOGNIZED] = "unrecognized",
Jerry Yud25cab02022-10-31 12:48:30 +0800604 [MBEDTLS_SSL_EXT_ID_SERVERNAME] = "server_name",
605 [MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH] = "max_fragment_length",
606 [MBEDTLS_SSL_EXT_ID_STATUS_REQUEST] = "status_request",
607 [MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS] = "supported_groups",
608 [MBEDTLS_SSL_EXT_ID_SIG_ALG] = "signature_algorithms",
609 [MBEDTLS_SSL_EXT_ID_USE_SRTP] = "use_srtp",
610 [MBEDTLS_SSL_EXT_ID_HEARTBEAT] = "heartbeat",
611 [MBEDTLS_SSL_EXT_ID_ALPN] = "application_layer_protocol_negotiation",
612 [MBEDTLS_SSL_EXT_ID_SCT] = "signed_certificate_timestamp",
613 [MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE] = "client_certificate_type",
614 [MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE] = "server_certificate_type",
615 [MBEDTLS_SSL_EXT_ID_PADDING] = "padding",
616 [MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY] = "pre_shared_key",
617 [MBEDTLS_SSL_EXT_ID_EARLY_DATA] = "early_data",
618 [MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS] = "supported_versions",
619 [MBEDTLS_SSL_EXT_ID_COOKIE] = "cookie",
620 [MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES] = "psk_key_exchange_modes",
621 [MBEDTLS_SSL_EXT_ID_CERT_AUTH] = "certificate_authorities",
622 [MBEDTLS_SSL_EXT_ID_OID_FILTERS] = "oid_filters",
623 [MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH] = "post_handshake_auth",
624 [MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT] = "signature_algorithms_cert",
625 [MBEDTLS_SSL_EXT_ID_KEY_SHARE] = "key_share",
626 [MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC] = "truncated_hmac",
627 [MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS] = "supported_point_formats",
628 [MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC] = "encrypt_then_mac",
629 [MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET] = "extended_master_secret",
Jan Bruckner151f6422023-02-10 12:45:19 +0100630 [MBEDTLS_SSL_EXT_ID_SESSION_TICKET] = "session_ticket",
631 [MBEDTLS_SSL_EXT_ID_RECORD_SIZE_LIMIT] = "record_size_limit"
Jerry Yud25cab02022-10-31 12:48:30 +0800632};
633
Chien Wong4e9683e2023-12-28 17:07:43 +0800634static const unsigned int extension_type_table[] = {
Jerry Yud25cab02022-10-31 12:48:30 +0800635 [MBEDTLS_SSL_EXT_ID_UNRECOGNIZED] = 0xff,
636 [MBEDTLS_SSL_EXT_ID_SERVERNAME] = MBEDTLS_TLS_EXT_SERVERNAME,
637 [MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH] = MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH,
638 [MBEDTLS_SSL_EXT_ID_STATUS_REQUEST] = MBEDTLS_TLS_EXT_STATUS_REQUEST,
639 [MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS] = MBEDTLS_TLS_EXT_SUPPORTED_GROUPS,
640 [MBEDTLS_SSL_EXT_ID_SIG_ALG] = MBEDTLS_TLS_EXT_SIG_ALG,
641 [MBEDTLS_SSL_EXT_ID_USE_SRTP] = MBEDTLS_TLS_EXT_USE_SRTP,
642 [MBEDTLS_SSL_EXT_ID_HEARTBEAT] = MBEDTLS_TLS_EXT_HEARTBEAT,
643 [MBEDTLS_SSL_EXT_ID_ALPN] = MBEDTLS_TLS_EXT_ALPN,
644 [MBEDTLS_SSL_EXT_ID_SCT] = MBEDTLS_TLS_EXT_SCT,
645 [MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE] = MBEDTLS_TLS_EXT_CLI_CERT_TYPE,
646 [MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE] = MBEDTLS_TLS_EXT_SERV_CERT_TYPE,
647 [MBEDTLS_SSL_EXT_ID_PADDING] = MBEDTLS_TLS_EXT_PADDING,
648 [MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY] = MBEDTLS_TLS_EXT_PRE_SHARED_KEY,
649 [MBEDTLS_SSL_EXT_ID_EARLY_DATA] = MBEDTLS_TLS_EXT_EARLY_DATA,
650 [MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS] = MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS,
651 [MBEDTLS_SSL_EXT_ID_COOKIE] = MBEDTLS_TLS_EXT_COOKIE,
652 [MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES] = MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES,
653 [MBEDTLS_SSL_EXT_ID_CERT_AUTH] = MBEDTLS_TLS_EXT_CERT_AUTH,
654 [MBEDTLS_SSL_EXT_ID_OID_FILTERS] = MBEDTLS_TLS_EXT_OID_FILTERS,
655 [MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH] = MBEDTLS_TLS_EXT_POST_HANDSHAKE_AUTH,
656 [MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT] = MBEDTLS_TLS_EXT_SIG_ALG_CERT,
657 [MBEDTLS_SSL_EXT_ID_KEY_SHARE] = MBEDTLS_TLS_EXT_KEY_SHARE,
658 [MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC] = MBEDTLS_TLS_EXT_TRUNCATED_HMAC,
659 [MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS] = MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS,
660 [MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC] = MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC,
661 [MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET] = MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET,
Jan Bruckner151f6422023-02-10 12:45:19 +0100662 [MBEDTLS_SSL_EXT_ID_SESSION_TICKET] = MBEDTLS_TLS_EXT_SESSION_TICKET,
663 [MBEDTLS_SSL_EXT_ID_RECORD_SIZE_LIMIT] = MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT
Jerry Yud25cab02022-10-31 12:48:30 +0800664};
665
Gilles Peskine449bd832023-01-11 14:50:10 +0100666const char *mbedtls_ssl_get_extension_name(unsigned int extension_type)
Jerry Yud25cab02022-10-31 12:48:30 +0800667{
Gilles Peskine449bd832023-01-11 14:50:10 +0100668 return extension_name_table[
669 mbedtls_ssl_get_extension_id(extension_type)];
Jerry Yud25cab02022-10-31 12:48:30 +0800670}
671
Gilles Peskine449bd832023-01-11 14:50:10 +0100672static const char *ssl_tls13_get_hs_msg_name(int hs_msg_type)
Jerry Yud25cab02022-10-31 12:48:30 +0800673{
Gilles Peskine449bd832023-01-11 14:50:10 +0100674 switch (hs_msg_type) {
Jerry Yud25cab02022-10-31 12:48:30 +0800675 case MBEDTLS_SSL_HS_CLIENT_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100676 return "ClientHello";
Jerry Yud25cab02022-10-31 12:48:30 +0800677 case MBEDTLS_SSL_HS_SERVER_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100678 return "ServerHello";
Jerry Yud25cab02022-10-31 12:48:30 +0800679 case MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +0100680 return "HelloRetryRequest";
Jerry Yud25cab02022-10-31 12:48:30 +0800681 case MBEDTLS_SSL_HS_NEW_SESSION_TICKET:
Gilles Peskine449bd832023-01-11 14:50:10 +0100682 return "NewSessionTicket";
Jerry Yud25cab02022-10-31 12:48:30 +0800683 case MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS:
Gilles Peskine449bd832023-01-11 14:50:10 +0100684 return "EncryptedExtensions";
Jerry Yud25cab02022-10-31 12:48:30 +0800685 case MBEDTLS_SSL_HS_CERTIFICATE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100686 return "Certificate";
Jerry Yud25cab02022-10-31 12:48:30 +0800687 case MBEDTLS_SSL_HS_CERTIFICATE_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +0100688 return "CertificateRequest";
Jerry Yud25cab02022-10-31 12:48:30 +0800689 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100690 return "Unknown";
Jerry Yud25cab02022-10-31 12:48:30 +0800691}
692
Gilles Peskine449bd832023-01-11 14:50:10 +0100693void mbedtls_ssl_print_extension(const mbedtls_ssl_context *ssl,
694 int level, const char *file, int line,
695 int hs_msg_type, unsigned int extension_type,
696 const char *extra_msg0, const char *extra_msg1)
Jerry Yud25cab02022-10-31 12:48:30 +0800697{
698 const char *extra_msg;
Gilles Peskine449bd832023-01-11 14:50:10 +0100699 if (extra_msg0 && extra_msg1) {
Jerry Yud25cab02022-10-31 12:48:30 +0800700 mbedtls_debug_print_msg(
701 ssl, level, file, line,
702 "%s: %s(%u) extension %s %s.",
Gilles Peskine449bd832023-01-11 14:50:10 +0100703 ssl_tls13_get_hs_msg_name(hs_msg_type),
704 mbedtls_ssl_get_extension_name(extension_type),
Jerry Yud25cab02022-10-31 12:48:30 +0800705 extension_type,
Gilles Peskine449bd832023-01-11 14:50:10 +0100706 extra_msg0, extra_msg1);
Jerry Yud25cab02022-10-31 12:48:30 +0800707 return;
708 }
709
710 extra_msg = extra_msg0 ? extra_msg0 : extra_msg1;
Gilles Peskine449bd832023-01-11 14:50:10 +0100711 if (extra_msg) {
Jerry Yud25cab02022-10-31 12:48:30 +0800712 mbedtls_debug_print_msg(
713 ssl, level, file, line,
Gilles Peskine449bd832023-01-11 14:50:10 +0100714 "%s: %s(%u) extension %s.", ssl_tls13_get_hs_msg_name(hs_msg_type),
715 mbedtls_ssl_get_extension_name(extension_type), extension_type,
716 extra_msg);
Jerry Yud25cab02022-10-31 12:48:30 +0800717 return;
718 }
719
720 mbedtls_debug_print_msg(
721 ssl, level, file, line,
Gilles Peskine449bd832023-01-11 14:50:10 +0100722 "%s: %s(%u) extension.", ssl_tls13_get_hs_msg_name(hs_msg_type),
723 mbedtls_ssl_get_extension_name(extension_type), extension_type);
Jerry Yud25cab02022-10-31 12:48:30 +0800724}
725
Gilles Peskine449bd832023-01-11 14:50:10 +0100726void mbedtls_ssl_print_extensions(const mbedtls_ssl_context *ssl,
727 int level, const char *file, int line,
728 int hs_msg_type, uint32_t extensions_mask,
729 const char *extra)
Jerry Yud25cab02022-10-31 12:48:30 +0800730{
731
Gilles Peskine449bd832023-01-11 14:50:10 +0100732 for (unsigned i = 0;
733 i < sizeof(extension_name_table) / sizeof(extension_name_table[0]);
734 i++) {
Jerry Yu79aa7212022-11-08 21:30:21 +0800735 mbedtls_ssl_print_extension(
Jerry Yuea52ed92022-11-08 21:01:17 +0800736 ssl, level, file, line, hs_msg_type, extension_type_table[i],
Gilles Peskine449bd832023-01-11 14:50:10 +0100737 extensions_mask & (1 << i) ? "exists" : "does not exist", extra);
Jerry Yud25cab02022-10-31 12:48:30 +0800738 }
739}
740
Pengyu Lvee455c02023-01-12 14:37:24 +0800741#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Pengyu Lvee455c02023-01-12 14:37:24 +0800742static const char *ticket_flag_name_table[] =
743{
744 [0] = "ALLOW_PSK_RESUMPTION",
745 [2] = "ALLOW_PSK_EPHEMERAL_RESUMPTION",
746 [3] = "ALLOW_EARLY_DATA",
747};
748
Pengyu Lv4938a562023-01-16 11:28:49 +0800749void mbedtls_ssl_print_ticket_flags(const mbedtls_ssl_context *ssl,
750 int level, const char *file, int line,
751 unsigned int flags)
Pengyu Lvee455c02023-01-12 14:37:24 +0800752{
753 size_t i;
754
755 mbedtls_debug_print_msg(ssl, level, file, line,
Pengyu Lv4938a562023-01-16 11:28:49 +0800756 "print ticket_flags (0x%02x)", flags);
757
758 flags = flags & MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK;
Pengyu Lvee455c02023-01-12 14:37:24 +0800759
760 for (i = 0; i < ARRAY_LENGTH(ticket_flag_name_table); i++) {
Pengyu Lv4938a562023-01-16 11:28:49 +0800761 if ((flags & (1 << i))) {
Pengyu Lvee455c02023-01-12 14:37:24 +0800762 mbedtls_debug_print_msg(ssl, level, file, line, "- %s is set.",
763 ticket_flag_name_table[i]);
764 }
765 }
766}
767#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_SSL_SESSION_TICKETS */
768
Jerry Yud25cab02022-10-31 12:48:30 +0800769#endif /* MBEDTLS_DEBUG_C */
770
Gilles Peskine449bd832023-01-11 14:50:10 +0100771void mbedtls_ssl_optimize_checksum(mbedtls_ssl_context *ssl,
772 const mbedtls_ssl_ciphersuite_t *ciphersuite_info)
Jerry Yuc73c6182022-02-08 20:29:25 +0800773{
774 ((void) ciphersuite_info);
775
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100776#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +0100777 if (ciphersuite_info->mac == MBEDTLS_MD_SHA384) {
Jerry Yuc73c6182022-02-08 20:29:25 +0800778 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
Gilles Peskine449bd832023-01-11 14:50:10 +0100779 } else
Jerry Yuc73c6182022-02-08 20:29:25 +0800780#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100781#if defined(MBEDTLS_MD_CAN_SHA256)
Gilles Peskine449bd832023-01-11 14:50:10 +0100782 if (ciphersuite_info->mac != MBEDTLS_MD_SHA384) {
Jerry Yuc73c6182022-02-08 20:29:25 +0800783 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
Gilles Peskine449bd832023-01-11 14:50:10 +0100784 } else
Jerry Yuc73c6182022-02-08 20:29:25 +0800785#endif
786 {
Gilles Peskine449bd832023-01-11 14:50:10 +0100787 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
Jerry Yuc73c6182022-02-08 20:29:25 +0800788 return;
789 }
790}
791
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100792int mbedtls_ssl_add_hs_hdr_to_checksum(mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100793 unsigned hs_type,
794 size_t total_hs_len)
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100795{
796 unsigned char hs_hdr[4];
797
798 /* Build HS header for checksum update. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100799 hs_hdr[0] = MBEDTLS_BYTE_0(hs_type);
800 hs_hdr[1] = MBEDTLS_BYTE_2(total_hs_len);
801 hs_hdr[2] = MBEDTLS_BYTE_1(total_hs_len);
802 hs_hdr[3] = MBEDTLS_BYTE_0(total_hs_len);
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100803
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100804 return ssl->handshake->update_checksum(ssl, hs_hdr, sizeof(hs_hdr));
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100805}
806
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100807int mbedtls_ssl_add_hs_msg_to_checksum(mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100808 unsigned hs_type,
809 unsigned char const *msg,
810 size_t msg_len)
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100811{
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100812 int ret;
813 ret = mbedtls_ssl_add_hs_hdr_to_checksum(ssl, hs_type, msg_len);
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100814 if (ret != 0) {
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100815 return ret;
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100816 }
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100817 return ssl->handshake->update_checksum(ssl, msg, msg_len);
Ronald Cron8f6d39a2022-03-10 18:56:50 +0100818}
819
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100820int mbedtls_ssl_reset_checksum(mbedtls_ssl_context *ssl)
Jerry Yuc73c6182022-02-08 20:29:25 +0800821{
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100822#if defined(MBEDTLS_MD_CAN_SHA256) || \
823 defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100824#if defined(MBEDTLS_USE_PSA_CRYPTO)
825 psa_status_t status;
826#else
827 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
828#endif
Manuel Pégourié-Gonnard626aaed2023-02-06 22:03:06 +0100829#else /* SHA-256 or SHA-384 */
Jerry Yuc73c6182022-02-08 20:29:25 +0800830 ((void) ssl);
Manuel Pégourié-Gonnard626aaed2023-02-06 22:03:06 +0100831#endif /* SHA-256 or SHA-384 */
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100832#if defined(MBEDTLS_MD_CAN_SHA256)
Jerry Yuc73c6182022-02-08 20:29:25 +0800833#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100834 status = psa_hash_abort(&ssl->handshake->fin_sha256_psa);
835 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200836 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100837 }
838 status = psa_hash_setup(&ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256);
839 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200840 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100841 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800842#else
Manuel Pégourié-Gonnard947cee12023-03-06 11:59:59 +0100843 mbedtls_md_free(&ssl->handshake->fin_sha256);
844 mbedtls_md_init(&ssl->handshake->fin_sha256);
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100845 ret = mbedtls_md_setup(&ssl->handshake->fin_sha256,
846 mbedtls_md_info_from_type(MBEDTLS_MD_SHA256),
847 0);
848 if (ret != 0) {
849 return ret;
850 }
851 ret = mbedtls_md_starts(&ssl->handshake->fin_sha256);
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100852 if (ret != 0) {
853 return ret;
854 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800855#endif
856#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100857#if defined(MBEDTLS_MD_CAN_SHA384)
Jerry Yuc73c6182022-02-08 20:29:25 +0800858#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100859 status = psa_hash_abort(&ssl->handshake->fin_sha384_psa);
860 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200861 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100862 }
863 status = psa_hash_setup(&ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384);
864 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200865 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100866 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800867#else
Manuel Pégourié-Gonnard947cee12023-03-06 11:59:59 +0100868 mbedtls_md_free(&ssl->handshake->fin_sha384);
869 mbedtls_md_init(&ssl->handshake->fin_sha384);
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100870 ret = mbedtls_md_setup(&ssl->handshake->fin_sha384,
871 mbedtls_md_info_from_type(MBEDTLS_MD_SHA384), 0);
872 if (ret != 0) {
873 return ret;
874 }
875 ret = mbedtls_md_starts(&ssl->handshake->fin_sha384);
Manuel Pégourié-Gonnardb72ff492023-02-06 09:54:49 +0100876 if (ret != 0) {
877 return ret;
878 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800879#endif
880#endif
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100881 return 0;
Jerry Yuc73c6182022-02-08 20:29:25 +0800882}
883
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100884static int ssl_update_checksum_start(mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100885 const unsigned char *buf, size_t len)
Jerry Yuc73c6182022-02-08 20:29:25 +0800886{
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100887#if defined(MBEDTLS_MD_CAN_SHA256) || \
888 defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100889#if defined(MBEDTLS_USE_PSA_CRYPTO)
890 psa_status_t status;
891#else
892 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
893#endif
Manuel Pégourié-Gonnard626aaed2023-02-06 22:03:06 +0100894#else /* SHA-256 or SHA-384 */
895 ((void) ssl);
896 (void) buf;
897 (void) len;
898#endif /* SHA-256 or SHA-384 */
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100899#if defined(MBEDTLS_MD_CAN_SHA256)
Jerry Yuc73c6182022-02-08 20:29:25 +0800900#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100901 status = psa_hash_update(&ssl->handshake->fin_sha256_psa, buf, len);
902 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200903 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100904 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800905#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100906 ret = mbedtls_md_update(&ssl->handshake->fin_sha256, buf, len);
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100907 if (ret != 0) {
908 return ret;
909 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800910#endif
911#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100912#if defined(MBEDTLS_MD_CAN_SHA384)
Jerry Yuc73c6182022-02-08 20:29:25 +0800913#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100914 status = psa_hash_update(&ssl->handshake->fin_sha384_psa, buf, len);
915 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200916 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100917 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800918#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100919 ret = mbedtls_md_update(&ssl->handshake->fin_sha384, buf, len);
Manuel Pégourié-Gonnarddf949012023-02-06 10:00:52 +0100920 if (ret != 0) {
921 return ret;
922 }
Jerry Yuc73c6182022-02-08 20:29:25 +0800923#endif
924#endif
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100925 return 0;
Jerry Yuc73c6182022-02-08 20:29:25 +0800926}
927
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100928#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100929static int ssl_update_checksum_sha256(mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100930 const unsigned char *buf, size_t len)
Jerry Yuc73c6182022-02-08 20:29:25 +0800931{
932#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200933 return mbedtls_md_error_from_psa(psa_hash_update(
934 &ssl->handshake->fin_sha256_psa, buf, len));
Jerry Yuc73c6182022-02-08 20:29:25 +0800935#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100936 return mbedtls_md_update(&ssl->handshake->fin_sha256, buf, len);
Jerry Yuc73c6182022-02-08 20:29:25 +0800937#endif
938}
939#endif
940
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100941#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +0100942static int ssl_update_checksum_sha384(mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +0100943 const unsigned char *buf, size_t len)
Jerry Yuc73c6182022-02-08 20:29:25 +0800944{
945#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +0200946 return mbedtls_md_error_from_psa(psa_hash_update(
947 &ssl->handshake->fin_sha384_psa, buf, len));
Jerry Yuc73c6182022-02-08 20:29:25 +0800948#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100949 return mbedtls_md_update(&ssl->handshake->fin_sha384, buf, len);
Jerry Yuc73c6182022-02-08 20:29:25 +0800950#endif
951}
952#endif
953
Gilles Peskine449bd832023-01-11 14:50:10 +0100954static void ssl_handshake_params_init(mbedtls_ssl_handshake_params *handshake)
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200955{
Gilles Peskine449bd832023-01-11 14:50:10 +0100956 memset(handshake, 0, sizeof(mbedtls_ssl_handshake_params));
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200957
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100958#if defined(MBEDTLS_MD_CAN_SHA256)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500959#if defined(MBEDTLS_USE_PSA_CRYPTO)
960 handshake->fin_sha256_psa = psa_hash_operation_init();
Andrzej Kurekeb342242019-01-29 09:14:33 -0500961#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100962 mbedtls_md_init(&handshake->fin_sha256);
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200963#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500964#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +0100965#if defined(MBEDTLS_MD_CAN_SHA384)
Andrzej Kurekeb342242019-01-29 09:14:33 -0500966#if defined(MBEDTLS_USE_PSA_CRYPTO)
Andrzej Kurek972fba52019-01-30 03:29:12 -0500967 handshake->fin_sha384_psa = psa_hash_operation_init();
Andrzej Kurekeb342242019-01-29 09:14:33 -0500968#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +0100969 mbedtls_md_init(&handshake->fin_sha384);
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200970#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -0500971#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200972
973 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100974
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200975#if defined(MBEDTLS_DHM_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100976 mbedtls_dhm_init(&handshake->dhm_ctx);
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200977#endif
Valerio Setti7aeec542023-07-05 18:57:21 +0200978#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
Valerio Setti6eb00542023-07-07 17:04:24 +0200979 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +0100980 mbedtls_ecdh_init(&handshake->ecdh_ctx);
Paul Bakkeraccaffe2014-06-26 13:37:14 +0200981#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +0200982#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Neil Armstrongca7d5062022-05-31 14:43:23 +0200983#if defined(MBEDTLS_USE_PSA_CRYPTO)
984 handshake->psa_pake_ctx = psa_pake_operation_init();
985 handshake->psa_pake_password = MBEDTLS_SVC_KEY_ID_INIT;
986#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100987 mbedtls_ecjpake_init(&handshake->ecjpake_ctx);
Neil Armstrongca7d5062022-05-31 14:43:23 +0200988#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +0200989#if defined(MBEDTLS_SSL_CLI_C)
990 handshake->ecjpake_cache = NULL;
991 handshake->ecjpake_cache_len = 0;
992#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +0200993#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200994
Gilles Peskineeccd8882020-03-10 12:19:08 +0100995#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +0100996 mbedtls_x509_crt_restart_init(&handshake->ecrs_ctx);
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +0200997#endif
998
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +0200999#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1000 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
1001#endif
Hanno Becker75173122019-02-06 16:18:31 +00001002
1003#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
1004 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01001005 mbedtls_pk_init(&handshake->peer_pubkey);
Hanno Becker75173122019-02-06 16:18:31 +00001006#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001007}
1008
Gilles Peskine449bd832023-01-11 14:50:10 +01001009void mbedtls_ssl_transform_init(mbedtls_ssl_transform *transform)
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001010{
Gilles Peskine449bd832023-01-11 14:50:10 +01001011 memset(transform, 0, sizeof(mbedtls_ssl_transform));
Paul Bakker84bbeb52014-07-01 14:53:22 +02001012
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +01001013#if defined(MBEDTLS_USE_PSA_CRYPTO)
1014 transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
1015 transform->psa_key_dec = MBEDTLS_SVC_KEY_ID_INIT;
Przemyslaw Stekiel6be9cf52022-01-19 16:00:22 +01001016#else
Gilles Peskine449bd832023-01-11 14:50:10 +01001017 mbedtls_cipher_init(&transform->cipher_ctx_enc);
1018 mbedtls_cipher_init(&transform->cipher_ctx_dec);
Przemyslaw Stekiel8f80fb92022-01-11 08:28:13 +01001019#endif
1020
Hanno Beckerfd86ca82020-11-30 08:54:23 +00001021#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Neil Armstrong39b8e7d2022-02-23 09:24:45 +01001022#if defined(MBEDTLS_USE_PSA_CRYPTO)
1023 transform->psa_mac_enc = MBEDTLS_SVC_KEY_ID_INIT;
1024 transform->psa_mac_dec = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrongcf8841a2022-02-24 11:17:45 +01001025#else
Gilles Peskine449bd832023-01-11 14:50:10 +01001026 mbedtls_md_init(&transform->md_ctx_enc);
1027 mbedtls_md_init(&transform->md_ctx_dec);
Hanno Beckerd56ed242018-01-03 15:32:51 +00001028#endif
Neil Armstrongcf8841a2022-02-24 11:17:45 +01001029#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001030}
1031
Gilles Peskine449bd832023-01-11 14:50:10 +01001032void mbedtls_ssl_session_init(mbedtls_ssl_session *session)
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001033{
Gilles Peskine449bd832023-01-11 14:50:10 +01001034 memset(session, 0, sizeof(mbedtls_ssl_session));
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001035}
1036
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001037MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001038static int ssl_handshake_init(mbedtls_ssl_context *ssl)
Paul Bakker48916f92012-09-16 19:57:18 +00001039{
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001040 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1041
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001042 /* Clear old handshake information if present */
Jerry Yu2e199812022-12-01 18:57:19 +08001043#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001044 if (ssl->transform_negotiate) {
1045 mbedtls_ssl_transform_free(ssl->transform_negotiate);
1046 }
Jerry Yu2e199812022-12-01 18:57:19 +08001047#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001048 if (ssl->session_negotiate) {
1049 mbedtls_ssl_session_free(ssl->session_negotiate);
1050 }
1051 if (ssl->handshake) {
1052 mbedtls_ssl_handshake_free(ssl);
1053 }
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001054
Jerry Yu2e199812022-12-01 18:57:19 +08001055#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001056 /*
1057 * Either the pointers are now NULL or cleared properly and can be freed.
1058 * Now allocate missing structures.
1059 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001060 if (ssl->transform_negotiate == NULL) {
1061 ssl->transform_negotiate = mbedtls_calloc(1, sizeof(mbedtls_ssl_transform));
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001062 }
Jerry Yu2e199812022-12-01 18:57:19 +08001063#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker48916f92012-09-16 19:57:18 +00001064
Gilles Peskine449bd832023-01-11 14:50:10 +01001065 if (ssl->session_negotiate == NULL) {
1066 ssl->session_negotiate = mbedtls_calloc(1, sizeof(mbedtls_ssl_session));
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001067 }
Paul Bakker48916f92012-09-16 19:57:18 +00001068
Gilles Peskine449bd832023-01-11 14:50:10 +01001069 if (ssl->handshake == NULL) {
1070 ssl->handshake = mbedtls_calloc(1, sizeof(mbedtls_ssl_handshake_params));
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001071 }
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05001072#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1073 /* If the buffers are too small - reallocate */
Andrzej Kurek8ea68722020-04-03 06:40:47 -04001074
Gilles Peskine449bd832023-01-11 14:50:10 +01001075 handle_buffer_resizing(ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN,
1076 MBEDTLS_SSL_OUT_BUFFER_LEN);
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05001077#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001078
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001079 /* All pointers should exist and can be directly freed without issue */
Gilles Peskine449bd832023-01-11 14:50:10 +01001080 if (ssl->handshake == NULL ||
Jerry Yu2e199812022-12-01 18:57:19 +08001081#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker48916f92012-09-16 19:57:18 +00001082 ssl->transform_negotiate == NULL ||
Jerry Yu2e199812022-12-01 18:57:19 +08001083#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001084 ssl->session_negotiate == NULL) {
1085 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc() of ssl sub-contexts failed"));
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001086
Gilles Peskine449bd832023-01-11 14:50:10 +01001087 mbedtls_free(ssl->handshake);
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001088 ssl->handshake = NULL;
Jerry Yu2e199812022-12-01 18:57:19 +08001089
1090#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001091 mbedtls_free(ssl->transform_negotiate);
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001092 ssl->transform_negotiate = NULL;
Jerry Yu2e199812022-12-01 18:57:19 +08001093#endif
1094
Gilles Peskine449bd832023-01-11 14:50:10 +01001095 mbedtls_free(ssl->session_negotiate);
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001096 ssl->session_negotiate = NULL;
1097
Gilles Peskine449bd832023-01-11 14:50:10 +01001098 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
Paul Bakker48916f92012-09-16 19:57:18 +00001099 }
1100
Ronald Cron78a38f62024-02-01 18:30:31 +01001101#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_CLI_C)
1102 ssl->early_data_status = MBEDTLS_SSL_EARLY_DATA_STATUS_NOT_SENT;
Ronald Cron5d0ae902024-01-05 14:20:35 +01001103#endif
1104
Paul Bakkeraccaffe2014-06-26 13:37:14 +02001105 /* Initialize structures */
Gilles Peskine449bd832023-01-11 14:50:10 +01001106 mbedtls_ssl_session_init(ssl->session_negotiate);
1107 ssl_handshake_params_init(ssl->handshake);
Paul Bakker968afaa2014-07-09 11:09:24 +02001108
Jerry Yu2e199812022-12-01 18:57:19 +08001109#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001110 mbedtls_ssl_transform_init(ssl->transform_negotiate);
Jerry Yu2e199812022-12-01 18:57:19 +08001111#endif
1112
Manuel Pégourié-Gonnard537f2312023-02-05 10:17:45 +01001113 /* Setup handshake checksums */
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001114 ret = mbedtls_ssl_reset_checksum(ssl);
1115 if (ret != 0) {
1116 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_reset_checksum", ret);
1117 return ret;
1118 }
Manuel Pégourié-Gonnard537f2312023-02-05 10:17:45 +01001119
Jerry Yud0766ec2022-09-22 10:46:57 +08001120#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
1121 defined(MBEDTLS_SSL_SRV_C) && \
1122 defined(MBEDTLS_SSL_SESSION_TICKETS)
1123 ssl->handshake->new_session_tickets_count =
Gilles Peskine449bd832023-01-11 14:50:10 +01001124 ssl->conf->new_session_tickets_count;
Jerry Yud0766ec2022-09-22 10:46:57 +08001125#endif
1126
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001127#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01001128 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001129 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02001130
Gilles Peskine449bd832023-01-11 14:50:10 +01001131 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001132 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
Gilles Peskine449bd832023-01-11 14:50:10 +01001133 } else {
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001134 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Gilles Peskine449bd832023-01-11 14:50:10 +01001135 }
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001136
Gilles Peskine449bd832023-01-11 14:50:10 +01001137 mbedtls_ssl_set_timer(ssl, 0);
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001138 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02001139#endif
1140
Brett Warrene0edc842021-08-17 09:53:13 +01001141/*
1142 * curve_list is translated to IANA TLS group identifiers here because
1143 * mbedtls_ssl_conf_curves returns void and so can't return
1144 * any error codes.
1145 */
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02001146#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01001147#if !defined(MBEDTLS_DEPRECATED_REMOVED)
1148 /* Heap allocate and translate curve_list from internal to IANA group ids */
Gilles Peskine449bd832023-01-11 14:50:10 +01001149 if (ssl->conf->curve_list != NULL) {
Brett Warrene0edc842021-08-17 09:53:13 +01001150 size_t length;
1151 const mbedtls_ecp_group_id *curve_list = ssl->conf->curve_list;
1152
Thomas Daubney850a0792023-05-22 12:05:03 +01001153 for (length = 0; (curve_list[length] != MBEDTLS_ECP_DP_NONE); length++) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001154 }
Brett Warrene0edc842021-08-17 09:53:13 +01001155
1156 /* Leave room for zero termination */
Gilles Peskine449bd832023-01-11 14:50:10 +01001157 uint16_t *group_list = mbedtls_calloc(length + 1, sizeof(uint16_t));
1158 if (group_list == NULL) {
1159 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
1160 }
Brett Warrene0edc842021-08-17 09:53:13 +01001161
Gilles Peskine449bd832023-01-11 14:50:10 +01001162 for (size_t i = 0; i < length; i++) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01001163 uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(
Gilles Peskine449bd832023-01-11 14:50:10 +01001164 curve_list[i]);
1165 if (tls_id == 0) {
1166 mbedtls_free(group_list);
1167 return MBEDTLS_ERR_SSL_BAD_CONFIG;
Brett Warrene0edc842021-08-17 09:53:13 +01001168 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01001169 group_list[i] = tls_id;
Brett Warrene0edc842021-08-17 09:53:13 +01001170 }
1171
1172 group_list[length] = 0;
1173
1174 ssl->handshake->group_list = group_list;
1175 ssl->handshake->group_list_heap_allocated = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01001176 } else {
Brett Warrene0edc842021-08-17 09:53:13 +01001177 ssl->handshake->group_list = ssl->conf->group_list;
1178 ssl->handshake->group_list_heap_allocated = 0;
1179 }
1180#endif /* MBEDTLS_DEPRECATED_REMOVED */
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02001181#endif /* MBEDTLS_ECP_C */
Brett Warrene0edc842021-08-17 09:53:13 +01001182
Ronald Crone68ab4f2022-10-05 12:46:29 +02001183#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08001184#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Jerry Yua69269a2022-01-17 21:06:01 +08001185#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jerry Yu713013f2022-01-17 18:16:35 +08001186 /* Heap allocate and translate sig_hashes from internal hash identifiers to
1187 signature algorithms IANA identifiers. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001188 if (mbedtls_ssl_conf_is_tls12_only(ssl->conf) &&
1189 ssl->conf->sig_hashes != NULL) {
Jerry Yuf017ee42022-01-12 15:49:48 +08001190 const int *md;
1191 const int *sig_hashes = ssl->conf->sig_hashes;
Jerry Yub476a442022-01-21 18:14:45 +08001192 size_t sig_algs_len = 0;
Jerry Yuf017ee42022-01-12 15:49:48 +08001193 uint16_t *p;
1194
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001195 MBEDTLS_STATIC_ASSERT(MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN
1196 <= (SIZE_MAX - (2 * sizeof(uint16_t))),
1197 "MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN too big");
Jerry Yua68dca22022-01-20 16:28:27 +08001198
Gilles Peskine449bd832023-01-11 14:50:10 +01001199 for (md = sig_hashes; *md != MBEDTLS_MD_NONE; md++) {
1200 if (mbedtls_ssl_hash_from_md_alg(*md) == MBEDTLS_SSL_HASH_NONE) {
Jerry Yuf017ee42022-01-12 15:49:48 +08001201 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001202 }
Valerio Settie9646ec2023-08-02 20:02:28 +02001203#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001204 sig_algs_len += sizeof(uint16_t);
Jerry Yub476a442022-01-21 18:14:45 +08001205#endif
Jerry Yua68dca22022-01-20 16:28:27 +08001206
Jerry Yub476a442022-01-21 18:14:45 +08001207#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001208 sig_algs_len += sizeof(uint16_t);
Jerry Yub476a442022-01-21 18:14:45 +08001209#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001210 if (sig_algs_len > MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN) {
1211 return MBEDTLS_ERR_SSL_BAD_CONFIG;
1212 }
Jerry Yuf017ee42022-01-12 15:49:48 +08001213 }
1214
Gilles Peskine449bd832023-01-11 14:50:10 +01001215 if (sig_algs_len < MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN) {
1216 return MBEDTLS_ERR_SSL_BAD_CONFIG;
1217 }
Jerry Yuf017ee42022-01-12 15:49:48 +08001218
Gilles Peskine449bd832023-01-11 14:50:10 +01001219 ssl->handshake->sig_algs = mbedtls_calloc(1, sig_algs_len +
1220 sizeof(uint16_t));
1221 if (ssl->handshake->sig_algs == NULL) {
1222 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
1223 }
Jerry Yuf017ee42022-01-12 15:49:48 +08001224
Gilles Peskine449bd832023-01-11 14:50:10 +01001225 p = (uint16_t *) ssl->handshake->sig_algs;
1226 for (md = sig_hashes; *md != MBEDTLS_MD_NONE; md++) {
1227 unsigned char hash = mbedtls_ssl_hash_from_md_alg(*md);
1228 if (hash == MBEDTLS_SSL_HASH_NONE) {
Jerry Yuf017ee42022-01-12 15:49:48 +08001229 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001230 }
Valerio Settie9646ec2023-08-02 20:02:28 +02001231#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001232 *p = ((hash << 8) | MBEDTLS_SSL_SIG_ECDSA);
Jerry Yuf017ee42022-01-12 15:49:48 +08001233 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +08001234#endif
1235#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001236 *p = ((hash << 8) | MBEDTLS_SSL_SIG_RSA);
Jerry Yuf017ee42022-01-12 15:49:48 +08001237 p++;
Jerry Yu6106fdc2022-01-12 16:36:14 +08001238#endif
Jerry Yuf017ee42022-01-12 15:49:48 +08001239 }
Gabor Mezei15b95a62022-05-09 16:37:58 +02001240 *p = MBEDTLS_TLS_SIG_NONE;
Jerry Yuf017ee42022-01-12 15:49:48 +08001241 ssl->handshake->sig_algs_heap_allocated = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01001242 } else
Jerry Yua69269a2022-01-17 21:06:01 +08001243#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Jerry Yuf017ee42022-01-12 15:49:48 +08001244 {
Jerry Yuf017ee42022-01-12 15:49:48 +08001245 ssl->handshake->sig_algs_heap_allocated = 0;
1246 }
Jerry Yucc539102022-06-27 16:27:35 +08001247#endif /* !MBEDTLS_DEPRECATED_REMOVED */
Ronald Crone68ab4f2022-10-05 12:46:29 +02001248#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Gilles Peskine449bd832023-01-11 14:50:10 +01001249 return 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001250}
1251
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001252#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001253/* Dummy cookie callbacks for defaults */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001254MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001255static int ssl_cookie_write_dummy(void *ctx,
1256 unsigned char **p, unsigned char *end,
1257 const unsigned char *cli_id, size_t cli_id_len)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001258{
1259 ((void) ctx);
1260 ((void) p);
1261 ((void) end);
1262 ((void) cli_id);
1263 ((void) cli_id_len);
1264
Gilles Peskine449bd832023-01-11 14:50:10 +01001265 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001266}
1267
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001268MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001269static int ssl_cookie_check_dummy(void *ctx,
1270 const unsigned char *cookie, size_t cookie_len,
1271 const unsigned char *cli_id, size_t cli_id_len)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001272{
1273 ((void) ctx);
1274 ((void) cookie);
1275 ((void) cookie_len);
1276 ((void) cli_id);
1277 ((void) cli_id_len);
1278
Gilles Peskine449bd832023-01-11 14:50:10 +01001279 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001280}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001281#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001282
Paul Bakker5121ce52009-01-03 21:22:43 +00001283/*
1284 * Initialize an SSL context
1285 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001286void mbedtls_ssl_init(mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02001287{
Gilles Peskine449bd832023-01-11 14:50:10 +01001288 memset(ssl, 0, sizeof(mbedtls_ssl_context));
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02001289}
1290
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001291MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001292static int ssl_conf_version_check(const mbedtls_ssl_context *ssl)
Jerry Yu60835a82021-08-04 10:13:52 +08001293{
Ronald Cron086ee0b2022-03-15 15:18:51 +01001294 const mbedtls_ssl_config *conf = ssl->conf;
1295
Ronald Cron6f135e12021-12-08 16:57:54 +01001296#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001297 if (mbedtls_ssl_conf_is_tls13_only(conf)) {
1298 if (conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1299 MBEDTLS_SSL_DEBUG_MSG(1, ("DTLS 1.3 is not yet supported."));
1300 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQianed582dd2022-04-13 08:21:05 +00001301 }
1302
Gilles Peskine449bd832023-01-11 14:50:10 +01001303 MBEDTLS_SSL_DEBUG_MSG(4, ("The SSL configuration is tls13 only."));
1304 return 0;
Jerry Yu60835a82021-08-04 10:13:52 +08001305 }
1306#endif
1307
1308#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001309 if (mbedtls_ssl_conf_is_tls12_only(conf)) {
1310 MBEDTLS_SSL_DEBUG_MSG(4, ("The SSL configuration is tls12 only."));
1311 return 0;
Jerry Yu60835a82021-08-04 10:13:52 +08001312 }
1313#endif
1314
Ronald Cron6f135e12021-12-08 16:57:54 +01001315#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001316 if (mbedtls_ssl_conf_is_hybrid_tls12_tls13(conf)) {
1317 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1318 MBEDTLS_SSL_DEBUG_MSG(1, ("DTLS not yet supported in Hybrid TLS 1.3 + TLS 1.2"));
1319 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQianed582dd2022-04-13 08:21:05 +00001320 }
1321
Gilles Peskine449bd832023-01-11 14:50:10 +01001322 MBEDTLS_SSL_DEBUG_MSG(4, ("The SSL configuration is TLS 1.3 or TLS 1.2."));
1323 return 0;
Jerry Yu60835a82021-08-04 10:13:52 +08001324 }
1325#endif
1326
Gilles Peskine449bd832023-01-11 14:50:10 +01001327 MBEDTLS_SSL_DEBUG_MSG(1, ("The SSL configuration is invalid."));
1328 return MBEDTLS_ERR_SSL_BAD_CONFIG;
Jerry Yu60835a82021-08-04 10:13:52 +08001329}
1330
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001331MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu60835a82021-08-04 10:13:52 +08001332static int ssl_conf_check(const mbedtls_ssl_context *ssl)
1333{
1334 int ret;
Gilles Peskine449bd832023-01-11 14:50:10 +01001335 ret = ssl_conf_version_check(ssl);
1336 if (ret != 0) {
1337 return ret;
1338 }
Jerry Yu60835a82021-08-04 10:13:52 +08001339
Jerry Yudef7ae42022-10-30 14:13:19 +08001340#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1341 /* RFC 8446 section 4.4.3
1342 *
1343 * If the verification fails, the receiver MUST terminate the handshake with
1344 * a "decrypt_error" alert.
1345 *
1346 * If the client is configured as TLS 1.3 only with optional verify, return
1347 * bad config.
1348 *
1349 */
Pengyu Lv0a1ff2b2023-11-14 11:03:32 +08001350 if (mbedtls_ssl_conf_tls13_is_ephemeral_enabled(
Gilles Peskine449bd832023-01-11 14:50:10 +01001351 (mbedtls_ssl_context *) ssl) &&
Jerry Yudef7ae42022-10-30 14:13:19 +08001352 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
1353 ssl->conf->max_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
1354 ssl->conf->min_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
Gilles Peskine449bd832023-01-11 14:50:10 +01001355 ssl->conf->authmode == MBEDTLS_SSL_VERIFY_OPTIONAL) {
Jerry Yudef7ae42022-10-30 14:13:19 +08001356 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +01001357 1, ("Optional verify auth mode "
1358 "is not available for TLS 1.3 client"));
1359 return MBEDTLS_ERR_SSL_BAD_CONFIG;
Jerry Yudef7ae42022-10-30 14:13:19 +08001360 }
1361#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
1362
Jerry Yu60835a82021-08-04 10:13:52 +08001363 /* Space for further checks */
1364
Gilles Peskine449bd832023-01-11 14:50:10 +01001365 return 0;
Jerry Yu60835a82021-08-04 10:13:52 +08001366}
1367
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02001368/*
1369 * Setup an SSL context
1370 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01001371
Gilles Peskine449bd832023-01-11 14:50:10 +01001372int mbedtls_ssl_setup(mbedtls_ssl_context *ssl,
1373 const mbedtls_ssl_config *conf)
Paul Bakker5121ce52009-01-03 21:22:43 +00001374{
Janos Follath865b3eb2019-12-16 11:46:15 +00001375 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Darryl Greenb33cc762019-11-28 14:29:44 +00001376 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1377 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
Paul Bakker5121ce52009-01-03 21:22:43 +00001378
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02001379 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00001380
Gilles Peskine449bd832023-01-11 14:50:10 +01001381 if ((ret = ssl_conf_check(ssl)) != 0) {
1382 return ret;
1383 }
Ronald Cron8a12aee2023-03-08 15:30:43 +01001384 ssl->tls_version = ssl->conf->max_tls_version;
Jerry Yu60835a82021-08-04 10:13:52 +08001385
Paul Bakker62f2dee2012-09-28 07:31:51 +00001386 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01001387 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00001388 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02001389
1390 /* Set to NULL in case of an error condition */
1391 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02001392
Darryl Greenb33cc762019-11-28 14:29:44 +00001393#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1394 ssl->in_buf_len = in_buf_len;
1395#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001396 ssl->in_buf = mbedtls_calloc(1, in_buf_len);
1397 if (ssl->in_buf == NULL) {
1398 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len));
k-stachowiak9f7798e2018-07-31 16:52:32 +02001399 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001400 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10001401 }
1402
Darryl Greenb33cc762019-11-28 14:29:44 +00001403#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1404 ssl->out_buf_len = out_buf_len;
1405#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001406 ssl->out_buf = mbedtls_calloc(1, out_buf_len);
1407 if (ssl->out_buf == NULL) {
1408 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len));
k-stachowiak9f7798e2018-07-31 16:52:32 +02001409 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02001410 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00001411 }
1412
Gilles Peskine449bd832023-01-11 14:50:10 +01001413 mbedtls_ssl_reset_in_out_pointers(ssl);
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02001414
Johan Pascalb62bb512015-12-03 21:56:45 +01001415#if defined(MBEDTLS_SSL_DTLS_SRTP)
Gilles Peskine449bd832023-01-11 14:50:10 +01001416 memset(&ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info));
Johan Pascalb62bb512015-12-03 21:56:45 +01001417#endif
1418
Gilles Peskine449bd832023-01-11 14:50:10 +01001419 if ((ret = ssl_handshake_init(ssl)) != 0) {
k-stachowiaka47911c2018-07-04 17:41:58 +02001420 goto error;
Gilles Peskine449bd832023-01-11 14:50:10 +01001421 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001422
Gilles Peskine449bd832023-01-11 14:50:10 +01001423 return 0;
k-stachowiaka47911c2018-07-04 17:41:58 +02001424
1425error:
Gilles Peskine449bd832023-01-11 14:50:10 +01001426 mbedtls_free(ssl->in_buf);
1427 mbedtls_free(ssl->out_buf);
k-stachowiaka47911c2018-07-04 17:41:58 +02001428
1429 ssl->conf = NULL;
1430
Darryl Greenb33cc762019-11-28 14:29:44 +00001431#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1432 ssl->in_buf_len = 0;
1433 ssl->out_buf_len = 0;
1434#endif
k-stachowiaka47911c2018-07-04 17:41:58 +02001435 ssl->in_buf = NULL;
1436 ssl->out_buf = NULL;
1437
1438 ssl->in_hdr = NULL;
1439 ssl->in_ctr = NULL;
1440 ssl->in_len = NULL;
1441 ssl->in_iv = NULL;
1442 ssl->in_msg = NULL;
1443
1444 ssl->out_hdr = NULL;
1445 ssl->out_ctr = NULL;
1446 ssl->out_len = NULL;
1447 ssl->out_iv = NULL;
1448 ssl->out_msg = NULL;
1449
Gilles Peskine449bd832023-01-11 14:50:10 +01001450 return ret;
Paul Bakker5121ce52009-01-03 21:22:43 +00001451}
1452
1453/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00001454 * Reset an initialized and used SSL context for re-use while retaining
1455 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001456 *
1457 * If partial is non-zero, keep data in the input buffer and client ID.
1458 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00001459 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001460void mbedtls_ssl_session_reset_msg_layer(mbedtls_ssl_context *ssl,
1461 int partial)
Paul Bakker7eb013f2011-10-06 12:37:39 +00001462{
Darryl Greenb33cc762019-11-28 14:29:44 +00001463#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
1464 size_t in_buf_len = ssl->in_buf_len;
1465 size_t out_buf_len = ssl->out_buf_len;
1466#else
1467 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
1468 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
1469#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001470
Hanno Beckerb0302c42021-08-03 09:39:42 +01001471#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || !defined(MBEDTLS_SSL_SRV_C)
1472 partial = 0;
Hanno Becker7e772132018-08-10 12:38:21 +01001473#endif
1474
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001475 /* Cancel any possibly running timer */
Gilles Peskine449bd832023-01-11 14:50:10 +01001476 mbedtls_ssl_set_timer(ssl, 0);
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001477
Gilles Peskine449bd832023-01-11 14:50:10 +01001478 mbedtls_ssl_reset_in_out_pointers(ssl);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001479
1480 /* Reset incoming message parsing */
1481 ssl->in_offt = NULL;
1482 ssl->nb_zero = 0;
1483 ssl->in_msgtype = 0;
1484 ssl->in_msglen = 0;
1485 ssl->in_hslen = 0;
1486 ssl->keep_current_message = 0;
1487 ssl->transform_in = NULL;
1488
1489#if defined(MBEDTLS_SSL_PROTO_DTLS)
1490 ssl->next_record_offset = 0;
1491 ssl->in_epoch = 0;
1492#endif
1493
1494 /* Keep current datagram if partial == 1 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001495 if (partial == 0) {
Hanno Beckerb0302c42021-08-03 09:39:42 +01001496 ssl->in_left = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001497 memset(ssl->in_buf, 0, in_buf_len);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001498 }
1499
Ronald Cronad8c17b2022-06-10 17:18:09 +02001500 ssl->send_alert = 0;
1501
Hanno Beckerb0302c42021-08-03 09:39:42 +01001502 /* Reset outgoing message writing */
1503 ssl->out_msgtype = 0;
1504 ssl->out_msglen = 0;
1505 ssl->out_left = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001506 memset(ssl->out_buf, 0, out_buf_len);
1507 memset(ssl->cur_out_ctr, 0, sizeof(ssl->cur_out_ctr));
Hanno Beckerb0302c42021-08-03 09:39:42 +01001508 ssl->transform_out = NULL;
1509
1510#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Gilles Peskine449bd832023-01-11 14:50:10 +01001511 mbedtls_ssl_dtls_replay_reset(ssl);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001512#endif
1513
XiaokangQian2b01dc32022-01-21 02:53:13 +00001514#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01001515 if (ssl->transform) {
1516 mbedtls_ssl_transform_free(ssl->transform);
1517 mbedtls_free(ssl->transform);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001518 ssl->transform = NULL;
1519 }
XiaokangQian2b01dc32022-01-21 02:53:13 +00001520#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1521
XiaokangQian2b01dc32022-01-21 02:53:13 +00001522#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001523 mbedtls_ssl_transform_free(ssl->transform_application);
1524 mbedtls_free(ssl->transform_application);
XiaokangQian2b01dc32022-01-21 02:53:13 +00001525 ssl->transform_application = NULL;
1526
Gilles Peskine449bd832023-01-11 14:50:10 +01001527 if (ssl->handshake != NULL) {
Jerry Yu3d9b5902022-11-04 14:07:25 +08001528#if defined(MBEDTLS_SSL_EARLY_DATA)
Gilles Peskine449bd832023-01-11 14:50:10 +01001529 mbedtls_ssl_transform_free(ssl->handshake->transform_earlydata);
1530 mbedtls_free(ssl->handshake->transform_earlydata);
XiaokangQian2b01dc32022-01-21 02:53:13 +00001531 ssl->handshake->transform_earlydata = NULL;
Jerry Yu3d9b5902022-11-04 14:07:25 +08001532#endif
XiaokangQian2b01dc32022-01-21 02:53:13 +00001533
Gilles Peskine449bd832023-01-11 14:50:10 +01001534 mbedtls_ssl_transform_free(ssl->handshake->transform_handshake);
1535 mbedtls_free(ssl->handshake->transform_handshake);
XiaokangQian2b01dc32022-01-21 02:53:13 +00001536 ssl->handshake->transform_handshake = NULL;
1537 }
1538
XiaokangQian2b01dc32022-01-21 02:53:13 +00001539#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerb0302c42021-08-03 09:39:42 +01001540}
1541
Gilles Peskine449bd832023-01-11 14:50:10 +01001542int mbedtls_ssl_session_reset_int(mbedtls_ssl_context *ssl, int partial)
Hanno Beckerb0302c42021-08-03 09:39:42 +01001543{
1544 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1545
1546 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
1547
Gilles Peskine449bd832023-01-11 14:50:10 +01001548 mbedtls_ssl_session_reset_msg_layer(ssl, partial);
Hanno Beckerb0302c42021-08-03 09:39:42 +01001549
1550 /* Reset renegotiation state */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001551#if defined(MBEDTLS_SSL_RENEGOTIATION)
1552 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001553 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001554
1555 ssl->verify_data_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001556 memset(ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN);
1557 memset(ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN);
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001558#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001559 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00001560
Hanno Beckerb0302c42021-08-03 09:39:42 +01001561 ssl->session_in = NULL;
Hanno Becker78640902018-08-13 16:35:15 +01001562 ssl->session_out = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001563 if (ssl->session) {
1564 mbedtls_ssl_session_free(ssl->session);
1565 mbedtls_free(ssl->session);
Paul Bakkerc0463502013-02-14 11:19:38 +01001566 ssl->session = NULL;
1567 }
1568
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001569#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02001570 ssl->alpn_chosen = NULL;
1571#endif
1572
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02001573#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
David Horstmann3b2276a2022-10-06 14:49:08 +01001574 int free_cli_id = 1;
Hanno Becker4ccbf062018-08-10 11:20:38 +01001575#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Gilles Peskine449bd832023-01-11 14:50:10 +01001576 free_cli_id = (partial == 0);
Hanno Becker4ccbf062018-08-10 11:20:38 +01001577#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001578 if (free_cli_id) {
1579 mbedtls_free(ssl->cli_id);
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001580 ssl->cli_id = NULL;
1581 ssl->cli_id_len = 0;
1582 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02001583#endif
1584
Gilles Peskine449bd832023-01-11 14:50:10 +01001585 if ((ret = ssl_handshake_init(ssl)) != 0) {
1586 return ret;
1587 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00001588
Gilles Peskine449bd832023-01-11 14:50:10 +01001589 return 0;
Paul Bakker7eb013f2011-10-06 12:37:39 +00001590}
1591
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02001592/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001593 * Reset an initialized and used SSL context for re-use while retaining
1594 * all application-set variables, function pointers and data.
1595 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001596int mbedtls_ssl_session_reset(mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001597{
Gilles Peskine449bd832023-01-11 14:50:10 +01001598 return mbedtls_ssl_session_reset_int(ssl, 0);
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02001599}
1600
1601/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001602 * SSL set accessors
1603 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001604void mbedtls_ssl_conf_endpoint(mbedtls_ssl_config *conf, int endpoint)
Paul Bakker5121ce52009-01-03 21:22:43 +00001605{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001606 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00001607}
1608
Gilles Peskine449bd832023-01-11 14:50:10 +01001609void mbedtls_ssl_conf_transport(mbedtls_ssl_config *conf, int transport)
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001610{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001611 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01001612}
1613
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001614#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Gilles Peskine449bd832023-01-11 14:50:10 +01001615void mbedtls_ssl_conf_dtls_anti_replay(mbedtls_ssl_config *conf, char mode)
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001616{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001617 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02001618}
1619#endif
1620
Gilles Peskine449bd832023-01-11 14:50:10 +01001621void mbedtls_ssl_conf_dtls_badmac_limit(mbedtls_ssl_config *conf, unsigned limit)
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001622{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001623 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001624}
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02001625
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001626#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01001627
Gilles Peskine449bd832023-01-11 14:50:10 +01001628void mbedtls_ssl_set_datagram_packing(mbedtls_ssl_context *ssl,
1629 unsigned allow_packing)
Hanno Becker04da1892018-08-14 13:22:10 +01001630{
1631 ssl->disable_datagram_packing = !allow_packing;
1632}
1633
Gilles Peskine449bd832023-01-11 14:50:10 +01001634void mbedtls_ssl_conf_handshake_timeout(mbedtls_ssl_config *conf,
1635 uint32_t min, uint32_t max)
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001636{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001637 conf->hs_timeout_min = min;
1638 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02001639}
1640#endif
1641
Gilles Peskine449bd832023-01-11 14:50:10 +01001642void mbedtls_ssl_conf_authmode(mbedtls_ssl_config *conf, int authmode)
Paul Bakker5121ce52009-01-03 21:22:43 +00001643{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001644 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00001645}
1646
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001647#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001648void mbedtls_ssl_conf_verify(mbedtls_ssl_config *conf,
1649 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
1650 void *p_vrfy)
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001651{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001652 conf->f_vrfy = f_vrfy;
1653 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001654}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001655#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00001656
Gilles Peskine449bd832023-01-11 14:50:10 +01001657void mbedtls_ssl_conf_rng(mbedtls_ssl_config *conf,
1658 int (*f_rng)(void *, unsigned char *, size_t),
1659 void *p_rng)
Paul Bakker5121ce52009-01-03 21:22:43 +00001660{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001661 conf->f_rng = f_rng;
1662 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00001663}
1664
Gilles Peskine449bd832023-01-11 14:50:10 +01001665void mbedtls_ssl_conf_dbg(mbedtls_ssl_config *conf,
1666 void (*f_dbg)(void *, int, const char *, int, const char *),
1667 void *p_dbg)
Paul Bakker5121ce52009-01-03 21:22:43 +00001668{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001669 conf->f_dbg = f_dbg;
1670 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00001671}
1672
Gilles Peskine449bd832023-01-11 14:50:10 +01001673void mbedtls_ssl_set_bio(mbedtls_ssl_context *ssl,
1674 void *p_bio,
1675 mbedtls_ssl_send_t *f_send,
1676 mbedtls_ssl_recv_t *f_recv,
1677 mbedtls_ssl_recv_timeout_t *f_recv_timeout)
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001678{
1679 ssl->p_bio = p_bio;
1680 ssl->f_send = f_send;
1681 ssl->f_recv = f_recv;
1682 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001683}
1684
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02001685#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01001686void mbedtls_ssl_set_mtu(mbedtls_ssl_context *ssl, uint16_t mtu)
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02001687{
1688 ssl->mtu = mtu;
1689}
1690#endif
1691
Gilles Peskine449bd832023-01-11 14:50:10 +01001692void mbedtls_ssl_conf_read_timeout(mbedtls_ssl_config *conf, uint32_t timeout)
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01001693{
1694 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02001695}
1696
Gilles Peskine449bd832023-01-11 14:50:10 +01001697void mbedtls_ssl_set_timer_cb(mbedtls_ssl_context *ssl,
1698 void *p_timer,
1699 mbedtls_ssl_set_timer_t *f_set_timer,
1700 mbedtls_ssl_get_timer_t *f_get_timer)
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001701{
1702 ssl->p_timer = p_timer;
1703 ssl->f_set_timer = f_set_timer;
1704 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02001705
1706 /* Make sure we start with no timer running */
Gilles Peskine449bd832023-01-11 14:50:10 +01001707 mbedtls_ssl_set_timer(ssl, 0);
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02001708}
1709
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001710#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001711void mbedtls_ssl_conf_session_cache(mbedtls_ssl_config *conf,
1712 void *p_cache,
1713 mbedtls_ssl_cache_get_t *f_get_cache,
1714 mbedtls_ssl_cache_set_t *f_set_cache)
Paul Bakker5121ce52009-01-03 21:22:43 +00001715{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01001716 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001717 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02001718 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00001719}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001720#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001721
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001722#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001723int mbedtls_ssl_set_session(mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session)
Paul Bakker5121ce52009-01-03 21:22:43 +00001724{
Janos Follath865b3eb2019-12-16 11:46:15 +00001725 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001726
Gilles Peskine449bd832023-01-11 14:50:10 +01001727 if (ssl == NULL ||
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001728 session == NULL ||
1729 ssl->session_negotiate == NULL ||
Gilles Peskine449bd832023-01-11 14:50:10 +01001730 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT) {
1731 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001732 }
1733
Gilles Peskine449bd832023-01-11 14:50:10 +01001734 if (ssl->handshake->resume == 1) {
1735 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
1736 }
Hanno Beckere810bbc2021-05-14 16:01:05 +01001737
Jerry Yu21092062022-10-10 21:21:31 +08001738#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001739 if (session->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
Jerry Yu21092062022-10-10 21:21:31 +08001740 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01001741 mbedtls_ssl_ciphersuite_from_id(session->ciphersuite);
Jerry Yu21092062022-10-10 21:21:31 +08001742
Gilles Peskine449bd832023-01-11 14:50:10 +01001743 if (mbedtls_ssl_validate_ciphersuite(
Jerry Yu21092062022-10-10 21:21:31 +08001744 ssl, ciphersuite_info, MBEDTLS_SSL_VERSION_TLS1_3,
Gilles Peskine449bd832023-01-11 14:50:10 +01001745 MBEDTLS_SSL_VERSION_TLS1_3) != 0) {
1746 MBEDTLS_SSL_DEBUG_MSG(4, ("%d is not a valid TLS 1.3 ciphersuite.",
1747 session->ciphersuite));
1748 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jerry Yu21092062022-10-10 21:21:31 +08001749 }
Jerry Yu40afab62022-10-08 10:42:13 +08001750 }
Jerry Yu21092062022-10-10 21:21:31 +08001751#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yu40afab62022-10-08 10:42:13 +08001752
Gilles Peskine449bd832023-01-11 14:50:10 +01001753 if ((ret = mbedtls_ssl_session_copy(ssl->session_negotiate,
1754 session)) != 0) {
1755 return ret;
1756 }
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001757
Paul Bakker0a597072012-09-25 21:55:46 +00001758 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02001759
Gilles Peskine449bd832023-01-11 14:50:10 +01001760 return 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001761}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001762#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001763
Gilles Peskine449bd832023-01-11 14:50:10 +01001764void mbedtls_ssl_conf_ciphersuites(mbedtls_ssl_config *conf,
1765 const int *ciphersuites)
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001766{
Hanno Beckerd60b6c62021-04-29 12:04:11 +01001767 conf->ciphersuite_list = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00001768}
1769
Ronald Cron6f135e12021-12-08 16:57:54 +01001770#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01001771void mbedtls_ssl_conf_tls13_key_exchange_modes(mbedtls_ssl_config *conf,
1772 const int kex_modes)
Hanno Becker71f1ed62021-07-24 06:01:47 +01001773{
Xiaofei Bai746f9482021-11-12 08:53:56 +00001774 conf->tls13_kex_modes = kex_modes & MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Hanno Becker71f1ed62021-07-24 06:01:47 +01001775}
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001776
1777#if defined(MBEDTLS_SSL_EARLY_DATA)
Yanray Wangd5ed36f2023-11-07 11:40:43 +08001778void mbedtls_ssl_conf_early_data(mbedtls_ssl_config *conf,
1779 int early_data_enabled)
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001780{
1781 conf->early_data_enabled = early_data_enabled;
1782}
Jerry Yucc4e0072022-11-22 17:22:22 +08001783
1784#if defined(MBEDTLS_SSL_SRV_C)
Yanray Wang07517612023-11-07 11:47:36 +08001785void mbedtls_ssl_conf_max_early_data_size(
Gilles Peskine449bd832023-01-11 14:50:10 +01001786 mbedtls_ssl_config *conf, uint32_t max_early_data_size)
Jerry Yucc4e0072022-11-22 17:22:22 +08001787{
Jerry Yu39da9852022-12-06 16:58:36 +08001788 conf->max_early_data_size = max_early_data_size;
Jerry Yucc4e0072022-11-22 17:22:22 +08001789}
1790#endif /* MBEDTLS_SSL_SRV_C */
1791
Xiaokang Qian72de95d2022-10-25 02:54:33 +00001792#endif /* MBEDTLS_SSL_EARLY_DATA */
Ronald Cron6f135e12021-12-08 16:57:54 +01001793#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01001794
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001795#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001796void mbedtls_ssl_conf_cert_profile(mbedtls_ssl_config *conf,
1797 const mbedtls_x509_crt_profile *profile)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02001798{
1799 conf->cert_profile = profile;
1800}
1801
Gilles Peskine449bd832023-01-11 14:50:10 +01001802static void ssl_key_cert_free(mbedtls_ssl_key_cert *key_cert)
Glenn Strauss36872db2022-01-22 05:06:31 -05001803{
1804 mbedtls_ssl_key_cert *cur = key_cert, *next;
1805
Gilles Peskine449bd832023-01-11 14:50:10 +01001806 while (cur != NULL) {
Glenn Strauss36872db2022-01-22 05:06:31 -05001807 next = cur->next;
Gilles Peskine449bd832023-01-11 14:50:10 +01001808 mbedtls_free(cur);
Glenn Strauss36872db2022-01-22 05:06:31 -05001809 cur = next;
1810 }
1811}
1812
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001813/* Append a new keycert entry to a (possibly empty) list */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001814MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001815static int ssl_append_key_cert(mbedtls_ssl_key_cert **head,
1816 mbedtls_x509_crt *cert,
1817 mbedtls_pk_context *key)
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001818{
niisato8ee24222018-06-25 19:05:48 +09001819 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001820
Gilles Peskine449bd832023-01-11 14:50:10 +01001821 if (cert == NULL) {
Glenn Strauss36872db2022-01-22 05:06:31 -05001822 /* Free list if cert is null */
Gilles Peskine449bd832023-01-11 14:50:10 +01001823 ssl_key_cert_free(*head);
Glenn Strauss36872db2022-01-22 05:06:31 -05001824 *head = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001825 return 0;
Glenn Strauss36872db2022-01-22 05:06:31 -05001826 }
1827
Gilles Peskine449bd832023-01-11 14:50:10 +01001828 new_cert = mbedtls_calloc(1, sizeof(mbedtls_ssl_key_cert));
1829 if (new_cert == NULL) {
1830 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
1831 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001832
niisato8ee24222018-06-25 19:05:48 +09001833 new_cert->cert = cert;
1834 new_cert->key = key;
1835 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001836
Glenn Strauss36872db2022-01-22 05:06:31 -05001837 /* Update head if the list was null, else add to the end */
Gilles Peskine449bd832023-01-11 14:50:10 +01001838 if (*head == NULL) {
niisato8ee24222018-06-25 19:05:48 +09001839 *head = new_cert;
Gilles Peskine449bd832023-01-11 14:50:10 +01001840 } else {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001841 mbedtls_ssl_key_cert *cur = *head;
Gilles Peskine449bd832023-01-11 14:50:10 +01001842 while (cur->next != NULL) {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001843 cur = cur->next;
Gilles Peskine449bd832023-01-11 14:50:10 +01001844 }
niisato8ee24222018-06-25 19:05:48 +09001845 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001846 }
1847
Gilles Peskine449bd832023-01-11 14:50:10 +01001848 return 0;
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001849}
1850
Gilles Peskine449bd832023-01-11 14:50:10 +01001851int mbedtls_ssl_conf_own_cert(mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001852 mbedtls_x509_crt *own_cert,
Gilles Peskine449bd832023-01-11 14:50:10 +01001853 mbedtls_pk_context *pk_key)
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02001854{
Gilles Peskine449bd832023-01-11 14:50:10 +01001855 return ssl_append_key_cert(&conf->key_cert, own_cert, pk_key);
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02001856}
1857
Gilles Peskine449bd832023-01-11 14:50:10 +01001858void mbedtls_ssl_conf_ca_chain(mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001859 mbedtls_x509_crt *ca_chain,
Gilles Peskine449bd832023-01-11 14:50:10 +01001860 mbedtls_x509_crl *ca_crl)
Paul Bakker5121ce52009-01-03 21:22:43 +00001861{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01001862 conf->ca_chain = ca_chain;
1863 conf->ca_crl = ca_crl;
Hanno Becker5adaad92019-03-27 16:54:37 +00001864
1865#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
1866 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1867 * cannot be used together. */
1868 conf->f_ca_cb = NULL;
1869 conf->p_ca_cb = NULL;
1870#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Paul Bakker5121ce52009-01-03 21:22:43 +00001871}
Hanno Becker5adaad92019-03-27 16:54:37 +00001872
1873#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
Gilles Peskine449bd832023-01-11 14:50:10 +01001874void mbedtls_ssl_conf_ca_cb(mbedtls_ssl_config *conf,
1875 mbedtls_x509_crt_ca_cb_t f_ca_cb,
1876 void *p_ca_cb)
Hanno Becker5adaad92019-03-27 16:54:37 +00001877{
1878 conf->f_ca_cb = f_ca_cb;
1879 conf->p_ca_cb = p_ca_cb;
1880
1881 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb()
1882 * cannot be used together. */
1883 conf->ca_chain = NULL;
1884 conf->ca_crl = NULL;
1885}
1886#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001887#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00001888
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001889#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01001890const unsigned char *mbedtls_ssl_get_hs_sni(mbedtls_ssl_context *ssl,
1891 size_t *name_len)
Glenn Strauss69894072022-01-24 12:58:00 -05001892{
1893 *name_len = ssl->handshake->sni_name_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01001894 return ssl->handshake->sni_name;
Glenn Strauss69894072022-01-24 12:58:00 -05001895}
1896
Gilles Peskine449bd832023-01-11 14:50:10 +01001897int mbedtls_ssl_set_hs_own_cert(mbedtls_ssl_context *ssl,
1898 mbedtls_x509_crt *own_cert,
1899 mbedtls_pk_context *pk_key)
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001900{
Gilles Peskine449bd832023-01-11 14:50:10 +01001901 return ssl_append_key_cert(&ssl->handshake->sni_key_cert,
1902 own_cert, pk_key);
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001903}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02001904
Gilles Peskine449bd832023-01-11 14:50:10 +01001905void mbedtls_ssl_set_hs_ca_chain(mbedtls_ssl_context *ssl,
1906 mbedtls_x509_crt *ca_chain,
1907 mbedtls_x509_crl *ca_crl)
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02001908{
1909 ssl->handshake->sni_ca_chain = ca_chain;
1910 ssl->handshake->sni_ca_crl = ca_crl;
1911}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001912
Glenn Strauss999ef702022-03-11 01:37:23 -05001913#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001914void mbedtls_ssl_set_hs_dn_hints(mbedtls_ssl_context *ssl,
1915 const mbedtls_x509_crt *crt)
Glenn Strauss999ef702022-03-11 01:37:23 -05001916{
1917 ssl->handshake->dn_hints = crt;
1918}
1919#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
1920
Gilles Peskine449bd832023-01-11 14:50:10 +01001921void mbedtls_ssl_set_hs_authmode(mbedtls_ssl_context *ssl,
1922 int authmode)
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02001923{
1924 ssl->handshake->sni_authmode = authmode;
1925}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02001926#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1927
Hanno Becker8927c832019-04-03 12:52:50 +01001928#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001929void mbedtls_ssl_set_verify(mbedtls_ssl_context *ssl,
1930 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
1931 void *p_vrfy)
Hanno Becker8927c832019-04-03 12:52:50 +01001932{
1933 ssl->f_vrfy = f_vrfy;
1934 ssl->p_vrfy = p_vrfy;
1935}
1936#endif
1937
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001938#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001939
Valerio Setti016f6822022-12-09 14:17:50 +01001940#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemek Stekielfde11282023-03-13 16:06:09 +01001941static const uint8_t jpake_server_id[] = { 's', 'e', 'r', 'v', 'e', 'r' };
1942static const uint8_t jpake_client_id[] = { 'c', 'l', 'i', 'e', 'n', 't' };
1943
Valerio Setti016f6822022-12-09 14:17:50 +01001944static psa_status_t mbedtls_ssl_set_hs_ecjpake_password_common(
Gilles Peskine449bd832023-01-11 14:50:10 +01001945 mbedtls_ssl_context *ssl,
1946 mbedtls_svc_key_id_t pwd)
Valerio Setti016f6822022-12-09 14:17:50 +01001947{
1948 psa_status_t status;
Valerio Setti016f6822022-12-09 14:17:50 +01001949 psa_pake_cipher_suite_t cipher_suite = psa_pake_cipher_suite_init();
Przemek Stekielfde11282023-03-13 16:06:09 +01001950 const uint8_t *user = NULL;
Przemek Stekiel4cd20312023-03-01 11:11:28 +01001951 size_t user_len = 0;
Przemek Stekielfde11282023-03-13 16:06:09 +01001952 const uint8_t *peer = NULL;
Przemek Stekiel4cd20312023-03-01 11:11:28 +01001953 size_t peer_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01001954 psa_pake_cs_set_algorithm(&cipher_suite, PSA_ALG_JPAKE);
1955 psa_pake_cs_set_primitive(&cipher_suite,
1956 PSA_PAKE_PRIMITIVE(PSA_PAKE_PRIMITIVE_TYPE_ECC,
1957 PSA_ECC_FAMILY_SECP_R1,
1958 256));
1959 psa_pake_cs_set_hash(&cipher_suite, PSA_ALG_SHA_256);
Valerio Setti016f6822022-12-09 14:17:50 +01001960
Gilles Peskine449bd832023-01-11 14:50:10 +01001961 status = psa_pake_setup(&ssl->handshake->psa_pake_ctx, &cipher_suite);
1962 if (status != PSA_SUCCESS) {
Valerio Setti016f6822022-12-09 14:17:50 +01001963 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001964 }
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02001965
Gilles Peskine449bd832023-01-11 14:50:10 +01001966 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Przemek Stekielfde11282023-03-13 16:06:09 +01001967 user = jpake_server_id;
1968 user_len = sizeof(jpake_server_id);
1969 peer = jpake_client_id;
1970 peer_len = sizeof(jpake_client_id);
Gilles Peskine449bd832023-01-11 14:50:10 +01001971 } else {
Przemek Stekielfde11282023-03-13 16:06:09 +01001972 user = jpake_client_id;
1973 user_len = sizeof(jpake_client_id);
1974 peer = jpake_server_id;
1975 peer_len = sizeof(jpake_server_id);
Gilles Peskine449bd832023-01-11 14:50:10 +01001976 }
Neil Armstrongca7d5062022-05-31 14:43:23 +02001977
Przemek Stekiel4cd20312023-03-01 11:11:28 +01001978 status = psa_pake_set_user(&ssl->handshake->psa_pake_ctx, user, user_len);
1979 if (status != PSA_SUCCESS) {
1980 return status;
1981 }
1982
1983 status = psa_pake_set_peer(&ssl->handshake->psa_pake_ctx, peer, peer_len);
Gilles Peskine449bd832023-01-11 14:50:10 +01001984 if (status != PSA_SUCCESS) {
Valerio Setti016f6822022-12-09 14:17:50 +01001985 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001986 }
Valerio Setti016f6822022-12-09 14:17:50 +01001987
Gilles Peskine449bd832023-01-11 14:50:10 +01001988 status = psa_pake_set_password_key(&ssl->handshake->psa_pake_ctx, pwd);
1989 if (status != PSA_SUCCESS) {
Valerio Setti016f6822022-12-09 14:17:50 +01001990 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001991 }
Valerio Setti016f6822022-12-09 14:17:50 +01001992
1993 ssl->handshake->psa_pake_ctx_is_ok = 1;
1994
Gilles Peskine449bd832023-01-11 14:50:10 +01001995 return PSA_SUCCESS;
Valerio Setti016f6822022-12-09 14:17:50 +01001996}
1997
Gilles Peskine449bd832023-01-11 14:50:10 +01001998int mbedtls_ssl_set_hs_ecjpake_password(mbedtls_ssl_context *ssl,
1999 const unsigned char *pw,
2000 size_t pw_len)
Valerio Setti016f6822022-12-09 14:17:50 +01002001{
2002 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
2003 psa_status_t status;
2004
Gilles Peskine449bd832023-01-11 14:50:10 +01002005 if (ssl->handshake == NULL || ssl->conf == NULL) {
2006 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Neil Armstrongca7d5062022-05-31 14:43:23 +02002007 }
2008
Gilles Peskine449bd832023-01-11 14:50:10 +01002009 /* Empty password is not valid */
2010 if ((pw == NULL) || (pw_len == 0)) {
2011 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2012 }
2013
2014 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DERIVE);
2015 psa_set_key_algorithm(&attributes, PSA_ALG_JPAKE);
2016 psa_set_key_type(&attributes, PSA_KEY_TYPE_PASSWORD);
2017
2018 status = psa_import_key(&attributes, pw, pw_len,
2019 &ssl->handshake->psa_pake_password);
2020 if (status != PSA_SUCCESS) {
2021 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
2022 }
2023
2024 status = mbedtls_ssl_set_hs_ecjpake_password_common(ssl,
2025 ssl->handshake->psa_pake_password);
2026 if (status != PSA_SUCCESS) {
2027 psa_destroy_key(ssl->handshake->psa_pake_password);
2028 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
2029 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
2030 }
2031
2032 return 0;
Valerio Setti02c25b52022-11-15 14:08:42 +01002033}
Valerio Settia9a97dc2022-11-28 18:26:16 +01002034
Gilles Peskine449bd832023-01-11 14:50:10 +01002035int mbedtls_ssl_set_hs_ecjpake_password_opaque(mbedtls_ssl_context *ssl,
2036 mbedtls_svc_key_id_t pwd)
Valerio Settia9a97dc2022-11-28 18:26:16 +01002037{
Valerio Settia9a97dc2022-11-28 18:26:16 +01002038 psa_status_t status;
2039
Gilles Peskine449bd832023-01-11 14:50:10 +01002040 if (ssl->handshake == NULL || ssl->conf == NULL) {
2041 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Neil Armstrongca7d5062022-05-31 14:43:23 +02002042 }
2043
Gilles Peskine449bd832023-01-11 14:50:10 +01002044 if (mbedtls_svc_key_id_is_null(pwd)) {
2045 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2046 }
2047
2048 status = mbedtls_ssl_set_hs_ecjpake_password_common(ssl, pwd);
2049 if (status != PSA_SUCCESS) {
2050 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
2051 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
2052 }
2053
2054 return 0;
Valerio Setti02c25b52022-11-15 14:08:42 +01002055}
2056#else /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01002057int mbedtls_ssl_set_hs_ecjpake_password(mbedtls_ssl_context *ssl,
2058 const unsigned char *pw,
2059 size_t pw_len)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002060{
2061 mbedtls_ecjpake_role role;
2062
Gilles Peskine449bd832023-01-11 14:50:10 +01002063 if (ssl->handshake == NULL || ssl->conf == NULL) {
2064 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2065 }
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002066
Valerio Settic689ed82022-12-07 14:40:38 +01002067 /* Empty password is not valid */
Gilles Peskine449bd832023-01-11 14:50:10 +01002068 if ((pw == NULL) || (pw_len == 0)) {
2069 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2070 }
Valerio Settic689ed82022-12-07 14:40:38 +01002071
Gilles Peskine449bd832023-01-11 14:50:10 +01002072 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002073 role = MBEDTLS_ECJPAKE_SERVER;
Gilles Peskine449bd832023-01-11 14:50:10 +01002074 } else {
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002075 role = MBEDTLS_ECJPAKE_CLIENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01002076 }
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002077
Gilles Peskine449bd832023-01-11 14:50:10 +01002078 return mbedtls_ecjpake_setup(&ssl->handshake->ecjpake_ctx,
2079 role,
2080 MBEDTLS_MD_SHA256,
2081 MBEDTLS_ECP_DP_SECP256R1,
2082 pw, pw_len);
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002083}
Valerio Setti02c25b52022-11-15 14:08:42 +01002084#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002085#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02002086
Ronald Cron73fe8df2022-10-05 14:31:43 +02002087#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01002088int mbedtls_ssl_conf_has_static_psk(mbedtls_ssl_config const *conf)
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002089{
Gilles Peskine449bd832023-01-11 14:50:10 +01002090 if (conf->psk_identity == NULL ||
2091 conf->psk_identity_len == 0) {
2092 return 0;
Ronald Crond29e13e2022-10-19 10:33:48 +02002093 }
2094
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002095#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002096 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) {
2097 return 1;
2098 }
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002099#endif /* MBEDTLS_USE_PSA_CRYPTO */
Ronald Crond29e13e2022-10-19 10:33:48 +02002100
Gilles Peskine449bd832023-01-11 14:50:10 +01002101 if (conf->psk != NULL && conf->psk_len != 0) {
2102 return 1;
2103 }
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002104
Gilles Peskine449bd832023-01-11 14:50:10 +01002105 return 0;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002106}
2107
Gilles Peskine449bd832023-01-11 14:50:10 +01002108static void ssl_conf_remove_psk(mbedtls_ssl_config *conf)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002109{
2110 /* Remove reference to existing PSK, if any. */
2111#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002112 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) {
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002113 /* The maintenance of the PSK key slot is the
2114 * user's responsibility. */
Ronald Croncf56a0a2020-08-04 09:51:30 +02002115 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002116 }
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002117#endif /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01002118 if (conf->psk != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01002119 mbedtls_zeroize_and_free(conf->psk, conf->psk_len);
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002120 conf->psk = NULL;
2121 conf->psk_len = 0;
2122 }
2123
2124 /* Remove reference to PSK identity, if any. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002125 if (conf->psk_identity != NULL) {
2126 mbedtls_free(conf->psk_identity);
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002127 conf->psk_identity = NULL;
2128 conf->psk_identity_len = 0;
2129 }
2130}
2131
Hanno Becker7390c712018-11-15 13:33:04 +00002132/* This function assumes that PSK identity in the SSL config is unset.
2133 * It checks that the provided identity is well-formed and attempts
2134 * to make a copy of it in the SSL config.
2135 * On failure, the PSK identity in the config remains unset. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002136MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002137static int ssl_conf_set_psk_identity(mbedtls_ssl_config *conf,
2138 unsigned char const *psk_identity,
2139 size_t psk_identity_len)
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02002140{
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02002141 /* Identity len will be encoded on two bytes */
Gilles Peskine449bd832023-01-11 14:50:10 +01002142 if (psk_identity == NULL ||
Ronald Cron2a87e9b2022-10-19 10:55:26 +02002143 psk_identity_len == 0 ||
Gilles Peskine449bd832023-01-11 14:50:10 +01002144 (psk_identity_len >> 16) != 0 ||
2145 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN) {
2146 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02002147 }
2148
Gilles Peskine449bd832023-01-11 14:50:10 +01002149 conf->psk_identity = mbedtls_calloc(1, psk_identity_len);
2150 if (conf->psk_identity == NULL) {
2151 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2152 }
Paul Bakker6db455e2013-09-18 17:29:31 +02002153
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01002154 conf->psk_identity_len = psk_identity_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002155 memcpy(conf->psk_identity, psk_identity, conf->psk_identity_len);
Paul Bakker5ad403f2013-09-18 21:21:30 +02002156
Gilles Peskine449bd832023-01-11 14:50:10 +01002157 return 0;
Paul Bakker6db455e2013-09-18 17:29:31 +02002158}
2159
Gilles Peskine449bd832023-01-11 14:50:10 +01002160int mbedtls_ssl_conf_psk(mbedtls_ssl_config *conf,
2161 const unsigned char *psk, size_t psk_len,
2162 const unsigned char *psk_identity, size_t psk_identity_len)
Hanno Becker7390c712018-11-15 13:33:04 +00002163{
Janos Follath865b3eb2019-12-16 11:46:15 +00002164 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002165
2166 /* We currently only support one PSK, raw or opaque. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002167 if (mbedtls_ssl_conf_has_static_psk(conf)) {
2168 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2169 }
Hanno Becker7390c712018-11-15 13:33:04 +00002170
2171 /* Check and set raw PSK */
Gilles Peskine449bd832023-01-11 14:50:10 +01002172 if (psk == NULL) {
2173 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2174 }
2175 if (psk_len == 0) {
2176 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2177 }
2178 if (psk_len > MBEDTLS_PSK_MAX_LEN) {
2179 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2180 }
Piotr Nowicki9926eaf2019-11-20 14:54:36 +01002181
Gilles Peskine449bd832023-01-11 14:50:10 +01002182 if ((conf->psk = mbedtls_calloc(1, psk_len)) == NULL) {
2183 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2184 }
Hanno Becker7390c712018-11-15 13:33:04 +00002185 conf->psk_len = psk_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002186 memcpy(conf->psk, psk, conf->psk_len);
Hanno Becker7390c712018-11-15 13:33:04 +00002187
2188 /* Check and set PSK Identity */
Gilles Peskine449bd832023-01-11 14:50:10 +01002189 ret = ssl_conf_set_psk_identity(conf, psk_identity, psk_identity_len);
2190 if (ret != 0) {
2191 ssl_conf_remove_psk(conf);
2192 }
Hanno Becker7390c712018-11-15 13:33:04 +00002193
Gilles Peskine449bd832023-01-11 14:50:10 +01002194 return ret;
Hanno Becker7390c712018-11-15 13:33:04 +00002195}
2196
Gilles Peskine449bd832023-01-11 14:50:10 +01002197static void ssl_remove_psk(mbedtls_ssl_context *ssl)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002198{
2199#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002200 if (!mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque)) {
Neil Armstrong501c9322022-05-03 09:35:09 +02002201 /* The maintenance of the external PSK key slot is the
2202 * user's responsibility. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002203 if (ssl->handshake->psk_opaque_is_internal) {
2204 psa_destroy_key(ssl->handshake->psk_opaque);
Neil Armstrong501c9322022-05-03 09:35:09 +02002205 ssl->handshake->psk_opaque_is_internal = 0;
2206 }
Ronald Croncf56a0a2020-08-04 09:51:30 +02002207 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002208 }
Neil Armstronge952a302022-05-03 10:22:14 +02002209#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002210 if (ssl->handshake->psk != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01002211 mbedtls_zeroize_and_free(ssl->handshake->psk,
Gilles Peskine449bd832023-01-11 14:50:10 +01002212 ssl->handshake->psk_len);
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002213 ssl->handshake->psk_len = 0;
2214 }
Neil Armstronge952a302022-05-03 10:22:14 +02002215#endif /* MBEDTLS_USE_PSA_CRYPTO */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002216}
2217
Gilles Peskine449bd832023-01-11 14:50:10 +01002218int mbedtls_ssl_set_hs_psk(mbedtls_ssl_context *ssl,
2219 const unsigned char *psk, size_t psk_len)
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002220{
Neil Armstrong501c9322022-05-03 09:35:09 +02002221#if defined(MBEDTLS_USE_PSA_CRYPTO)
2222 psa_key_attributes_t key_attributes = psa_key_attributes_init();
Jerry Yu5d01c052022-08-17 10:18:10 +08002223 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Jerry Yu24b8c812022-08-20 19:06:56 +08002224 psa_algorithm_t alg = PSA_ALG_NONE;
Jerry Yu5d01c052022-08-17 10:18:10 +08002225 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Neil Armstrong501c9322022-05-03 09:35:09 +02002226#endif /* MBEDTLS_USE_PSA_CRYPTO */
2227
Gilles Peskine449bd832023-01-11 14:50:10 +01002228 if (psk == NULL || ssl->handshake == NULL) {
2229 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2230 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002231
Gilles Peskine449bd832023-01-11 14:50:10 +01002232 if (psk_len > MBEDTLS_PSK_MAX_LEN) {
2233 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2234 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002235
Gilles Peskine449bd832023-01-11 14:50:10 +01002236 ssl_remove_psk(ssl);
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002237
Neil Armstrong501c9322022-05-03 09:35:09 +02002238#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yuccc68a42022-07-26 16:39:20 +08002239#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01002240 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2) {
2241 if (ssl->handshake->ciphersuite_info->mac == MBEDTLS_MD_SHA384) {
2242 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
2243 } else {
2244 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
2245 }
2246 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
Jerry Yuccc68a42022-07-26 16:39:20 +08002247 }
2248#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Neil Armstrong501c9322022-05-03 09:35:09 +02002249
Jerry Yu568ec252022-07-22 21:27:34 +08002250#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01002251 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
2252 alg = PSA_ALG_HKDF_EXTRACT(PSA_ALG_ANY_HASH);
2253 psa_set_key_usage_flags(&key_attributes,
2254 PSA_KEY_USAGE_DERIVE | PSA_KEY_USAGE_EXPORT);
Jerry Yuccc68a42022-07-26 16:39:20 +08002255 }
2256#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
2257
Gilles Peskine449bd832023-01-11 14:50:10 +01002258 psa_set_key_algorithm(&key_attributes, alg);
2259 psa_set_key_type(&key_attributes, PSA_KEY_TYPE_DERIVE);
Neil Armstrong501c9322022-05-03 09:35:09 +02002260
Gilles Peskine449bd832023-01-11 14:50:10 +01002261 status = psa_import_key(&key_attributes, psk, psk_len, &key);
2262 if (status != PSA_SUCCESS) {
2263 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
2264 }
Neil Armstrong501c9322022-05-03 09:35:09 +02002265
2266 /* Allow calling psa_destroy_key() on psk remove */
2267 ssl->handshake->psk_opaque_is_internal = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01002268 return mbedtls_ssl_set_hs_psk_opaque(ssl, key);
Neil Armstrong501c9322022-05-03 09:35:09 +02002269#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002270 if ((ssl->handshake->psk = mbedtls_calloc(1, psk_len)) == NULL) {
2271 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2272 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002273
2274 ssl->handshake->psk_len = psk_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002275 memcpy(ssl->handshake->psk, psk, ssl->handshake->psk_len);
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002276
Gilles Peskine449bd832023-01-11 14:50:10 +01002277 return 0;
Neil Armstrong501c9322022-05-03 09:35:09 +02002278#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01002279}
2280
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002281#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002282int mbedtls_ssl_conf_psk_opaque(mbedtls_ssl_config *conf,
2283 mbedtls_svc_key_id_t psk,
2284 const unsigned char *psk_identity,
2285 size_t psk_identity_len)
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002286{
Janos Follath865b3eb2019-12-16 11:46:15 +00002287 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker2ed3dce2021-04-19 21:59:14 +01002288
2289 /* We currently only support one PSK, raw or opaque. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002290 if (mbedtls_ssl_conf_has_static_psk(conf)) {
2291 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2292 }
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002293
Hanno Becker7390c712018-11-15 13:33:04 +00002294 /* Check and set opaque PSK */
Gilles Peskine449bd832023-01-11 14:50:10 +01002295 if (mbedtls_svc_key_id_is_null(psk)) {
2296 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2297 }
Ronald Croncf56a0a2020-08-04 09:51:30 +02002298 conf->psk_opaque = psk;
Hanno Becker7390c712018-11-15 13:33:04 +00002299
2300 /* Check and set PSK Identity */
Gilles Peskine449bd832023-01-11 14:50:10 +01002301 ret = ssl_conf_set_psk_identity(conf, psk_identity,
2302 psk_identity_len);
2303 if (ret != 0) {
2304 ssl_conf_remove_psk(conf);
2305 }
Hanno Becker7390c712018-11-15 13:33:04 +00002306
Gilles Peskine449bd832023-01-11 14:50:10 +01002307 return ret;
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002308}
2309
Gilles Peskine449bd832023-01-11 14:50:10 +01002310int mbedtls_ssl_set_hs_psk_opaque(mbedtls_ssl_context *ssl,
2311 mbedtls_svc_key_id_t psk)
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002312{
Gilles Peskine449bd832023-01-11 14:50:10 +01002313 if ((mbedtls_svc_key_id_is_null(psk)) ||
2314 (ssl->handshake == NULL)) {
2315 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2316 }
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002317
Gilles Peskine449bd832023-01-11 14:50:10 +01002318 ssl_remove_psk(ssl);
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002319 ssl->handshake->psk_opaque = psk;
Gilles Peskine449bd832023-01-11 14:50:10 +01002320 return 0;
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002321}
2322#endif /* MBEDTLS_USE_PSA_CRYPTO */
2323
Jerry Yu8897c072022-08-12 13:56:53 +08002324#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002325void mbedtls_ssl_conf_psk_cb(mbedtls_ssl_config *conf,
2326 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
2327 size_t),
2328 void *p_psk)
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002329{
2330 conf->f_psk = f_psk;
2331 conf->p_psk = p_psk;
2332}
Jerry Yu8897c072022-08-12 13:56:53 +08002333#endif /* MBEDTLS_SSL_SRV_C */
2334
Ronald Cron73fe8df2022-10-05 14:31:43 +02002335#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Przemyslaw Stekiel6928a512022-02-03 13:50:35 +01002336
2337#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine301711e2022-04-26 16:57:05 +02002338static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
Gilles Peskine449bd832023-01-11 14:50:10 +01002339 psa_algorithm_t alg)
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002340{
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002341#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01002342 if (alg == PSA_ALG_CBC_NO_PADDING) {
2343 return MBEDTLS_SSL_MODE_CBC;
2344 }
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002345#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
Gilles Peskine449bd832023-01-11 14:50:10 +01002346 if (PSA_ALG_IS_AEAD(alg)) {
2347 return MBEDTLS_SSL_MODE_AEAD;
2348 }
2349 return MBEDTLS_SSL_MODE_STREAM;
Gilles Peskine301711e2022-04-26 16:57:05 +02002350}
2351
2352#else /* MBEDTLS_USE_PSA_CRYPTO */
2353
2354static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
Gilles Peskine449bd832023-01-11 14:50:10 +01002355 mbedtls_cipher_mode_t mode)
Gilles Peskine301711e2022-04-26 16:57:05 +02002356{
2357#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01002358 if (mode == MBEDTLS_MODE_CBC) {
2359 return MBEDTLS_SSL_MODE_CBC;
2360 }
Gilles Peskine301711e2022-04-26 16:57:05 +02002361#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
2362
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002363#if defined(MBEDTLS_GCM_C) || \
2364 defined(MBEDTLS_CCM_C) || \
2365 defined(MBEDTLS_CHACHAPOLY_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002366 if (mode == MBEDTLS_MODE_GCM ||
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002367 mode == MBEDTLS_MODE_CCM ||
Gilles Peskine449bd832023-01-11 14:50:10 +01002368 mode == MBEDTLS_MODE_CHACHAPOLY) {
2369 return MBEDTLS_SSL_MODE_AEAD;
2370 }
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002371#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002372
Gilles Peskine449bd832023-01-11 14:50:10 +01002373 return MBEDTLS_SSL_MODE_STREAM;
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002374}
Gilles Peskine301711e2022-04-26 16:57:05 +02002375#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong8a0f3e82022-03-30 10:57:37 +02002376
Gilles Peskinee108d982022-04-26 16:50:40 +02002377static mbedtls_ssl_mode_t mbedtls_ssl_get_actual_mode(
2378 mbedtls_ssl_mode_t base_mode,
Gilles Peskine449bd832023-01-11 14:50:10 +01002379 int encrypt_then_mac)
Gilles Peskinee108d982022-04-26 16:50:40 +02002380{
2381#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01002382 if (encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
2383 base_mode == MBEDTLS_SSL_MODE_CBC) {
2384 return MBEDTLS_SSL_MODE_CBC_ETM;
Gilles Peskinee108d982022-04-26 16:50:40 +02002385 }
2386#else
2387 (void) encrypt_then_mac;
2388#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002389 return base_mode;
Gilles Peskinee108d982022-04-26 16:50:40 +02002390}
2391
Neil Armstrongab555e02022-04-04 11:07:59 +02002392mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_transform(
Gilles Peskine449bd832023-01-11 14:50:10 +01002393 const mbedtls_ssl_transform *transform)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002394{
Gilles Peskinee108d982022-04-26 16:50:40 +02002395 mbedtls_ssl_mode_t base_mode = mbedtls_ssl_get_base_mode(
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002396#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01002397 transform->psa_alg
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002398#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002399 mbedtls_cipher_get_cipher_mode(&transform->cipher_ctx_enc)
Gilles Peskinee108d982022-04-26 16:50:40 +02002400#endif
2401 );
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002402
Gilles Peskinee108d982022-04-26 16:50:40 +02002403 int encrypt_then_mac = 0;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02002404#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskinee108d982022-04-26 16:50:40 +02002405 encrypt_then_mac = transform->encrypt_then_mac;
2406#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002407 return mbedtls_ssl_get_actual_mode(base_mode, encrypt_then_mac);
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002408}
2409
Neil Armstrongab555e02022-04-04 11:07:59 +02002410mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02002411#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01002412 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02002413#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01002414 const mbedtls_ssl_ciphersuite_t *suite)
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002415{
Gilles Peskinee108d982022-04-26 16:50:40 +02002416 mbedtls_ssl_mode_t base_mode = MBEDTLS_SSL_MODE_STREAM;
2417
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002418#if defined(MBEDTLS_USE_PSA_CRYPTO)
2419 psa_status_t status;
2420 psa_algorithm_t alg;
2421 psa_key_type_t type;
2422 size_t size;
Dave Rodgman2eab4622023-10-05 13:30:37 +01002423 status = mbedtls_ssl_cipher_to_psa((mbedtls_cipher_type_t) suite->cipher,
2424 0, &alg, &type, &size);
Gilles Peskine449bd832023-01-11 14:50:10 +01002425 if (status == PSA_SUCCESS) {
2426 base_mode = mbedtls_ssl_get_base_mode(alg);
2427 }
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002428#else
2429 const mbedtls_cipher_info_t *cipher =
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01002430 mbedtls_cipher_info_from_type((mbedtls_cipher_type_t) suite->cipher);
Gilles Peskine449bd832023-01-11 14:50:10 +01002431 if (cipher != NULL) {
Gilles Peskinee108d982022-04-26 16:50:40 +02002432 base_mode =
2433 mbedtls_ssl_get_base_mode(
Gilles Peskine449bd832023-01-11 14:50:10 +01002434 mbedtls_cipher_info_get_mode(cipher));
Gilles Peskinee108d982022-04-26 16:50:40 +02002435 }
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002436#endif /* MBEDTLS_USE_PSA_CRYPTO */
2437
Gilles Peskinee108d982022-04-26 16:50:40 +02002438#if !defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
2439 int encrypt_then_mac = 0;
2440#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002441 return mbedtls_ssl_get_actual_mode(base_mode, encrypt_then_mac);
Neil Armstrong4bf4c862022-04-01 10:35:48 +02002442}
2443
Neil Armstrong8395d7a2022-05-18 11:44:56 +02002444#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu251a12e2022-07-13 15:15:48 +08002445
2446#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu438ddd82022-07-07 06:55:50 +00002447/* Serialization of TLS 1.3 sessions:
2448 *
2449 * struct {
Xiaokang Qian126bf8e2022-10-13 02:22:40 +00002450 * opaque hostname<0..2^16-1>;
Jerry Yu342a5552023-11-10 14:23:39 +08002451 * uint64 ticket_reception_time;
Jerry Yu438ddd82022-07-07 06:55:50 +00002452 * uint32 ticket_lifetime;
Jerry Yu34191072022-08-18 10:32:09 +08002453 * opaque ticket<1..2^16-1>;
Jerry Yu438ddd82022-07-07 06:55:50 +00002454 * } ClientOnlyData;
2455 *
2456 * struct {
2457 * uint8 endpoint;
2458 * uint8 ciphersuite[2];
2459 * uint32 ticket_age_add;
2460 * uint8 ticket_flags;
2461 * opaque resumption_key<0..255>;
Jerry Yu02e3a072022-12-12 15:13:20 +08002462 * uint32 max_early_data_size;
Jan Brucknerf482dcc2023-03-15 09:09:06 +01002463 * uint16 record_size_limit;
Jerry Yu438ddd82022-07-07 06:55:50 +00002464 * select ( endpoint ) {
2465 * case client: ClientOnlyData;
Jerry Yucf913512023-11-14 11:06:52 +08002466 * case server: uint64 ticket_creation_time;
Jerry Yu438ddd82022-07-07 06:55:50 +00002467 * };
2468 * } serialized_session_tls13;
2469 *
2470 */
2471#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yue36fdd62022-08-17 21:31:36 +08002472MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002473static int ssl_tls13_session_save(const mbedtls_ssl_session *session,
2474 unsigned char *buf,
2475 size_t buf_len,
2476 size_t *olen)
Jerry Yu438ddd82022-07-07 06:55:50 +00002477{
2478 unsigned char *p = buf;
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00002479#if defined(MBEDTLS_SSL_CLI_C) && \
2480 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01002481 size_t hostname_len = (session->hostname == NULL) ?
2482 0 : strlen(session->hostname) + 1;
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00002483#endif
Jerry Yubc7c1a42022-07-21 22:57:37 +08002484 size_t needed = 1 /* endpoint */
2485 + 2 /* ciphersuite */
2486 + 4 /* ticket_age_add */
Jerry Yu34191072022-08-18 10:32:09 +08002487 + 1 /* ticket_flags */
2488 + 1; /* resumption_key length */
Jerry Yue36fdd62022-08-17 21:31:36 +08002489 *olen = 0;
Jerry Yu34191072022-08-18 10:32:09 +08002490
Gilles Peskine449bd832023-01-11 14:50:10 +01002491 if (session->resumption_key_len > MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN) {
2492 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2493 }
Jerry Yu34191072022-08-18 10:32:09 +08002494 needed += session->resumption_key_len; /* resumption_key */
2495
Jerry Yu02e3a072022-12-12 15:13:20 +08002496#if defined(MBEDTLS_SSL_EARLY_DATA)
2497 needed += 4; /* max_early_data_size */
2498#endif
Jan Brucknerf482dcc2023-03-15 09:09:06 +01002499#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
Waleed Elmelegy049cd302023-12-20 17:28:31 +00002500 needed += 2; /* record_size_limit */
Jan Brucknerf482dcc2023-03-15 09:09:06 +01002501#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
Jerry Yu02e3a072022-12-12 15:13:20 +08002502
Jerry Yu438ddd82022-07-07 06:55:50 +00002503#if defined(MBEDTLS_HAVE_TIME)
Jerry Yucf913512023-11-14 11:06:52 +08002504 needed += 8; /* ticket_creation_time or ticket_reception_time */
Jerry Yu438ddd82022-07-07 06:55:50 +00002505#endif
2506
2507#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002508 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Xiaokang Qian126bf8e2022-10-13 02:22:40 +00002509#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaokang Qianbc663a02022-10-09 11:14:39 +00002510 needed += 2 /* hostname_len */
Gilles Peskine449bd832023-01-11 14:50:10 +01002511 + hostname_len; /* hostname */
Xiaokang Qian281fd1b2022-09-20 11:35:41 +00002512#endif
2513
Jerry Yu438ddd82022-07-07 06:55:50 +00002514 needed += 4 /* ticket_lifetime */
Jerry Yue36fdd62022-08-17 21:31:36 +08002515 + 2; /* ticket_len */
Jerry Yu34191072022-08-18 10:32:09 +08002516
2517 /* Check size_t overflow */
Gilles Peskine449bd832023-01-11 14:50:10 +01002518 if (session->ticket_len > SIZE_MAX - needed) {
2519 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2520 }
Jerry Yu34191072022-08-18 10:32:09 +08002521
Jerry Yue28d9742022-08-18 15:44:03 +08002522 needed += session->ticket_len; /* ticket */
Jerry Yu438ddd82022-07-07 06:55:50 +00002523 }
2524#endif /* MBEDTLS_SSL_CLI_C */
2525
Jerry Yue36fdd62022-08-17 21:31:36 +08002526 *olen = needed;
Gilles Peskine449bd832023-01-11 14:50:10 +01002527 if (needed > buf_len) {
2528 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
2529 }
Jerry Yu438ddd82022-07-07 06:55:50 +00002530
2531 p[0] = session->endpoint;
Gilles Peskine449bd832023-01-11 14:50:10 +01002532 MBEDTLS_PUT_UINT16_BE(session->ciphersuite, p, 1);
2533 MBEDTLS_PUT_UINT32_BE(session->ticket_age_add, p, 3);
Jerry Yu438ddd82022-07-07 06:55:50 +00002534 p[7] = session->ticket_flags;
2535
2536 /* save resumption_key */
Jerry Yubc7c1a42022-07-21 22:57:37 +08002537 p[8] = session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002538 p += 9;
Gilles Peskine449bd832023-01-11 14:50:10 +01002539 memcpy(p, session->resumption_key, session->resumption_key_len);
Jerry Yubc7c1a42022-07-21 22:57:37 +08002540 p += session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002541
Jerry Yu02e3a072022-12-12 15:13:20 +08002542#if defined(MBEDTLS_SSL_EARLY_DATA)
2543 MBEDTLS_PUT_UINT32_BE(session->max_early_data_size, p, 0);
2544 p += 4;
2545#endif
Jan Brucknerf482dcc2023-03-15 09:09:06 +01002546#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
2547 MBEDTLS_PUT_UINT16_BE(session->record_size_limit, p, 0);
2548 p += 2;
2549#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
Jerry Yu02e3a072022-12-12 15:13:20 +08002550
Jerry Yu438ddd82022-07-07 06:55:50 +00002551#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002552 if (session->endpoint == MBEDTLS_SSL_IS_SERVER) {
Jerry Yu25ba4d42023-11-10 14:12:20 +08002553 MBEDTLS_PUT_UINT64_BE((uint64_t) session->ticket_creation_time, p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002554 p += 8;
2555 }
2556#endif /* MBEDTLS_HAVE_TIME */
2557
2558#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002559 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002560#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01002561 MBEDTLS_PUT_UINT16_BE(hostname_len, p, 0);
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002562 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01002563 if (hostname_len > 0) {
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002564 /* save host name */
Gilles Peskine449bd832023-01-11 14:50:10 +01002565 memcpy(p, session->hostname, hostname_len);
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002566 p += hostname_len;
2567 }
2568#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
2569
Jerry Yu438ddd82022-07-07 06:55:50 +00002570#if defined(MBEDTLS_HAVE_TIME)
Jerry Yu342a5552023-11-10 14:23:39 +08002571 MBEDTLS_PUT_UINT64_BE((uint64_t) session->ticket_reception_time, p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002572 p += 8;
2573#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002574 MBEDTLS_PUT_UINT32_BE(session->ticket_lifetime, p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002575 p += 4;
2576
Gilles Peskine449bd832023-01-11 14:50:10 +01002577 MBEDTLS_PUT_UINT16_BE(session->ticket_len, p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002578 p += 2;
Jerry Yu34191072022-08-18 10:32:09 +08002579
Gilles Peskine449bd832023-01-11 14:50:10 +01002580 if (session->ticket != NULL && session->ticket_len > 0) {
2581 memcpy(p, session->ticket, session->ticket_len);
Jerry Yu438ddd82022-07-07 06:55:50 +00002582 p += session->ticket_len;
2583 }
2584 }
2585#endif /* MBEDTLS_SSL_CLI_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01002586 return 0;
Jerry Yu438ddd82022-07-07 06:55:50 +00002587}
2588
2589MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002590static int ssl_tls13_session_load(mbedtls_ssl_session *session,
2591 const unsigned char *buf,
2592 size_t len)
Jerry Yu438ddd82022-07-07 06:55:50 +00002593{
2594 const unsigned char *p = buf;
2595 const unsigned char *end = buf + len;
2596
Gilles Peskine449bd832023-01-11 14:50:10 +01002597 if (end - p < 9) {
2598 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2599 }
Jerry Yu438ddd82022-07-07 06:55:50 +00002600 session->endpoint = p[0];
Gilles Peskine449bd832023-01-11 14:50:10 +01002601 session->ciphersuite = MBEDTLS_GET_UINT16_BE(p, 1);
2602 session->ticket_age_add = MBEDTLS_GET_UINT32_BE(p, 3);
Jerry Yu438ddd82022-07-07 06:55:50 +00002603 session->ticket_flags = p[7];
2604
2605 /* load resumption_key */
Jerry Yubc7c1a42022-07-21 22:57:37 +08002606 session->resumption_key_len = p[8];
Jerry Yu438ddd82022-07-07 06:55:50 +00002607 p += 9;
2608
Gilles Peskine449bd832023-01-11 14:50:10 +01002609 if (end - p < session->resumption_key_len) {
2610 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2611 }
Jerry Yu438ddd82022-07-07 06:55:50 +00002612
Gilles Peskine449bd832023-01-11 14:50:10 +01002613 if (sizeof(session->resumption_key) < session->resumption_key_len) {
2614 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2615 }
2616 memcpy(session->resumption_key, p, session->resumption_key_len);
Jerry Yubc7c1a42022-07-21 22:57:37 +08002617 p += session->resumption_key_len;
Jerry Yu438ddd82022-07-07 06:55:50 +00002618
Jerry Yu02e3a072022-12-12 15:13:20 +08002619#if defined(MBEDTLS_SSL_EARLY_DATA)
2620 if (end - p < 4) {
2621 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2622 }
2623 session->max_early_data_size = MBEDTLS_GET_UINT32_BE(p, 0);
2624 p += 4;
2625#endif
Jan Brucknerf482dcc2023-03-15 09:09:06 +01002626#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
2627 if (end - p < 2) {
2628 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2629 }
2630 session->record_size_limit = MBEDTLS_GET_UINT16_BE(p, 0);
2631 p += 2;
2632#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
Jerry Yu02e3a072022-12-12 15:13:20 +08002633
Jerry Yu438ddd82022-07-07 06:55:50 +00002634#if defined(MBEDTLS_HAVE_TIME) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002635 if (session->endpoint == MBEDTLS_SSL_IS_SERVER) {
2636 if (end - p < 8) {
2637 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2638 }
Jerry Yu25ba4d42023-11-10 14:12:20 +08002639 session->ticket_creation_time = MBEDTLS_GET_UINT64_BE(p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002640 p += 8;
2641 }
2642#endif /* MBEDTLS_HAVE_TIME */
2643
2644#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002645 if (session->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Yanray Wangfd256542023-11-22 10:32:03 +08002646#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002647 size_t hostname_len;
2648 /* load host name */
Gilles Peskine449bd832023-01-11 14:50:10 +01002649 if (end - p < 2) {
2650 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2651 }
2652 hostname_len = MBEDTLS_GET_UINT16_BE(p, 0);
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002653 p += 2;
2654
Gilles Peskine449bd832023-01-11 14:50:10 +01002655 if (end - p < (long int) hostname_len) {
2656 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2657 }
2658 if (hostname_len > 0) {
2659 session->hostname = mbedtls_calloc(1, hostname_len);
2660 if (session->hostname == NULL) {
2661 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2662 }
2663 memcpy(session->hostname, p, hostname_len);
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002664 p += hostname_len;
2665 }
Yanray Wangfd256542023-11-22 10:32:03 +08002666#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Xiaokang Qianed0620c2022-10-12 06:58:13 +00002667
Jerry Yu438ddd82022-07-07 06:55:50 +00002668#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +01002669 if (end - p < 8) {
2670 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2671 }
Jerry Yu342a5552023-11-10 14:23:39 +08002672 session->ticket_reception_time = MBEDTLS_GET_UINT64_BE(p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002673 p += 8;
2674#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002675 if (end - p < 4) {
2676 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2677 }
2678 session->ticket_lifetime = MBEDTLS_GET_UINT32_BE(p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002679 p += 4;
2680
Gilles Peskine449bd832023-01-11 14:50:10 +01002681 if (end - p < 2) {
2682 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2683 }
2684 session->ticket_len = MBEDTLS_GET_UINT16_BE(p, 0);
Jerry Yu438ddd82022-07-07 06:55:50 +00002685 p += 2;
2686
Gilles Peskine449bd832023-01-11 14:50:10 +01002687 if (end - p < (long int) session->ticket_len) {
2688 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2689 }
2690 if (session->ticket_len > 0) {
2691 session->ticket = mbedtls_calloc(1, session->ticket_len);
2692 if (session->ticket == NULL) {
2693 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2694 }
2695 memcpy(session->ticket, p, session->ticket_len);
Jerry Yu438ddd82022-07-07 06:55:50 +00002696 p += session->ticket_len;
2697 }
2698 }
2699#endif /* MBEDTLS_SSL_CLI_C */
2700
Gilles Peskine449bd832023-01-11 14:50:10 +01002701 return 0;
Jerry Yu438ddd82022-07-07 06:55:50 +00002702
2703}
2704#else /* MBEDTLS_SSL_SESSION_TICKETS */
Jerry Yue36fdd62022-08-17 21:31:36 +08002705MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002706static int ssl_tls13_session_save(const mbedtls_ssl_session *session,
2707 unsigned char *buf,
2708 size_t buf_len,
2709 size_t *olen)
Jerry Yu251a12e2022-07-13 15:15:48 +08002710{
2711 ((void) session);
2712 ((void) buf);
2713 ((void) buf_len);
Jerry Yue36fdd62022-08-17 21:31:36 +08002714 *olen = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002715 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Jerry Yu251a12e2022-07-13 15:15:48 +08002716}
Jerry Yu438ddd82022-07-07 06:55:50 +00002717
Gilles Peskine449bd832023-01-11 14:50:10 +01002718static int ssl_tls13_session_load(const mbedtls_ssl_session *session,
2719 unsigned char *buf,
2720 size_t buf_len)
Jerry Yu438ddd82022-07-07 06:55:50 +00002721{
2722 ((void) session);
2723 ((void) buf);
2724 ((void) buf_len);
Gilles Peskine449bd832023-01-11 14:50:10 +01002725 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Jerry Yu438ddd82022-07-07 06:55:50 +00002726}
2727#endif /* !MBEDTLS_SSL_SESSION_TICKETS */
Jerry Yu251a12e2022-07-13 15:15:48 +08002728#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
2729
Gilles Peskine449bd832023-01-11 14:50:10 +01002730psa_status_t mbedtls_ssl_cipher_to_psa(mbedtls_cipher_type_t mbedtls_cipher_type,
2731 size_t taglen,
2732 psa_algorithm_t *alg,
2733 psa_key_type_t *key_type,
2734 size_t *key_size)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002735{
Yanray Wang19e4dc82023-11-16 18:02:05 +08002736#if !defined(MBEDTLS_SSL_HAVE_CCM)
2737 (void) taglen;
2738#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01002739 switch (mbedtls_cipher_type) {
Yanray Wang1a369d62023-11-16 15:17:31 +08002740#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_CBC)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002741 case MBEDTLS_CIPHER_AES_128_CBC:
2742 *alg = PSA_ALG_CBC_NO_PADDING;
2743 *key_type = PSA_KEY_TYPE_AES;
2744 *key_size = 128;
2745 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002746#endif
2747#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002748 case MBEDTLS_CIPHER_AES_128_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002749 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002750 *key_type = PSA_KEY_TYPE_AES;
2751 *key_size = 128;
2752 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002753#endif
2754#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002755 case MBEDTLS_CIPHER_AES_128_GCM:
2756 *alg = PSA_ALG_GCM;
2757 *key_type = PSA_KEY_TYPE_AES;
2758 *key_size = 128;
2759 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002760#endif
2761#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002762 case MBEDTLS_CIPHER_AES_192_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002763 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002764 *key_type = PSA_KEY_TYPE_AES;
2765 *key_size = 192;
2766 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002767#endif
2768#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002769 case MBEDTLS_CIPHER_AES_192_GCM:
2770 *alg = PSA_ALG_GCM;
2771 *key_type = PSA_KEY_TYPE_AES;
2772 *key_size = 192;
2773 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002774#endif
2775#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_CBC)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002776 case MBEDTLS_CIPHER_AES_256_CBC:
2777 *alg = PSA_ALG_CBC_NO_PADDING;
2778 *key_type = PSA_KEY_TYPE_AES;
2779 *key_size = 256;
2780 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002781#endif
2782#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002783 case MBEDTLS_CIPHER_AES_256_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002784 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002785 *key_type = PSA_KEY_TYPE_AES;
2786 *key_size = 256;
2787 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002788#endif
2789#if defined(MBEDTLS_SSL_HAVE_AES) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002790 case MBEDTLS_CIPHER_AES_256_GCM:
2791 *alg = PSA_ALG_GCM;
2792 *key_type = PSA_KEY_TYPE_AES;
2793 *key_size = 256;
2794 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002795#endif
2796#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_CBC)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002797 case MBEDTLS_CIPHER_ARIA_128_CBC:
2798 *alg = PSA_ALG_CBC_NO_PADDING;
2799 *key_type = PSA_KEY_TYPE_ARIA;
2800 *key_size = 128;
2801 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002802#endif
2803#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002804 case MBEDTLS_CIPHER_ARIA_128_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002805 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002806 *key_type = PSA_KEY_TYPE_ARIA;
2807 *key_size = 128;
2808 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002809#endif
2810#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002811 case MBEDTLS_CIPHER_ARIA_128_GCM:
2812 *alg = PSA_ALG_GCM;
2813 *key_type = PSA_KEY_TYPE_ARIA;
2814 *key_size = 128;
2815 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002816#endif
2817#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002818 case MBEDTLS_CIPHER_ARIA_192_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002819 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002820 *key_type = PSA_KEY_TYPE_ARIA;
2821 *key_size = 192;
2822 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002823#endif
2824#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002825 case MBEDTLS_CIPHER_ARIA_192_GCM:
2826 *alg = PSA_ALG_GCM;
2827 *key_type = PSA_KEY_TYPE_ARIA;
2828 *key_size = 192;
2829 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002830#endif
2831#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_CBC)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002832 case MBEDTLS_CIPHER_ARIA_256_CBC:
2833 *alg = PSA_ALG_CBC_NO_PADDING;
2834 *key_type = PSA_KEY_TYPE_ARIA;
2835 *key_size = 256;
2836 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002837#endif
2838#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002839 case MBEDTLS_CIPHER_ARIA_256_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002840 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002841 *key_type = PSA_KEY_TYPE_ARIA;
2842 *key_size = 256;
2843 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002844#endif
2845#if defined(MBEDTLS_SSL_HAVE_ARIA) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002846 case MBEDTLS_CIPHER_ARIA_256_GCM:
2847 *alg = PSA_ALG_GCM;
2848 *key_type = PSA_KEY_TYPE_ARIA;
2849 *key_size = 256;
2850 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002851#endif
2852#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_CBC)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002853 case MBEDTLS_CIPHER_CAMELLIA_128_CBC:
2854 *alg = PSA_ALG_CBC_NO_PADDING;
2855 *key_type = PSA_KEY_TYPE_CAMELLIA;
2856 *key_size = 128;
2857 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002858#endif
2859#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002860 case MBEDTLS_CIPHER_CAMELLIA_128_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002861 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002862 *key_type = PSA_KEY_TYPE_CAMELLIA;
2863 *key_size = 128;
2864 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002865#endif
2866#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002867 case MBEDTLS_CIPHER_CAMELLIA_128_GCM:
2868 *alg = PSA_ALG_GCM;
2869 *key_type = PSA_KEY_TYPE_CAMELLIA;
2870 *key_size = 128;
2871 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002872#endif
2873#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002874 case MBEDTLS_CIPHER_CAMELLIA_192_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002875 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002876 *key_type = PSA_KEY_TYPE_CAMELLIA;
2877 *key_size = 192;
2878 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002879#endif
2880#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002881 case MBEDTLS_CIPHER_CAMELLIA_192_GCM:
2882 *alg = PSA_ALG_GCM;
2883 *key_type = PSA_KEY_TYPE_CAMELLIA;
2884 *key_size = 192;
2885 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002886#endif
2887#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_CBC)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002888 case MBEDTLS_CIPHER_CAMELLIA_256_CBC:
2889 *alg = PSA_ALG_CBC_NO_PADDING;
2890 *key_type = PSA_KEY_TYPE_CAMELLIA;
2891 *key_size = 256;
2892 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002893#endif
2894#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_CCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002895 case MBEDTLS_CIPHER_CAMELLIA_256_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01002896 *alg = taglen ? PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, taglen) : PSA_ALG_CCM;
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002897 *key_type = PSA_KEY_TYPE_CAMELLIA;
2898 *key_size = 256;
2899 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002900#endif
2901#if defined(MBEDTLS_SSL_HAVE_CAMELLIA) && defined(MBEDTLS_SSL_HAVE_GCM)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002902 case MBEDTLS_CIPHER_CAMELLIA_256_GCM:
2903 *alg = PSA_ALG_GCM;
2904 *key_type = PSA_KEY_TYPE_CAMELLIA;
2905 *key_size = 256;
2906 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002907#endif
2908#if defined(MBEDTLS_SSL_HAVE_CHACHAPOLY)
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002909 case MBEDTLS_CIPHER_CHACHA20_POLY1305:
2910 *alg = PSA_ALG_CHACHA20_POLY1305;
2911 *key_type = PSA_KEY_TYPE_CHACHA20;
2912 *key_size = 256;
2913 break;
Yanray Wang1a369d62023-11-16 15:17:31 +08002914#endif
Przemyslaw Stekiel430f3372022-01-10 11:55:46 +01002915 case MBEDTLS_CIPHER_NULL:
2916 *alg = MBEDTLS_SSL_NULL_CIPHER;
2917 *key_type = 0;
2918 *key_size = 0;
2919 break;
2920 default:
2921 return PSA_ERROR_NOT_SUPPORTED;
2922 }
2923
2924 return PSA_SUCCESS;
2925}
Neil Armstrong8395d7a2022-05-18 11:44:56 +02002926#endif /* MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Beckerd20a8ca2018-10-22 15:31:26 +01002927
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002928#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002929int mbedtls_ssl_conf_dh_param_bin(mbedtls_ssl_config *conf,
2930 const unsigned char *dhm_P, size_t P_len,
2931 const unsigned char *dhm_G, size_t G_len)
Hanno Beckera90658f2017-10-04 15:29:08 +01002932{
Janos Follath865b3eb2019-12-16 11:46:15 +00002933 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckera90658f2017-10-04 15:29:08 +01002934
Gilles Peskine449bd832023-01-11 14:50:10 +01002935 mbedtls_mpi_free(&conf->dhm_P);
2936 mbedtls_mpi_free(&conf->dhm_G);
Glenn Strausscee11292021-12-20 01:43:17 -05002937
Gilles Peskine449bd832023-01-11 14:50:10 +01002938 if ((ret = mbedtls_mpi_read_binary(&conf->dhm_P, dhm_P, P_len)) != 0 ||
2939 (ret = mbedtls_mpi_read_binary(&conf->dhm_G, dhm_G, G_len)) != 0) {
2940 mbedtls_mpi_free(&conf->dhm_P);
2941 mbedtls_mpi_free(&conf->dhm_G);
2942 return ret;
Hanno Beckera90658f2017-10-04 15:29:08 +01002943 }
2944
Gilles Peskine449bd832023-01-11 14:50:10 +01002945 return 0;
Hanno Beckera90658f2017-10-04 15:29:08 +01002946}
Paul Bakker5121ce52009-01-03 21:22:43 +00002947
Gilles Peskine449bd832023-01-11 14:50:10 +01002948int mbedtls_ssl_conf_dh_param_ctx(mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx)
Paul Bakker1b57b062011-01-06 15:48:19 +00002949{
Janos Follath865b3eb2019-12-16 11:46:15 +00002950 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker1b57b062011-01-06 15:48:19 +00002951
Gilles Peskine449bd832023-01-11 14:50:10 +01002952 mbedtls_mpi_free(&conf->dhm_P);
2953 mbedtls_mpi_free(&conf->dhm_G);
Glenn Strausscee11292021-12-20 01:43:17 -05002954
Gilles Peskine449bd832023-01-11 14:50:10 +01002955 if ((ret = mbedtls_dhm_get_value(dhm_ctx, MBEDTLS_DHM_PARAM_P,
2956 &conf->dhm_P)) != 0 ||
2957 (ret = mbedtls_dhm_get_value(dhm_ctx, MBEDTLS_DHM_PARAM_G,
2958 &conf->dhm_G)) != 0) {
2959 mbedtls_mpi_free(&conf->dhm_P);
2960 mbedtls_mpi_free(&conf->dhm_G);
2961 return ret;
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002962 }
Paul Bakker1b57b062011-01-06 15:48:19 +00002963
Gilles Peskine449bd832023-01-11 14:50:10 +01002964 return 0;
Paul Bakker1b57b062011-01-06 15:48:19 +00002965}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02002966#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00002967
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02002968#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
2969/*
2970 * Set the minimum length for Diffie-Hellman parameters
2971 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002972void mbedtls_ssl_conf_dhm_min_bitlen(mbedtls_ssl_config *conf,
2973 unsigned int bitlen)
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02002974{
2975 conf->dhm_min_bitlen = bitlen;
2976}
2977#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
2978
Ronald Crone68ab4f2022-10-05 12:46:29 +02002979#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002980#if !defined(MBEDTLS_DEPRECATED_REMOVED) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002981/*
2982 * Set allowed/preferred hashes for handshake signatures
2983 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002984void mbedtls_ssl_conf_sig_hashes(mbedtls_ssl_config *conf,
2985 const int *hashes)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02002986{
2987 conf->sig_hashes = hashes;
2988}
Jerry Yu7ddc38c2022-01-19 11:08:05 +08002989#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker1cd6e002021-08-10 13:27:10 +01002990
Jerry Yuf017ee42022-01-12 15:49:48 +08002991/* Configure allowed signature algorithms for handshake */
Gilles Peskine449bd832023-01-11 14:50:10 +01002992void mbedtls_ssl_conf_sig_algs(mbedtls_ssl_config *conf,
2993 const uint16_t *sig_algs)
Hanno Becker1cd6e002021-08-10 13:27:10 +01002994{
Jerry Yuf017ee42022-01-12 15:49:48 +08002995#if !defined(MBEDTLS_DEPRECATED_REMOVED)
2996 conf->sig_hashes = NULL;
2997#endif /* !MBEDTLS_DEPRECATED_REMOVED */
2998 conf->sig_algs = sig_algs;
Hanno Becker1cd6e002021-08-10 13:27:10 +01002999}
Ronald Crone68ab4f2022-10-05 12:46:29 +02003000#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02003001
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02003002#if defined(MBEDTLS_ECP_C)
Brett Warrene0edc842021-08-17 09:53:13 +01003003#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01003004/*
3005 * Set the allowed elliptic curves
Brett Warrene0edc842021-08-17 09:53:13 +01003006 *
3007 * mbedtls_ssl_setup() takes the provided list
3008 * and translates it to a list of IANA TLS group identifiers,
3009 * stored in ssl->handshake->group_list.
3010 *
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01003011 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003012void mbedtls_ssl_conf_curves(mbedtls_ssl_config *conf,
3013 const mbedtls_ecp_group_id *curve_list)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01003014{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003015 conf->curve_list = curve_list;
Brett Warrene0edc842021-08-17 09:53:13 +01003016 conf->group_list = NULL;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01003017}
Brett Warrene0edc842021-08-17 09:53:13 +01003018#endif /* MBEDTLS_DEPRECATED_REMOVED */
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02003019#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01003020
Brett Warrene0edc842021-08-17 09:53:13 +01003021/*
3022 * Set the allowed groups
3023 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003024void mbedtls_ssl_conf_groups(mbedtls_ssl_config *conf,
3025 const uint16_t *group_list)
Brett Warrene0edc842021-08-17 09:53:13 +01003026{
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02003027#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
Brett Warrene0edc842021-08-17 09:53:13 +01003028 conf->curve_list = NULL;
3029#endif
3030 conf->group_list = group_list;
3031}
3032
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01003033#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003034int mbedtls_ssl_set_hostname(mbedtls_ssl_context *ssl, const char *hostname)
Paul Bakker5121ce52009-01-03 21:22:43 +00003035{
Hanno Becker947194e2017-04-07 13:25:49 +01003036 /* Initialize to suppress unnecessary compiler warning */
3037 size_t hostname_len = 0;
3038
3039 /* Check if new hostname is valid before
3040 * making any change to current one */
Gilles Peskine449bd832023-01-11 14:50:10 +01003041 if (hostname != NULL) {
3042 hostname_len = strlen(hostname);
Hanno Becker947194e2017-04-07 13:25:49 +01003043
Gilles Peskine449bd832023-01-11 14:50:10 +01003044 if (hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN) {
3045 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3046 }
Hanno Becker947194e2017-04-07 13:25:49 +01003047 }
3048
3049 /* Now it's clear that we will overwrite the old hostname,
3050 * so we can free it safely */
3051
Gilles Peskine449bd832023-01-11 14:50:10 +01003052 if (ssl->hostname != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01003053 mbedtls_zeroize_and_free(ssl->hostname, strlen(ssl->hostname));
Hanno Becker947194e2017-04-07 13:25:49 +01003054 }
3055
3056 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01003057
Gilles Peskine449bd832023-01-11 14:50:10 +01003058 if (hostname == NULL) {
Hanno Becker947194e2017-04-07 13:25:49 +01003059 ssl->hostname = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01003060 } else {
3061 ssl->hostname = mbedtls_calloc(1, hostname_len + 1);
3062 if (ssl->hostname == NULL) {
3063 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
3064 }
Paul Bakker75c1a6f2013-08-19 14:25:29 +02003065
Gilles Peskine449bd832023-01-11 14:50:10 +01003066 memcpy(ssl->hostname, hostname, hostname_len);
Paul Bakker75c1a6f2013-08-19 14:25:29 +02003067
Hanno Becker947194e2017-04-07 13:25:49 +01003068 ssl->hostname[hostname_len] = '\0';
3069 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003070
Gilles Peskine449bd832023-01-11 14:50:10 +01003071 return 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00003072}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01003073#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00003074
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01003075#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01003076void mbedtls_ssl_conf_sni(mbedtls_ssl_config *conf,
3077 int (*f_sni)(void *, mbedtls_ssl_context *,
3078 const unsigned char *, size_t),
3079 void *p_sni)
Paul Bakker5701cdc2012-09-27 21:49:42 +00003080{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003081 conf->f_sni = f_sni;
3082 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00003083}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003084#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00003085
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003086#if defined(MBEDTLS_SSL_ALPN)
Gilles Peskine449bd832023-01-11 14:50:10 +01003087int mbedtls_ssl_conf_alpn_protocols(mbedtls_ssl_config *conf, const char **protos)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02003088{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02003089 size_t cur_len, tot_len;
3090 const char **p;
3091
3092 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08003093 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
3094 * MUST NOT be truncated."
3095 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02003096 */
3097 tot_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003098 for (p = protos; *p != NULL; p++) {
3099 cur_len = strlen(*p);
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02003100 tot_len += cur_len;
3101
Gilles Peskine449bd832023-01-11 14:50:10 +01003102 if ((cur_len == 0) ||
3103 (cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN) ||
3104 (tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN)) {
3105 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3106 }
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02003107 }
3108
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003109 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02003110
Gilles Peskine449bd832023-01-11 14:50:10 +01003111 return 0;
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02003112}
3113
Gilles Peskine449bd832023-01-11 14:50:10 +01003114const char *mbedtls_ssl_get_alpn_protocol(const mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02003115{
Gilles Peskine449bd832023-01-11 14:50:10 +01003116 return ssl->alpn_chosen;
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02003117}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003118#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02003119
Johan Pascalb62bb512015-12-03 21:56:45 +01003120#if defined(MBEDTLS_SSL_DTLS_SRTP)
Gilles Peskine449bd832023-01-11 14:50:10 +01003121void mbedtls_ssl_conf_srtp_mki_value_supported(mbedtls_ssl_config *conf,
3122 int support_mki_value)
Ron Eldor591f1622018-01-22 12:30:04 +02003123{
3124 conf->dtls_srtp_mki_support = support_mki_value;
3125}
3126
Gilles Peskine449bd832023-01-11 14:50:10 +01003127int mbedtls_ssl_dtls_srtp_set_mki_value(mbedtls_ssl_context *ssl,
3128 unsigned char *mki_value,
3129 uint16_t mki_len)
Ron Eldor591f1622018-01-22 12:30:04 +02003130{
Gilles Peskine449bd832023-01-11 14:50:10 +01003131 if (mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH) {
3132 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Ron Eldora9788042018-12-05 11:04:31 +02003133 }
Ron Eldor591f1622018-01-22 12:30:04 +02003134
Gilles Peskine449bd832023-01-11 14:50:10 +01003135 if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED) {
3136 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Ron Eldora9788042018-12-05 11:04:31 +02003137 }
Ron Eldor591f1622018-01-22 12:30:04 +02003138
Gilles Peskine449bd832023-01-11 14:50:10 +01003139 memcpy(ssl->dtls_srtp_info.mki_value, mki_value, mki_len);
Ron Eldor591f1622018-01-22 12:30:04 +02003140 ssl->dtls_srtp_info.mki_len = mki_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01003141 return 0;
Ron Eldor591f1622018-01-22 12:30:04 +02003142}
3143
Gilles Peskine449bd832023-01-11 14:50:10 +01003144int mbedtls_ssl_conf_dtls_srtp_protection_profiles(mbedtls_ssl_config *conf,
3145 const mbedtls_ssl_srtp_profile *profiles)
Johan Pascalb62bb512015-12-03 21:56:45 +01003146{
Johan Pascal253d0262020-09-22 13:04:45 +02003147 const mbedtls_ssl_srtp_profile *p;
3148 size_t list_size = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01003149
Johan Pascal253d0262020-09-22 13:04:45 +02003150 /* check the profiles list: all entry must be valid,
3151 * its size cannot be more than the total number of supported profiles, currently 4 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003152 for (p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET &&
3153 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH;
3154 p++) {
3155 if (mbedtls_ssl_check_srtp_profile_value(*p) != MBEDTLS_TLS_SRTP_UNSET) {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02003156 list_size++;
Gilles Peskine449bd832023-01-11 14:50:10 +01003157 } else {
Johan Pascal76fdf1d2020-10-22 23:31:00 +02003158 /* unsupported value, stop parsing and set the size to an error value */
3159 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1;
Johan Pascalb62bb512015-12-03 21:56:45 +01003160 }
3161 }
3162
Gilles Peskine449bd832023-01-11 14:50:10 +01003163 if (list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH) {
3164 conf->dtls_srtp_profile_list = NULL;
3165 conf->dtls_srtp_profile_list_len = 0;
3166 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Johan Pascal253d0262020-09-22 13:04:45 +02003167 }
3168
Johan Pascal9bc97ca2020-09-21 23:44:45 +02003169 conf->dtls_srtp_profile_list = profiles;
Johan Pascal253d0262020-09-22 13:04:45 +02003170 conf->dtls_srtp_profile_list_len = list_size;
Johan Pascalb62bb512015-12-03 21:56:45 +01003171
Gilles Peskine449bd832023-01-11 14:50:10 +01003172 return 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01003173}
3174
Gilles Peskine449bd832023-01-11 14:50:10 +01003175void mbedtls_ssl_get_dtls_srtp_negotiation_result(const mbedtls_ssl_context *ssl,
3176 mbedtls_dtls_srtp_info *dtls_srtp_info)
Johan Pascalb62bb512015-12-03 21:56:45 +01003177{
Johan Pascal2258a4f2020-10-28 13:53:09 +01003178 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile;
3179 /* do not copy the mki value if there is no chosen profile */
Gilles Peskine449bd832023-01-11 14:50:10 +01003180 if (dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET) {
Johan Pascal2258a4f2020-10-28 13:53:09 +01003181 dtls_srtp_info->mki_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003182 } else {
Johan Pascal2258a4f2020-10-28 13:53:09 +01003183 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01003184 memcpy(dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value,
3185 ssl->dtls_srtp_info.mki_len);
Johan Pascal2258a4f2020-10-28 13:53:09 +01003186 }
Johan Pascalb62bb512015-12-03 21:56:45 +01003187}
Johan Pascalb62bb512015-12-03 21:56:45 +01003188#endif /* MBEDTLS_SSL_DTLS_SRTP */
3189
Aditya Patwardhan3096f332022-07-26 14:31:46 +05303190#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskine449bd832023-01-11 14:50:10 +01003191void mbedtls_ssl_conf_max_version(mbedtls_ssl_config *conf, int major, int minor)
Paul Bakker490ecc82011-10-06 13:04:09 +00003192{
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01003193 conf->max_tls_version = (mbedtls_ssl_protocol_version) ((major << 8) | minor);
Paul Bakker490ecc82011-10-06 13:04:09 +00003194}
3195
Gilles Peskine449bd832023-01-11 14:50:10 +01003196void mbedtls_ssl_conf_min_version(mbedtls_ssl_config *conf, int major, int minor)
Paul Bakker1d29fb52012-09-28 13:28:45 +00003197{
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01003198 conf->min_tls_version = (mbedtls_ssl_protocol_version) ((major << 8) | minor);
Paul Bakker1d29fb52012-09-28 13:28:45 +00003199}
Aditya Patwardhan3096f332022-07-26 14:31:46 +05303200#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker1d29fb52012-09-28 13:28:45 +00003201
Janos Follath088ce432017-04-10 12:42:31 +01003202#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003203void mbedtls_ssl_conf_cert_req_ca_list(mbedtls_ssl_config *conf,
3204 char cert_req_ca_list)
Janos Follath088ce432017-04-10 12:42:31 +01003205{
3206 conf->cert_req_ca_list = cert_req_ca_list;
3207}
3208#endif
3209
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003210#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01003211void mbedtls_ssl_conf_encrypt_then_mac(mbedtls_ssl_config *conf, char etm)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01003212{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003213 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01003214}
3215#endif
3216
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003217#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Gilles Peskine449bd832023-01-11 14:50:10 +01003218void mbedtls_ssl_conf_extended_master_secret(mbedtls_ssl_config *conf, char ems)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02003219{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003220 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02003221}
3222#endif
3223
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003224#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01003225int mbedtls_ssl_conf_max_frag_len(mbedtls_ssl_config *conf, unsigned char mfl_code)
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003226{
Gilles Peskine449bd832023-01-11 14:50:10 +01003227 if (mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
3228 ssl_mfl_code_to_length(mfl_code) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN) {
3229 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003230 }
3231
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01003232 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003233
Gilles Peskine449bd832023-01-11 14:50:10 +01003234 return 0;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003235}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003236#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02003237
Gilles Peskine449bd832023-01-11 14:50:10 +01003238void mbedtls_ssl_conf_legacy_renegotiation(mbedtls_ssl_config *conf, int allow_legacy)
Paul Bakker48916f92012-09-16 19:57:18 +00003239{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003240 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00003241}
3242
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003243#if defined(MBEDTLS_SSL_RENEGOTIATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01003244void mbedtls_ssl_conf_renegotiation(mbedtls_ssl_config *conf, int renegotiation)
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01003245{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003246 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01003247}
3248
Gilles Peskine449bd832023-01-11 14:50:10 +01003249void mbedtls_ssl_conf_renegotiation_enforced(mbedtls_ssl_config *conf, int max_records)
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02003250{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02003251 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02003252}
3253
Gilles Peskine449bd832023-01-11 14:50:10 +01003254void mbedtls_ssl_conf_renegotiation_period(mbedtls_ssl_config *conf,
3255 const unsigned char period[8])
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01003256{
Gilles Peskine449bd832023-01-11 14:50:10 +01003257 memcpy(conf->renego_period, period, 8);
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01003258}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003259#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00003260
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003261#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003262#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003263void mbedtls_ssl_conf_session_tickets(mbedtls_ssl_config *conf, int use_tickets)
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02003264{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01003265 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02003266}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003267#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02003268
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003269#if defined(MBEDTLS_SSL_SRV_C)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08003270
Jerry Yud0766ec2022-09-22 10:46:57 +08003271#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003272void mbedtls_ssl_conf_new_session_tickets(mbedtls_ssl_config *conf,
3273 uint16_t num_tickets)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08003274{
Jerry Yud0766ec2022-09-22 10:46:57 +08003275 conf->new_session_tickets_count = num_tickets;
Jerry Yu1ad7ace2022-08-09 13:28:39 +08003276}
3277#endif
3278
Gilles Peskine449bd832023-01-11 14:50:10 +01003279void mbedtls_ssl_conf_session_tickets_cb(mbedtls_ssl_config *conf,
3280 mbedtls_ssl_ticket_write_t *f_ticket_write,
3281 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
3282 void *p_ticket)
Paul Bakker606b4ba2013-08-14 16:52:14 +02003283{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02003284 conf->f_ticket_write = f_ticket_write;
3285 conf->f_ticket_parse = f_ticket_parse;
3286 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02003287}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02003288#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003289#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02003290
Gilles Peskine449bd832023-01-11 14:50:10 +01003291void mbedtls_ssl_set_export_keys_cb(mbedtls_ssl_context *ssl,
3292 mbedtls_ssl_export_keys_t *f_export_keys,
3293 void *p_export_keys)
Robert Cragie4feb7ae2015-10-02 13:33:37 +01003294{
Hanno Becker7e6c1782021-06-08 09:24:55 +01003295 ssl->f_export_keys = f_export_keys;
3296 ssl->p_export_keys = p_export_keys;
Ron Eldorf5cc10d2019-05-07 18:33:40 +03003297}
Robert Cragie4feb7ae2015-10-02 13:33:37 +01003298
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003299#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003300void mbedtls_ssl_conf_async_private_cb(
3301 mbedtls_ssl_config *conf,
3302 mbedtls_ssl_async_sign_t *f_async_sign,
3303 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
3304 mbedtls_ssl_async_resume_t *f_async_resume,
3305 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskine449bd832023-01-11 14:50:10 +01003306 void *async_config_data)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003307{
3308 conf->f_async_sign_start = f_async_sign;
3309 conf->f_async_decrypt_start = f_async_decrypt;
3310 conf->f_async_resume = f_async_resume;
3311 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003312 conf->p_async_config_data = async_config_data;
3313}
3314
Gilles Peskine449bd832023-01-11 14:50:10 +01003315void *mbedtls_ssl_conf_get_async_config_data(const mbedtls_ssl_config *conf)
Gilles Peskine8f97af72018-04-26 11:46:10 +02003316{
Gilles Peskine449bd832023-01-11 14:50:10 +01003317 return conf->p_async_config_data;
Gilles Peskine8f97af72018-04-26 11:46:10 +02003318}
3319
Gilles Peskine449bd832023-01-11 14:50:10 +01003320void *mbedtls_ssl_get_async_operation_data(const mbedtls_ssl_context *ssl)
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003321{
Gilles Peskine449bd832023-01-11 14:50:10 +01003322 if (ssl->handshake == NULL) {
3323 return NULL;
3324 } else {
3325 return ssl->handshake->user_async_ctx;
3326 }
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003327}
3328
Gilles Peskine449bd832023-01-11 14:50:10 +01003329void mbedtls_ssl_set_async_operation_data(mbedtls_ssl_context *ssl,
3330 void *ctx)
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003331{
Gilles Peskine449bd832023-01-11 14:50:10 +01003332 if (ssl->handshake != NULL) {
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003333 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine449bd832023-01-11 14:50:10 +01003334 }
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003335}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003336#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01003337
Paul Bakker5121ce52009-01-03 21:22:43 +00003338/*
3339 * SSL get accessors
3340 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003341uint32_t mbedtls_ssl_get_verify_result(const mbedtls_ssl_context *ssl)
Paul Bakker5121ce52009-01-03 21:22:43 +00003342{
Gilles Peskine449bd832023-01-11 14:50:10 +01003343 if (ssl->session != NULL) {
3344 return ssl->session->verify_result;
3345 }
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00003346
Gilles Peskine449bd832023-01-11 14:50:10 +01003347 if (ssl->session_negotiate != NULL) {
3348 return ssl->session_negotiate->verify_result;
3349 }
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00003350
Gilles Peskine449bd832023-01-11 14:50:10 +01003351 return 0xFFFFFFFF;
Paul Bakker5121ce52009-01-03 21:22:43 +00003352}
3353
Gilles Peskine449bd832023-01-11 14:50:10 +01003354int mbedtls_ssl_get_ciphersuite_id_from_ssl(const mbedtls_ssl_context *ssl)
Glenn Strauss8f526902022-01-13 00:04:49 -05003355{
Gilles Peskine449bd832023-01-11 14:50:10 +01003356 if (ssl == NULL || ssl->session == NULL) {
3357 return 0;
3358 }
Glenn Strauss8f526902022-01-13 00:04:49 -05003359
Gilles Peskine449bd832023-01-11 14:50:10 +01003360 return ssl->session->ciphersuite;
Glenn Strauss8f526902022-01-13 00:04:49 -05003361}
3362
Gilles Peskine449bd832023-01-11 14:50:10 +01003363const char *mbedtls_ssl_get_ciphersuite(const mbedtls_ssl_context *ssl)
Paul Bakker72f62662011-01-16 21:27:44 +00003364{
Gilles Peskine449bd832023-01-11 14:50:10 +01003365 if (ssl == NULL || ssl->session == NULL) {
3366 return NULL;
3367 }
Paul Bakker926c8e42013-03-06 10:23:34 +01003368
Gilles Peskine449bd832023-01-11 14:50:10 +01003369 return mbedtls_ssl_get_ciphersuite_name(ssl->session->ciphersuite);
Paul Bakker72f62662011-01-16 21:27:44 +00003370}
3371
Gilles Peskine449bd832023-01-11 14:50:10 +01003372const char *mbedtls_ssl_get_version(const mbedtls_ssl_context *ssl)
Paul Bakker43ca69c2011-01-15 17:35:19 +00003373{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003374#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003375 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
3376 switch (ssl->tls_version) {
Glenn Strauss60bfe602022-03-14 19:04:24 -04003377 case MBEDTLS_SSL_VERSION_TLS1_2:
Gilles Peskine449bd832023-01-11 14:50:10 +01003378 return "DTLSv1.2";
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01003379 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01003380 return "unknown (DTLS)";
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01003381 }
3382 }
3383#endif
3384
Gilles Peskine449bd832023-01-11 14:50:10 +01003385 switch (ssl->tls_version) {
Glenn Strauss60bfe602022-03-14 19:04:24 -04003386 case MBEDTLS_SSL_VERSION_TLS1_2:
Gilles Peskine449bd832023-01-11 14:50:10 +01003387 return "TLSv1.2";
Glenn Strauss60bfe602022-03-14 19:04:24 -04003388 case MBEDTLS_SSL_VERSION_TLS1_3:
Gilles Peskine449bd832023-01-11 14:50:10 +01003389 return "TLSv1.3";
Paul Bakker43ca69c2011-01-15 17:35:19 +00003390 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01003391 return "unknown";
Paul Bakker43ca69c2011-01-15 17:35:19 +00003392 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00003393}
3394
Waleed Elmelegy6a971fd2023-12-28 17:48:16 +00003395#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
3396
3397size_t mbedtls_ssl_get_output_record_size_limit(const mbedtls_ssl_context *ssl)
3398{
3399 const size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
3400 size_t record_size_limit = max_len;
3401
3402 if (ssl->session != NULL &&
3403 ssl->session->record_size_limit >= MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN &&
3404 ssl->session->record_size_limit < max_len) {
3405 record_size_limit = ssl->session->record_size_limit;
3406 }
3407
3408 // TODO: this is currently untested
3409 /* During a handshake, use the value being negotiated */
3410 if (ssl->session_negotiate != NULL &&
3411 ssl->session_negotiate->record_size_limit >= MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN &&
3412 ssl->session_negotiate->record_size_limit < max_len) {
3413 record_size_limit = ssl->session_negotiate->record_size_limit;
3414 }
3415
3416 return record_size_limit;
3417}
3418#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
3419
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003420#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01003421size_t mbedtls_ssl_get_input_max_frag_len(const mbedtls_ssl_context *ssl)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003422{
David Horstmann95d516f2021-05-04 18:36:56 +01003423 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003424 size_t read_mfl;
3425
Jerry Yuddda0502022-12-01 19:43:12 +08003426#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003427 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
Gilles Peskine449bd832023-01-11 14:50:10 +01003428 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
3429 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE) {
3430 return ssl_mfl_code_to_length(ssl->conf->mfl_code);
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003431 }
Jerry Yuddda0502022-12-01 19:43:12 +08003432#endif
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003433
3434 /* Check if a smaller max length was negotiated */
Gilles Peskine449bd832023-01-11 14:50:10 +01003435 if (ssl->session_out != NULL) {
3436 read_mfl = ssl_mfl_code_to_length(ssl->session_out->mfl_code);
3437 if (read_mfl < max_len) {
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003438 max_len = read_mfl;
3439 }
3440 }
3441
Jerry Yuddda0502022-12-01 19:43:12 +08003442 /* During a handshake, use the value being negotiated */
Gilles Peskine449bd832023-01-11 14:50:10 +01003443 if (ssl->session_negotiate != NULL) {
3444 read_mfl = ssl_mfl_code_to_length(ssl->session_negotiate->mfl_code);
3445 if (read_mfl < max_len) {
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003446 max_len = read_mfl;
3447 }
3448 }
3449
Gilles Peskine449bd832023-01-11 14:50:10 +01003450 return max_len;
Andrzej Kurek90c6e842020-04-03 05:25:29 -04003451}
3452
Gilles Peskine449bd832023-01-11 14:50:10 +01003453size_t mbedtls_ssl_get_output_max_frag_len(const mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003454{
3455 size_t max_len;
3456
3457 /*
3458 * Assume mfl_code is correct since it was checked when set
3459 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003460 max_len = ssl_mfl_code_to_length(ssl->conf->mfl_code);
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003461
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02003462 /* Check if a smaller max length was negotiated */
Gilles Peskine449bd832023-01-11 14:50:10 +01003463 if (ssl->session_out != NULL &&
3464 ssl_mfl_code_to_length(ssl->session_out->mfl_code) < max_len) {
3465 max_len = ssl_mfl_code_to_length(ssl->session_out->mfl_code);
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003466 }
3467
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02003468 /* During a handshake, use the value being negotiated */
Gilles Peskine449bd832023-01-11 14:50:10 +01003469 if (ssl->session_negotiate != NULL &&
3470 ssl_mfl_code_to_length(ssl->session_negotiate->mfl_code) < max_len) {
3471 max_len = ssl_mfl_code_to_length(ssl->session_negotiate->mfl_code);
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02003472 }
3473
Gilles Peskine449bd832023-01-11 14:50:10 +01003474 return max_len;
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02003475}
3476#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
3477
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003478#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003479size_t mbedtls_ssl_get_current_mtu(const mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003480{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04003481 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01003482 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
3483 (ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
3484 ssl->state == MBEDTLS_SSL_SERVER_HELLO)) {
3485 return 0;
3486 }
Andrzej Kurekef43ce62018-10-09 08:24:12 -04003487
Gilles Peskine449bd832023-01-11 14:50:10 +01003488 if (ssl->handshake == NULL || ssl->handshake->mtu == 0) {
3489 return ssl->mtu;
3490 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003491
Gilles Peskine449bd832023-01-11 14:50:10 +01003492 if (ssl->mtu == 0) {
3493 return ssl->handshake->mtu;
3494 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003495
Gilles Peskine449bd832023-01-11 14:50:10 +01003496 return ssl->mtu < ssl->handshake->mtu ?
3497 ssl->mtu : ssl->handshake->mtu;
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003498}
3499#endif /* MBEDTLS_SSL_PROTO_DTLS */
3500
Gilles Peskine449bd832023-01-11 14:50:10 +01003501int mbedtls_ssl_get_max_out_record_payload(const mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003502{
3503 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
3504
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02003505#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
Jan Brucknerf482dcc2023-03-15 09:09:06 +01003506 !defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT) && \
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02003507 !defined(MBEDTLS_SSL_PROTO_DTLS)
3508 (void) ssl;
3509#endif
3510
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003511#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01003512 const size_t mfl = mbedtls_ssl_get_output_max_frag_len(ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003513
Gilles Peskine449bd832023-01-11 14:50:10 +01003514 if (max_len > mfl) {
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003515 max_len = mfl;
Gilles Peskine449bd832023-01-11 14:50:10 +01003516 }
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003517#endif
3518
Jan Brucknerf482dcc2023-03-15 09:09:06 +01003519#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
3520 const size_t record_size_limit = mbedtls_ssl_get_output_record_size_limit(ssl);
3521
3522 if (max_len > record_size_limit) {
3523 max_len = record_size_limit;
3524 }
3525#endif
3526
Waleed Elmelegy6a971fd2023-12-28 17:48:16 +00003527 if (ssl->transform_out != NULL &&
3528 ssl->transform_out->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
Waleed Elmelegyf5017902024-01-09 14:18:34 +00003529 /*
3530 * In TLS 1.3 case, when records are protected, `max_len` as computed
3531 * above is the maximum length of the TLSInnerPlaintext structure that
3532 * along the plaintext payload contains the inner content type (one byte)
3533 * and some zero padding. Given the algorithm used for padding
3534 * in mbedtls_ssl_encrypt_buf(), compute the maximum length for
3535 * the plaintext payload. Round down to a multiple of
3536 * MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY and
3537 * subtract 1.
Waleed Elmelegy6a971fd2023-12-28 17:48:16 +00003538 */
3539 max_len = ((max_len / MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY) *
3540 MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY) - 1;
3541 }
3542
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003543#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003544 if (mbedtls_ssl_get_current_mtu(ssl) != 0) {
3545 const size_t mtu = mbedtls_ssl_get_current_mtu(ssl);
3546 const int ret = mbedtls_ssl_get_record_expansion(ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003547 const size_t overhead = (size_t) ret;
3548
Gilles Peskine449bd832023-01-11 14:50:10 +01003549 if (ret < 0) {
3550 return ret;
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003551 }
3552
Gilles Peskine449bd832023-01-11 14:50:10 +01003553 if (mtu <= overhead) {
3554 MBEDTLS_SSL_DEBUG_MSG(1, ("MTU too low for record expansion"));
3555 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
3556 }
3557
3558 if (max_len > mtu - overhead) {
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003559 max_len = mtu - overhead;
Gilles Peskine449bd832023-01-11 14:50:10 +01003560 }
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003561 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02003562#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003563
Hanno Becker0defedb2018-08-10 12:35:02 +01003564#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
Waleed Elmelegy049cd302023-12-20 17:28:31 +00003565 !defined(MBEDTLS_SSL_PROTO_DTLS) && \
3566 !defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
Hanno Becker0defedb2018-08-10 12:35:02 +01003567 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003568#endif
3569
Gilles Peskine449bd832023-01-11 14:50:10 +01003570 return (int) max_len;
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02003571}
3572
Gilles Peskine449bd832023-01-11 14:50:10 +01003573int mbedtls_ssl_get_max_in_record_payload(const mbedtls_ssl_context *ssl)
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003574{
3575 size_t max_len = MBEDTLS_SSL_IN_CONTENT_LEN;
3576
3577#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
3578 (void) ssl;
3579#endif
3580
3581#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01003582 const size_t mfl = mbedtls_ssl_get_input_max_frag_len(ssl);
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003583
Gilles Peskine449bd832023-01-11 14:50:10 +01003584 if (max_len > mfl) {
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003585 max_len = mfl;
Gilles Peskine449bd832023-01-11 14:50:10 +01003586 }
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003587#endif
3588
Gilles Peskine449bd832023-01-11 14:50:10 +01003589 return (int) max_len;
Hanno Becker2d8e99b2021-04-21 06:19:50 +01003590}
3591
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003592#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003593const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert(const mbedtls_ssl_context *ssl)
Paul Bakkerb0550d92012-10-30 07:51:03 +00003594{
Gilles Peskine449bd832023-01-11 14:50:10 +01003595 if (ssl == NULL || ssl->session == NULL) {
3596 return NULL;
3597 }
Paul Bakkerb0550d92012-10-30 07:51:03 +00003598
Hanno Beckere6824572019-02-07 13:18:46 +00003599#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01003600 return ssl->session->peer_cert;
Hanno Beckere6824572019-02-07 13:18:46 +00003601#else
Gilles Peskine449bd832023-01-11 14:50:10 +01003602 return NULL;
Hanno Beckere6824572019-02-07 13:18:46 +00003603#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakkerb0550d92012-10-30 07:51:03 +00003604}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003605#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00003606
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003607#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003608int mbedtls_ssl_get_session(const mbedtls_ssl_context *ssl,
3609 mbedtls_ssl_session *dst)
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003610{
Hanno Beckere810bbc2021-05-14 16:01:05 +01003611 int ret;
3612
Gilles Peskine449bd832023-01-11 14:50:10 +01003613 if (ssl == NULL ||
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003614 dst == NULL ||
3615 ssl->session == NULL ||
Gilles Peskine449bd832023-01-11 14:50:10 +01003616 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT) {
3617 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003618 }
3619
Hanno Beckere810bbc2021-05-14 16:01:05 +01003620 /* Since Mbed TLS 3.0, mbedtls_ssl_get_session() is no longer
3621 * idempotent: Each session can only be exported once.
3622 *
3623 * (This is in preparation for TLS 1.3 support where we will
3624 * need the ability to export multiple sessions (aka tickets),
3625 * which will be achieved by calling mbedtls_ssl_get_session()
3626 * multiple times until it fails.)
3627 *
3628 * Check whether we have already exported the current session,
3629 * and fail if so.
3630 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003631 if (ssl->session->exported == 1) {
3632 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
3633 }
Hanno Beckere810bbc2021-05-14 16:01:05 +01003634
Gilles Peskine449bd832023-01-11 14:50:10 +01003635 ret = mbedtls_ssl_session_copy(dst, ssl->session);
3636 if (ret != 0) {
3637 return ret;
3638 }
Hanno Beckere810bbc2021-05-14 16:01:05 +01003639
3640 /* Remember that we've exported the session. */
3641 ssl->session->exported = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01003642 return 0;
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003643}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003644#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02003645
Paul Bakker5121ce52009-01-03 21:22:43 +00003646/*
Hanno Beckera835da52019-05-16 12:39:07 +01003647 * Define ticket header determining Mbed TLS version
3648 * and structure of the ticket.
3649 */
3650
Hanno Becker94ef3b32019-05-16 12:50:45 +01003651/*
Hanno Becker50b59662019-05-28 14:30:45 +01003652 * Define bitflag determining compile-time settings influencing
3653 * structure of serialized SSL sessions.
Hanno Becker94ef3b32019-05-16 12:50:45 +01003654 */
3655
Hanno Becker50b59662019-05-28 14:30:45 +01003656#if defined(MBEDTLS_HAVE_TIME)
Hanno Becker3e088662019-05-29 11:10:18 +01003657#define SSL_SERIALIZED_SESSION_CONFIG_TIME 1
Hanno Becker50b59662019-05-28 14:30:45 +01003658#else
Hanno Becker3e088662019-05-29 11:10:18 +01003659#define SSL_SERIALIZED_SESSION_CONFIG_TIME 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003660#endif /* MBEDTLS_HAVE_TIME */
3661
3662#if defined(MBEDTLS_X509_CRT_PARSE_C)
Hanno Becker3e088662019-05-29 11:10:18 +01003663#define SSL_SERIALIZED_SESSION_CONFIG_CRT 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003664#else
Hanno Becker3e088662019-05-29 11:10:18 +01003665#define SSL_SERIALIZED_SESSION_CONFIG_CRT 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003666#endif /* MBEDTLS_X509_CRT_PARSE_C */
3667
3668#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker3e088662019-05-29 11:10:18 +01003669#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003670#else
Hanno Becker3e088662019-05-29 11:10:18 +01003671#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003672#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */
3673
3674#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker3e088662019-05-29 11:10:18 +01003675#define SSL_SERIALIZED_SESSION_CONFIG_MFL 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003676#else
Hanno Becker3e088662019-05-29 11:10:18 +01003677#define SSL_SERIALIZED_SESSION_CONFIG_MFL 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003678#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
3679
Hanno Becker94ef3b32019-05-16 12:50:45 +01003680#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3e088662019-05-29 11:10:18 +01003681#define SSL_SERIALIZED_SESSION_CONFIG_ETM 1
Hanno Becker94ef3b32019-05-16 12:50:45 +01003682#else
Hanno Becker3e088662019-05-29 11:10:18 +01003683#define SSL_SERIALIZED_SESSION_CONFIG_ETM 0
Hanno Becker94ef3b32019-05-16 12:50:45 +01003684#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
3685
Hanno Becker94ef3b32019-05-16 12:50:45 +01003686#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3687#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1
3688#else
3689#define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0
3690#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3691
Hanno Becker3e088662019-05-29 11:10:18 +01003692#define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0
3693#define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1
3694#define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2
3695#define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3
Hanno Becker37bdbe62021-08-01 05:38:58 +01003696#define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 4
3697#define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 5
Hanno Becker3e088662019-05-29 11:10:18 +01003698
Hanno Becker50b59662019-05-28 14:30:45 +01003699#define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \
Gilles Peskine449bd832023-01-11 14:50:10 +01003700 ((uint16_t) ( \
3701 (SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT) | \
3702 (SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT) | \
3703 (SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << \
3704 SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT) | \
3705 (SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT) | \
3706 (SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT) | \
3707 (SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT)))
Hanno Becker94ef3b32019-05-16 12:50:45 +01003708
Chien Wong4e9683e2023-12-28 17:07:43 +08003709static const unsigned char ssl_serialized_session_header[] = {
Hanno Becker94ef3b32019-05-16 12:50:45 +01003710 MBEDTLS_VERSION_MAJOR,
3711 MBEDTLS_VERSION_MINOR,
3712 MBEDTLS_VERSION_PATCH,
Gilles Peskine449bd832023-01-11 14:50:10 +01003713 MBEDTLS_BYTE_1(SSL_SERIALIZED_SESSION_CONFIG_BITFLAG),
3714 MBEDTLS_BYTE_0(SSL_SERIALIZED_SESSION_CONFIG_BITFLAG),
Hanno Beckerf8787072019-05-16 12:41:07 +01003715};
Hanno Beckera835da52019-05-16 12:39:07 +01003716
3717/*
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003718 * Serialize a session in the following format:
Manuel Pégourié-Gonnard35eb8022019-05-16 11:11:08 +02003719 * (in the presentation language of TLS, RFC 8446 section 3)
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003720 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003721 * struct {
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01003722 *
Hanno Beckerdce50972021-08-01 05:39:23 +01003723 * opaque mbedtls_version[3]; // library version: major, minor, patch
3724 * opaque session_format[2]; // library-version specific 16-bit field
3725 * // determining the format of the remaining
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003726 * // serialized data.
Hanno Beckerdc28b6c2019-05-29 11:08:00 +01003727 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003728 * Note: When updating the format, remember to keep
3729 * these version+format bytes.
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003730 *
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003731 * // In this version, `session_format` determines
3732 * // the setting of those compile-time
3733 * // configuration options which influence
3734 * // the structure of mbedtls_ssl_session.
3735 *
Glenn Straussda7851c2022-03-14 13:29:48 -04003736 * uint8_t minor_ver; // Protocol minor version. Possible values:
Jerry Yu0c2a7382022-12-06 13:27:25 +08003737 * // - TLS 1.2 (0x0303)
3738 * // - TLS 1.3 (0x0304)
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003739 *
Glenn Straussda7851c2022-03-14 13:29:48 -04003740 * select (serialized_session.tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003741 *
Glenn Straussda7851c2022-03-14 13:29:48 -04003742 * case MBEDTLS_SSL_VERSION_TLS1_2:
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003743 * serialized_session_tls12 data;
Jerry Yu0c2a7382022-12-06 13:27:25 +08003744 * case MBEDTLS_SSL_VERSION_TLS1_3:
Jerry Yuddda0502022-12-01 19:43:12 +08003745 * serialized_session_tls13 data;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003746 *
3747 * };
3748 *
3749 * } serialized_session;
3750 *
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003751 */
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003752
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003753MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01003754static int ssl_session_save(const mbedtls_ssl_session *session,
3755 unsigned char omit_header,
3756 unsigned char *buf,
3757 size_t buf_len,
3758 size_t *olen)
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003759{
3760 unsigned char *p = buf;
3761 size_t used = 0;
Jerry Yu251a12e2022-07-13 15:15:48 +08003762 size_t remaining_len;
Jerry Yue36fdd62022-08-17 21:31:36 +08003763#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3764 size_t out_len;
3765 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3766#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01003767 if (session == NULL) {
3768 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3769 }
Jerry Yu438ddd82022-07-07 06:55:50 +00003770
Gilles Peskine449bd832023-01-11 14:50:10 +01003771 if (!omit_header) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003772 /*
3773 * Add Mbed TLS version identifier
3774 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003775 used += sizeof(ssl_serialized_session_header);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003776
Gilles Peskine449bd832023-01-11 14:50:10 +01003777 if (used <= buf_len) {
3778 memcpy(p, ssl_serialized_session_header,
3779 sizeof(ssl_serialized_session_header));
3780 p += sizeof(ssl_serialized_session_header);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003781 }
3782 }
3783
3784 /*
3785 * TLS version identifier
3786 */
3787 used += 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01003788 if (used <= buf_len) {
3789 *p++ = MBEDTLS_BYTE_0(session->tls_version);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003790 }
3791
3792 /* Forward to version-specific serialization routine. */
Jerry Yufca4d572022-07-21 10:37:48 +08003793 remaining_len = (buf_len >= used) ? buf_len - used : 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003794 switch (session->tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003795#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01003796 case MBEDTLS_SSL_VERSION_TLS1_2:
3797 used += ssl_tls12_session_save(session, p, remaining_len);
3798 break;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003799#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3800
Jerry Yu251a12e2022-07-13 15:15:48 +08003801#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01003802 case MBEDTLS_SSL_VERSION_TLS1_3:
3803 ret = ssl_tls13_session_save(session, p, remaining_len, &out_len);
3804 if (ret != 0 && ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL) {
3805 return ret;
3806 }
3807 used += out_len;
3808 break;
Jerry Yu251a12e2022-07-13 15:15:48 +08003809#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3810
Gilles Peskine449bd832023-01-11 14:50:10 +01003811 default:
3812 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003813 }
3814
3815 *olen = used;
Gilles Peskine449bd832023-01-11 14:50:10 +01003816 if (used > buf_len) {
3817 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
3818 }
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003819
Gilles Peskine449bd832023-01-11 14:50:10 +01003820 return 0;
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003821}
3822
3823/*
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003824 * Public wrapper for ssl_session_save()
3825 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003826int mbedtls_ssl_session_save(const mbedtls_ssl_session *session,
3827 unsigned char *buf,
3828 size_t buf_len,
3829 size_t *olen)
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003830{
Gilles Peskine449bd832023-01-11 14:50:10 +01003831 return ssl_session_save(session, 0, buf, buf_len, olen);
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02003832}
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003833
Jerry Yuf1b23ca2022-02-18 11:48:47 +08003834/*
3835 * Deserialize session, see mbedtls_ssl_session_save() for format.
3836 *
3837 * This internal version is wrapped by a public function that cleans up in
3838 * case of error, and has an extra option omit_header.
3839 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003840MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01003841static int ssl_session_load(mbedtls_ssl_session *session,
3842 unsigned char omit_header,
3843 const unsigned char *buf,
3844 size_t len)
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003845{
3846 const unsigned char *p = buf;
3847 const unsigned char * const end = buf + len;
Jerry Yu438ddd82022-07-07 06:55:50 +00003848 size_t remaining_len;
3849
3850
Gilles Peskine449bd832023-01-11 14:50:10 +01003851 if (session == NULL) {
3852 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3853 }
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003854
Gilles Peskine449bd832023-01-11 14:50:10 +01003855 if (!omit_header) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003856 /*
3857 * Check Mbed TLS version identifier
3858 */
3859
Gilles Peskine449bd832023-01-11 14:50:10 +01003860 if ((size_t) (end - p) < sizeof(ssl_serialized_session_header)) {
3861 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003862 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003863
3864 if (memcmp(p, ssl_serialized_session_header,
3865 sizeof(ssl_serialized_session_header)) != 0) {
3866 return MBEDTLS_ERR_SSL_VERSION_MISMATCH;
3867 }
3868 p += sizeof(ssl_serialized_session_header);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003869 }
3870
3871 /*
3872 * TLS version identifier
3873 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003874 if (1 > (size_t) (end - p)) {
3875 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3876 }
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01003877 session->tls_version = (mbedtls_ssl_protocol_version) (0x0300 | *p++);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003878
3879 /* Dispatch according to TLS version. */
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00003880 remaining_len = (size_t) (end - p);
Gilles Peskine449bd832023-01-11 14:50:10 +01003881 switch (session->tls_version) {
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003882#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01003883 case MBEDTLS_SSL_VERSION_TLS1_2:
3884 return ssl_tls12_session_load(session, p, remaining_len);
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003885#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3886
Jerry Yu438ddd82022-07-07 06:55:50 +00003887#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01003888 case MBEDTLS_SSL_VERSION_TLS1_3:
3889 return ssl_tls13_session_load(session, p, remaining_len);
Jerry Yu438ddd82022-07-07 06:55:50 +00003890#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3891
Gilles Peskine449bd832023-01-11 14:50:10 +01003892 default:
3893 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01003894 }
3895}
3896
Manuel Pégourié-Gonnarda3e7c652019-05-16 10:08:35 +02003897/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02003898 * Deserialize session: public wrapper for error cleaning
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003899 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003900int mbedtls_ssl_session_load(mbedtls_ssl_session *session,
3901 const unsigned char *buf,
3902 size_t len)
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003903{
Gilles Peskine449bd832023-01-11 14:50:10 +01003904 int ret = ssl_session_load(session, 0, buf, len);
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003905
Gilles Peskine449bd832023-01-11 14:50:10 +01003906 if (ret != 0) {
3907 mbedtls_ssl_session_free(session);
3908 }
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003909
Gilles Peskine449bd832023-01-11 14:50:10 +01003910 return ret;
Manuel Pégourié-Gonnarda3d831b2019-05-23 12:28:45 +02003911}
3912
3913/*
Paul Bakker1961b702013-01-25 14:49:24 +01003914 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00003915 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003916MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01003917static int ssl_prepare_handshake_step(mbedtls_ssl_context *ssl)
Hanno Becker41934dd2021-08-07 19:13:43 +01003918{
3919 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3920
Ronald Cron66dbf912022-02-02 15:33:46 +01003921 /*
3922 * We may have not been able to send to the peer all the handshake data
Ronald Cron3f20b772022-03-08 16:00:02 +01003923 * that were written into the output buffer by the previous handshake step,
3924 * if the write to the network callback returned with the
Ronald Cron66dbf912022-02-02 15:33:46 +01003925 * #MBEDTLS_ERR_SSL_WANT_WRITE error code.
3926 * We proceed to the next handshake step only when all data from the
3927 * previous one have been sent to the peer, thus we make sure that this is
3928 * the case here by calling `mbedtls_ssl_flush_output()`. The function may
3929 * return with the #MBEDTLS_ERR_SSL_WANT_WRITE error code in which case
3930 * we have to wait before to go ahead.
3931 * In the case of TLS 1.3, handshake step handlers do not send data to the
3932 * peer. Data are only sent here and through
3933 * `mbedtls_ssl_handle_pending_alert` in case an error that triggered an
Andrzej Kurek5c65c572022-04-13 14:28:52 -04003934 * alert occurred.
Ronald Cron66dbf912022-02-02 15:33:46 +01003935 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003936 if ((ret = mbedtls_ssl_flush_output(ssl)) != 0) {
3937 return ret;
3938 }
Hanno Becker41934dd2021-08-07 19:13:43 +01003939
3940#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01003941 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3942 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING) {
3943 if ((ret = mbedtls_ssl_flight_transmit(ssl)) != 0) {
3944 return ret;
3945 }
Hanno Becker41934dd2021-08-07 19:13:43 +01003946 }
3947#endif /* MBEDTLS_SSL_PROTO_DTLS */
3948
Gilles Peskine449bd832023-01-11 14:50:10 +01003949 return ret;
Hanno Becker41934dd2021-08-07 19:13:43 +01003950}
3951
Gilles Peskine449bd832023-01-11 14:50:10 +01003952int mbedtls_ssl_handshake_step(mbedtls_ssl_context *ssl)
Paul Bakker5121ce52009-01-03 21:22:43 +00003953{
Hanno Becker41934dd2021-08-07 19:13:43 +01003954 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00003955
Gilles Peskine449bd832023-01-11 14:50:10 +01003956 if (ssl == NULL ||
Hanno Becker41934dd2021-08-07 19:13:43 +01003957 ssl->conf == NULL ||
3958 ssl->handshake == NULL ||
Gilles Peskine449bd832023-01-11 14:50:10 +01003959 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER) {
3960 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Becker41934dd2021-08-07 19:13:43 +01003961 }
3962
Gilles Peskine449bd832023-01-11 14:50:10 +01003963 ret = ssl_prepare_handshake_step(ssl);
3964 if (ret != 0) {
3965 return ret;
3966 }
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02003967
Gilles Peskine449bd832023-01-11 14:50:10 +01003968 ret = mbedtls_ssl_handle_pending_alert(ssl);
3969 if (ret != 0) {
Jerry Yue7047812021-09-13 19:26:39 +08003970 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01003971 }
Jerry Yue7047812021-09-13 19:26:39 +08003972
Tom Cosgrove2fdc7b32022-09-21 12:33:17 +01003973 /* If ssl->conf->endpoint is not one of MBEDTLS_SSL_IS_CLIENT or
3974 * MBEDTLS_SSL_IS_SERVER, this is the return code we give */
3975 ret = MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3976
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003977#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01003978 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
3979 MBEDTLS_SSL_DEBUG_MSG(2, ("client state: %s",
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01003980 mbedtls_ssl_states_str((mbedtls_ssl_states) ssl->state)));
Jerry Yub9930e72021-08-06 17:11:51 +08003981
Gilles Peskine449bd832023-01-11 14:50:10 +01003982 switch (ssl->state) {
Ronald Cron9f0fba32022-02-10 16:45:15 +01003983 case MBEDTLS_SSL_HELLO_REQUEST:
3984 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
Tom Cosgrove87d9c6c2022-09-22 09:27:56 +01003985 ret = 0;
Ronald Cron9f0fba32022-02-10 16:45:15 +01003986 break;
Jerry Yub9930e72021-08-06 17:11:51 +08003987
Ronald Cron9f0fba32022-02-10 16:45:15 +01003988 case MBEDTLS_SSL_CLIENT_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +01003989 ret = mbedtls_ssl_write_client_hello(ssl);
Ronald Cron9f0fba32022-02-10 16:45:15 +01003990 break;
3991
3992 default:
3993#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01003994 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
3995 ret = mbedtls_ssl_tls13_handshake_client_step(ssl);
3996 } else {
3997 ret = mbedtls_ssl_handshake_client_step(ssl);
3998 }
Ronald Cron9f0fba32022-02-10 16:45:15 +01003999#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01004000 ret = mbedtls_ssl_handshake_client_step(ssl);
Ronald Cron9f0fba32022-02-10 16:45:15 +01004001#else
Gilles Peskine449bd832023-01-11 14:50:10 +01004002 ret = mbedtls_ssl_tls13_handshake_client_step(ssl);
Ronald Cron9f0fba32022-02-10 16:45:15 +01004003#endif
4004 }
Jerry Yub9930e72021-08-06 17:11:51 +08004005 }
Ronald Cron6291b232023-03-08 15:51:25 +01004006#endif /* MBEDTLS_SSL_CLI_C */
4007
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004008#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004009 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Ronald Cron6291b232023-03-08 15:51:25 +01004010#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
4011 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
Gilles Peskine449bd832023-01-11 14:50:10 +01004012 ret = mbedtls_ssl_tls13_handshake_server_step(ssl);
Ronald Cron6291b232023-03-08 15:51:25 +01004013 } else {
Gilles Peskine449bd832023-01-11 14:50:10 +01004014 ret = mbedtls_ssl_handshake_server_step(ssl);
4015 }
Ronald Cron6291b232023-03-08 15:51:25 +01004016#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
4017 ret = mbedtls_ssl_handshake_server_step(ssl);
4018#else
4019 ret = mbedtls_ssl_tls13_handshake_server_step(ssl);
Paul Bakker5121ce52009-01-03 21:22:43 +00004020#endif
Ronald Cron6291b232023-03-08 15:51:25 +01004021 }
4022#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00004023
Gilles Peskine449bd832023-01-11 14:50:10 +01004024 if (ret != 0) {
Jerry Yubbd5a3f2021-09-18 20:50:22 +08004025 /* handshake_step return error. And it is same
4026 * with alert_reason.
4027 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004028 if (ssl->send_alert) {
4029 ret = mbedtls_ssl_handle_pending_alert(ssl);
Jerry Yue7047812021-09-13 19:26:39 +08004030 goto cleanup;
4031 }
4032 }
4033
4034cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01004035 return ret;
Paul Bakker1961b702013-01-25 14:49:24 +01004036}
4037
4038/*
4039 * Perform the SSL handshake
4040 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004041int mbedtls_ssl_handshake(mbedtls_ssl_context *ssl)
Paul Bakker1961b702013-01-25 14:49:24 +01004042{
4043 int ret = 0;
4044
Hanno Beckera817ea42020-10-20 15:20:23 +01004045 /* Sanity checks */
4046
Gilles Peskine449bd832023-01-11 14:50:10 +01004047 if (ssl == NULL || ssl->conf == NULL) {
4048 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4049 }
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02004050
Hanno Beckera817ea42020-10-20 15:20:23 +01004051#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004052 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
4053 (ssl->f_set_timer == NULL || ssl->f_get_timer == NULL)) {
4054 MBEDTLS_SSL_DEBUG_MSG(1, ("You must use "
4055 "mbedtls_ssl_set_timer_cb() for DTLS"));
4056 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Beckera817ea42020-10-20 15:20:23 +01004057 }
4058#endif /* MBEDTLS_SSL_PROTO_DTLS */
4059
Gilles Peskine449bd832023-01-11 14:50:10 +01004060 MBEDTLS_SSL_DEBUG_MSG(2, ("=> handshake"));
Paul Bakker1961b702013-01-25 14:49:24 +01004061
Hanno Beckera817ea42020-10-20 15:20:23 +01004062 /* Main handshake loop */
Gilles Peskine449bd832023-01-11 14:50:10 +01004063 while (ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER) {
4064 ret = mbedtls_ssl_handshake_step(ssl);
Paul Bakker1961b702013-01-25 14:49:24 +01004065
Gilles Peskine449bd832023-01-11 14:50:10 +01004066 if (ret != 0) {
Paul Bakker1961b702013-01-25 14:49:24 +01004067 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01004068 }
Paul Bakker1961b702013-01-25 14:49:24 +01004069 }
4070
Gilles Peskine449bd832023-01-11 14:50:10 +01004071 MBEDTLS_SSL_DEBUG_MSG(2, ("<= handshake"));
Paul Bakker5121ce52009-01-03 21:22:43 +00004072
Gilles Peskine449bd832023-01-11 14:50:10 +01004073 return ret;
Paul Bakker5121ce52009-01-03 21:22:43 +00004074}
4075
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004076#if defined(MBEDTLS_SSL_RENEGOTIATION)
4077#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00004078/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004079 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00004080 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004081MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01004082static int ssl_write_hello_request(mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004083{
Janos Follath865b3eb2019-12-16 11:46:15 +00004084 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004085
Gilles Peskine449bd832023-01-11 14:50:10 +01004086 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write hello request"));
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004087
4088 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004089 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4090 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004091
Gilles Peskine449bd832023-01-11 14:50:10 +01004092 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
4093 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
4094 return ret;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004095 }
4096
Gilles Peskine449bd832023-01-11 14:50:10 +01004097 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write hello request"));
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004098
Gilles Peskine449bd832023-01-11 14:50:10 +01004099 return 0;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004100}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004101#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004102
4103/*
4104 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004105 * - any side: calling mbedtls_ssl_renegotiate(),
4106 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
4107 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02004108 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004109 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004110 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004111 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004112int mbedtls_ssl_start_renegotiation(mbedtls_ssl_context *ssl)
Paul Bakker48916f92012-09-16 19:57:18 +00004113{
Janos Follath865b3eb2019-12-16 11:46:15 +00004114 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker48916f92012-09-16 19:57:18 +00004115
Gilles Peskine449bd832023-01-11 14:50:10 +01004116 MBEDTLS_SSL_DEBUG_MSG(2, ("=> renegotiate"));
Paul Bakker48916f92012-09-16 19:57:18 +00004117
Gilles Peskine449bd832023-01-11 14:50:10 +01004118 if ((ret = ssl_handshake_init(ssl)) != 0) {
4119 return ret;
4120 }
Paul Bakker48916f92012-09-16 19:57:18 +00004121
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02004122 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
4123 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004124#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004125 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
4126 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING) {
4127 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004128 ssl->handshake->out_msg_seq = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004129 } else {
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004130 ssl->handshake->in_msg_seq = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004131 }
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02004132 }
4133#endif
4134
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004135 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
4136 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00004137
Gilles Peskine449bd832023-01-11 14:50:10 +01004138 if ((ret = mbedtls_ssl_handshake(ssl)) != 0) {
4139 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_handshake", ret);
4140 return ret;
Paul Bakker48916f92012-09-16 19:57:18 +00004141 }
4142
Gilles Peskine449bd832023-01-11 14:50:10 +01004143 MBEDTLS_SSL_DEBUG_MSG(2, ("<= renegotiate"));
Paul Bakker48916f92012-09-16 19:57:18 +00004144
Gilles Peskine449bd832023-01-11 14:50:10 +01004145 return 0;
Paul Bakker48916f92012-09-16 19:57:18 +00004146}
4147
4148/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004149 * Renegotiate current connection on client,
4150 * or request renegotiation on server
4151 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004152int mbedtls_ssl_renegotiate(mbedtls_ssl_context *ssl)
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004153{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004154 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004155
Gilles Peskine449bd832023-01-11 14:50:10 +01004156 if (ssl == NULL || ssl->conf == NULL) {
4157 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4158 }
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02004159
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004160#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004161 /* On server, just send the request */
Gilles Peskine449bd832023-01-11 14:50:10 +01004162 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
4163 if (mbedtls_ssl_is_handshake_over(ssl) == 0) {
4164 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4165 }
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004166
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004167 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02004168
4169 /* Did we already try/start sending HelloRequest? */
Gilles Peskine449bd832023-01-11 14:50:10 +01004170 if (ssl->out_left != 0) {
4171 return mbedtls_ssl_flush_output(ssl);
4172 }
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02004173
Gilles Peskine449bd832023-01-11 14:50:10 +01004174 return ssl_write_hello_request(ssl);
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004175 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004176#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004177
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004178#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004179 /*
4180 * On client, either start the renegotiation process or,
4181 * if already in progress, continue the handshake
4182 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004183 if (ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
4184 if (mbedtls_ssl_is_handshake_over(ssl) == 0) {
4185 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004186 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004187
4188 if ((ret = mbedtls_ssl_start_renegotiation(ssl)) != 0) {
4189 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_start_renegotiation", ret);
4190 return ret;
4191 }
4192 } else {
4193 if ((ret = mbedtls_ssl_handshake(ssl)) != 0) {
4194 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_handshake", ret);
4195 return ret;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004196 }
4197 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004198#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01004199
Gilles Peskine449bd832023-01-11 14:50:10 +01004200 return ret;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004201}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004202#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01004203
Gilles Peskine449bd832023-01-11 14:50:10 +01004204void mbedtls_ssl_handshake_free(mbedtls_ssl_context *ssl)
Paul Bakker48916f92012-09-16 19:57:18 +00004205{
Gilles Peskine9b562d52018-04-25 20:32:43 +02004206 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
4207
Gilles Peskine449bd832023-01-11 14:50:10 +01004208 if (handshake == NULL) {
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004209 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01004210 }
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004211
Valerio Setti6f0441d2023-07-03 12:11:36 +02004212#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
Brett Warrene0edc842021-08-17 09:53:13 +01004213#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskine449bd832023-01-11 14:50:10 +01004214 if (ssl->handshake->group_list_heap_allocated) {
4215 mbedtls_free((void *) handshake->group_list);
4216 }
Brett Warrene0edc842021-08-17 09:53:13 +01004217 handshake->group_list = NULL;
4218#endif /* MBEDTLS_DEPRECATED_REMOVED */
Valerio Setti6f0441d2023-07-03 12:11:36 +02004219#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */
Brett Warrene0edc842021-08-17 09:53:13 +01004220
Ronald Crone68ab4f2022-10-05 12:46:29 +02004221#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yuf017ee42022-01-12 15:49:48 +08004222#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Gilles Peskine449bd832023-01-11 14:50:10 +01004223 if (ssl->handshake->sig_algs_heap_allocated) {
4224 mbedtls_free((void *) handshake->sig_algs);
4225 }
Jerry Yuf017ee42022-01-12 15:49:48 +08004226 handshake->sig_algs = NULL;
4227#endif /* MBEDTLS_DEPRECATED_REMOVED */
Xiaofei Baic234ecf2022-02-08 09:59:23 +00004228#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01004229 if (ssl->handshake->certificate_request_context) {
4230 mbedtls_free((void *) handshake->certificate_request_context);
Xiaofei Baic234ecf2022-02-08 09:59:23 +00004231 }
4232#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Ronald Crone68ab4f2022-10-05 12:46:29 +02004233#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yuf017ee42022-01-12 15:49:48 +08004234
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004235#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01004236 if (ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0) {
4237 ssl->conf->f_async_cancel(ssl);
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004238 handshake->async_in_progress = 0;
4239 }
4240#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
4241
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01004242#if defined(MBEDTLS_MD_CAN_SHA256)
Andrzej Kurekeb342242019-01-29 09:14:33 -05004243#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01004244 psa_hash_abort(&handshake->fin_sha256_psa);
Andrzej Kurekeb342242019-01-29 09:14:33 -05004245#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01004246 mbedtls_md_free(&handshake->fin_sha256);
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02004247#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05004248#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01004249#if defined(MBEDTLS_MD_CAN_SHA384)
Andrzej Kurekeb342242019-01-29 09:14:33 -05004250#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01004251 psa_hash_abort(&handshake->fin_sha384_psa);
Andrzej Kurekeb342242019-01-29 09:14:33 -05004252#else
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01004253 mbedtls_md_free(&handshake->fin_sha384);
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02004254#endif
Andrzej Kurekeb342242019-01-29 09:14:33 -05004255#endif
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02004256
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004257#if defined(MBEDTLS_DHM_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004258 mbedtls_dhm_free(&handshake->dhm_ctx);
Paul Bakker48916f92012-09-16 19:57:18 +00004259#endif
Valerio Setti7aeec542023-07-05 18:57:21 +02004260#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
Valerio Setti6eb00542023-07-07 17:04:24 +02004261 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01004262 mbedtls_ecdh_free(&handshake->ecdh_ctx);
Paul Bakker61d113b2013-07-04 11:51:43 +02004263#endif
Valerio Setti02c25b52022-11-15 14:08:42 +01004264
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02004265#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Neil Armstrongca7d5062022-05-31 14:43:23 +02004266#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01004267 psa_pake_abort(&handshake->psa_pake_ctx);
Valerio Settieb3f7882022-12-08 18:42:58 +01004268 /*
4269 * Opaque keys are not stored in the handshake's data and it's the user
4270 * responsibility to destroy them. Clear ones, instead, are created by
4271 * the TLS library and should be destroyed at the same level
4272 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004273 if (!mbedtls_svc_key_id_is_null(handshake->psa_pake_password)) {
4274 psa_destroy_key(handshake->psa_pake_password);
Valerio Settieb3f7882022-12-08 18:42:58 +01004275 }
Neil Armstrongca7d5062022-05-31 14:43:23 +02004276 handshake->psa_pake_password = MBEDTLS_SVC_KEY_ID_INIT;
4277#else
Gilles Peskine449bd832023-01-11 14:50:10 +01004278 mbedtls_ecjpake_free(&handshake->ecjpake_ctx);
Neil Armstrongca7d5062022-05-31 14:43:23 +02004279#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02004280#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004281 mbedtls_free(handshake->ecjpake_cache);
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02004282 handshake->ecjpake_cache = NULL;
4283 handshake->ecjpake_cache_len = 0;
4284#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02004285#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02004286
Valerio Setti7aeec542023-07-05 18:57:21 +02004287#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED) || \
Valerio Setti45d56f32023-07-13 17:23:20 +02004288 defined(MBEDTLS_KEY_EXCHANGE_WITH_ECDSA_ANY_ENABLED) || \
Janos Follath4ae5c292016-02-10 11:27:43 +00004289 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02004290 /* explicit void pointer cast for buggy MS compiler */
Gilles Peskine449bd832023-01-11 14:50:10 +01004291 mbedtls_free((void *) handshake->curves_tls_id);
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02004292#endif
4293
Ronald Cron73fe8df2022-10-05 14:31:43 +02004294#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02004295#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01004296 if (!mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque)) {
Neil Armstrong501c9322022-05-03 09:35:09 +02004297 /* The maintenance of the external PSK key slot is the
4298 * user's responsibility. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004299 if (ssl->handshake->psk_opaque_is_internal) {
4300 psa_destroy_key(ssl->handshake->psk_opaque);
Neil Armstrong501c9322022-05-03 09:35:09 +02004301 ssl->handshake->psk_opaque_is_internal = 0;
4302 }
4303 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
4304 }
Neil Armstronge952a302022-05-03 10:22:14 +02004305#else
Gilles Peskine449bd832023-01-11 14:50:10 +01004306 if (handshake->psk != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01004307 mbedtls_zeroize_and_free(handshake->psk, handshake->psk_len);
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01004308 }
Neil Armstronge952a302022-05-03 10:22:14 +02004309#endif /* MBEDTLS_USE_PSA_CRYPTO */
Ronald Cron73fe8df2022-10-05 14:31:43 +02004310#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01004311
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004312#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
4313 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02004314 /*
4315 * Free only the linked list wrapper, not the keys themselves
4316 * since the belong to the SNI callback
4317 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004318 ssl_key_cert_free(handshake->sni_key_cert);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004319#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02004320
Gilles Peskineeccd8882020-03-10 12:19:08 +01004321#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01004322 mbedtls_x509_crt_restart_free(&handshake->ecrs_ctx);
4323 if (handshake->ecrs_peer_cert != NULL) {
4324 mbedtls_x509_crt_free(handshake->ecrs_peer_cert);
4325 mbedtls_free(handshake->ecrs_peer_cert);
Hanno Becker3dad3112019-02-05 17:19:52 +00004326 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02004327#endif
4328
Hanno Becker75173122019-02-06 16:18:31 +00004329#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
4330 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01004331 mbedtls_pk_free(&handshake->peer_pubkey);
Hanno Becker75173122019-02-06 16:18:31 +00004332#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4333
XiaokangQian9b93c0d2022-02-09 06:02:25 +00004334#if defined(MBEDTLS_SSL_CLI_C) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01004335 (defined(MBEDTLS_SSL_PROTO_DTLS) || defined(MBEDTLS_SSL_PROTO_TLS1_3))
4336 mbedtls_free(handshake->cookie);
XiaokangQian9b93c0d2022-02-09 06:02:25 +00004337#endif /* MBEDTLS_SSL_CLI_C &&
4338 ( MBEDTLS_SSL_PROTO_DTLS || MBEDTLS_SSL_PROTO_TLS1_3 ) */
XiaokangQian8499b6c2022-01-27 09:00:11 +00004339
4340#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004341 mbedtls_ssl_flight_free(handshake->flight);
4342 mbedtls_ssl_buffering_free(ssl);
XiaokangQian8499b6c2022-01-27 09:00:11 +00004343#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02004344
Valerio Settiea59c432023-07-25 11:14:03 +02004345#if defined(MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED)
Przemek Stekiel7ac93be2023-07-04 10:02:38 +02004346 if (handshake->xxdh_psa_privkey_is_external == 0) {
4347 psa_destroy_key(handshake->xxdh_psa_privkey);
Gilles Peskine449bd832023-01-11 14:50:10 +01004348 }
Valerio Settiea59c432023-07-25 11:14:03 +02004349#endif /* MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED */
Hanno Becker4a63ed42019-01-08 11:39:35 +00004350
Ronald Cron6f135e12021-12-08 16:57:54 +01004351#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01004352 mbedtls_ssl_transform_free(handshake->transform_handshake);
4353 mbedtls_free(handshake->transform_handshake);
Jerry Yu3d9b5902022-11-04 14:07:25 +08004354#if defined(MBEDTLS_SSL_EARLY_DATA)
Gilles Peskine449bd832023-01-11 14:50:10 +01004355 mbedtls_ssl_transform_free(handshake->transform_earlydata);
4356 mbedtls_free(handshake->transform_earlydata);
Jerry Yu3d9b5902022-11-04 14:07:25 +08004357#endif
Ronald Cron6f135e12021-12-08 16:57:54 +01004358#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yuba9c7272021-10-30 11:54:10 +08004359
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004360
4361#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4362 /* If the buffers are too big - reallocate. Because of the way Mbed TLS
4363 * processes datagrams and the fact that a datagram is allowed to have
4364 * several records in it, it is possible that the I/O buffers are not
4365 * empty at this stage */
Gilles Peskine449bd832023-01-11 14:50:10 +01004366 handle_buffer_resizing(ssl, 1, mbedtls_ssl_get_input_buflen(ssl),
4367 mbedtls_ssl_get_output_buflen(ssl));
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004368#endif
Hanno Becker3aa186f2021-08-10 09:24:19 +01004369
Jerry Yuba9c7272021-10-30 11:54:10 +08004370 /* mbedtls_platform_zeroize MUST be last one in this function */
Gilles Peskine449bd832023-01-11 14:50:10 +01004371 mbedtls_platform_zeroize(handshake,
4372 sizeof(mbedtls_ssl_handshake_params));
Paul Bakker48916f92012-09-16 19:57:18 +00004373}
4374
Gilles Peskine449bd832023-01-11 14:50:10 +01004375void mbedtls_ssl_session_free(mbedtls_ssl_session *session)
Paul Bakker48916f92012-09-16 19:57:18 +00004376{
Gilles Peskine449bd832023-01-11 14:50:10 +01004377 if (session == NULL) {
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004378 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01004379 }
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004380
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004381#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01004382 ssl_clear_peer_cert(session);
Paul Bakkered27a042013-04-18 22:46:23 +02004383#endif
Paul Bakker0a597072012-09-25 21:55:46 +00004384
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02004385#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Xiaokang Qianbc663a02022-10-09 11:14:39 +00004386#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
4387 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01004388 mbedtls_free(session->hostname);
Xiaokang Qian281fd1b2022-09-20 11:35:41 +00004389#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01004390 mbedtls_free(session->ticket);
Paul Bakkera503a632013-08-14 13:48:06 +02004391#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02004392
Gilles Peskine449bd832023-01-11 14:50:10 +01004393 mbedtls_platform_zeroize(session, sizeof(mbedtls_ssl_session));
Paul Bakker48916f92012-09-16 19:57:18 +00004394}
4395
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02004396#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004397
4398#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4399#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u
4400#else
4401#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u
4402#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4403
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004404#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004405
4406#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4407#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u
4408#else
4409#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u
4410#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
4411
4412#if defined(MBEDTLS_SSL_ALPN)
4413#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u
4414#else
4415#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u
4416#endif /* MBEDTLS_SSL_ALPN */
4417
4418#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0
4419#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1
4420#define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2
4421#define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3
4422
4423#define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \
Gilles Peskine449bd832023-01-11 14:50:10 +01004424 ((uint32_t) ( \
4425 (SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << \
4426 SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT) | \
4427 (SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << \
4428 SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT) | \
4429 (SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << \
4430 SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT) | \
4431 (SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT) | \
4432 0u))
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004433
Chien Wong4e9683e2023-12-28 17:07:43 +08004434static const unsigned char ssl_serialized_context_header[] = {
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004435 MBEDTLS_VERSION_MAJOR,
4436 MBEDTLS_VERSION_MINOR,
4437 MBEDTLS_VERSION_PATCH,
Gilles Peskine449bd832023-01-11 14:50:10 +01004438 MBEDTLS_BYTE_1(SSL_SERIALIZED_SESSION_CONFIG_BITFLAG),
4439 MBEDTLS_BYTE_0(SSL_SERIALIZED_SESSION_CONFIG_BITFLAG),
4440 MBEDTLS_BYTE_2(SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG),
4441 MBEDTLS_BYTE_1(SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG),
4442 MBEDTLS_BYTE_0(SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG),
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004443};
4444
Paul Bakker5121ce52009-01-03 21:22:43 +00004445/*
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004446 * Serialize a full SSL context
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02004447 *
4448 * The format of the serialized data is:
4449 * (in the presentation language of TLS, RFC 8446 section 3)
4450 *
4451 * // header
4452 * opaque mbedtls_version[3]; // major, minor, patch
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004453 * opaque context_format[5]; // version-specific field determining
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02004454 * // the format of the remaining
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004455 * // serialized data.
Manuel Pégourié-Gonnard4e9370b2019-07-23 16:31:16 +02004456 * Note: When updating the format, remember to keep these
4457 * version+format bytes. (We may make their size part of the API.)
Manuel Pégourié-Gonnard00400c22019-07-10 14:58:45 +02004458 *
4459 * // session sub-structure
4460 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save()
4461 * // transform sub-structure
4462 * uint8 random[64]; // ServerHello.random+ClientHello.random
4463 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value
4464 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use
4465 * // fields from ssl_context
4466 * uint32 badmac_seen; // DTLS: number of records with failing MAC
4467 * uint64 in_window_top; // DTLS: last validated record seq_num
4468 * uint64 in_window; // DTLS: bitmask for replay protection
4469 * uint8 disable_datagram_packing; // DTLS: only one record per datagram
4470 * uint64 cur_out_ctr; // Record layer: outgoing sequence number
4471 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size)
4472 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol
4473 *
4474 * Note that many fields of the ssl_context or sub-structures are not
4475 * serialized, as they fall in one of the following categories:
4476 *
4477 * 1. forced value (eg in_left must be 0)
4478 * 2. pointer to dynamically-allocated memory (eg session, transform)
4479 * 3. value can be re-derived from other data (eg session keys from MS)
4480 * 4. value was temporary (eg content of input buffer)
4481 * 5. value will be provided by the user again (eg I/O callbacks and context)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004482 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004483int mbedtls_ssl_context_save(mbedtls_ssl_context *ssl,
4484 unsigned char *buf,
4485 size_t buf_len,
4486 size_t *olen)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004487{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004488 unsigned char *p = buf;
4489 size_t used = 0;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004490 size_t session_len;
4491 int ret = 0;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004492
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02004493 /*
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004494 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in
4495 * this function's documentation.
4496 *
4497 * These are due to assumptions/limitations in the implementation. Some of
4498 * them are likely to stay (no handshake in progress) some might go away
4499 * (only DTLS) but are currently used to simplify the implementation.
Manuel Pégourié-Gonnard1aaf6692019-07-10 14:14:05 +02004500 */
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004501 /* The initial handshake must be over */
Gilles Peskine449bd832023-01-11 14:50:10 +01004502 if (mbedtls_ssl_is_handshake_over(ssl) == 0) {
4503 MBEDTLS_SSL_DEBUG_MSG(1, ("Initial handshake isn't over"));
4504 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004505 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004506 if (ssl->handshake != NULL) {
4507 MBEDTLS_SSL_DEBUG_MSG(1, ("Handshake isn't completed"));
4508 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004509 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004510 /* Double-check that sub-structures are indeed ready */
Gilles Peskine449bd832023-01-11 14:50:10 +01004511 if (ssl->transform == NULL || ssl->session == NULL) {
4512 MBEDTLS_SSL_DEBUG_MSG(1, ("Serialised structures aren't ready"));
4513 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004514 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004515 /* There must be no pending incoming or outgoing data */
Gilles Peskine449bd832023-01-11 14:50:10 +01004516 if (mbedtls_ssl_check_pending(ssl) != 0) {
4517 MBEDTLS_SSL_DEBUG_MSG(1, ("There is pending incoming data"));
4518 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004519 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004520 if (ssl->out_left != 0) {
4521 MBEDTLS_SSL_DEBUG_MSG(1, ("There is pending outgoing data"));
4522 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004523 }
Dave Rodgman556e8a32022-12-06 16:31:25 +00004524 /* Protocol must be DTLS, not TLS */
Gilles Peskine449bd832023-01-11 14:50:10 +01004525 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
4526 MBEDTLS_SSL_DEBUG_MSG(1, ("Only DTLS is supported"));
4527 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004528 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004529 /* Version must be 1.2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004530 if (ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2) {
4531 MBEDTLS_SSL_DEBUG_MSG(1, ("Only version 1.2 supported"));
4532 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004533 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004534 /* We must be using an AEAD ciphersuite */
Gilles Peskine449bd832023-01-11 14:50:10 +01004535 if (mbedtls_ssl_transform_uses_aead(ssl->transform) != 1) {
4536 MBEDTLS_SSL_DEBUG_MSG(1, ("Only AEAD ciphersuites supported"));
4537 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004538 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004539 /* Renegotiation must not be enabled */
4540#if defined(MBEDTLS_SSL_RENEGOTIATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01004541 if (ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED) {
4542 MBEDTLS_SSL_DEBUG_MSG(1, ("Renegotiation must not be enabled"));
4543 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jarno Lamsa8c51b7c2019-08-21 13:45:05 +03004544 }
Manuel Pégourié-Gonnarde4588692019-07-29 12:28:52 +02004545#endif
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004546
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004547 /*
4548 * Version and format identifier
4549 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004550 used += sizeof(ssl_serialized_context_header);
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004551
Gilles Peskine449bd832023-01-11 14:50:10 +01004552 if (used <= buf_len) {
4553 memcpy(p, ssl_serialized_context_header,
4554 sizeof(ssl_serialized_context_header));
4555 p += sizeof(ssl_serialized_context_header);
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004556 }
4557
4558 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004559 * Session (length + data)
4560 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004561 ret = ssl_session_save(ssl->session, 1, NULL, 0, &session_len);
4562 if (ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL) {
4563 return ret;
4564 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004565
4566 used += 4 + session_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004567 if (used <= buf_len) {
4568 MBEDTLS_PUT_UINT32_BE(session_len, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004569 p += 4;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004570
Gilles Peskine449bd832023-01-11 14:50:10 +01004571 ret = ssl_session_save(ssl->session, 1,
4572 p, session_len, &session_len);
4573 if (ret != 0) {
4574 return ret;
4575 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004576
4577 p += session_len;
4578 }
4579
4580 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004581 * Transform
4582 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004583 used += sizeof(ssl->transform->randbytes);
4584 if (used <= buf_len) {
4585 memcpy(p, ssl->transform->randbytes,
4586 sizeof(ssl->transform->randbytes));
4587 p += sizeof(ssl->transform->randbytes);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004588 }
4589
4590#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Dave Rodgmanc37ad442023-11-03 23:36:06 +00004591 used += 2U + ssl->transform->in_cid_len + ssl->transform->out_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004592 if (used <= buf_len) {
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004593 *p++ = ssl->transform->in_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004594 memcpy(p, ssl->transform->in_cid, ssl->transform->in_cid_len);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004595 p += ssl->transform->in_cid_len;
4596
4597 *p++ = ssl->transform->out_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004598 memcpy(p, ssl->transform->out_cid, ssl->transform->out_cid_len);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004599 p += ssl->transform->out_cid_len;
4600 }
4601#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4602
4603 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004604 * Saved fields from top-level ssl_context structure
4605 */
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004606 used += 4;
Gilles Peskine449bd832023-01-11 14:50:10 +01004607 if (used <= buf_len) {
4608 MBEDTLS_PUT_UINT32_BE(ssl->badmac_seen, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004609 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004610 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004611
4612#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4613 used += 16;
Gilles Peskine449bd832023-01-11 14:50:10 +01004614 if (used <= buf_len) {
4615 MBEDTLS_PUT_UINT64_BE(ssl->in_window_top, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004616 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004617
Gilles Peskine449bd832023-01-11 14:50:10 +01004618 MBEDTLS_PUT_UINT64_BE(ssl->in_window, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004619 p += 8;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004620 }
4621#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
4622
4623#if defined(MBEDTLS_SSL_PROTO_DTLS)
4624 used += 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004625 if (used <= buf_len) {
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004626 *p++ = ssl->disable_datagram_packing;
4627 }
4628#endif /* MBEDTLS_SSL_PROTO_DTLS */
4629
Jerry Yuae0b2e22021-10-08 15:21:19 +08004630 used += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Gilles Peskine449bd832023-01-11 14:50:10 +01004631 if (used <= buf_len) {
4632 memcpy(p, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN);
Jerry Yuae0b2e22021-10-08 15:21:19 +08004633 p += MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004634 }
4635
4636#if defined(MBEDTLS_SSL_PROTO_DTLS)
4637 used += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01004638 if (used <= buf_len) {
4639 MBEDTLS_PUT_UINT16_BE(ssl->mtu, p, 0);
Joe Subbiani1f6c3ae2021-08-20 11:44:44 +01004640 p += 2;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004641 }
4642#endif /* MBEDTLS_SSL_PROTO_DTLS */
4643
4644#if defined(MBEDTLS_SSL_ALPN)
4645 {
4646 const uint8_t alpn_len = ssl->alpn_chosen
Gilles Peskine449bd832023-01-11 14:50:10 +01004647 ? (uint8_t) strlen(ssl->alpn_chosen)
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004648 : 0;
4649
4650 used += 1 + alpn_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004651 if (used <= buf_len) {
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004652 *p++ = alpn_len;
4653
Gilles Peskine449bd832023-01-11 14:50:10 +01004654 if (ssl->alpn_chosen != NULL) {
4655 memcpy(p, ssl->alpn_chosen, alpn_len);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004656 p += alpn_len;
4657 }
4658 }
4659 }
4660#endif /* MBEDTLS_SSL_ALPN */
4661
4662 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004663 * Done
4664 */
4665 *olen = used;
4666
Gilles Peskine449bd832023-01-11 14:50:10 +01004667 if (used > buf_len) {
4668 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
4669 }
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004670
Gilles Peskine449bd832023-01-11 14:50:10 +01004671 MBEDTLS_SSL_DEBUG_BUF(4, "saved context", buf, used);
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004672
Gilles Peskine449bd832023-01-11 14:50:10 +01004673 return mbedtls_ssl_session_reset_int(ssl, 0);
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004674}
4675
4676/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02004677 * Deserialize context, see mbedtls_ssl_context_save() for format.
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004678 *
4679 * This internal version is wrapped by a public function that cleans up in
4680 * case of error.
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004681 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02004682MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01004683static int ssl_context_load(mbedtls_ssl_context *ssl,
4684 const unsigned char *buf,
4685 size_t len)
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004686{
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004687 const unsigned char *p = buf;
4688 const unsigned char * const end = buf + len;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004689 size_t session_len;
Janos Follath865b3eb2019-12-16 11:46:15 +00004690 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004691#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Andrzej Kurek894edde2022-09-29 06:31:14 -04004692 tls_prf_fn prf_func = NULL;
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004693#endif
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004694
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004695 /*
4696 * The context should have been freshly setup or reset.
4697 * Give the user an error in case of obvious misuse.
Manuel Pégourié-Gonnard4ca930f2019-07-26 16:31:53 +02004698 * (Checking session is useful because it won't be NULL if we're
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004699 * renegotiating, or if the user mistakenly loaded a session first.)
4700 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004701 if (ssl->state != MBEDTLS_SSL_HELLO_REQUEST ||
4702 ssl->session != NULL) {
4703 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004704 }
4705
4706 /*
4707 * We can't check that the config matches the initial one, but we can at
4708 * least check it matches the requirements for serializing.
4709 */
Dave Rodgmane99b24d2023-09-14 15:45:03 +01004710 if (
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004711#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard9a96fd72019-07-23 17:11:24 +02004712 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004713#endif
Dave Rodgmane99b24d2023-09-14 15:45:03 +01004714 ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
4715 ssl->conf->max_tls_version < MBEDTLS_SSL_VERSION_TLS1_2 ||
4716 ssl->conf->min_tls_version > MBEDTLS_SSL_VERSION_TLS1_2
4717 ) {
Gilles Peskine449bd832023-01-11 14:50:10 +01004718 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard0ff76402019-07-11 09:56:30 +02004719 }
4720
Gilles Peskine449bd832023-01-11 14:50:10 +01004721 MBEDTLS_SSL_DEBUG_BUF(4, "context to load", buf, len);
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004722
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004723 /*
4724 * Check version identifier
4725 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004726 if ((size_t) (end - p) < sizeof(ssl_serialized_context_header)) {
4727 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004728 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004729
4730 if (memcmp(p, ssl_serialized_context_header,
4731 sizeof(ssl_serialized_context_header)) != 0) {
4732 return MBEDTLS_ERR_SSL_VERSION_MISMATCH;
4733 }
4734 p += sizeof(ssl_serialized_context_header);
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004735
4736 /*
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004737 * Session
4738 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004739 if ((size_t) (end - p) < 4) {
4740 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4741 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004742
Thomas Daubneyf9f0ba82023-05-23 17:34:33 +01004743 session_len = MBEDTLS_GET_UINT32_BE(p, 0);
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004744 p += 4;
4745
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004746 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00004747 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004748 ssl->session = ssl->session_negotiate;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004749 ssl->session_in = ssl->session;
4750 ssl->session_out = ssl->session;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004751 ssl->session_negotiate = NULL;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004752
Gilles Peskine449bd832023-01-11 14:50:10 +01004753 if ((size_t) (end - p) < session_len) {
4754 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4755 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004756
Gilles Peskine449bd832023-01-11 14:50:10 +01004757 ret = ssl_session_load(ssl->session, 1, p, session_len);
4758 if (ret != 0) {
4759 mbedtls_ssl_session_free(ssl->session);
4760 return ret;
Manuel Pégourié-Gonnard45ac1f02019-07-23 16:52:45 +02004761 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004762
4763 p += session_len;
4764
4765 /*
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004766 * Transform
4767 */
4768
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004769 /* This has been allocated by ssl_handshake_init(), called by
Hanno Becker43aefe22020-02-05 10:44:56 +00004770 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */
Jerry Yu2e199812022-12-01 18:57:19 +08004771#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004772 ssl->transform = ssl->transform_negotiate;
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004773 ssl->transform_in = ssl->transform;
4774 ssl->transform_out = ssl->transform;
Manuel Pégourié-Gonnard142ba732019-07-23 14:43:30 +02004775 ssl->transform_negotiate = NULL;
Jerry Yu2e199812022-12-01 18:57:19 +08004776#endif
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004777
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004778#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01004779 prf_func = ssl_tls12prf_from_cs(ssl->session->ciphersuite);
4780 if (prf_func == NULL) {
4781 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4782 }
Andrzej Kurek894edde2022-09-29 06:31:14 -04004783
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004784 /* Read random bytes and populate structure */
Gilles Peskine449bd832023-01-11 14:50:10 +01004785 if ((size_t) (end - p) < sizeof(ssl->transform->randbytes)) {
4786 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4787 }
Andrzej Kurek2d59dbc2022-10-13 08:34:38 -04004788
Gilles Peskine449bd832023-01-11 14:50:10 +01004789 ret = ssl_tls12_populate_transform(ssl->transform,
4790 ssl->session->ciphersuite,
4791 ssl->session->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02004792#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004793 ssl->session->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02004794#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01004795 prf_func,
4796 p, /* currently pointing to randbytes */
4797 MBEDTLS_SSL_VERSION_TLS1_2, /* (D)TLS 1.2 is forced */
4798 ssl->conf->endpoint,
4799 ssl);
4800 if (ret != 0) {
4801 return ret;
4802 }
Jerry Yu840fbb22022-02-17 14:59:29 +08004803#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004804 p += sizeof(ssl->transform->randbytes);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004805
4806#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
4807 /* Read connection IDs and store them */
Gilles Peskine449bd832023-01-11 14:50:10 +01004808 if ((size_t) (end - p) < 1) {
4809 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4810 }
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004811
4812 ssl->transform->in_cid_len = *p++;
4813
Gilles Peskine449bd832023-01-11 14:50:10 +01004814 if ((size_t) (end - p) < ssl->transform->in_cid_len + 1u) {
4815 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4816 }
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004817
Gilles Peskine449bd832023-01-11 14:50:10 +01004818 memcpy(ssl->transform->in_cid, p, ssl->transform->in_cid_len);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004819 p += ssl->transform->in_cid_len;
4820
4821 ssl->transform->out_cid_len = *p++;
4822
Gilles Peskine449bd832023-01-11 14:50:10 +01004823 if ((size_t) (end - p) < ssl->transform->out_cid_len) {
4824 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4825 }
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004826
Gilles Peskine449bd832023-01-11 14:50:10 +01004827 memcpy(ssl->transform->out_cid, p, ssl->transform->out_cid_len);
Manuel Pégourié-Gonnardc2a7b892019-07-15 09:04:11 +02004828 p += ssl->transform->out_cid_len;
4829#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
4830
4831 /*
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004832 * Saved fields from top-level ssl_context structure
4833 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004834 if ((size_t) (end - p) < 4) {
4835 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4836 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004837
Thomas Daubneyf9f0ba82023-05-23 17:34:33 +01004838 ssl->badmac_seen = MBEDTLS_GET_UINT32_BE(p, 0);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004839 p += 4;
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004840
4841#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Gilles Peskine449bd832023-01-11 14:50:10 +01004842 if ((size_t) (end - p) < 16) {
4843 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4844 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004845
Thomas Daubneyf9f0ba82023-05-23 17:34:33 +01004846 ssl->in_window_top = MBEDTLS_GET_UINT64_BE(p, 0);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004847 p += 8;
4848
Thomas Daubneyf9f0ba82023-05-23 17:34:33 +01004849 ssl->in_window = MBEDTLS_GET_UINT64_BE(p, 0);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004850 p += 8;
4851#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
4852
4853#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004854 if ((size_t) (end - p) < 1) {
4855 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4856 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004857
4858 ssl->disable_datagram_packing = *p++;
4859#endif /* MBEDTLS_SSL_PROTO_DTLS */
4860
Gilles Peskine449bd832023-01-11 14:50:10 +01004861 if ((size_t) (end - p) < sizeof(ssl->cur_out_ctr)) {
4862 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4863 }
4864 memcpy(ssl->cur_out_ctr, p, sizeof(ssl->cur_out_ctr));
4865 p += sizeof(ssl->cur_out_ctr);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004866
4867#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01004868 if ((size_t) (end - p) < 2) {
4869 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4870 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004871
Dave Rodgmana3d0f612023-11-03 23:34:02 +00004872 ssl->mtu = MBEDTLS_GET_UINT16_BE(p, 0);
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004873 p += 2;
4874#endif /* MBEDTLS_SSL_PROTO_DTLS */
4875
4876#if defined(MBEDTLS_SSL_ALPN)
4877 {
4878 uint8_t alpn_len;
4879 const char **cur;
4880
Gilles Peskine449bd832023-01-11 14:50:10 +01004881 if ((size_t) (end - p) < 1) {
4882 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4883 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004884
4885 alpn_len = *p++;
4886
Gilles Peskine449bd832023-01-11 14:50:10 +01004887 if (alpn_len != 0 && ssl->conf->alpn_list != NULL) {
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004888 /* alpn_chosen should point to an item in the configured list */
Gilles Peskine449bd832023-01-11 14:50:10 +01004889 for (cur = ssl->conf->alpn_list; *cur != NULL; cur++) {
4890 if (strlen(*cur) == alpn_len &&
4891 memcmp(p, cur, alpn_len) == 0) {
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004892 ssl->alpn_chosen = *cur;
4893 break;
4894 }
4895 }
4896 }
4897
4898 /* can only happen on conf mismatch */
Gilles Peskine449bd832023-01-11 14:50:10 +01004899 if (alpn_len != 0 && ssl->alpn_chosen == NULL) {
4900 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4901 }
Manuel Pégourié-Gonnardc86c5df2019-07-15 11:23:03 +02004902
4903 p += alpn_len;
4904 }
4905#endif /* MBEDTLS_SSL_ALPN */
4906
4907 /*
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004908 * Forced fields from top-level ssl_context structure
4909 *
4910 * Most of them already set to the correct value by mbedtls_ssl_init() and
4911 * mbedtls_ssl_reset(), so we only need to set the remaining ones.
4912 */
4913 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Glenn Strauss60bfe602022-03-14 19:04:24 -04004914 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004915
Hanno Becker361b10d2019-08-30 10:42:49 +01004916 /* Adjust pointers for header fields of outgoing records to
4917 * the given transform, accounting for explicit IV and CID. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004918 mbedtls_ssl_update_out_pointers(ssl, ssl->transform);
Hanno Becker361b10d2019-08-30 10:42:49 +01004919
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004920#if defined(MBEDTLS_SSL_PROTO_DTLS)
4921 ssl->in_epoch = 1;
4922#endif
4923
4924 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated,
4925 * which we don't want - otherwise we'd end up freeing the wrong transform
Hanno Beckerce5f5fd2020-02-05 10:47:44 +00004926 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform()
4927 * inappropriately. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004928 if (ssl->handshake != NULL) {
4929 mbedtls_ssl_handshake_free(ssl);
4930 mbedtls_free(ssl->handshake);
Manuel Pégourié-Gonnard0eb3eac2019-07-15 11:53:51 +02004931 ssl->handshake = NULL;
4932 }
4933
4934 /*
Manuel Pégourié-Gonnard4c90e852019-07-11 10:58:10 +02004935 * Done - should have consumed entire buffer
4936 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004937 if (p != end) {
4938 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4939 }
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004940
Gilles Peskine449bd832023-01-11 14:50:10 +01004941 return 0;
Manuel Pégourié-Gonnardac87e282019-05-28 13:02:16 +02004942}
4943
4944/*
Manuel Pégourié-Gonnardb9dfc9f2019-07-12 10:50:19 +02004945 * Deserialize context: public wrapper for error cleaning
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004946 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004947int mbedtls_ssl_context_load(mbedtls_ssl_context *context,
4948 const unsigned char *buf,
4949 size_t len)
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004950{
Gilles Peskine449bd832023-01-11 14:50:10 +01004951 int ret = ssl_context_load(context, buf, len);
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004952
Gilles Peskine449bd832023-01-11 14:50:10 +01004953 if (ret != 0) {
4954 mbedtls_ssl_free(context);
4955 }
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004956
Gilles Peskine449bd832023-01-11 14:50:10 +01004957 return ret;
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004958}
Manuel Pégourié-Gonnard5c0e3772019-07-23 16:13:17 +02004959#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Manuel Pégourié-Gonnard4b7e6b92019-07-11 12:50:53 +02004960
4961/*
Paul Bakker5121ce52009-01-03 21:22:43 +00004962 * Free an SSL context
4963 */
Gilles Peskine449bd832023-01-11 14:50:10 +01004964void mbedtls_ssl_free(mbedtls_ssl_context *ssl)
Paul Bakker5121ce52009-01-03 21:22:43 +00004965{
Gilles Peskine449bd832023-01-11 14:50:10 +01004966 if (ssl == NULL) {
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004967 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01004968 }
Paul Bakkeraccaffe2014-06-26 13:37:14 +02004969
Gilles Peskine449bd832023-01-11 14:50:10 +01004970 MBEDTLS_SSL_DEBUG_MSG(2, ("=> free"));
Paul Bakker5121ce52009-01-03 21:22:43 +00004971
Gilles Peskine449bd832023-01-11 14:50:10 +01004972 if (ssl->out_buf != NULL) {
sander-visserb8aa2072020-05-06 22:05:13 +02004973#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4974 size_t out_buf_len = ssl->out_buf_len;
4975#else
4976 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN;
4977#endif
4978
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01004979 mbedtls_zeroize_and_free(ssl->out_buf, out_buf_len);
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004980 ssl->out_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00004981 }
4982
Gilles Peskine449bd832023-01-11 14:50:10 +01004983 if (ssl->in_buf != NULL) {
sander-visserb8aa2072020-05-06 22:05:13 +02004984#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
4985 size_t in_buf_len = ssl->in_buf_len;
4986#else
4987 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
4988#endif
4989
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01004990 mbedtls_zeroize_and_free(ssl->in_buf, in_buf_len);
Andrzej Kurek0afa2a12020-03-03 10:39:58 -05004991 ssl->in_buf = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00004992 }
4993
Gilles Peskine449bd832023-01-11 14:50:10 +01004994 if (ssl->transform) {
4995 mbedtls_ssl_transform_free(ssl->transform);
4996 mbedtls_free(ssl->transform);
Paul Bakker48916f92012-09-16 19:57:18 +00004997 }
4998
Gilles Peskine449bd832023-01-11 14:50:10 +01004999 if (ssl->handshake) {
5000 mbedtls_ssl_handshake_free(ssl);
5001 mbedtls_free(ssl->handshake);
Jerry Yu2e199812022-12-01 18:57:19 +08005002
5003#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01005004 mbedtls_ssl_transform_free(ssl->transform_negotiate);
5005 mbedtls_free(ssl->transform_negotiate);
Jerry Yu2e199812022-12-01 18:57:19 +08005006#endif
5007
Gilles Peskine449bd832023-01-11 14:50:10 +01005008 mbedtls_ssl_session_free(ssl->session_negotiate);
5009 mbedtls_free(ssl->session_negotiate);
Paul Bakker48916f92012-09-16 19:57:18 +00005010 }
5011
Ronald Cron6f135e12021-12-08 16:57:54 +01005012#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01005013 mbedtls_ssl_transform_free(ssl->transform_application);
5014 mbedtls_free(ssl->transform_application);
Ronald Cron6f135e12021-12-08 16:57:54 +01005015#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker3aa186f2021-08-10 09:24:19 +01005016
Gilles Peskine449bd832023-01-11 14:50:10 +01005017 if (ssl->session) {
5018 mbedtls_ssl_session_free(ssl->session);
5019 mbedtls_free(ssl->session);
Paul Bakkerc0463502013-02-14 11:19:38 +01005020 }
5021
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02005022#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005023 if (ssl->hostname != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005024 mbedtls_zeroize_and_free(ssl->hostname, strlen(ssl->hostname));
Paul Bakker5121ce52009-01-03 21:22:43 +00005025 }
Paul Bakker0be444a2013-08-27 21:55:01 +02005026#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00005027
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02005028#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005029 mbedtls_free(ssl->cli_id);
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02005030#endif
5031
Gilles Peskine449bd832023-01-11 14:50:10 +01005032 MBEDTLS_SSL_DEBUG_MSG(2, ("<= free"));
Paul Bakker2da561c2009-02-05 18:00:28 +00005033
Paul Bakker86f04f42013-02-14 11:20:09 +01005034 /* Actually clear after last debug message */
Gilles Peskine449bd832023-01-11 14:50:10 +01005035 mbedtls_platform_zeroize(ssl, sizeof(mbedtls_ssl_context));
Paul Bakker5121ce52009-01-03 21:22:43 +00005036}
5037
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005038/*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08005039 * Initialize mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005040 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005041void mbedtls_ssl_config_init(mbedtls_ssl_config *conf)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005042{
Gilles Peskine449bd832023-01-11 14:50:10 +01005043 memset(conf, 0, sizeof(mbedtls_ssl_config));
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005044}
5045
Gilles Peskineae270bf2021-06-02 00:05:29 +02005046/* The selection should be the same as mbedtls_x509_crt_profile_default in
5047 * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
Gilles Peskineb1940a72021-06-02 15:18:12 +02005048 * curves with a lower resource usage come first.
Gilles Peskineae270bf2021-06-02 00:05:29 +02005049 * See the documentation of mbedtls_ssl_conf_curves() for what we promise
Gilles Peskineb1940a72021-06-02 15:18:12 +02005050 * about this list.
5051 */
Chien Wong4e9683e2023-12-28 17:07:43 +08005052static const uint16_t ssl_preset_default_groups[] = {
Valerio Settidb6b4db2023-09-01 09:20:51 +02005053#if defined(MBEDTLS_ECP_HAVE_CURVE25519)
Brett Warrene0edc842021-08-17 09:53:13 +01005054 MBEDTLS_SSL_IANA_TLS_GROUP_X25519,
Gilles Peskineae270bf2021-06-02 00:05:29 +02005055#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005056#if defined(MBEDTLS_ECP_HAVE_SECP256R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005057 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02005058#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005059#if defined(MBEDTLS_ECP_HAVE_SECP384R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005060 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02005061#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005062#if defined(MBEDTLS_ECP_HAVE_CURVE448)
Brett Warrene0edc842021-08-17 09:53:13 +01005063 MBEDTLS_SSL_IANA_TLS_GROUP_X448,
Gilles Peskineb1940a72021-06-02 15:18:12 +02005064#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005065#if defined(MBEDTLS_ECP_HAVE_SECP521R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005066 MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02005067#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005068#if defined(MBEDTLS_ECP_HAVE_BP256R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005069 MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1,
Gilles Peskineae270bf2021-06-02 00:05:29 +02005070#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005071#if defined(MBEDTLS_ECP_HAVE_BP384R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005072 MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02005073#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005074#if defined(MBEDTLS_ECP_HAVE_BP512R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005075 MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1,
Gilles Peskineb1940a72021-06-02 15:18:12 +02005076#endif
Przemek Stekiel316c19e2023-05-31 15:25:11 +02005077#if defined(PSA_WANT_ALG_FFDH)
Przemek Stekiel383f4712022-12-12 14:48:57 +01005078 MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048,
5079 MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE3072,
5080 MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE4096,
5081 MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE6144,
5082 MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192,
5083#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005084 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Gilles Peskineae270bf2021-06-02 00:05:29 +02005085};
Gilles Peskineae270bf2021-06-02 00:05:29 +02005086
Alexey Tsvetkov2ca34372022-06-07 10:21:05 +03005087static const int ssl_preset_suiteb_ciphersuites[] = {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005088 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
5089 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
5090 0
5091};
5092
Ronald Crone68ab4f2022-10-05 12:46:29 +02005093#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01005094
Jerry Yu909df7b2022-01-22 11:56:27 +08005095/* NOTICE:
Jerry Yu0b994b82022-01-25 17:22:12 +08005096 * For ssl_preset_*_sig_algs and ssl_tls12_preset_*_sig_algs, the following
Jerry Yu370e1462022-01-25 10:36:53 +08005097 * rules SHOULD be upheld.
5098 * - No duplicate entries.
5099 * - But if there is a good reason, do not change the order of the algorithms.
Jerry Yu09a99fc2022-07-28 14:22:17 +08005100 * - ssl_tls12_preset* is for TLS 1.2 use only.
Jerry Yu370e1462022-01-25 10:36:53 +08005101 * - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes.
Jerry Yu1a8b4812022-01-20 17:56:50 +08005102 */
Chien Wong4e9683e2023-12-28 17:07:43 +08005103static const uint16_t ssl_preset_default_sig_algs[] = {
Jerry Yu1a8b4812022-01-20 17:56:50 +08005104
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005105#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005106 defined(MBEDTLS_MD_CAN_SHA256) && \
Valerio Setticf29c5d2023-09-01 09:03:41 +02005107 defined(PSA_WANT_ECC_SECP_R1_256)
Jerry Yued5e9f42022-01-26 11:21:34 +08005108 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005109 // == MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256)
5110#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08005111
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005112#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005113 defined(MBEDTLS_MD_CAN_SHA384) && \
Valerio Setticf29c5d2023-09-01 09:03:41 +02005114 defined(PSA_WANT_ECC_SECP_R1_384)
Jerry Yu909df7b2022-01-22 11:56:27 +08005115 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005116 // == MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384)
5117#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08005118
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005119#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005120 defined(MBEDTLS_MD_CAN_SHA512) && \
Valerio Setticf29c5d2023-09-01 09:03:41 +02005121 defined(PSA_WANT_ECC_SECP_R1_521)
Jerry Yued5e9f42022-01-26 11:21:34 +08005122 MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005123 // == MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512)
5124#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08005125
Yanray Wang1136fad2023-11-22 16:54:31 +08005126#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_MD_CAN_SHA512)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08005127 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
Yanray Wang1136fad2023-11-22 16:54:31 +08005128#endif
Jerry Yu9bb3ee42022-06-23 10:16:33 +08005129
Yanray Wang1136fad2023-11-22 16:54:31 +08005130#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_MD_CAN_SHA384)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08005131 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
Yanray Wang1136fad2023-11-22 16:54:31 +08005132#endif
Jerry Yu9bb3ee42022-06-23 10:16:33 +08005133
Yanray Wang1136fad2023-11-22 16:54:31 +08005134#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_MD_CAN_SHA256)
Jerry Yu9bb3ee42022-06-23 10:16:33 +08005135 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
Yanray Wang1136fad2023-11-22 16:54:31 +08005136#endif
Jerry Yu9bb3ee42022-06-23 10:16:33 +08005137
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005138#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_MD_CAN_SHA512)
Jerry Yu693a47a2022-06-23 14:02:28 +08005139 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512,
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005140#endif /* MBEDTLS_RSA_C && MBEDTLS_MD_CAN_SHA512 */
Jerry Yu693a47a2022-06-23 14:02:28 +08005141
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005142#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_MD_CAN_SHA384)
Jerry Yu693a47a2022-06-23 14:02:28 +08005143 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384,
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005144#endif /* MBEDTLS_RSA_C && MBEDTLS_MD_CAN_SHA384 */
Jerry Yu693a47a2022-06-23 14:02:28 +08005145
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005146#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_MD_CAN_SHA256)
Jerry Yu693a47a2022-06-23 14:02:28 +08005147 MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005148#endif /* MBEDTLS_RSA_C && MBEDTLS_MD_CAN_SHA256 */
Jerry Yu693a47a2022-06-23 14:02:28 +08005149
Gabor Mezei15b95a62022-05-09 16:37:58 +02005150 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08005151};
5152
5153/* NOTICE: see above */
5154#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5155static uint16_t ssl_tls12_preset_default_sig_algs[] = {
Yanray Wang1136fad2023-11-22 16:54:31 +08005156
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005157#if defined(MBEDTLS_MD_CAN_SHA512)
Valerio Settie9646ec2023-08-02 20:02:28 +02005158#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005159 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512),
Jerry Yu713013f2022-01-17 18:16:35 +08005160#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08005161#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
5162 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
Yanray Wang1136fad2023-11-22 16:54:31 +08005163#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02005164#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005165 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA512),
Gabor Mezeic1051b62022-05-10 13:13:58 +02005166#endif
Yanray Wang1136fad2023-11-22 16:54:31 +08005167#endif /* MBEDTLS_MD_CAN_SHA512 */
5168
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005169#if defined(MBEDTLS_MD_CAN_SHA384)
Valerio Settie9646ec2023-08-02 20:02:28 +02005170#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005171 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08005172#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08005173#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
5174 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
Yanray Wang1136fad2023-11-22 16:54:31 +08005175#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02005176#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005177 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384),
Gabor Mezeic1051b62022-05-10 13:13:58 +02005178#endif
Yanray Wang1136fad2023-11-22 16:54:31 +08005179#endif /* MBEDTLS_MD_CAN_SHA384 */
5180
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005181#if defined(MBEDTLS_MD_CAN_SHA256)
Valerio Settie9646ec2023-08-02 20:02:28 +02005182#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005183 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256),
Jerry Yu11f0a9c2022-01-12 18:43:08 +08005184#endif
Jerry Yu09a99fc2022-07-28 14:22:17 +08005185#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
5186 MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
Yanray Wang1136fad2023-11-22 16:54:31 +08005187#endif
Gabor Mezeic1051b62022-05-10 13:13:58 +02005188#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005189 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256),
Gabor Mezeic1051b62022-05-10 13:13:58 +02005190#endif
Yanray Wang1136fad2023-11-22 16:54:31 +08005191#endif /* MBEDTLS_MD_CAN_SHA256 */
5192
Gabor Mezei15b95a62022-05-09 16:37:58 +02005193 MBEDTLS_TLS_SIG_NONE
Jerry Yu909df7b2022-01-22 11:56:27 +08005194};
5195#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Yanray Wang1136fad2023-11-22 16:54:31 +08005196
Jerry Yu909df7b2022-01-22 11:56:27 +08005197/* NOTICE: see above */
Chien Wong4e9683e2023-12-28 17:07:43 +08005198static const uint16_t ssl_preset_suiteb_sig_algs[] = {
Jerry Yu909df7b2022-01-22 11:56:27 +08005199
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005200#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
Valerio Setti45d56f32023-07-13 17:23:20 +02005201 defined(MBEDTLS_MD_CAN_SHA256) && \
Valerio Settidb6b4db2023-09-01 09:20:51 +02005202 defined(MBEDTLS_ECP_HAVE_SECP256R1)
Jerry Yu909df7b2022-01-22 11:56:27 +08005203 MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005204 // == MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256)
5205#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08005206
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005207#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) && \
Valerio Setti45d56f32023-07-13 17:23:20 +02005208 defined(MBEDTLS_MD_CAN_SHA384) && \
Valerio Settidb6b4db2023-09-01 09:20:51 +02005209 defined(MBEDTLS_ECP_HAVE_SECP384R1)
Jerry Yu53037892022-01-25 11:02:06 +08005210 MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
Manuel Pégourié-Gonnard275afe12023-09-18 11:19:20 +02005211 // == MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384)
5212#endif
Jerry Yu909df7b2022-01-22 11:56:27 +08005213
Gabor Mezei15b95a62022-05-09 16:37:58 +02005214 MBEDTLS_TLS_SIG_NONE
Jerry Yu713013f2022-01-17 18:16:35 +08005215};
Jerry Yu6106fdc2022-01-12 16:36:14 +08005216
Jerry Yu909df7b2022-01-22 11:56:27 +08005217/* NOTICE: see above */
5218#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
5219static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = {
Yanray Wang1136fad2023-11-22 16:54:31 +08005220
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005221#if defined(MBEDTLS_MD_CAN_SHA256)
Valerio Settie9646ec2023-08-02 20:02:28 +02005222#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005223 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256),
Jerry Yu713013f2022-01-17 18:16:35 +08005224#endif
Yanray Wang1136fad2023-11-22 16:54:31 +08005225#endif /* MBEDTLS_MD_CAN_SHA256 */
Yanray Wang69ceb392023-11-22 16:32:39 +08005226
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005227#if defined(MBEDTLS_MD_CAN_SHA384)
Valerio Settie9646ec2023-08-02 20:02:28 +02005228#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005229 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384),
Jerry Yu18c833e2022-01-25 10:55:47 +08005230#endif
Yanray Wang1136fad2023-11-22 16:54:31 +08005231#endif /* MBEDTLS_MD_CAN_SHA384 */
5232
Gabor Mezei15b95a62022-05-09 16:37:58 +02005233 MBEDTLS_TLS_SIG_NONE
Hanno Becker9c6aa7b2021-08-10 13:50:43 +01005234};
Jerry Yu909df7b2022-01-22 11:56:27 +08005235#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
5236
Ronald Crone68ab4f2022-10-05 12:46:29 +02005237#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005238
Chien Wong4e9683e2023-12-28 17:07:43 +08005239static const uint16_t ssl_preset_suiteb_groups[] = {
Valerio Settidb6b4db2023-09-01 09:20:51 +02005240#if defined(MBEDTLS_ECP_HAVE_SECP256R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005241 MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01005242#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005243#if defined(MBEDTLS_ECP_HAVE_SECP384R1)
Brett Warrene0edc842021-08-17 09:53:13 +01005244 MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
Jaeden Amerod4311042019-06-03 08:27:16 +01005245#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005246 MBEDTLS_SSL_IANA_TLS_GROUP_NONE
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005247};
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005248
Ronald Crone68ab4f2022-10-05 12:46:29 +02005249#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08005250/* Function for checking `ssl_preset_*_sig_algs` and `ssl_tls12_preset_*_sig_algs`
Jerry Yu370e1462022-01-25 10:36:53 +08005251 * to make sure there are no duplicated signature algorithm entries. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005252MBEDTLS_CHECK_RETURN_CRITICAL
Chien Wong4e9683e2023-12-28 17:07:43 +08005253static int ssl_check_no_sig_alg_duplication(const uint16_t *sig_algs)
Jerry Yu1a8b4812022-01-20 17:56:50 +08005254{
5255 size_t i, j;
5256 int ret = 0;
Jerry Yu909df7b2022-01-22 11:56:27 +08005257
Gilles Peskine449bd832023-01-11 14:50:10 +01005258 for (i = 0; sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++) {
5259 for (j = 0; j < i; j++) {
5260 if (sig_algs[i] != sig_algs[j]) {
Jerry Yuf377d642022-01-25 10:43:59 +08005261 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01005262 }
5263 mbedtls_printf(" entry(%04x,%" MBEDTLS_PRINTF_SIZET
5264 ") is duplicated at %" MBEDTLS_PRINTF_SIZET "\n",
5265 sig_algs[i], j, i);
Jerry Yuf377d642022-01-25 10:43:59 +08005266 ret = -1;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005267 }
5268 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005269 return ret;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005270}
5271
Ronald Crone68ab4f2022-10-05 12:46:29 +02005272#endif /* MBEDTLS_DEBUG_C && MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yu1a8b4812022-01-20 17:56:50 +08005273
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005274/*
Tillmann Karras588ad502015-09-25 04:27:22 +02005275 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005276 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005277int mbedtls_ssl_config_defaults(mbedtls_ssl_config *conf,
5278 int endpoint, int transport, int preset)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005279{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02005280#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Janos Follath865b3eb2019-12-16 11:46:15 +00005281 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02005282#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005283
Ronald Crone68ab4f2022-10-05 12:46:29 +02005284#if defined(MBEDTLS_DEBUG_C) && defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005285 if (ssl_check_no_sig_alg_duplication(ssl_preset_suiteb_sig_algs)) {
5286 mbedtls_printf("ssl_preset_suiteb_sig_algs has duplicated entries\n");
5287 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005288 }
5289
Gilles Peskine449bd832023-01-11 14:50:10 +01005290 if (ssl_check_no_sig_alg_duplication(ssl_preset_default_sig_algs)) {
5291 mbedtls_printf("ssl_preset_default_sig_algs has duplicated entries\n");
5292 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu1a8b4812022-01-20 17:56:50 +08005293 }
Jerry Yu909df7b2022-01-22 11:56:27 +08005294
5295#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01005296 if (ssl_check_no_sig_alg_duplication(ssl_tls12_preset_suiteb_sig_algs)) {
5297 mbedtls_printf("ssl_tls12_preset_suiteb_sig_algs has duplicated entries\n");
5298 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu909df7b2022-01-22 11:56:27 +08005299 }
5300
Gilles Peskine449bd832023-01-11 14:50:10 +01005301 if (ssl_check_no_sig_alg_duplication(ssl_tls12_preset_default_sig_algs)) {
5302 mbedtls_printf("ssl_tls12_preset_default_sig_algs has duplicated entries\n");
5303 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu909df7b2022-01-22 11:56:27 +08005304 }
5305#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Ronald Crone68ab4f2022-10-05 12:46:29 +02005306#endif /* MBEDTLS_DEBUG_C && MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Jerry Yu1a8b4812022-01-20 17:56:50 +08005307
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02005308 /* Use the functions here so that they are covered in tests,
5309 * but otherwise access member directly for efficiency */
Gilles Peskine449bd832023-01-11 14:50:10 +01005310 mbedtls_ssl_conf_endpoint(conf, endpoint);
5311 mbedtls_ssl_conf_transport(conf, transport);
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005312
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005313 /*
5314 * Things that are common to all presets
5315 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02005316#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005317 if (endpoint == MBEDTLS_SSL_IS_CLIENT) {
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02005318 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
5319#if defined(MBEDTLS_SSL_SESSION_TICKETS)
5320 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
5321#endif
5322 }
5323#endif
5324
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005325#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
5326 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
5327#endif
5328
5329#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
5330 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
5331#endif
5332
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02005333#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005334 conf->f_cookie_write = ssl_cookie_write_dummy;
5335 conf->f_cookie_check = ssl_cookie_check_dummy;
5336#endif
5337
5338#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
5339 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
5340#endif
5341
Janos Follath088ce432017-04-10 12:42:31 +01005342#if defined(MBEDTLS_SSL_SRV_C)
5343 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
TRodziewicz3946f792021-06-14 12:11:18 +02005344 conf->respect_cli_pref = MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER;
Janos Follath088ce432017-04-10 12:42:31 +01005345#endif
5346
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005347#if defined(MBEDTLS_SSL_PROTO_DTLS)
5348 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
5349 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
5350#endif
5351
5352#if defined(MBEDTLS_SSL_RENEGOTIATION)
5353 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005354 memset(conf->renego_period, 0x00, 2);
5355 memset(conf->renego_period + 2, 0xFF, 6);
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005356#endif
5357
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005358#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005359 if (endpoint == MBEDTLS_SSL_IS_SERVER) {
Hanno Beckere2defad2021-07-24 05:59:17 +01005360 const unsigned char dhm_p[] =
5361 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
5362 const unsigned char dhm_g[] =
5363 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
Hanno Becker00d0a682017-10-04 13:14:29 +01005364
Gilles Peskine449bd832023-01-11 14:50:10 +01005365 if ((ret = mbedtls_ssl_conf_dh_param_bin(conf,
5366 dhm_p, sizeof(dhm_p),
5367 dhm_g, sizeof(dhm_g))) != 0) {
5368 return ret;
Hanno Beckere2defad2021-07-24 05:59:17 +01005369 }
5370 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02005371#endif
5372
Ronald Cron6f135e12021-12-08 16:57:54 +01005373#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu6ee56aa2022-12-06 17:47:22 +08005374
5375#if defined(MBEDTLS_SSL_EARLY_DATA)
Yanray Wangd5ed36f2023-11-07 11:40:43 +08005376 mbedtls_ssl_conf_early_data(conf, MBEDTLS_SSL_EARLY_DATA_DISABLED);
Jerry Yu6ee56aa2022-12-06 17:47:22 +08005377#if defined(MBEDTLS_SSL_SRV_C)
Yanray Wang07517612023-11-07 11:47:36 +08005378 mbedtls_ssl_conf_max_early_data_size(conf, MBEDTLS_SSL_MAX_EARLY_DATA_SIZE);
Jerry Yu6ee56aa2022-12-06 17:47:22 +08005379#endif
5380#endif /* MBEDTLS_SSL_EARLY_DATA */
5381
Jerry Yud0766ec2022-09-22 10:46:57 +08005382#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yu1ad7ace2022-08-09 13:28:39 +08005383 mbedtls_ssl_conf_new_session_tickets(
Gilles Peskine449bd832023-01-11 14:50:10 +01005384 conf, MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS);
Jerry Yu1ad7ace2022-08-09 13:28:39 +08005385#endif
Hanno Becker71f1ed62021-07-24 06:01:47 +01005386 /*
5387 * Allow all TLS 1.3 key exchange modes by default.
5388 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00005389 conf->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL;
Ronald Cron6f135e12021-12-08 16:57:54 +01005390#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Hanno Becker71f1ed62021-07-24 06:01:47 +01005391
Gilles Peskine449bd832023-01-11 14:50:10 +01005392 if (transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
Glenn Strauss2dfcea22022-03-14 17:26:42 -04005393#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
XiaokangQian4d3a6042022-04-21 13:46:17 +00005394 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian060d8672022-04-21 09:24:56 +00005395 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
XiaokangQian4d3a6042022-04-21 13:46:17 +00005396#else
Gilles Peskine449bd832023-01-11 14:50:10 +01005397 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQian060d8672022-04-21 09:24:56 +00005398#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01005399 } else {
XiaokangQian4d3a6042022-04-21 13:46:17 +00005400#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Ronald Cron097ba142023-03-08 16:18:00 +01005401 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5402 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
XiaokangQian4d3a6042022-04-21 13:46:17 +00005403#elif defined(MBEDTLS_SSL_PROTO_TLS1_3)
5404 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
5405 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
5406#elif defined(MBEDTLS_SSL_PROTO_TLS1_2)
5407 conf->min_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5408 conf->max_tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
5409#else
Gilles Peskine449bd832023-01-11 14:50:10 +01005410 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQian4d3a6042022-04-21 13:46:17 +00005411#endif
5412 }
Glenn Strauss2dfcea22022-03-14 17:26:42 -04005413
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005414 /*
5415 * Preset-specific defaults
5416 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005417 switch (preset) {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005418 /*
5419 * NSA Suite B
5420 */
5421 case MBEDTLS_SSL_PRESET_SUITEB:
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005422
Hanno Beckerd60b6c62021-04-29 12:04:11 +01005423 conf->ciphersuite_list = ssl_preset_suiteb_ciphersuites;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005424
5425#if defined(MBEDTLS_X509_CRT_PARSE_C)
5426 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005427#endif
5428
Ronald Crone68ab4f2022-10-05 12:46:29 +02005429#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08005430#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01005431 if (mbedtls_ssl_conf_is_tls12_only(conf)) {
Jerry Yu909df7b2022-01-22 11:56:27 +08005432 conf->sig_algs = ssl_tls12_preset_suiteb_sig_algs;
Gilles Peskine449bd832023-01-11 14:50:10 +01005433 } else
Jerry Yu909df7b2022-01-22 11:56:27 +08005434#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005435 conf->sig_algs = ssl_preset_suiteb_sig_algs;
Ronald Crone68ab4f2022-10-05 12:46:29 +02005436#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005437
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02005438#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
Brett Warrene0edc842021-08-17 09:53:13 +01005439 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005440#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005441 conf->group_list = ssl_preset_suiteb_groups;
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02005442 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005443
5444 /*
5445 * Default
5446 */
5447 default:
Ronald Cronf6606552022-03-15 11:23:25 +01005448
Hanno Beckerd60b6c62021-04-29 12:04:11 +01005449 conf->ciphersuite_list = mbedtls_ssl_list_ciphersuites();
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005450
5451#if defined(MBEDTLS_X509_CRT_PARSE_C)
5452 conf->cert_profile = &mbedtls_x509_crt_profile_default;
5453#endif
5454
Ronald Crone68ab4f2022-10-05 12:46:29 +02005455#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Jerry Yu909df7b2022-01-22 11:56:27 +08005456#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01005457 if (mbedtls_ssl_conf_is_tls12_only(conf)) {
Jerry Yu909df7b2022-01-22 11:56:27 +08005458 conf->sig_algs = ssl_tls12_preset_default_sig_algs;
Gilles Peskine449bd832023-01-11 14:50:10 +01005459 } else
Jerry Yu909df7b2022-01-22 11:56:27 +08005460#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005461 conf->sig_algs = ssl_preset_default_sig_algs;
Ronald Crone68ab4f2022-10-05 12:46:29 +02005462#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005463
Manuel Pégourié-Gonnardf07ce3b2023-09-22 11:53:41 +02005464#if defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_DEPRECATED_REMOVED)
Brett Warrene0edc842021-08-17 09:53:13 +01005465 conf->curve_list = NULL;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005466#endif
Brett Warrene0edc842021-08-17 09:53:13 +01005467 conf->group_list = ssl_preset_default_groups;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02005468
5469#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
5470 conf->dhm_min_bitlen = 1024;
5471#endif
5472 }
5473
Gilles Peskine449bd832023-01-11 14:50:10 +01005474 return 0;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005475}
5476
5477/*
5478 * Free mbedtls_ssl_config
5479 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005480void mbedtls_ssl_config_free(mbedtls_ssl_config *conf)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005481{
5482#if defined(MBEDTLS_DHM_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005483 mbedtls_mpi_free(&conf->dhm_P);
5484 mbedtls_mpi_free(&conf->dhm_G);
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005485#endif
5486
Ronald Cron73fe8df2022-10-05 14:31:43 +02005487#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
Neil Armstrong501c9322022-05-03 09:35:09 +02005488#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01005489 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) {
Neil Armstrong501c9322022-05-03 09:35:09 +02005490 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT;
5491 }
Neil Armstrong8ecd6682022-05-05 11:40:35 +02005492#endif /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01005493 if (conf->psk != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005494 mbedtls_zeroize_and_free(conf->psk, conf->psk_len);
Azim Khan27e8a122018-03-21 14:24:11 +00005495 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005496 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09005497 }
5498
Gilles Peskine449bd832023-01-11 14:50:10 +01005499 if (conf->psk_identity != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005500 mbedtls_zeroize_and_free(conf->psk_identity, conf->psk_identity_len);
Azim Khan27e8a122018-03-21 14:24:11 +00005501 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005502 conf->psk_identity_len = 0;
5503 }
Ronald Cron73fe8df2022-10-05 14:31:43 +02005504#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005505
5506#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005507 ssl_key_cert_free(conf->key_cert);
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005508#endif
5509
Gilles Peskine449bd832023-01-11 14:50:10 +01005510 mbedtls_platform_zeroize(conf, sizeof(mbedtls_ssl_config));
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02005511}
5512
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02005513#if defined(MBEDTLS_PK_C) && \
Valerio Settie9646ec2023-08-02 20:02:28 +02005514 (defined(MBEDTLS_RSA_C) || defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED))
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005515/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005516 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005517 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005518unsigned char mbedtls_ssl_sig_from_pk(mbedtls_pk_context *pk)
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005519{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005520#if defined(MBEDTLS_RSA_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005521 if (mbedtls_pk_can_do(pk, MBEDTLS_PK_RSA)) {
5522 return MBEDTLS_SSL_SIG_RSA;
5523 }
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005524#endif
Valerio Settie9646ec2023-08-02 20:02:28 +02005525#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01005526 if (mbedtls_pk_can_do(pk, MBEDTLS_PK_ECDSA)) {
5527 return MBEDTLS_SSL_SIG_ECDSA;
5528 }
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005529#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01005530 return MBEDTLS_SSL_SIG_ANON;
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02005531}
5532
Gilles Peskine449bd832023-01-11 14:50:10 +01005533unsigned char mbedtls_ssl_sig_from_pk_alg(mbedtls_pk_type_t type)
Hanno Becker7e5437a2017-04-28 17:15:26 +01005534{
Gilles Peskine449bd832023-01-11 14:50:10 +01005535 switch (type) {
Hanno Becker7e5437a2017-04-28 17:15:26 +01005536 case MBEDTLS_PK_RSA:
Gilles Peskine449bd832023-01-11 14:50:10 +01005537 return MBEDTLS_SSL_SIG_RSA;
Hanno Becker7e5437a2017-04-28 17:15:26 +01005538 case MBEDTLS_PK_ECDSA:
5539 case MBEDTLS_PK_ECKEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01005540 return MBEDTLS_SSL_SIG_ECDSA;
Hanno Becker7e5437a2017-04-28 17:15:26 +01005541 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005542 return MBEDTLS_SSL_SIG_ANON;
Hanno Becker7e5437a2017-04-28 17:15:26 +01005543 }
5544}
5545
Gilles Peskine449bd832023-01-11 14:50:10 +01005546mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig(unsigned char sig)
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005547{
Gilles Peskine449bd832023-01-11 14:50:10 +01005548 switch (sig) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005549#if defined(MBEDTLS_RSA_C)
5550 case MBEDTLS_SSL_SIG_RSA:
Gilles Peskine449bd832023-01-11 14:50:10 +01005551 return MBEDTLS_PK_RSA;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005552#endif
Valerio Settie9646ec2023-08-02 20:02:28 +02005553#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005554 case MBEDTLS_SSL_SIG_ECDSA:
Gilles Peskine449bd832023-01-11 14:50:10 +01005555 return MBEDTLS_PK_ECDSA;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005556#endif
5557 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005558 return MBEDTLS_PK_NONE;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005559 }
5560}
Valerio Settie9646ec2023-08-02 20:02:28 +02005561#endif /* MBEDTLS_PK_C &&
5562 ( MBEDTLS_RSA_C || MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005563
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02005564/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005565 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02005566 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005567mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash(unsigned char hash)
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005568{
Gilles Peskine449bd832023-01-11 14:50:10 +01005569 switch (hash) {
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005570#if defined(MBEDTLS_MD_CAN_MD5)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005571 case MBEDTLS_SSL_HASH_MD5:
Gilles Peskine449bd832023-01-11 14:50:10 +01005572 return MBEDTLS_MD_MD5;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005573#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005574#if defined(MBEDTLS_MD_CAN_SHA1)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005575 case MBEDTLS_SSL_HASH_SHA1:
Gilles Peskine449bd832023-01-11 14:50:10 +01005576 return MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005577#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005578#if defined(MBEDTLS_MD_CAN_SHA224)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005579 case MBEDTLS_SSL_HASH_SHA224:
Gilles Peskine449bd832023-01-11 14:50:10 +01005580 return MBEDTLS_MD_SHA224;
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02005581#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005582#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005583 case MBEDTLS_SSL_HASH_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01005584 return MBEDTLS_MD_SHA256;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005585#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005586#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005587 case MBEDTLS_SSL_HASH_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01005588 return MBEDTLS_MD_SHA384;
Mateusz Starzyk3352a532021-04-06 14:28:22 +02005589#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005590#if defined(MBEDTLS_MD_CAN_SHA512)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005591 case MBEDTLS_SSL_HASH_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01005592 return MBEDTLS_MD_SHA512;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005593#endif
5594 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005595 return MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02005596 }
5597}
5598
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005599/*
5600 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
5601 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005602unsigned char mbedtls_ssl_hash_from_md_alg(int md)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005603{
Gilles Peskine449bd832023-01-11 14:50:10 +01005604 switch (md) {
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005605#if defined(MBEDTLS_MD_CAN_MD5)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005606 case MBEDTLS_MD_MD5:
Gilles Peskine449bd832023-01-11 14:50:10 +01005607 return MBEDTLS_SSL_HASH_MD5;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005608#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005609#if defined(MBEDTLS_MD_CAN_SHA1)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005610 case MBEDTLS_MD_SHA1:
Gilles Peskine449bd832023-01-11 14:50:10 +01005611 return MBEDTLS_SSL_HASH_SHA1;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005612#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005613#if defined(MBEDTLS_MD_CAN_SHA224)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005614 case MBEDTLS_MD_SHA224:
Gilles Peskine449bd832023-01-11 14:50:10 +01005615 return MBEDTLS_SSL_HASH_SHA224;
Mateusz Starzyke3c48b42021-04-19 16:46:28 +02005616#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005617#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005618 case MBEDTLS_MD_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01005619 return MBEDTLS_SSL_HASH_SHA256;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005620#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005621#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005622 case MBEDTLS_MD_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01005623 return MBEDTLS_SSL_HASH_SHA384;
Mateusz Starzyk3352a532021-04-06 14:28:22 +02005624#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005625#if defined(MBEDTLS_MD_CAN_SHA512)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005626 case MBEDTLS_MD_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01005627 return MBEDTLS_SSL_HASH_SHA512;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005628#endif
5629 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005630 return MBEDTLS_SSL_HASH_NONE;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005631 }
5632}
5633
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005634/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02005635 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02005636 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005637 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005638int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_id)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005639{
Gilles Peskine449bd832023-01-11 14:50:10 +01005640 const uint16_t *group_list = mbedtls_ssl_get_groups(ssl);
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005641
Gilles Peskine449bd832023-01-11 14:50:10 +01005642 if (group_list == NULL) {
5643 return -1;
Brett Warrene0edc842021-08-17 09:53:13 +01005644 }
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005645
Gilles Peskine449bd832023-01-11 14:50:10 +01005646 for (; *group_list != 0; group_list++) {
5647 if (*group_list == tls_id) {
5648 return 0;
5649 }
5650 }
5651
5652 return -1;
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005653}
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005654
Valerio Setti49e69072023-06-27 17:27:51 +02005655#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005656/*
5657 * Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id.
5658 */
Gilles Peskine449bd832023-01-11 14:50:10 +01005659int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id)
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005660{
Gilles Peskine449bd832023-01-11 14:50:10 +01005661 uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(grp_id);
Leonid Rozenboim19e59732022-08-08 16:52:38 -07005662
Gilles Peskine449bd832023-01-11 14:50:10 +01005663 if (tls_id == 0) {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07005664 return -1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005665 }
Leonid Rozenboim19e59732022-08-08 16:52:38 -07005666
Gilles Peskine449bd832023-01-11 14:50:10 +01005667 return mbedtls_ssl_check_curve_tls_id(ssl, tls_id);
Manuel Pégourié-Gonnard0d63b842022-01-18 13:10:56 +01005668}
Valerio Setti49e69072023-06-27 17:27:51 +02005669#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */
Valerio Setti67419f02023-01-04 16:12:42 +01005670
Valerio Setti18c9fed2022-12-30 17:44:24 +01005671static const struct {
5672 uint16_t tls_id;
5673 mbedtls_ecp_group_id ecp_group_id;
5674 psa_ecc_family_t psa_family;
5675 uint16_t bits;
Valerio Setti18c9fed2022-12-30 17:44:24 +01005676} tls_id_match_table[] =
5677{
Valerio Settidb6b4db2023-09-01 09:20:51 +02005678#if defined(MBEDTLS_ECP_HAVE_SECP521R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02005679 { 25, MBEDTLS_ECP_DP_SECP521R1, PSA_ECC_FAMILY_SECP_R1, 521 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005680#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005681#if defined(MBEDTLS_ECP_HAVE_BP512R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02005682 { 28, MBEDTLS_ECP_DP_BP512R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 512 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005683#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005684#if defined(MBEDTLS_ECP_HAVE_SECP384R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02005685 { 24, MBEDTLS_ECP_DP_SECP384R1, PSA_ECC_FAMILY_SECP_R1, 384 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005686#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005687#if defined(MBEDTLS_ECP_HAVE_BP384R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02005688 { 27, MBEDTLS_ECP_DP_BP384R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 384 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005689#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005690#if defined(MBEDTLS_ECP_HAVE_SECP256R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02005691 { 23, MBEDTLS_ECP_DP_SECP256R1, PSA_ECC_FAMILY_SECP_R1, 256 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005692#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005693#if defined(MBEDTLS_ECP_HAVE_SECP256K1)
Valerio Settiacd32c02023-06-29 18:06:29 +02005694 { 22, MBEDTLS_ECP_DP_SECP256K1, PSA_ECC_FAMILY_SECP_K1, 256 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005695#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005696#if defined(MBEDTLS_ECP_HAVE_BP256R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02005697 { 26, MBEDTLS_ECP_DP_BP256R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1, 256 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005698#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005699#if defined(MBEDTLS_ECP_HAVE_SECP224R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02005700 { 21, MBEDTLS_ECP_DP_SECP224R1, PSA_ECC_FAMILY_SECP_R1, 224 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005701#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005702#if defined(MBEDTLS_ECP_HAVE_SECP224K1)
Valerio Settiacd32c02023-06-29 18:06:29 +02005703 { 20, MBEDTLS_ECP_DP_SECP224K1, PSA_ECC_FAMILY_SECP_K1, 224 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005704#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005705#if defined(MBEDTLS_ECP_HAVE_SECP192R1)
Valerio Settiacd32c02023-06-29 18:06:29 +02005706 { 19, MBEDTLS_ECP_DP_SECP192R1, PSA_ECC_FAMILY_SECP_R1, 192 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005707#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005708#if defined(MBEDTLS_ECP_HAVE_SECP192K1)
Valerio Settiacd32c02023-06-29 18:06:29 +02005709 { 18, MBEDTLS_ECP_DP_SECP192K1, PSA_ECC_FAMILY_SECP_K1, 192 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005710#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005711#if defined(MBEDTLS_ECP_HAVE_CURVE25519)
Valerio Settiacd32c02023-06-29 18:06:29 +02005712 { 29, MBEDTLS_ECP_DP_CURVE25519, PSA_ECC_FAMILY_MONTGOMERY, 255 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005713#endif
Valerio Settidb6b4db2023-09-01 09:20:51 +02005714#if defined(MBEDTLS_ECP_HAVE_CURVE448)
Valerio Settiacd32c02023-06-29 18:06:29 +02005715 { 30, MBEDTLS_ECP_DP_CURVE448, PSA_ECC_FAMILY_MONTGOMERY, 448 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005716#endif
Valerio Settiacd32c02023-06-29 18:06:29 +02005717 { 0, MBEDTLS_ECP_DP_NONE, 0, 0 },
Valerio Setti18c9fed2022-12-30 17:44:24 +01005718};
5719
Gilles Peskine449bd832023-01-11 14:50:10 +01005720int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id,
Przemek Stekielda4fba62023-06-02 14:52:28 +02005721 psa_key_type_t *type,
Gilles Peskine449bd832023-01-11 14:50:10 +01005722 size_t *bits)
Valerio Setti18c9fed2022-12-30 17:44:24 +01005723{
Gilles Peskine449bd832023-01-11 14:50:10 +01005724 for (int i = 0; tls_id_match_table[i].tls_id != 0; i++) {
5725 if (tls_id_match_table[i].tls_id == tls_id) {
Przemek Stekielda4fba62023-06-02 14:52:28 +02005726 if (type != NULL) {
5727 *type = PSA_KEY_TYPE_ECC_KEY_PAIR(tls_id_match_table[i].psa_family);
Gilles Peskine449bd832023-01-11 14:50:10 +01005728 }
5729 if (bits != NULL) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01005730 *bits = tls_id_match_table[i].bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01005731 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01005732 return PSA_SUCCESS;
5733 }
5734 }
5735
5736 return PSA_ERROR_NOT_SUPPORTED;
5737}
5738
Gilles Peskine449bd832023-01-11 14:50:10 +01005739mbedtls_ecp_group_id mbedtls_ssl_get_ecp_group_id_from_tls_id(uint16_t tls_id)
Valerio Setti18c9fed2022-12-30 17:44:24 +01005740{
Gilles Peskine449bd832023-01-11 14:50:10 +01005741 for (int i = 0; tls_id_match_table[i].tls_id != 0; i++) {
5742 if (tls_id_match_table[i].tls_id == tls_id) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01005743 return tls_id_match_table[i].ecp_group_id;
Gilles Peskine449bd832023-01-11 14:50:10 +01005744 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01005745 }
5746
5747 return MBEDTLS_ECP_DP_NONE;
5748}
5749
Gilles Peskine449bd832023-01-11 14:50:10 +01005750uint16_t mbedtls_ssl_get_tls_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id)
Valerio Setti18c9fed2022-12-30 17:44:24 +01005751{
Gilles Peskine449bd832023-01-11 14:50:10 +01005752 for (int i = 0; tls_id_match_table[i].ecp_group_id != MBEDTLS_ECP_DP_NONE;
5753 i++) {
5754 if (tls_id_match_table[i].ecp_group_id == grp_id) {
Valerio Setti18c9fed2022-12-30 17:44:24 +01005755 return tls_id_match_table[i].tls_id;
Gilles Peskine449bd832023-01-11 14:50:10 +01005756 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01005757 }
5758
5759 return 0;
5760}
5761
Valerio Setti67419f02023-01-04 16:12:42 +01005762#if defined(MBEDTLS_DEBUG_C)
Valerio Settiacd32c02023-06-29 18:06:29 +02005763static const struct {
5764 uint16_t tls_id;
5765 const char *name;
5766} tls_id_curve_name_table[] =
5767{
Valerio Setti54e23792023-07-07 10:49:27 +02005768 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1, "secp521r1" },
5769 { MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1, "brainpoolP512r1" },
5770 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1, "secp384r1" },
5771 { MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1, "brainpoolP384r1" },
5772 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1, "secp256r1" },
5773 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1, "secp256k1" },
5774 { MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1, "brainpoolP256r1" },
5775 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1, "secp224r1" },
5776 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1, "secp224k1" },
5777 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1, "secp192r1" },
5778 { MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1, "secp192k1" },
5779 { MBEDTLS_SSL_IANA_TLS_GROUP_X25519, "x25519" },
5780 { MBEDTLS_SSL_IANA_TLS_GROUP_X448, "x448" },
Valerio Settiacd32c02023-06-29 18:06:29 +02005781 { 0, NULL },
5782};
5783
Gilles Peskine449bd832023-01-11 14:50:10 +01005784const char *mbedtls_ssl_get_curve_name_from_tls_id(uint16_t tls_id)
Valerio Setti18c9fed2022-12-30 17:44:24 +01005785{
Valerio Settiacd32c02023-06-29 18:06:29 +02005786 for (int i = 0; tls_id_curve_name_table[i].tls_id != 0; i++) {
5787 if (tls_id_curve_name_table[i].tls_id == tls_id) {
5788 return tls_id_curve_name_table[i].name;
Gilles Peskine449bd832023-01-11 14:50:10 +01005789 }
Valerio Setti18c9fed2022-12-30 17:44:24 +01005790 }
5791
5792 return NULL;
5793}
Valerio Setti67419f02023-01-04 16:12:42 +01005794#endif
Valerio Setti18c9fed2022-12-30 17:44:24 +01005795
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005796#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01005797int mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt *cert,
5798 const mbedtls_ssl_ciphersuite_t *ciphersuite,
5799 int cert_endpoint,
5800 uint32_t *flags)
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005801{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005802 int ret = 0;
Dave Rodgmanc37ad442023-11-03 23:36:06 +00005803 unsigned int usage = 0;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005804 const char *ext_oid;
5805 size_t ext_len;
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005806
Gilles Peskine449bd832023-01-11 14:50:10 +01005807 if (cert_endpoint == MBEDTLS_SSL_IS_SERVER) {
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005808 /* Server part of the key exchange */
Gilles Peskine449bd832023-01-11 14:50:10 +01005809 switch (ciphersuite->key_exchange) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005810 case MBEDTLS_KEY_EXCHANGE_RSA:
5811 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005812 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005813 break;
5814
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005815 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
5816 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
5817 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
5818 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005819 break;
5820
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005821 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
5822 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005823 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005824 break;
5825
5826 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005827 case MBEDTLS_KEY_EXCHANGE_NONE:
5828 case MBEDTLS_KEY_EXCHANGE_PSK:
5829 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
5830 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02005831 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005832 usage = 0;
5833 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005834 } else {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005835 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
5836 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005837 }
5838
Gilles Peskine449bd832023-01-11 14:50:10 +01005839 if (mbedtls_x509_crt_check_key_usage(cert, usage) != 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005840 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005841 ret = -1;
5842 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005843
Gilles Peskine449bd832023-01-11 14:50:10 +01005844 if (cert_endpoint == MBEDTLS_SSL_IS_SERVER) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005845 ext_oid = MBEDTLS_OID_SERVER_AUTH;
Gilles Peskine449bd832023-01-11 14:50:10 +01005846 ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH);
5847 } else {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005848 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
Gilles Peskine449bd832023-01-11 14:50:10 +01005849 ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_CLIENT_AUTH);
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005850 }
5851
Gilles Peskine449bd832023-01-11 14:50:10 +01005852 if (mbedtls_x509_crt_check_extended_key_usage(cert, ext_oid, ext_len) != 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005853 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005854 ret = -1;
5855 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02005856
Gilles Peskine449bd832023-01-11 14:50:10 +01005857 return ret;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005858}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005859#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02005860
Jerry Yu148165c2021-09-24 23:20:59 +08005861#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01005862int mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context *ssl,
5863 const mbedtls_md_type_t md,
5864 unsigned char *dst,
5865 size_t dst_len,
5866 size_t *olen)
Jerry Yu148165c2021-09-24 23:20:59 +08005867{
Ronald Cronf6893e12022-01-07 22:09:01 +01005868 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5869 psa_hash_operation_t *hash_operation_to_clone;
5870 psa_hash_operation_t hash_operation = psa_hash_operation_init();
5871
Jerry Yu148165c2021-09-24 23:20:59 +08005872 *olen = 0;
Ronald Cronf6893e12022-01-07 22:09:01 +01005873
Gilles Peskine449bd832023-01-11 14:50:10 +01005874 switch (md) {
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005875#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +01005876 case MBEDTLS_MD_SHA384:
5877 hash_operation_to_clone = &ssl->handshake->fin_sha384_psa;
5878 break;
Ronald Cronf6893e12022-01-07 22:09:01 +01005879#endif
5880
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005881#if defined(MBEDTLS_MD_CAN_SHA256)
Gilles Peskine449bd832023-01-11 14:50:10 +01005882 case MBEDTLS_MD_SHA256:
5883 hash_operation_to_clone = &ssl->handshake->fin_sha256_psa;
5884 break;
Ronald Cronf6893e12022-01-07 22:09:01 +01005885#endif
5886
Gilles Peskine449bd832023-01-11 14:50:10 +01005887 default:
5888 goto exit;
5889 }
5890
5891 status = psa_hash_clone(hash_operation_to_clone, &hash_operation);
5892 if (status != PSA_SUCCESS) {
Ronald Cronf6893e12022-01-07 22:09:01 +01005893 goto exit;
5894 }
5895
Gilles Peskine449bd832023-01-11 14:50:10 +01005896 status = psa_hash_finish(&hash_operation, dst, dst_len, olen);
5897 if (status != PSA_SUCCESS) {
Ronald Cronf6893e12022-01-07 22:09:01 +01005898 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005899 }
Ronald Cronf6893e12022-01-07 22:09:01 +01005900
5901exit:
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005902#if !defined(MBEDTLS_MD_CAN_SHA384) && \
5903 !defined(MBEDTLS_MD_CAN_SHA256)
Andrzej Kurekeabeb302022-10-17 07:52:51 -04005904 (void) ssl;
5905#endif
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05005906 return PSA_TO_MBEDTLS_ERR(status);
Jerry Yu148165c2021-09-24 23:20:59 +08005907}
5908#else /* MBEDTLS_USE_PSA_CRYPTO */
5909
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005910#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005911MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01005912static int ssl_get_handshake_transcript_sha384(mbedtls_ssl_context *ssl,
5913 unsigned char *dst,
5914 size_t dst_len,
5915 size_t *olen)
Jerry Yu24c0ec32021-09-09 14:21:07 +08005916{
Jerry Yu24c0ec32021-09-09 14:21:07 +08005917 int ret;
Manuel Pégourié-Gonnard02d55d52023-02-24 13:21:16 +01005918 mbedtls_md_context_t sha384;
Jerry Yu24c0ec32021-09-09 14:21:07 +08005919
Gilles Peskine449bd832023-01-11 14:50:10 +01005920 if (dst_len < 48) {
5921 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
5922 }
Jerry Yu24c0ec32021-09-09 14:21:07 +08005923
Manuel Pégourié-Gonnard02d55d52023-02-24 13:21:16 +01005924 mbedtls_md_init(&sha384);
5925 ret = mbedtls_md_setup(&sha384, mbedtls_md_info_from_type(MBEDTLS_MD_SHA384), 0);
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01005926 if (ret != 0) {
5927 goto exit;
5928 }
Manuel Pégourié-Gonnard02d55d52023-02-24 13:21:16 +01005929 ret = mbedtls_md_clone(&sha384, &ssl->handshake->fin_sha384);
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01005930 if (ret != 0) {
5931 goto exit;
5932 }
Jerry Yu24c0ec32021-09-09 14:21:07 +08005933
Manuel Pégourié-Gonnard02d55d52023-02-24 13:21:16 +01005934 if ((ret = mbedtls_md_finish(&sha384, dst)) != 0) {
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01005935 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_finish", ret);
Jerry Yu24c0ec32021-09-09 14:21:07 +08005936 goto exit;
5937 }
5938
5939 *olen = 48;
5940
5941exit:
5942
Manuel Pégourié-Gonnard02d55d52023-02-24 13:21:16 +01005943 mbedtls_md_free(&sha384);
Gilles Peskine449bd832023-01-11 14:50:10 +01005944 return ret;
Jerry Yu24c0ec32021-09-09 14:21:07 +08005945}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005946#endif /* MBEDTLS_MD_CAN_SHA384 */
Jerry Yu24c0ec32021-09-09 14:21:07 +08005947
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005948#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02005949MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01005950static int ssl_get_handshake_transcript_sha256(mbedtls_ssl_context *ssl,
5951 unsigned char *dst,
5952 size_t dst_len,
5953 size_t *olen)
Jerry Yu24c0ec32021-09-09 14:21:07 +08005954{
Jerry Yu24c0ec32021-09-09 14:21:07 +08005955 int ret;
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01005956 mbedtls_md_context_t sha256;
Jerry Yu24c0ec32021-09-09 14:21:07 +08005957
Gilles Peskine449bd832023-01-11 14:50:10 +01005958 if (dst_len < 32) {
5959 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
5960 }
Jerry Yu24c0ec32021-09-09 14:21:07 +08005961
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01005962 mbedtls_md_init(&sha256);
5963 ret = mbedtls_md_setup(&sha256, mbedtls_md_info_from_type(MBEDTLS_MD_SHA256), 0);
5964 if (ret != 0) {
5965 goto exit;
5966 }
5967 ret = mbedtls_md_clone(&sha256, &ssl->handshake->fin_sha256);
5968 if (ret != 0) {
5969 goto exit;
5970 }
Jerry Yuc5aef882021-12-23 20:15:02 +08005971
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01005972 if ((ret = mbedtls_md_finish(&sha256, dst)) != 0) {
5973 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_finish", ret);
Jerry Yu24c0ec32021-09-09 14:21:07 +08005974 goto exit;
5975 }
5976
5977 *olen = 32;
5978
5979exit:
5980
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01005981 mbedtls_md_free(&sha256);
Gilles Peskine449bd832023-01-11 14:50:10 +01005982 return ret;
Jerry Yu24c0ec32021-09-09 14:21:07 +08005983}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005984#endif /* MBEDTLS_MD_CAN_SHA256 */
Jerry Yu24c0ec32021-09-09 14:21:07 +08005985
Gilles Peskine449bd832023-01-11 14:50:10 +01005986int mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context *ssl,
5987 const mbedtls_md_type_t md,
5988 unsigned char *dst,
5989 size_t dst_len,
5990 size_t *olen)
Jerry Yu24c0ec32021-09-09 14:21:07 +08005991{
Gilles Peskine449bd832023-01-11 14:50:10 +01005992 switch (md) {
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005993
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005994#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +01005995 case MBEDTLS_MD_SHA384:
5996 return ssl_get_handshake_transcript_sha384(ssl, dst, dst_len, olen);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005997#endif /* MBEDTLS_MD_CAN_SHA384*/
Jerry Yuc1ddeef2021-10-08 15:14:45 +08005998
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01005999#if defined(MBEDTLS_MD_CAN_SHA256)
Gilles Peskine449bd832023-01-11 14:50:10 +01006000 case MBEDTLS_MD_SHA256:
6001 return ssl_get_handshake_transcript_sha256(ssl, dst, dst_len, olen);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006002#endif /* MBEDTLS_MD_CAN_SHA256*/
Jerry Yuc1ddeef2021-10-08 15:14:45 +08006003
Gilles Peskine449bd832023-01-11 14:50:10 +01006004 default:
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006005#if !defined(MBEDTLS_MD_CAN_SHA384) && \
6006 !defined(MBEDTLS_MD_CAN_SHA256)
Gilles Peskine449bd832023-01-11 14:50:10 +01006007 (void) ssl;
6008 (void) dst;
6009 (void) dst_len;
6010 (void) olen;
Andrzej Kurek409248a2022-10-24 10:33:21 -04006011#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01006012 break;
Jerry Yuc1ddeef2021-10-08 15:14:45 +08006013 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006014 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu24c0ec32021-09-09 14:21:07 +08006015}
XiaokangQian647719a2021-12-07 09:16:29 +00006016
Jerry Yu148165c2021-09-24 23:20:59 +08006017#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu24c0ec32021-09-09 14:21:07 +08006018
Ronald Crone68ab4f2022-10-05 12:46:29 +02006019#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
Gabor Mezei078e8032022-04-27 21:17:56 +02006020/* mbedtls_ssl_parse_sig_alg_ext()
6021 *
6022 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
6023 * value (TLS 1.3 RFC8446):
6024 * enum {
6025 * ....
6026 * ecdsa_secp256r1_sha256( 0x0403 ),
6027 * ecdsa_secp384r1_sha384( 0x0503 ),
6028 * ecdsa_secp521r1_sha512( 0x0603 ),
6029 * ....
6030 * } SignatureScheme;
6031 *
6032 * struct {
6033 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
6034 * } SignatureSchemeList;
6035 *
6036 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
6037 * value (TLS 1.2 RFC5246):
6038 * enum {
6039 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
6040 * sha512(6), (255)
6041 * } HashAlgorithm;
6042 *
6043 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
6044 * SignatureAlgorithm;
6045 *
6046 * struct {
6047 * HashAlgorithm hash;
6048 * SignatureAlgorithm signature;
6049 * } SignatureAndHashAlgorithm;
6050 *
6051 * SignatureAndHashAlgorithm
6052 * supported_signature_algorithms<2..2^16-2>;
6053 *
6054 * The TLS 1.3 signature algorithm extension was defined to be a compatible
6055 * generalization of the TLS 1.2 signature algorithm extension.
6056 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
6057 * `SignatureScheme` field of TLS 1.3
6058 *
6059 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006060int mbedtls_ssl_parse_sig_alg_ext(mbedtls_ssl_context *ssl,
6061 const unsigned char *buf,
6062 const unsigned char *end)
Gabor Mezei078e8032022-04-27 21:17:56 +02006063{
6064 const unsigned char *p = buf;
6065 size_t supported_sig_algs_len = 0;
6066 const unsigned char *supported_sig_algs_end;
6067 uint16_t sig_alg;
6068 uint32_t common_idx = 0;
6069
Gilles Peskine449bd832023-01-11 14:50:10 +01006070 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
6071 supported_sig_algs_len = MBEDTLS_GET_UINT16_BE(p, 0);
Gabor Mezei078e8032022-04-27 21:17:56 +02006072 p += 2;
6073
Gilles Peskine449bd832023-01-11 14:50:10 +01006074 memset(ssl->handshake->received_sig_algs, 0,
6075 sizeof(ssl->handshake->received_sig_algs));
Gabor Mezei078e8032022-04-27 21:17:56 +02006076
Gilles Peskine449bd832023-01-11 14:50:10 +01006077 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, supported_sig_algs_len);
Gabor Mezei078e8032022-04-27 21:17:56 +02006078 supported_sig_algs_end = p + supported_sig_algs_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01006079 while (p < supported_sig_algs_end) {
6080 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, supported_sig_algs_end, 2);
6081 sig_alg = MBEDTLS_GET_UINT16_BE(p, 0);
Gabor Mezei078e8032022-04-27 21:17:56 +02006082 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01006083 MBEDTLS_SSL_DEBUG_MSG(4, ("received signature algorithm: 0x%x %s",
6084 sig_alg,
6085 mbedtls_ssl_sig_alg_to_str(sig_alg)));
Jerry Yu2fe6c632022-06-29 10:02:38 +08006086#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Gilles Peskine449bd832023-01-11 14:50:10 +01006087 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 &&
6088 (!(mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg) &&
6089 mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)))) {
Gabor Mezei078e8032022-04-27 21:17:56 +02006090 continue;
Jerry Yu2fe6c632022-06-29 10:02:38 +08006091 }
6092#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Gabor Mezei078e8032022-04-27 21:17:56 +02006093
Gilles Peskine449bd832023-01-11 14:50:10 +01006094 MBEDTLS_SSL_DEBUG_MSG(4, ("valid signature algorithm: %s",
6095 mbedtls_ssl_sig_alg_to_str(sig_alg)));
Gabor Mezei078e8032022-04-27 21:17:56 +02006096
Gilles Peskine449bd832023-01-11 14:50:10 +01006097 if (common_idx + 1 < MBEDTLS_RECEIVED_SIG_ALGS_SIZE) {
Gabor Mezei078e8032022-04-27 21:17:56 +02006098 ssl->handshake->received_sig_algs[common_idx] = sig_alg;
6099 common_idx += 1;
6100 }
6101 }
6102 /* Check that we consumed all the message. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006103 if (p != end) {
6104 MBEDTLS_SSL_DEBUG_MSG(1,
6105 ("Signature algorithms extension length misaligned"));
6106 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
6107 MBEDTLS_ERR_SSL_DECODE_ERROR);
6108 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Gabor Mezei078e8032022-04-27 21:17:56 +02006109 }
6110
Gilles Peskine449bd832023-01-11 14:50:10 +01006111 if (common_idx == 0) {
6112 MBEDTLS_SSL_DEBUG_MSG(3, ("no signature algorithm in common"));
6113 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
6114 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
6115 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Gabor Mezei078e8032022-04-27 21:17:56 +02006116 }
6117
Gabor Mezei15b95a62022-05-09 16:37:58 +02006118 ssl->handshake->received_sig_algs[common_idx] = MBEDTLS_TLS_SIG_NONE;
Gilles Peskine449bd832023-01-11 14:50:10 +01006119 return 0;
Gabor Mezei078e8032022-04-27 21:17:56 +02006120}
6121
Ronald Crone68ab4f2022-10-05 12:46:29 +02006122#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
Gabor Mezei078e8032022-04-27 21:17:56 +02006123
Jerry Yudc7bd172022-02-17 13:44:15 +08006124#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6125
6126#if defined(MBEDTLS_USE_PSA_CRYPTO)
6127
Gilles Peskine449bd832023-01-11 14:50:10 +01006128static psa_status_t setup_psa_key_derivation(psa_key_derivation_operation_t *derivation,
6129 mbedtls_svc_key_id_t key,
6130 psa_algorithm_t alg,
6131 const unsigned char *raw_psk, size_t raw_psk_length,
6132 const unsigned char *seed, size_t seed_length,
6133 const unsigned char *label, size_t label_length,
6134 const unsigned char *other_secret,
6135 size_t other_secret_length,
6136 size_t capacity)
Jerry Yudc7bd172022-02-17 13:44:15 +08006137{
6138 psa_status_t status;
6139
Gilles Peskine449bd832023-01-11 14:50:10 +01006140 status = psa_key_derivation_setup(derivation, alg);
6141 if (status != PSA_SUCCESS) {
6142 return status;
6143 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006144
Gilles Peskine449bd832023-01-11 14:50:10 +01006145 if (PSA_ALG_IS_TLS12_PRF(alg) || PSA_ALG_IS_TLS12_PSK_TO_MS(alg)) {
6146 status = psa_key_derivation_input_bytes(derivation,
6147 PSA_KEY_DERIVATION_INPUT_SEED,
6148 seed, seed_length);
6149 if (status != PSA_SUCCESS) {
6150 return status;
Przemek Stekiel1f027032022-04-05 17:12:11 +02006151 }
6152
Gilles Peskine449bd832023-01-11 14:50:10 +01006153 if (other_secret != NULL) {
6154 status = psa_key_derivation_input_bytes(derivation,
6155 PSA_KEY_DERIVATION_INPUT_OTHER_SECRET,
6156 other_secret, other_secret_length);
6157 if (status != PSA_SUCCESS) {
6158 return status;
6159 }
6160 }
6161
6162 if (mbedtls_svc_key_id_is_null(key)) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006163 status = psa_key_derivation_input_bytes(
6164 derivation, PSA_KEY_DERIVATION_INPUT_SECRET,
Gilles Peskine449bd832023-01-11 14:50:10 +01006165 raw_psk, raw_psk_length);
6166 } else {
Jerry Yudc7bd172022-02-17 13:44:15 +08006167 status = psa_key_derivation_input_key(
Gilles Peskine449bd832023-01-11 14:50:10 +01006168 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key);
Jerry Yudc7bd172022-02-17 13:44:15 +08006169 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006170 if (status != PSA_SUCCESS) {
6171 return status;
6172 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006173
Gilles Peskine449bd832023-01-11 14:50:10 +01006174 status = psa_key_derivation_input_bytes(derivation,
6175 PSA_KEY_DERIVATION_INPUT_LABEL,
6176 label, label_length);
6177 if (status != PSA_SUCCESS) {
6178 return status;
6179 }
6180 } else {
6181 return PSA_ERROR_NOT_SUPPORTED;
Jerry Yudc7bd172022-02-17 13:44:15 +08006182 }
6183
Gilles Peskine449bd832023-01-11 14:50:10 +01006184 status = psa_key_derivation_set_capacity(derivation, capacity);
6185 if (status != PSA_SUCCESS) {
6186 return status;
6187 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006188
Gilles Peskine449bd832023-01-11 14:50:10 +01006189 return PSA_SUCCESS;
Jerry Yudc7bd172022-02-17 13:44:15 +08006190}
6191
Andrzej Kurek57d10632022-10-24 10:32:01 -04006192#if defined(PSA_WANT_ALG_SHA_384) || \
6193 defined(PSA_WANT_ALG_SHA_256)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006194MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006195static int tls_prf_generic(mbedtls_md_type_t md_type,
6196 const unsigned char *secret, size_t slen,
6197 const char *label,
6198 const unsigned char *random, size_t rlen,
6199 unsigned char *dstbuf, size_t dlen)
Jerry Yudc7bd172022-02-17 13:44:15 +08006200{
6201 psa_status_t status;
6202 psa_algorithm_t alg;
6203 mbedtls_svc_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT;
6204 psa_key_derivation_operation_t derivation =
6205 PSA_KEY_DERIVATION_OPERATION_INIT;
6206
Gilles Peskine449bd832023-01-11 14:50:10 +01006207 if (md_type == MBEDTLS_MD_SHA384) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006208 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384);
Gilles Peskine449bd832023-01-11 14:50:10 +01006209 } else {
Jerry Yudc7bd172022-02-17 13:44:15 +08006210 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256);
Gilles Peskine449bd832023-01-11 14:50:10 +01006211 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006212
6213 /* Normally a "secret" should be long enough to be impossible to
6214 * find by brute force, and in particular should not be empty. But
6215 * this PRF is also used to derive an IV, in particular in EAP-TLS,
6216 * and for this use case it makes sense to have a 0-length "secret".
6217 * Since the key API doesn't allow importing a key of length 0,
6218 * keep master_key=0, which setup_psa_key_derivation() understands
6219 * to mean a 0-length "secret" input. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006220 if (slen != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006221 psa_key_attributes_t key_attributes = psa_key_attributes_init();
Gilles Peskine449bd832023-01-11 14:50:10 +01006222 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
6223 psa_set_key_algorithm(&key_attributes, alg);
6224 psa_set_key_type(&key_attributes, PSA_KEY_TYPE_DERIVE);
Jerry Yudc7bd172022-02-17 13:44:15 +08006225
Gilles Peskine449bd832023-01-11 14:50:10 +01006226 status = psa_import_key(&key_attributes, secret, slen, &master_key);
6227 if (status != PSA_SUCCESS) {
6228 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
6229 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006230 }
6231
Gilles Peskine449bd832023-01-11 14:50:10 +01006232 status = setup_psa_key_derivation(&derivation,
6233 master_key, alg,
6234 NULL, 0,
6235 random, rlen,
6236 (unsigned char const *) label,
6237 (size_t) strlen(label),
6238 NULL, 0,
6239 dlen);
6240 if (status != PSA_SUCCESS) {
6241 psa_key_derivation_abort(&derivation);
6242 psa_destroy_key(master_key);
6243 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yudc7bd172022-02-17 13:44:15 +08006244 }
6245
Gilles Peskine449bd832023-01-11 14:50:10 +01006246 status = psa_key_derivation_output_bytes(&derivation, dstbuf, dlen);
6247 if (status != PSA_SUCCESS) {
6248 psa_key_derivation_abort(&derivation);
6249 psa_destroy_key(master_key);
6250 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yudc7bd172022-02-17 13:44:15 +08006251 }
6252
Gilles Peskine449bd832023-01-11 14:50:10 +01006253 status = psa_key_derivation_abort(&derivation);
6254 if (status != PSA_SUCCESS) {
6255 psa_destroy_key(master_key);
6256 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yudc7bd172022-02-17 13:44:15 +08006257 }
6258
Gilles Peskine449bd832023-01-11 14:50:10 +01006259 if (!mbedtls_svc_key_id_is_null(master_key)) {
6260 status = psa_destroy_key(master_key);
6261 }
6262 if (status != PSA_SUCCESS) {
6263 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
6264 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006265
Gilles Peskine449bd832023-01-11 14:50:10 +01006266 return 0;
Jerry Yudc7bd172022-02-17 13:44:15 +08006267}
Andrzej Kurek57d10632022-10-24 10:32:01 -04006268#endif /* PSA_WANT_ALG_SHA_256 || PSA_WANT_ALG_SHA_384 */
Jerry Yudc7bd172022-02-17 13:44:15 +08006269#else /* MBEDTLS_USE_PSA_CRYPTO */
6270
Andrzej Kurek57d10632022-10-24 10:32:01 -04006271#if defined(MBEDTLS_MD_C) && \
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006272 (defined(MBEDTLS_MD_CAN_SHA256) || \
6273 defined(MBEDTLS_MD_CAN_SHA384))
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006274MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006275static int tls_prf_generic(mbedtls_md_type_t md_type,
6276 const unsigned char *secret, size_t slen,
6277 const char *label,
6278 const unsigned char *random, size_t rlen,
6279 unsigned char *dstbuf, size_t dlen)
Jerry Yudc7bd172022-02-17 13:44:15 +08006280{
6281 size_t nb;
6282 size_t i, j, k, md_len;
6283 unsigned char *tmp;
6284 size_t tmp_len = 0;
6285 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
6286 const mbedtls_md_info_t *md_info;
6287 mbedtls_md_context_t md_ctx;
6288 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6289
Gilles Peskine449bd832023-01-11 14:50:10 +01006290 mbedtls_md_init(&md_ctx);
Jerry Yudc7bd172022-02-17 13:44:15 +08006291
Gilles Peskine449bd832023-01-11 14:50:10 +01006292 if ((md_info = mbedtls_md_info_from_type(md_type)) == NULL) {
6293 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
6294 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006295
Gilles Peskine449bd832023-01-11 14:50:10 +01006296 md_len = mbedtls_md_get_size(md_info);
Jerry Yudc7bd172022-02-17 13:44:15 +08006297
Gilles Peskine449bd832023-01-11 14:50:10 +01006298 tmp_len = md_len + strlen(label) + rlen;
6299 tmp = mbedtls_calloc(1, tmp_len);
6300 if (tmp == NULL) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006301 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
6302 goto exit;
6303 }
6304
Gilles Peskine449bd832023-01-11 14:50:10 +01006305 nb = strlen(label);
6306 memcpy(tmp + md_len, label, nb);
6307 memcpy(tmp + md_len + nb, random, rlen);
Jerry Yudc7bd172022-02-17 13:44:15 +08006308 nb += rlen;
6309
6310 /*
6311 * Compute P_<hash>(secret, label + random)[0..dlen]
6312 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006313 if ((ret = mbedtls_md_setup(&md_ctx, md_info, 1)) != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006314 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006315 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006316
Gilles Peskine449bd832023-01-11 14:50:10 +01006317 ret = mbedtls_md_hmac_starts(&md_ctx, secret, slen);
6318 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006319 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006320 }
6321 ret = mbedtls_md_hmac_update(&md_ctx, tmp + md_len, nb);
6322 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006323 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006324 }
6325 ret = mbedtls_md_hmac_finish(&md_ctx, tmp);
6326 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006327 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006328 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006329
Gilles Peskine449bd832023-01-11 14:50:10 +01006330 for (i = 0; i < dlen; i += md_len) {
6331 ret = mbedtls_md_hmac_reset(&md_ctx);
6332 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006333 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006334 }
6335 ret = mbedtls_md_hmac_update(&md_ctx, tmp, md_len + nb);
6336 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006337 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006338 }
6339 ret = mbedtls_md_hmac_finish(&md_ctx, h_i);
6340 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006341 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006342 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006343
Gilles Peskine449bd832023-01-11 14:50:10 +01006344 ret = mbedtls_md_hmac_reset(&md_ctx);
6345 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006346 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006347 }
6348 ret = mbedtls_md_hmac_update(&md_ctx, tmp, md_len);
6349 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006350 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006351 }
6352 ret = mbedtls_md_hmac_finish(&md_ctx, tmp);
6353 if (ret != 0) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006354 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006355 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006356
Gilles Peskine449bd832023-01-11 14:50:10 +01006357 k = (i + md_len > dlen) ? dlen % md_len : md_len;
Jerry Yudc7bd172022-02-17 13:44:15 +08006358
Gilles Peskine449bd832023-01-11 14:50:10 +01006359 for (j = 0; j < k; j++) {
Jerry Yudc7bd172022-02-17 13:44:15 +08006360 dstbuf[i + j] = h_i[j];
Gilles Peskine449bd832023-01-11 14:50:10 +01006361 }
Jerry Yudc7bd172022-02-17 13:44:15 +08006362 }
6363
6364exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006365 mbedtls_md_free(&md_ctx);
Jerry Yudc7bd172022-02-17 13:44:15 +08006366
Gilles Peskine449bd832023-01-11 14:50:10 +01006367 if (tmp != NULL) {
6368 mbedtls_platform_zeroize(tmp, tmp_len);
6369 }
Dave Rodgman29b9b2b2022-11-01 16:08:14 +00006370
Gilles Peskine449bd832023-01-11 14:50:10 +01006371 mbedtls_platform_zeroize(h_i, sizeof(h_i));
Jerry Yudc7bd172022-02-17 13:44:15 +08006372
Gilles Peskine449bd832023-01-11 14:50:10 +01006373 mbedtls_free(tmp);
Jerry Yudc7bd172022-02-17 13:44:15 +08006374
Gilles Peskine449bd832023-01-11 14:50:10 +01006375 return ret;
Jerry Yudc7bd172022-02-17 13:44:15 +08006376}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006377#endif /* MBEDTLS_MD_C && ( MBEDTLS_MD_CAN_SHA256 || MBEDTLS_MD_CAN_SHA384 ) */
Jerry Yudc7bd172022-02-17 13:44:15 +08006378#endif /* MBEDTLS_USE_PSA_CRYPTO */
6379
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006380#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006381MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006382static int tls_prf_sha256(const unsigned char *secret, size_t slen,
6383 const char *label,
6384 const unsigned char *random, size_t rlen,
6385 unsigned char *dstbuf, size_t dlen)
Jerry Yudc7bd172022-02-17 13:44:15 +08006386{
Gilles Peskine449bd832023-01-11 14:50:10 +01006387 return tls_prf_generic(MBEDTLS_MD_SHA256, secret, slen,
6388 label, random, rlen, dstbuf, dlen);
Jerry Yudc7bd172022-02-17 13:44:15 +08006389}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006390#endif /* MBEDTLS_MD_CAN_SHA256*/
Jerry Yudc7bd172022-02-17 13:44:15 +08006391
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006392#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006393MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006394static int tls_prf_sha384(const unsigned char *secret, size_t slen,
6395 const char *label,
6396 const unsigned char *random, size_t rlen,
6397 unsigned char *dstbuf, size_t dlen)
Jerry Yudc7bd172022-02-17 13:44:15 +08006398{
Gilles Peskine449bd832023-01-11 14:50:10 +01006399 return tls_prf_generic(MBEDTLS_MD_SHA384, secret, slen,
6400 label, random, rlen, dstbuf, dlen);
Jerry Yudc7bd172022-02-17 13:44:15 +08006401}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006402#endif /* MBEDTLS_MD_CAN_SHA384*/
Jerry Yudc7bd172022-02-17 13:44:15 +08006403
Jerry Yuf009d862022-02-17 14:01:37 +08006404/*
6405 * Set appropriate PRF function and other SSL / TLS1.2 functions
6406 *
6407 * Inputs:
Jerry Yuf009d862022-02-17 14:01:37 +08006408 * - hash associated with the ciphersuite (only used by TLS 1.2)
6409 *
6410 * Outputs:
6411 * - the tls_prf, calc_verify and calc_finished members of handshake structure
6412 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006413MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006414static int ssl_set_handshake_prfs(mbedtls_ssl_handshake_params *handshake,
6415 mbedtls_md_type_t hash)
Jerry Yuf009d862022-02-17 14:01:37 +08006416{
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006417#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +01006418 if (hash == MBEDTLS_MD_SHA384) {
Jerry Yuf009d862022-02-17 14:01:37 +08006419 handshake->tls_prf = tls_prf_sha384;
6420 handshake->calc_verify = ssl_calc_verify_tls_sha384;
6421 handshake->calc_finished = ssl_calc_finished_tls_sha384;
Gilles Peskine449bd832023-01-11 14:50:10 +01006422 } else
Jerry Yuf009d862022-02-17 14:01:37 +08006423#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006424#if defined(MBEDTLS_MD_CAN_SHA256)
Jerry Yuf009d862022-02-17 14:01:37 +08006425 {
Ronald Cron81591aa2022-03-07 09:05:51 +01006426 (void) hash;
Jerry Yuf009d862022-02-17 14:01:37 +08006427 handshake->tls_prf = tls_prf_sha256;
6428 handshake->calc_verify = ssl_calc_verify_tls_sha256;
6429 handshake->calc_finished = ssl_calc_finished_tls_sha256;
6430 }
Ronald Cron81591aa2022-03-07 09:05:51 +01006431#else
Jerry Yuf009d862022-02-17 14:01:37 +08006432 {
Jerry Yuf009d862022-02-17 14:01:37 +08006433 (void) handshake;
Ronald Cron81591aa2022-03-07 09:05:51 +01006434 (void) hash;
Gilles Peskine449bd832023-01-11 14:50:10 +01006435 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yuf009d862022-02-17 14:01:37 +08006436 }
Ronald Cron81591aa2022-03-07 09:05:51 +01006437#endif
Jerry Yuf009d862022-02-17 14:01:37 +08006438
Gilles Peskine449bd832023-01-11 14:50:10 +01006439 return 0;
Jerry Yuf009d862022-02-17 14:01:37 +08006440}
Jerry Yud6ab2352022-02-17 14:03:43 +08006441
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006442/*
6443 * Compute master secret if needed
6444 *
6445 * Parameters:
6446 * [in/out] handshake
6447 * [in] resume, premaster, extended_ms, calc_verify, tls_prf
6448 * (PSA-PSK) ciphersuite_info, psk_opaque
6449 * [out] premaster (cleared)
6450 * [out] master
6451 * [in] ssl: optionally used for debugging, EMS and PSA-PSK
6452 * debug: conf->f_dbg, conf->p_dbg
6453 * EMS: passed to calc_verify (debug + session_negotiate)
Ronald Crona25cf582022-03-07 11:10:36 +01006454 * PSA-PSA: conf
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006455 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006456MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006457static int ssl_compute_master(mbedtls_ssl_handshake_params *handshake,
6458 unsigned char *master,
6459 const mbedtls_ssl_context *ssl)
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006460{
6461 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6462
6463 /* cf. RFC 5246, Section 8.1:
6464 * "The master secret is always exactly 48 bytes in length." */
6465 size_t const master_secret_len = 48;
6466
6467#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
6468 unsigned char session_hash[48];
6469#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
6470
6471 /* The label for the KDF used for key expansion.
6472 * This is either "master secret" or "extended master secret"
6473 * depending on whether the Extended Master Secret extension
6474 * is used. */
6475 char const *lbl = "master secret";
6476
Przemek Stekielae4ed302022-04-05 17:15:55 +02006477 /* The seed for the KDF used for key expansion.
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006478 * - If the Extended Master Secret extension is not used,
6479 * this is ClientHello.Random + ServerHello.Random
6480 * (see Sect. 8.1 in RFC 5246).
6481 * - If the Extended Master Secret extension is used,
6482 * this is the transcript of the handshake so far.
6483 * (see Sect. 4 in RFC 7627). */
Przemek Stekielae4ed302022-04-05 17:15:55 +02006484 unsigned char const *seed = handshake->randbytes;
6485 size_t seed_len = 64;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006486
6487#if !defined(MBEDTLS_DEBUG_C) && \
6488 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
6489 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01006490 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED))
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006491 ssl = NULL; /* make sure we don't use it except for those cases */
6492 (void) ssl;
6493#endif
6494
Gilles Peskine449bd832023-01-11 14:50:10 +01006495 if (handshake->resume != 0) {
6496 MBEDTLS_SSL_DEBUG_MSG(3, ("no premaster (session resumed)"));
6497 return 0;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006498 }
6499
6500#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Gilles Peskine449bd832023-01-11 14:50:10 +01006501 if (handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED) {
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006502 lbl = "extended master secret";
Przemek Stekielae4ed302022-04-05 17:15:55 +02006503 seed = session_hash;
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01006504 ret = handshake->calc_verify(ssl, session_hash, &seed_len);
6505 if (ret != 0) {
6506 MBEDTLS_SSL_DEBUG_RET(1, "calc_verify", ret);
6507 }
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006508
Gilles Peskine449bd832023-01-11 14:50:10 +01006509 MBEDTLS_SSL_DEBUG_BUF(3, "session hash for extended master secret",
6510 session_hash, seed_len);
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006511 }
Przemek Stekiel169bf0b2022-04-29 07:53:29 +02006512#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006513
Przemek Stekiel99114f32022-04-22 11:20:09 +02006514#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
Przemek Stekiel8a4b7fd2022-04-28 09:22:22 +02006515 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006516 if (mbedtls_ssl_ciphersuite_uses_psk(handshake->ciphersuite_info) == 1) {
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006517 /* Perform PSK-to-MS expansion in a single step. */
6518 psa_status_t status;
6519 psa_algorithm_t alg;
6520 mbedtls_svc_key_id_t psk;
6521 psa_key_derivation_operation_t derivation =
6522 PSA_KEY_DERIVATION_OPERATION_INIT;
Dave Rodgman2eab4622023-10-05 13:30:37 +01006523 mbedtls_md_type_t hash_alg = (mbedtls_md_type_t) handshake->ciphersuite_info->mac;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006524
Gilles Peskine449bd832023-01-11 14:50:10 +01006525 MBEDTLS_SSL_DEBUG_MSG(2, ("perform PSA-based PSK-to-MS expansion"));
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006526
Gilles Peskine449bd832023-01-11 14:50:10 +01006527 psk = mbedtls_ssl_get_opaque_psk(ssl);
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006528
Gilles Peskine449bd832023-01-11 14:50:10 +01006529 if (hash_alg == MBEDTLS_MD_SHA384) {
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006530 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384);
Gilles Peskine449bd832023-01-11 14:50:10 +01006531 } else {
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006532 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256);
Gilles Peskine449bd832023-01-11 14:50:10 +01006533 }
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006534
Przemek Stekiel51a1f362022-04-13 08:57:06 +02006535 size_t other_secret_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006536 unsigned char *other_secret = NULL;
Przemek Stekielc2033402022-04-05 17:19:41 +02006537
Gilles Peskine449bd832023-01-11 14:50:10 +01006538 switch (handshake->ciphersuite_info->key_exchange) {
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006539 /* Provide other secret.
Przemek Stekiel51a1f362022-04-13 08:57:06 +02006540 * Other secret is stored in premaster, where first 2 bytes hold the
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006541 * length of the other key.
Przemek Stekielc2033402022-04-05 17:19:41 +02006542 */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006543 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Przemek Stekiel8abcee92022-04-28 09:16:28 +02006544 /* For RSA-PSK other key length is always 48 bytes. */
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006545 other_secret_len = 48;
6546 other_secret = handshake->premaster + 2;
6547 break;
6548 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006549 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
Przemek Stekiel19b80f82022-04-14 08:29:31 +02006550 other_secret_len = MBEDTLS_GET_UINT16_BE(handshake->premaster, 0);
6551 other_secret = handshake->premaster + 2;
6552 break;
6553 default:
6554 break;
Przemek Stekielc2033402022-04-05 17:19:41 +02006555 }
6556
Gilles Peskine449bd832023-01-11 14:50:10 +01006557 status = setup_psa_key_derivation(&derivation, psk, alg,
6558 ssl->conf->psk, ssl->conf->psk_len,
6559 seed, seed_len,
6560 (unsigned char const *) lbl,
6561 (size_t) strlen(lbl),
6562 other_secret, other_secret_len,
6563 master_secret_len);
6564 if (status != PSA_SUCCESS) {
6565 psa_key_derivation_abort(&derivation);
6566 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006567 }
6568
Gilles Peskine449bd832023-01-11 14:50:10 +01006569 status = psa_key_derivation_output_bytes(&derivation,
6570 master,
6571 master_secret_len);
6572 if (status != PSA_SUCCESS) {
6573 psa_key_derivation_abort(&derivation);
6574 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006575 }
6576
Gilles Peskine449bd832023-01-11 14:50:10 +01006577 status = psa_key_derivation_abort(&derivation);
6578 if (status != PSA_SUCCESS) {
6579 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
6580 }
6581 } else
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006582#endif
6583 {
Neil Armstrongca7d5062022-05-31 14:43:23 +02006584#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
Gilles Peskine449bd832023-01-11 14:50:10 +01006585 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
6586 if (handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) {
Neil Armstrongca7d5062022-05-31 14:43:23 +02006587 psa_status_t status;
6588 psa_algorithm_t alg = PSA_ALG_TLS12_ECJPAKE_TO_PMS;
6589 psa_key_derivation_operation_t derivation =
6590 PSA_KEY_DERIVATION_OPERATION_INIT;
6591
Gilles Peskine449bd832023-01-11 14:50:10 +01006592 MBEDTLS_SSL_DEBUG_MSG(2, ("perform PSA-based PMS KDF for ECJPAKE"));
Neil Armstrongca7d5062022-05-31 14:43:23 +02006593
6594 handshake->pmslen = PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE;
6595
Gilles Peskine449bd832023-01-11 14:50:10 +01006596 status = psa_key_derivation_setup(&derivation, alg);
6597 if (status != PSA_SUCCESS) {
6598 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Neil Armstrongca7d5062022-05-31 14:43:23 +02006599 }
6600
Gilles Peskine449bd832023-01-11 14:50:10 +01006601 status = psa_key_derivation_set_capacity(&derivation,
6602 PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE);
6603 if (status != PSA_SUCCESS) {
6604 psa_key_derivation_abort(&derivation);
6605 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Neil Armstrongca7d5062022-05-31 14:43:23 +02006606 }
6607
Gilles Peskine449bd832023-01-11 14:50:10 +01006608 status = psa_pake_get_implicit_key(&handshake->psa_pake_ctx,
6609 &derivation);
6610 if (status != PSA_SUCCESS) {
6611 psa_key_derivation_abort(&derivation);
6612 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Neil Armstrongca7d5062022-05-31 14:43:23 +02006613 }
6614
Gilles Peskine449bd832023-01-11 14:50:10 +01006615 status = psa_key_derivation_output_bytes(&derivation,
6616 handshake->premaster,
6617 handshake->pmslen);
6618 if (status != PSA_SUCCESS) {
6619 psa_key_derivation_abort(&derivation);
6620 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
6621 }
6622
6623 status = psa_key_derivation_abort(&derivation);
6624 if (status != PSA_SUCCESS) {
6625 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
Neil Armstrongca7d5062022-05-31 14:43:23 +02006626 }
6627 }
6628#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01006629 ret = handshake->tls_prf(handshake->premaster, handshake->pmslen,
6630 lbl, seed, seed_len,
6631 master,
6632 master_secret_len);
6633 if (ret != 0) {
6634 MBEDTLS_SSL_DEBUG_RET(1, "prf", ret);
6635 return ret;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006636 }
6637
Gilles Peskine449bd832023-01-11 14:50:10 +01006638 MBEDTLS_SSL_DEBUG_BUF(3, "premaster secret",
6639 handshake->premaster,
6640 handshake->pmslen);
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006641
Gilles Peskine449bd832023-01-11 14:50:10 +01006642 mbedtls_platform_zeroize(handshake->premaster,
6643 sizeof(handshake->premaster));
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006644 }
6645
Gilles Peskine449bd832023-01-11 14:50:10 +01006646 return 0;
Jerry Yu2a7b5ac2022-02-17 14:07:00 +08006647}
6648
Gilles Peskine449bd832023-01-11 14:50:10 +01006649int mbedtls_ssl_derive_keys(mbedtls_ssl_context *ssl)
Jerry Yud62f87e2022-02-17 14:09:02 +08006650{
6651 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6652 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
6653 ssl->handshake->ciphersuite_info;
6654
Gilles Peskine449bd832023-01-11 14:50:10 +01006655 MBEDTLS_SSL_DEBUG_MSG(2, ("=> derive keys"));
Jerry Yud62f87e2022-02-17 14:09:02 +08006656
6657 /* Set PRF, calc_verify and calc_finished function pointers */
Gilles Peskine449bd832023-01-11 14:50:10 +01006658 ret = ssl_set_handshake_prfs(ssl->handshake,
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01006659 (mbedtls_md_type_t) ciphersuite_info->mac);
Gilles Peskine449bd832023-01-11 14:50:10 +01006660 if (ret != 0) {
6661 MBEDTLS_SSL_DEBUG_RET(1, "ssl_set_handshake_prfs", ret);
6662 return ret;
Jerry Yud62f87e2022-02-17 14:09:02 +08006663 }
6664
6665 /* Compute master secret if needed */
Gilles Peskine449bd832023-01-11 14:50:10 +01006666 ret = ssl_compute_master(ssl->handshake,
6667 ssl->session_negotiate->master,
6668 ssl);
6669 if (ret != 0) {
6670 MBEDTLS_SSL_DEBUG_RET(1, "ssl_compute_master", ret);
6671 return ret;
Jerry Yud62f87e2022-02-17 14:09:02 +08006672 }
6673
6674 /* Swap the client and server random values:
6675 * - MS derivation wanted client+server (RFC 5246 8.1)
6676 * - key derivation wants server+client (RFC 5246 6.3) */
6677 {
6678 unsigned char tmp[64];
Gilles Peskine449bd832023-01-11 14:50:10 +01006679 memcpy(tmp, ssl->handshake->randbytes, 64);
6680 memcpy(ssl->handshake->randbytes, tmp + 32, 32);
6681 memcpy(ssl->handshake->randbytes + 32, tmp, 32);
6682 mbedtls_platform_zeroize(tmp, sizeof(tmp));
Jerry Yud62f87e2022-02-17 14:09:02 +08006683 }
6684
6685 /* Populate transform structure */
Gilles Peskine449bd832023-01-11 14:50:10 +01006686 ret = ssl_tls12_populate_transform(ssl->transform_negotiate,
6687 ssl->session_negotiate->ciphersuite,
6688 ssl->session_negotiate->master,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02006689#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01006690 ssl->session_negotiate->encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02006691#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01006692 ssl->handshake->tls_prf,
6693 ssl->handshake->randbytes,
6694 ssl->tls_version,
6695 ssl->conf->endpoint,
6696 ssl);
6697 if (ret != 0) {
6698 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls12_populate_transform", ret);
6699 return ret;
Jerry Yud62f87e2022-02-17 14:09:02 +08006700 }
6701
6702 /* We no longer need Server/ClientHello.random values */
Gilles Peskine449bd832023-01-11 14:50:10 +01006703 mbedtls_platform_zeroize(ssl->handshake->randbytes,
6704 sizeof(ssl->handshake->randbytes));
Jerry Yud62f87e2022-02-17 14:09:02 +08006705
Gilles Peskine449bd832023-01-11 14:50:10 +01006706 MBEDTLS_SSL_DEBUG_MSG(2, ("<= derive keys"));
Jerry Yud62f87e2022-02-17 14:09:02 +08006707
Gilles Peskine449bd832023-01-11 14:50:10 +01006708 return 0;
Jerry Yud62f87e2022-02-17 14:09:02 +08006709}
Jerry Yu8392e0d2022-02-17 14:10:24 +08006710
Gilles Peskine449bd832023-01-11 14:50:10 +01006711int mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context *ssl, int md)
Ronald Cron4dcbca92022-03-07 10:21:40 +01006712{
Gilles Peskine449bd832023-01-11 14:50:10 +01006713 switch (md) {
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006714#if defined(MBEDTLS_MD_CAN_SHA384)
Ronald Cron4dcbca92022-03-07 10:21:40 +01006715 case MBEDTLS_SSL_HASH_SHA384:
6716 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
6717 break;
6718#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006719#if defined(MBEDTLS_MD_CAN_SHA256)
Ronald Cron4dcbca92022-03-07 10:21:40 +01006720 case MBEDTLS_SSL_HASH_SHA256:
6721 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
6722 break;
6723#endif
6724 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006725 return -1;
Ronald Cron4dcbca92022-03-07 10:21:40 +01006726 }
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006727#if !defined(MBEDTLS_MD_CAN_SHA384) && \
6728 !defined(MBEDTLS_MD_CAN_SHA256)
Andrzej Kurekeabeb302022-10-17 07:52:51 -04006729 (void) ssl;
6730#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01006731 return 0;
Ronald Cron4dcbca92022-03-07 10:21:40 +01006732}
6733
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006734#if defined(MBEDTLS_USE_PSA_CRYPTO)
6735static int ssl_calc_verify_tls_psa(const mbedtls_ssl_context *ssl,
6736 const psa_hash_operation_t *hs_op,
6737 size_t buffer_size,
6738 unsigned char *hash,
6739 size_t *hlen)
6740{
6741 psa_status_t status;
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02006742 psa_hash_operation_t cloned_op = psa_hash_operation_init();
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006743
6744#if !defined(MBEDTLS_DEBUG_C)
6745 (void) ssl;
6746#endif
6747 MBEDTLS_SSL_DEBUG_MSG(2, ("=> PSA calc verify"));
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02006748 status = psa_hash_clone(hs_op, &cloned_op);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006749 if (status != PSA_SUCCESS) {
6750 goto exit;
6751 }
6752
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02006753 status = psa_hash_finish(&cloned_op, hash, buffer_size, hlen);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006754 if (status != PSA_SUCCESS) {
6755 goto exit;
6756 }
6757
6758 MBEDTLS_SSL_DEBUG_BUF(3, "PSA calculated verify result", hash, *hlen);
6759 MBEDTLS_SSL_DEBUG_MSG(2, ("<= PSA calc verify"));
6760
6761exit:
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02006762 psa_hash_abort(&cloned_op);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006763 return mbedtls_md_error_from_psa(status);
6764}
6765#else
6766static int ssl_calc_verify_tls_legacy(const mbedtls_ssl_context *ssl,
6767 const mbedtls_md_context_t *hs_ctx,
6768 unsigned char *hash,
6769 size_t *hlen)
6770{
6771 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02006772 mbedtls_md_context_t cloned_ctx;
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006773
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02006774 mbedtls_md_init(&cloned_ctx);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006775
6776#if !defined(MBEDTLS_DEBUG_C)
6777 (void) ssl;
6778#endif
6779 MBEDTLS_SSL_DEBUG_MSG(2, ("=> calc verify"));
6780
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02006781 ret = mbedtls_md_setup(&cloned_ctx, mbedtls_md_info_from_ctx(hs_ctx), 0);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006782 if (ret != 0) {
6783 goto exit;
6784 }
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02006785 ret = mbedtls_md_clone(&cloned_ctx, hs_ctx);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006786 if (ret != 0) {
6787 goto exit;
6788 }
6789
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02006790 ret = mbedtls_md_finish(&cloned_ctx, hash);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006791 if (ret != 0) {
6792 goto exit;
6793 }
6794
6795 *hlen = mbedtls_md_get_size(mbedtls_md_info_from_ctx(hs_ctx));
6796
6797 MBEDTLS_SSL_DEBUG_BUF(3, "calculated verify result", hash, *hlen);
6798 MBEDTLS_SSL_DEBUG_MSG(2, ("<= calc verify"));
6799
6800exit:
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02006801 mbedtls_md_free(&cloned_ctx);
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006802 return ret;
6803}
6804#endif /* MBEDTLS_USE_PSA_CRYPTO */
6805
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006806#if defined(MBEDTLS_MD_CAN_SHA256)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +01006807int ssl_calc_verify_tls_sha256(const mbedtls_ssl_context *ssl,
6808 unsigned char *hash,
6809 size_t *hlen)
Jerry Yu8392e0d2022-02-17 14:10:24 +08006810{
6811#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006812 return ssl_calc_verify_tls_psa(ssl, &ssl->handshake->fin_sha256_psa, 32,
6813 hash, hlen);
Jerry Yu8392e0d2022-02-17 14:10:24 +08006814#else
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006815 return ssl_calc_verify_tls_legacy(ssl, &ssl->handshake->fin_sha256,
6816 hash, hlen);
Jerry Yu8392e0d2022-02-17 14:10:24 +08006817#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu8392e0d2022-02-17 14:10:24 +08006818}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006819#endif /* MBEDTLS_MD_CAN_SHA256 */
Jerry Yu8392e0d2022-02-17 14:10:24 +08006820
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006821#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +01006822int ssl_calc_verify_tls_sha384(const mbedtls_ssl_context *ssl,
6823 unsigned char *hash,
6824 size_t *hlen)
Jerry Yuc1cb3842022-02-17 14:13:48 +08006825{
6826#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006827 return ssl_calc_verify_tls_psa(ssl, &ssl->handshake->fin_sha384_psa, 48,
6828 hash, hlen);
Jerry Yuc1cb3842022-02-17 14:13:48 +08006829#else
Manuel Pégourié-Gonnard74970662023-06-24 09:43:26 +02006830 return ssl_calc_verify_tls_legacy(ssl, &ssl->handshake->fin_sha384,
6831 hash, hlen);
Jerry Yuc1cb3842022-02-17 14:13:48 +08006832#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yuc1cb3842022-02-17 14:13:48 +08006833}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01006834#endif /* MBEDTLS_MD_CAN_SHA384 */
Jerry Yuc1cb3842022-02-17 14:13:48 +08006835
Neil Armstrong80f6f322022-05-03 17:56:38 +02006836#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
6837 defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006838int mbedtls_ssl_psk_derive_premaster(mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex)
Jerry Yuce3dca42022-02-17 14:16:37 +08006839{
6840 unsigned char *p = ssl->handshake->premaster;
Gilles Peskine449bd832023-01-11 14:50:10 +01006841 unsigned char *end = p + sizeof(ssl->handshake->premaster);
Jerry Yuce3dca42022-02-17 14:16:37 +08006842 const unsigned char *psk = NULL;
6843 size_t psk_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006844 int psk_ret = mbedtls_ssl_get_psk(ssl, &psk, &psk_len);
Jerry Yuce3dca42022-02-17 14:16:37 +08006845
Gilles Peskine449bd832023-01-11 14:50:10 +01006846 if (psk_ret == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED) {
Jerry Yuce3dca42022-02-17 14:16:37 +08006847 /*
6848 * This should never happen because the existence of a PSK is always
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006849 * checked before calling this function.
6850 *
6851 * The exception is opaque DHE-PSK. For DHE-PSK fill premaster with
Przemek Stekiel8abcee92022-04-28 09:16:28 +02006852 * the shared secret without PSK.
Jerry Yuce3dca42022-02-17 14:16:37 +08006853 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006854 if (key_ex != MBEDTLS_KEY_EXCHANGE_DHE_PSK) {
6855 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
6856 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Przemek Stekielb293aaa2022-04-19 12:22:38 +02006857 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006858 }
6859
6860 /*
6861 * PMS = struct {
6862 * opaque other_secret<0..2^16-1>;
6863 * opaque psk<0..2^16-1>;
6864 * };
6865 * with "other_secret" depending on the particular key exchange
6866 */
6867#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006868 if (key_ex == MBEDTLS_KEY_EXCHANGE_PSK) {
6869 if (end - p < 2) {
6870 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
6871 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006872
Gilles Peskine449bd832023-01-11 14:50:10 +01006873 MBEDTLS_PUT_UINT16_BE(psk_len, p, 0);
Jerry Yuce3dca42022-02-17 14:16:37 +08006874 p += 2;
6875
Gilles Peskine449bd832023-01-11 14:50:10 +01006876 if (end < p || (size_t) (end - p) < psk_len) {
6877 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
6878 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006879
Gilles Peskine449bd832023-01-11 14:50:10 +01006880 memset(p, 0, psk_len);
Jerry Yuce3dca42022-02-17 14:16:37 +08006881 p += psk_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01006882 } else
Jerry Yuce3dca42022-02-17 14:16:37 +08006883#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
6884#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006885 if (key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK) {
Jerry Yuce3dca42022-02-17 14:16:37 +08006886 /*
6887 * other_secret already set by the ClientKeyExchange message,
6888 * and is 48 bytes long
6889 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006890 if (end - p < 2) {
6891 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
6892 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006893
6894 *p++ = 0;
6895 *p++ = 48;
6896 p += 48;
Gilles Peskine449bd832023-01-11 14:50:10 +01006897 } else
Jerry Yuce3dca42022-02-17 14:16:37 +08006898#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
6899#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006900 if (key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK) {
Jerry Yuce3dca42022-02-17 14:16:37 +08006901 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6902 size_t len;
6903
6904 /* Write length only when we know the actual value */
Gilles Peskine449bd832023-01-11 14:50:10 +01006905 if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx,
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00006906 p + 2, (size_t) (end - (p + 2)), &len,
Gilles Peskine449bd832023-01-11 14:50:10 +01006907 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
6908 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_calc_secret", ret);
6909 return ret;
Jerry Yuce3dca42022-02-17 14:16:37 +08006910 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006911 MBEDTLS_PUT_UINT16_BE(len, p, 0);
Jerry Yuce3dca42022-02-17 14:16:37 +08006912 p += 2 + len;
6913
Gilles Peskine449bd832023-01-11 14:50:10 +01006914 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: K ", &ssl->handshake->dhm_ctx.K);
6915 } else
Jerry Yuce3dca42022-02-17 14:16:37 +08006916#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Neil Armstrong80f6f322022-05-03 17:56:38 +02006917#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01006918 if (key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) {
Jerry Yuce3dca42022-02-17 14:16:37 +08006919 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
6920 size_t zlen;
6921
Gilles Peskine449bd832023-01-11 14:50:10 +01006922 if ((ret = mbedtls_ecdh_calc_secret(&ssl->handshake->ecdh_ctx, &zlen,
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00006923 p + 2, (size_t) (end - (p + 2)),
Gilles Peskine449bd832023-01-11 14:50:10 +01006924 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
6925 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_calc_secret", ret);
6926 return ret;
Jerry Yuce3dca42022-02-17 14:16:37 +08006927 }
6928
Gilles Peskine449bd832023-01-11 14:50:10 +01006929 MBEDTLS_PUT_UINT16_BE(zlen, p, 0);
Jerry Yuce3dca42022-02-17 14:16:37 +08006930 p += 2 + zlen;
6931
Gilles Peskine449bd832023-01-11 14:50:10 +01006932 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx,
6933 MBEDTLS_DEBUG_ECDH_Z);
6934 } else
Neil Armstrong80f6f322022-05-03 17:56:38 +02006935#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Jerry Yuce3dca42022-02-17 14:16:37 +08006936 {
Gilles Peskine449bd832023-01-11 14:50:10 +01006937 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
6938 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yuce3dca42022-02-17 14:16:37 +08006939 }
6940
6941 /* opaque psk<0..2^16-1>; */
Gilles Peskine449bd832023-01-11 14:50:10 +01006942 if (end - p < 2) {
6943 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
6944 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006945
Gilles Peskine449bd832023-01-11 14:50:10 +01006946 MBEDTLS_PUT_UINT16_BE(psk_len, p, 0);
Jerry Yuce3dca42022-02-17 14:16:37 +08006947 p += 2;
6948
Gilles Peskine449bd832023-01-11 14:50:10 +01006949 if (end < p || (size_t) (end - p) < psk_len) {
6950 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
6951 }
Jerry Yuce3dca42022-02-17 14:16:37 +08006952
Gilles Peskine449bd832023-01-11 14:50:10 +01006953 memcpy(p, psk, psk_len);
Jerry Yuce3dca42022-02-17 14:16:37 +08006954 p += psk_len;
6955
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00006956 ssl->handshake->pmslen = (size_t) (p - ssl->handshake->premaster);
Jerry Yuce3dca42022-02-17 14:16:37 +08006957
Gilles Peskine449bd832023-01-11 14:50:10 +01006958 return 0;
Jerry Yuce3dca42022-02-17 14:16:37 +08006959}
Neil Armstrong80f6f322022-05-03 17:56:38 +02006960#endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Jerry Yuc2c673d2022-02-17 14:20:39 +08006961
6962#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02006963MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01006964static int ssl_write_hello_request(mbedtls_ssl_context *ssl);
Jerry Yuc2c673d2022-02-17 14:20:39 +08006965
6966#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006967int mbedtls_ssl_resend_hello_request(mbedtls_ssl_context *ssl)
Jerry Yuc2c673d2022-02-17 14:20:39 +08006968{
6969 /* If renegotiation is not enforced, retransmit until we would reach max
6970 * timeout if we were using the usual handshake doubling scheme */
Gilles Peskine449bd832023-01-11 14:50:10 +01006971 if (ssl->conf->renego_max_records < 0) {
Jerry Yuc2c673d2022-02-17 14:20:39 +08006972 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
6973 unsigned char doublings = 1;
6974
Gilles Peskine449bd832023-01-11 14:50:10 +01006975 while (ratio != 0) {
Jerry Yuc2c673d2022-02-17 14:20:39 +08006976 ++doublings;
6977 ratio >>= 1;
6978 }
6979
Gilles Peskine449bd832023-01-11 14:50:10 +01006980 if (++ssl->renego_records_seen > doublings) {
6981 MBEDTLS_SSL_DEBUG_MSG(2, ("no longer retransmitting hello request"));
6982 return 0;
Jerry Yuc2c673d2022-02-17 14:20:39 +08006983 }
6984 }
6985
Gilles Peskine449bd832023-01-11 14:50:10 +01006986 return ssl_write_hello_request(ssl);
Jerry Yuc2c673d2022-02-17 14:20:39 +08006987}
6988#endif
6989#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Jerry Yud9526692022-02-17 14:23:47 +08006990
Jerry Yud9526692022-02-17 14:23:47 +08006991/*
6992 * Handshake functions
6993 */
6994#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
6995/* No certificate support -> dummy functions */
Gilles Peskine449bd832023-01-11 14:50:10 +01006996int mbedtls_ssl_write_certificate(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08006997{
6998 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
6999 ssl->handshake->ciphersuite_info;
7000
Gilles Peskine449bd832023-01-11 14:50:10 +01007001 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007002
Gilles Peskine449bd832023-01-11 14:50:10 +01007003 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
7004 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007005 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01007006 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007007 }
7008
Gilles Peskine449bd832023-01-11 14:50:10 +01007009 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
7010 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007011}
7012
Gilles Peskine449bd832023-01-11 14:50:10 +01007013int mbedtls_ssl_parse_certificate(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08007014{
7015 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7016 ssl->handshake->ciphersuite_info;
7017
Gilles Peskine449bd832023-01-11 14:50:10 +01007018 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007019
Gilles Peskine449bd832023-01-11 14:50:10 +01007020 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
7021 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007022 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01007023 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007024 }
7025
Gilles Peskine449bd832023-01-11 14:50:10 +01007026 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
7027 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007028}
7029
7030#else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7031/* Some certificate support -> implement write and parse */
7032
Gilles Peskine449bd832023-01-11 14:50:10 +01007033int mbedtls_ssl_write_certificate(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08007034{
7035 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
7036 size_t i, n;
7037 const mbedtls_x509_crt *crt;
7038 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7039 ssl->handshake->ciphersuite_info;
7040
Gilles Peskine449bd832023-01-11 14:50:10 +01007041 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007042
Gilles Peskine449bd832023-01-11 14:50:10 +01007043 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
7044 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007045 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01007046 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007047 }
7048
7049#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007050 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
7051 if (ssl->handshake->client_auth == 0) {
7052 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007053 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01007054 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007055 }
7056 }
7057#endif /* MBEDTLS_SSL_CLI_C */
7058#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007059 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
7060 if (mbedtls_ssl_own_cert(ssl) == NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007061 /* Should never happen because we shouldn't have picked the
7062 * ciphersuite if we don't have a certificate. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007063 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007064 }
7065 }
7066#endif
7067
Gilles Peskine449bd832023-01-11 14:50:10 +01007068 MBEDTLS_SSL_DEBUG_CRT(3, "own certificate", mbedtls_ssl_own_cert(ssl));
Jerry Yud9526692022-02-17 14:23:47 +08007069
7070 /*
7071 * 0 . 0 handshake type
7072 * 1 . 3 handshake length
7073 * 4 . 6 length of all certs
7074 * 7 . 9 length of cert. 1
7075 * 10 . n-1 peer certificate
7076 * n . n+2 length of cert. 2
7077 * n+3 . ... upper level cert, etc.
7078 */
7079 i = 7;
Gilles Peskine449bd832023-01-11 14:50:10 +01007080 crt = mbedtls_ssl_own_cert(ssl);
Jerry Yud9526692022-02-17 14:23:47 +08007081
Gilles Peskine449bd832023-01-11 14:50:10 +01007082 while (crt != NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007083 n = crt->raw.len;
Gilles Peskine449bd832023-01-11 14:50:10 +01007084 if (n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i) {
7085 MBEDTLS_SSL_DEBUG_MSG(1, ("certificate too large, %" MBEDTLS_PRINTF_SIZET
7086 " > %" MBEDTLS_PRINTF_SIZET,
7087 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN));
7088 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
Jerry Yud9526692022-02-17 14:23:47 +08007089 }
7090
Gilles Peskine449bd832023-01-11 14:50:10 +01007091 ssl->out_msg[i] = MBEDTLS_BYTE_2(n);
7092 ssl->out_msg[i + 1] = MBEDTLS_BYTE_1(n);
7093 ssl->out_msg[i + 2] = MBEDTLS_BYTE_0(n);
Jerry Yud9526692022-02-17 14:23:47 +08007094
Gilles Peskine449bd832023-01-11 14:50:10 +01007095 i += 3; memcpy(ssl->out_msg + i, crt->raw.p, n);
Jerry Yud9526692022-02-17 14:23:47 +08007096 i += n; crt = crt->next;
7097 }
7098
Gilles Peskine449bd832023-01-11 14:50:10 +01007099 ssl->out_msg[4] = MBEDTLS_BYTE_2(i - 7);
7100 ssl->out_msg[5] = MBEDTLS_BYTE_1(i - 7);
7101 ssl->out_msg[6] = MBEDTLS_BYTE_0(i - 7);
Jerry Yud9526692022-02-17 14:23:47 +08007102
7103 ssl->out_msglen = i;
7104 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
7105 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
7106
7107 ssl->state++;
7108
Gilles Peskine449bd832023-01-11 14:50:10 +01007109 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
7110 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
7111 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007112 }
7113
Gilles Peskine449bd832023-01-11 14:50:10 +01007114 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007115
Gilles Peskine449bd832023-01-11 14:50:10 +01007116 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007117}
7118
7119#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
7120
7121#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007122MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007123static int ssl_check_peer_crt_unchanged(mbedtls_ssl_context *ssl,
7124 unsigned char *crt_buf,
7125 size_t crt_buf_len)
Jerry Yud9526692022-02-17 14:23:47 +08007126{
7127 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert;
7128
Gilles Peskine449bd832023-01-11 14:50:10 +01007129 if (peer_crt == NULL) {
7130 return -1;
7131 }
Jerry Yud9526692022-02-17 14:23:47 +08007132
Gilles Peskine449bd832023-01-11 14:50:10 +01007133 if (peer_crt->raw.len != crt_buf_len) {
7134 return -1;
7135 }
Jerry Yud9526692022-02-17 14:23:47 +08007136
Gilles Peskine449bd832023-01-11 14:50:10 +01007137 return memcmp(peer_crt->raw.p, crt_buf, peer_crt->raw.len);
Jerry Yud9526692022-02-17 14:23:47 +08007138}
7139#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007140MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007141static int ssl_check_peer_crt_unchanged(mbedtls_ssl_context *ssl,
7142 unsigned char *crt_buf,
7143 size_t crt_buf_len)
Jerry Yud9526692022-02-17 14:23:47 +08007144{
7145 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7146 unsigned char const * const peer_cert_digest =
7147 ssl->session->peer_cert_digest;
7148 mbedtls_md_type_t const peer_cert_digest_type =
7149 ssl->session->peer_cert_digest_type;
7150 mbedtls_md_info_t const * const digest_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01007151 mbedtls_md_info_from_type(peer_cert_digest_type);
Jerry Yud9526692022-02-17 14:23:47 +08007152 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN];
7153 size_t digest_len;
7154
Gilles Peskine449bd832023-01-11 14:50:10 +01007155 if (peer_cert_digest == NULL || digest_info == NULL) {
7156 return -1;
7157 }
Jerry Yud9526692022-02-17 14:23:47 +08007158
Gilles Peskine449bd832023-01-11 14:50:10 +01007159 digest_len = mbedtls_md_get_size(digest_info);
7160 if (digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN) {
7161 return -1;
7162 }
Jerry Yud9526692022-02-17 14:23:47 +08007163
Gilles Peskine449bd832023-01-11 14:50:10 +01007164 ret = mbedtls_md(digest_info, crt_buf, crt_buf_len, tmp_digest);
7165 if (ret != 0) {
7166 return -1;
7167 }
Jerry Yud9526692022-02-17 14:23:47 +08007168
Gilles Peskine449bd832023-01-11 14:50:10 +01007169 return memcmp(tmp_digest, peer_cert_digest, digest_len);
Jerry Yud9526692022-02-17 14:23:47 +08007170}
7171#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7172#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
7173
7174/*
7175 * Once the certificate message is read, parse it into a cert chain and
7176 * perform basic checks, but leave actual verification to the caller
7177 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007178MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007179static int ssl_parse_certificate_chain(mbedtls_ssl_context *ssl,
7180 mbedtls_x509_crt *chain)
Jerry Yud9526692022-02-17 14:23:47 +08007181{
7182 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7183#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007184 int crt_cnt = 0;
Jerry Yud9526692022-02-17 14:23:47 +08007185#endif
7186 size_t i, n;
7187 uint8_t alert;
7188
Gilles Peskine449bd832023-01-11 14:50:10 +01007189 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) {
7190 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7191 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7192 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE);
7193 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
Jerry Yud9526692022-02-17 14:23:47 +08007194 }
7195
Gilles Peskine449bd832023-01-11 14:50:10 +01007196 if (ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE) {
7197 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7198 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE);
7199 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
Jerry Yud9526692022-02-17 14:23:47 +08007200 }
7201
Gilles Peskine449bd832023-01-11 14:50:10 +01007202 if (ssl->in_hslen < mbedtls_ssl_hs_hdr_len(ssl) + 3 + 3) {
7203 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7204 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7205 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
7206 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007207 }
7208
Gilles Peskine449bd832023-01-11 14:50:10 +01007209 i = mbedtls_ssl_hs_hdr_len(ssl);
Jerry Yud9526692022-02-17 14:23:47 +08007210
7211 /*
7212 * Same message structure as in mbedtls_ssl_write_certificate()
7213 */
Dave Rodgmana3d0f612023-11-03 23:34:02 +00007214 n = MBEDTLS_GET_UINT16_BE(ssl->in_msg, i + 1);
Jerry Yud9526692022-02-17 14:23:47 +08007215
Gilles Peskine449bd832023-01-11 14:50:10 +01007216 if (ssl->in_msg[i] != 0 ||
7217 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len(ssl)) {
7218 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7219 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7220 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
7221 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007222 }
7223
7224 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */
7225 i += 3;
7226
7227 /* Iterate through and parse the CRTs in the provided chain. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007228 while (i < ssl->in_hslen) {
Jerry Yud9526692022-02-17 14:23:47 +08007229 /* Check that there's room for the next CRT's length fields. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007230 if (i + 3 > ssl->in_hslen) {
7231 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7232 mbedtls_ssl_send_alert_message(ssl,
7233 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7234 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
7235 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007236 }
7237 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support
7238 * anything beyond 2**16 ~ 64K. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007239 if (ssl->in_msg[i] != 0) {
7240 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7241 mbedtls_ssl_send_alert_message(ssl,
7242 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7243 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT);
7244 return MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Jerry Yud9526692022-02-17 14:23:47 +08007245 }
7246
7247 /* Read length of the next CRT in the chain. */
Dave Rodgmana3d0f612023-11-03 23:34:02 +00007248 n = MBEDTLS_GET_UINT16_BE(ssl->in_msg, i + 1);
Jerry Yud9526692022-02-17 14:23:47 +08007249 i += 3;
7250
Gilles Peskine449bd832023-01-11 14:50:10 +01007251 if (n < 128 || i + n > ssl->in_hslen) {
7252 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
7253 mbedtls_ssl_send_alert_message(ssl,
7254 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7255 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
7256 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007257 }
7258
7259 /* Check if we're handling the first CRT in the chain. */
7260#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007261 if (crt_cnt++ == 0 &&
Jerry Yud9526692022-02-17 14:23:47 +08007262 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
Gilles Peskine449bd832023-01-11 14:50:10 +01007263 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
Jerry Yud9526692022-02-17 14:23:47 +08007264 /* During client-side renegotiation, check that the server's
7265 * end-CRTs hasn't changed compared to the initial handshake,
7266 * mitigating the triple handshake attack. On success, reuse
7267 * the original end-CRT instead of parsing it again. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007268 MBEDTLS_SSL_DEBUG_MSG(3, ("Check that peer CRT hasn't changed during renegotiation"));
7269 if (ssl_check_peer_crt_unchanged(ssl,
7270 &ssl->in_msg[i],
7271 n) != 0) {
7272 MBEDTLS_SSL_DEBUG_MSG(1, ("new server cert during renegotiation"));
7273 mbedtls_ssl_send_alert_message(ssl,
7274 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7275 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED);
7276 return MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Jerry Yud9526692022-02-17 14:23:47 +08007277 }
7278
7279 /* Now we can safely free the original chain. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007280 ssl_clear_peer_cert(ssl->session);
Jerry Yud9526692022-02-17 14:23:47 +08007281 }
7282#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
7283
7284 /* Parse the next certificate in the chain. */
7285#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007286 ret = mbedtls_x509_crt_parse_der(chain, ssl->in_msg + i, n);
Jerry Yud9526692022-02-17 14:23:47 +08007287#else
7288 /* If we don't need to store the CRT chain permanently, parse
7289 * it in-place from the input buffer instead of making a copy. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007290 ret = mbedtls_x509_crt_parse_der_nocopy(chain, ssl->in_msg + i, n);
Jerry Yud9526692022-02-17 14:23:47 +08007291#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine449bd832023-01-11 14:50:10 +01007292 switch (ret) {
Jerry Yud9526692022-02-17 14:23:47 +08007293 case 0: /*ok*/
7294 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
7295 /* Ignore certificate with an unknown algorithm: maybe a
7296 prior certificate was already trusted. */
7297 break;
7298
7299 case MBEDTLS_ERR_X509_ALLOC_FAILED:
7300 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
7301 goto crt_parse_der_failed;
7302
7303 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
7304 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
7305 goto crt_parse_der_failed;
7306
7307 default:
7308 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007309crt_parse_der_failed:
7310 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert);
7311 MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret);
7312 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007313 }
7314
7315 i += n;
7316 }
7317
Gilles Peskine449bd832023-01-11 14:50:10 +01007318 MBEDTLS_SSL_DEBUG_CRT(3, "peer certificate", chain);
7319 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007320}
7321
7322#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007323MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007324static int ssl_srv_check_client_no_crt_notification(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08007325{
Gilles Peskine449bd832023-01-11 14:50:10 +01007326 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
7327 return -1;
7328 }
Jerry Yud9526692022-02-17 14:23:47 +08007329
Gilles Peskine449bd832023-01-11 14:50:10 +01007330 if (ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len(ssl) &&
Jerry Yud9526692022-02-17 14:23:47 +08007331 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
7332 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
Gilles Peskine449bd832023-01-11 14:50:10 +01007333 memcmp(ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl), "\0\0\0", 3) == 0) {
7334 MBEDTLS_SSL_DEBUG_MSG(1, ("peer has no certificate"));
7335 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007336 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007337 return -1;
Jerry Yud9526692022-02-17 14:23:47 +08007338}
7339#endif /* MBEDTLS_SSL_SRV_C */
7340
7341/* Check if a certificate message is expected.
7342 * Return either
7343 * - SSL_CERTIFICATE_EXPECTED, or
7344 * - SSL_CERTIFICATE_SKIP
7345 * indicating whether a Certificate message is expected or not.
7346 */
7347#define SSL_CERTIFICATE_EXPECTED 0
7348#define SSL_CERTIFICATE_SKIP 1
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007349MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007350static int ssl_parse_certificate_coordinate(mbedtls_ssl_context *ssl,
7351 int authmode)
Jerry Yud9526692022-02-17 14:23:47 +08007352{
7353 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7354 ssl->handshake->ciphersuite_info;
7355
Gilles Peskine449bd832023-01-11 14:50:10 +01007356 if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
7357 return SSL_CERTIFICATE_SKIP;
7358 }
Jerry Yud9526692022-02-17 14:23:47 +08007359
7360#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007361 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
7362 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK) {
7363 return SSL_CERTIFICATE_SKIP;
7364 }
Jerry Yud9526692022-02-17 14:23:47 +08007365
Gilles Peskine449bd832023-01-11 14:50:10 +01007366 if (authmode == MBEDTLS_SSL_VERIFY_NONE) {
Jerry Yud9526692022-02-17 14:23:47 +08007367 ssl->session_negotiate->verify_result =
7368 MBEDTLS_X509_BADCERT_SKIP_VERIFY;
Gilles Peskine449bd832023-01-11 14:50:10 +01007369 return SSL_CERTIFICATE_SKIP;
Jerry Yud9526692022-02-17 14:23:47 +08007370 }
7371 }
7372#else
7373 ((void) authmode);
7374#endif /* MBEDTLS_SSL_SRV_C */
7375
Gilles Peskine449bd832023-01-11 14:50:10 +01007376 return SSL_CERTIFICATE_EXPECTED;
Jerry Yud9526692022-02-17 14:23:47 +08007377}
7378
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007379MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007380static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl,
7381 int authmode,
7382 mbedtls_x509_crt *chain,
7383 void *rs_ctx)
Jerry Yud9526692022-02-17 14:23:47 +08007384{
7385 int ret = 0;
7386 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
7387 ssl->handshake->ciphersuite_info;
7388 int have_ca_chain = 0;
7389
7390 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *);
7391 void *p_vrfy;
7392
Gilles Peskine449bd832023-01-11 14:50:10 +01007393 if (authmode == MBEDTLS_SSL_VERIFY_NONE) {
7394 return 0;
7395 }
Jerry Yud9526692022-02-17 14:23:47 +08007396
Gilles Peskine449bd832023-01-11 14:50:10 +01007397 if (ssl->f_vrfy != NULL) {
7398 MBEDTLS_SSL_DEBUG_MSG(3, ("Use context-specific verification callback"));
Jerry Yud9526692022-02-17 14:23:47 +08007399 f_vrfy = ssl->f_vrfy;
7400 p_vrfy = ssl->p_vrfy;
Gilles Peskine449bd832023-01-11 14:50:10 +01007401 } else {
7402 MBEDTLS_SSL_DEBUG_MSG(3, ("Use configuration-specific verification callback"));
Jerry Yud9526692022-02-17 14:23:47 +08007403 f_vrfy = ssl->conf->f_vrfy;
7404 p_vrfy = ssl->conf->p_vrfy;
7405 }
7406
7407 /*
7408 * Main check: verify certificate
7409 */
7410#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK)
Gilles Peskine449bd832023-01-11 14:50:10 +01007411 if (ssl->conf->f_ca_cb != NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007412 ((void) rs_ctx);
7413 have_ca_chain = 1;
7414
Gilles Peskine449bd832023-01-11 14:50:10 +01007415 MBEDTLS_SSL_DEBUG_MSG(3, ("use CA callback for X.509 CRT verification"));
Jerry Yud9526692022-02-17 14:23:47 +08007416 ret = mbedtls_x509_crt_verify_with_ca_cb(
7417 chain,
7418 ssl->conf->f_ca_cb,
7419 ssl->conf->p_ca_cb,
7420 ssl->conf->cert_profile,
7421 ssl->hostname,
7422 &ssl->session_negotiate->verify_result,
Gilles Peskine449bd832023-01-11 14:50:10 +01007423 f_vrfy, p_vrfy);
7424 } else
Jerry Yud9526692022-02-17 14:23:47 +08007425#endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */
7426 {
7427 mbedtls_x509_crt *ca_chain;
7428 mbedtls_x509_crl *ca_crl;
7429
7430#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01007431 if (ssl->handshake->sni_ca_chain != NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007432 ca_chain = ssl->handshake->sni_ca_chain;
7433 ca_crl = ssl->handshake->sni_ca_crl;
Gilles Peskine449bd832023-01-11 14:50:10 +01007434 } else
Jerry Yud9526692022-02-17 14:23:47 +08007435#endif
7436 {
7437 ca_chain = ssl->conf->ca_chain;
7438 ca_crl = ssl->conf->ca_crl;
7439 }
7440
Gilles Peskine449bd832023-01-11 14:50:10 +01007441 if (ca_chain != NULL) {
Jerry Yud9526692022-02-17 14:23:47 +08007442 have_ca_chain = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01007443 }
Jerry Yud9526692022-02-17 14:23:47 +08007444
7445 ret = mbedtls_x509_crt_verify_restartable(
7446 chain,
7447 ca_chain, ca_crl,
7448 ssl->conf->cert_profile,
7449 ssl->hostname,
7450 &ssl->session_negotiate->verify_result,
Gilles Peskine449bd832023-01-11 14:50:10 +01007451 f_vrfy, p_vrfy, rs_ctx);
Jerry Yud9526692022-02-17 14:23:47 +08007452 }
7453
Gilles Peskine449bd832023-01-11 14:50:10 +01007454 if (ret != 0) {
7455 MBEDTLS_SSL_DEBUG_RET(1, "x509_verify_cert", ret);
Jerry Yud9526692022-02-17 14:23:47 +08007456 }
7457
7458#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007459 if (ret == MBEDTLS_ERR_ECP_IN_PROGRESS) {
7460 return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
7461 }
Jerry Yud9526692022-02-17 14:23:47 +08007462#endif
7463
7464 /*
7465 * Secondary checks: always done, but change 'ret' only if it was 0
7466 */
7467
Valerio Settiacd32c02023-06-29 18:06:29 +02007468#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
Jerry Yud9526692022-02-17 14:23:47 +08007469 {
7470 const mbedtls_pk_context *pk = &chain->pk;
7471
Manuel Pégourié-Gonnard66b0d612022-06-17 10:49:29 +02007472 /* If certificate uses an EC key, make sure the curve is OK.
7473 * This is a public key, so it can't be opaque, so can_do() is a good
7474 * enough check to ensure pk_ec() is safe to use here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007475 if (mbedtls_pk_can_do(pk, MBEDTLS_PK_ECKEY)) {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007476 /* and in the unlikely case the above assumption no longer holds
7477 * we are making sure that pk_ec() here does not return a NULL
7478 */
Valerio Settif9362b72023-11-29 08:42:27 +01007479 mbedtls_ecp_group_id grp_id = mbedtls_pk_get_ec_group_id(pk);
Valerio Settid0405092023-05-24 13:16:40 +02007480 if (grp_id == MBEDTLS_ECP_DP_NONE) {
7481 MBEDTLS_SSL_DEBUG_MSG(1, ("invalid group ID"));
Gilles Peskine449bd832023-01-11 14:50:10 +01007482 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007483 }
Valerio Setti97207782023-05-18 18:59:06 +02007484 if (mbedtls_ssl_check_curve(ssl, grp_id) != 0) {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007485 ssl->session_negotiate->verify_result |=
7486 MBEDTLS_X509_BADCERT_BAD_KEY;
7487
Gilles Peskine449bd832023-01-11 14:50:10 +01007488 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (EC key curve)"));
7489 if (ret == 0) {
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007490 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Gilles Peskine449bd832023-01-11 14:50:10 +01007491 }
Leonid Rozenboim19e59732022-08-08 16:52:38 -07007492 }
Jerry Yud9526692022-02-17 14:23:47 +08007493 }
7494 }
Valerio Settiacd32c02023-06-29 18:06:29 +02007495#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */
Jerry Yud9526692022-02-17 14:23:47 +08007496
Gilles Peskine449bd832023-01-11 14:50:10 +01007497 if (mbedtls_ssl_check_cert_usage(chain,
7498 ciphersuite_info,
7499 !ssl->conf->endpoint,
7500 &ssl->session_negotiate->verify_result) != 0) {
7501 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (usage extensions)"));
7502 if (ret == 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007503 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
Gilles Peskine449bd832023-01-11 14:50:10 +01007504 }
Jerry Yud9526692022-02-17 14:23:47 +08007505 }
7506
7507 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
7508 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
7509 * with details encoded in the verification flags. All other kinds
7510 * of error codes, including those from the user provided f_vrfy
7511 * functions, are treated as fatal and lead to a failure of
7512 * ssl_parse_certificate even if verification was optional. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007513 if (authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
7514 (ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
7515 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE)) {
Jerry Yud9526692022-02-17 14:23:47 +08007516 ret = 0;
7517 }
7518
Gilles Peskine449bd832023-01-11 14:50:10 +01007519 if (have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED) {
7520 MBEDTLS_SSL_DEBUG_MSG(1, ("got no CA chain"));
Jerry Yud9526692022-02-17 14:23:47 +08007521 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
7522 }
7523
Gilles Peskine449bd832023-01-11 14:50:10 +01007524 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007525 uint8_t alert;
7526
7527 /* The certificate may have been rejected for several reasons.
7528 Pick one and send the corresponding alert. Which alert to send
7529 may be a subject of debate in some cases. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007530 if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER) {
Jerry Yud9526692022-02-17 14:23:47 +08007531 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
Gilles Peskine449bd832023-01-11 14:50:10 +01007532 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH) {
Jerry Yud9526692022-02-17 14:23:47 +08007533 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007534 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE) {
Jerry Yud9526692022-02-17 14:23:47 +08007535 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007536 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE) {
Jerry Yud9526692022-02-17 14:23:47 +08007537 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007538 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE) {
Jerry Yud9526692022-02-17 14:23:47 +08007539 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007540 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK) {
Jerry Yud9526692022-02-17 14:23:47 +08007541 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007542 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY) {
Jerry Yud9526692022-02-17 14:23:47 +08007543 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
Gilles Peskine449bd832023-01-11 14:50:10 +01007544 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED) {
Jerry Yud9526692022-02-17 14:23:47 +08007545 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
Gilles Peskine449bd832023-01-11 14:50:10 +01007546 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED) {
Jerry Yud9526692022-02-17 14:23:47 +08007547 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
Gilles Peskine449bd832023-01-11 14:50:10 +01007548 } else if (ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED) {
Jerry Yud9526692022-02-17 14:23:47 +08007549 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
Gilles Peskine449bd832023-01-11 14:50:10 +01007550 } else {
Jerry Yud9526692022-02-17 14:23:47 +08007551 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
Gilles Peskine449bd832023-01-11 14:50:10 +01007552 }
7553 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7554 alert);
Jerry Yud9526692022-02-17 14:23:47 +08007555 }
7556
7557#if defined(MBEDTLS_DEBUG_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007558 if (ssl->session_negotiate->verify_result != 0) {
7559 MBEDTLS_SSL_DEBUG_MSG(3, ("! Certificate verification flags %08x",
7560 (unsigned int) ssl->session_negotiate->verify_result));
7561 } else {
7562 MBEDTLS_SSL_DEBUG_MSG(3, ("Certificate verification flags clear"));
Jerry Yud9526692022-02-17 14:23:47 +08007563 }
7564#endif /* MBEDTLS_DEBUG_C */
7565
Gilles Peskine449bd832023-01-11 14:50:10 +01007566 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007567}
7568
7569#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007570MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007571static int ssl_remember_peer_crt_digest(mbedtls_ssl_context *ssl,
7572 unsigned char *start, size_t len)
Jerry Yud9526692022-02-17 14:23:47 +08007573{
7574 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7575 /* Remember digest of the peer's end-CRT. */
7576 ssl->session_negotiate->peer_cert_digest =
Gilles Peskine449bd832023-01-11 14:50:10 +01007577 mbedtls_calloc(1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN);
7578 if (ssl->session_negotiate->peer_cert_digest == NULL) {
7579 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc(%d bytes) failed",
7580 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN));
7581 mbedtls_ssl_send_alert_message(ssl,
7582 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7583 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
Jerry Yud9526692022-02-17 14:23:47 +08007584
Gilles Peskine449bd832023-01-11 14:50:10 +01007585 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
Jerry Yud9526692022-02-17 14:23:47 +08007586 }
7587
Gilles Peskine449bd832023-01-11 14:50:10 +01007588 ret = mbedtls_md(mbedtls_md_info_from_type(
7589 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE),
7590 start, len,
7591 ssl->session_negotiate->peer_cert_digest);
Jerry Yud9526692022-02-17 14:23:47 +08007592
7593 ssl->session_negotiate->peer_cert_digest_type =
7594 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
7595 ssl->session_negotiate->peer_cert_digest_len =
7596 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
7597
Gilles Peskine449bd832023-01-11 14:50:10 +01007598 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007599}
7600
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02007601MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01007602static int ssl_remember_peer_pubkey(mbedtls_ssl_context *ssl,
7603 unsigned char *start, size_t len)
Jerry Yud9526692022-02-17 14:23:47 +08007604{
7605 unsigned char *end = start + len;
7606 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
7607
7608 /* Make a copy of the peer's raw public key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007609 mbedtls_pk_init(&ssl->handshake->peer_pubkey);
7610 ret = mbedtls_pk_parse_subpubkey(&start, end,
7611 &ssl->handshake->peer_pubkey);
7612 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007613 /* We should have parsed the public key before. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007614 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yud9526692022-02-17 14:23:47 +08007615 }
7616
Gilles Peskine449bd832023-01-11 14:50:10 +01007617 return 0;
Jerry Yud9526692022-02-17 14:23:47 +08007618}
7619#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7620
Gilles Peskine449bd832023-01-11 14:50:10 +01007621int mbedtls_ssl_parse_certificate(mbedtls_ssl_context *ssl)
Jerry Yud9526692022-02-17 14:23:47 +08007622{
7623 int ret = 0;
7624 int crt_expected;
7625#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7626 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
7627 ? ssl->handshake->sni_authmode
7628 : ssl->conf->authmode;
7629#else
7630 const int authmode = ssl->conf->authmode;
7631#endif
7632 void *rs_ctx = NULL;
7633 mbedtls_x509_crt *chain = NULL;
7634
Gilles Peskine449bd832023-01-11 14:50:10 +01007635 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007636
Gilles Peskine449bd832023-01-11 14:50:10 +01007637 crt_expected = ssl_parse_certificate_coordinate(ssl, authmode);
7638 if (crt_expected == SSL_CERTIFICATE_SKIP) {
7639 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007640 goto exit;
7641 }
7642
7643#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007644 if (ssl->handshake->ecrs_enabled &&
7645 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify) {
Jerry Yud9526692022-02-17 14:23:47 +08007646 chain = ssl->handshake->ecrs_peer_cert;
7647 ssl->handshake->ecrs_peer_cert = NULL;
7648 goto crt_verify;
7649 }
7650#endif
7651
Gilles Peskine449bd832023-01-11 14:50:10 +01007652 if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007653 /* mbedtls_ssl_read_record may have sent an alert already. We
7654 let it decide whether to alert. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007655 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
Jerry Yud9526692022-02-17 14:23:47 +08007656 goto exit;
7657 }
7658
7659#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01007660 if (ssl_srv_check_client_no_crt_notification(ssl) == 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007661 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
7662
Gilles Peskine449bd832023-01-11 14:50:10 +01007663 if (authmode != MBEDTLS_SSL_VERIFY_OPTIONAL) {
Jerry Yud9526692022-02-17 14:23:47 +08007664 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
Gilles Peskine449bd832023-01-11 14:50:10 +01007665 }
Jerry Yud9526692022-02-17 14:23:47 +08007666
7667 goto exit;
7668 }
7669#endif /* MBEDTLS_SSL_SRV_C */
7670
7671 /* Clear existing peer CRT structure in case we tried to
7672 * reuse a session but it failed, and allocate a new one. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007673 ssl_clear_peer_cert(ssl->session_negotiate);
Jerry Yud9526692022-02-17 14:23:47 +08007674
Gilles Peskine449bd832023-01-11 14:50:10 +01007675 chain = mbedtls_calloc(1, sizeof(mbedtls_x509_crt));
7676 if (chain == NULL) {
7677 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed",
7678 sizeof(mbedtls_x509_crt)));
7679 mbedtls_ssl_send_alert_message(ssl,
7680 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7681 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
Jerry Yud9526692022-02-17 14:23:47 +08007682
7683 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
7684 goto exit;
7685 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007686 mbedtls_x509_crt_init(chain);
Jerry Yud9526692022-02-17 14:23:47 +08007687
Gilles Peskine449bd832023-01-11 14:50:10 +01007688 ret = ssl_parse_certificate_chain(ssl, chain);
7689 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007690 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007691 }
Jerry Yud9526692022-02-17 14:23:47 +08007692
7693#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007694 if (ssl->handshake->ecrs_enabled) {
Jerry Yud9526692022-02-17 14:23:47 +08007695 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
Gilles Peskine449bd832023-01-11 14:50:10 +01007696 }
Jerry Yud9526692022-02-17 14:23:47 +08007697
7698crt_verify:
Gilles Peskine449bd832023-01-11 14:50:10 +01007699 if (ssl->handshake->ecrs_enabled) {
Jerry Yud9526692022-02-17 14:23:47 +08007700 rs_ctx = &ssl->handshake->ecrs_ctx;
Gilles Peskine449bd832023-01-11 14:50:10 +01007701 }
Jerry Yud9526692022-02-17 14:23:47 +08007702#endif
7703
Gilles Peskine449bd832023-01-11 14:50:10 +01007704 ret = ssl_parse_certificate_verify(ssl, authmode,
7705 chain, rs_ctx);
7706 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007707 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007708 }
Jerry Yud9526692022-02-17 14:23:47 +08007709
7710#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
7711 {
7712 unsigned char *crt_start, *pk_start;
7713 size_t crt_len, pk_len;
7714
7715 /* We parse the CRT chain without copying, so
7716 * these pointers point into the input buffer,
7717 * and are hence still valid after freeing the
7718 * CRT chain. */
7719
7720 crt_start = chain->raw.p;
7721 crt_len = chain->raw.len;
7722
7723 pk_start = chain->pk_raw.p;
7724 pk_len = chain->pk_raw.len;
7725
7726 /* Free the CRT structures before computing
7727 * digest and copying the peer's public key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007728 mbedtls_x509_crt_free(chain);
7729 mbedtls_free(chain);
Jerry Yud9526692022-02-17 14:23:47 +08007730 chain = NULL;
7731
Gilles Peskine449bd832023-01-11 14:50:10 +01007732 ret = ssl_remember_peer_crt_digest(ssl, crt_start, crt_len);
7733 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007734 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007735 }
Jerry Yud9526692022-02-17 14:23:47 +08007736
Gilles Peskine449bd832023-01-11 14:50:10 +01007737 ret = ssl_remember_peer_pubkey(ssl, pk_start, pk_len);
7738 if (ret != 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007739 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007740 }
Jerry Yud9526692022-02-17 14:23:47 +08007741 }
7742#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7743 /* Pass ownership to session structure. */
7744 ssl->session_negotiate->peer_cert = chain;
7745 chain = NULL;
7746#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
7747
Gilles Peskine449bd832023-01-11 14:50:10 +01007748 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate"));
Jerry Yud9526692022-02-17 14:23:47 +08007749
7750exit:
7751
Gilles Peskine449bd832023-01-11 14:50:10 +01007752 if (ret == 0) {
Jerry Yud9526692022-02-17 14:23:47 +08007753 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01007754 }
Jerry Yud9526692022-02-17 14:23:47 +08007755
7756#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01007757 if (ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) {
Jerry Yud9526692022-02-17 14:23:47 +08007758 ssl->handshake->ecrs_peer_cert = chain;
7759 chain = NULL;
7760 }
7761#endif
7762
Gilles Peskine449bd832023-01-11 14:50:10 +01007763 if (chain != NULL) {
7764 mbedtls_x509_crt_free(chain);
7765 mbedtls_free(chain);
Jerry Yud9526692022-02-17 14:23:47 +08007766 }
7767
Gilles Peskine449bd832023-01-11 14:50:10 +01007768 return ret;
Jerry Yud9526692022-02-17 14:23:47 +08007769}
7770#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
7771
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007772static int ssl_calc_finished_tls_generic(mbedtls_ssl_context *ssl, void *ctx,
7773 unsigned char *padbuf, size_t hlen,
7774 unsigned char *buf, int from)
Jerry Yu615bd6f2022-02-17 14:25:15 +08007775{
Dave Rodgmanc37ad442023-11-03 23:36:06 +00007776 unsigned int len = 12;
Jerry Yu615bd6f2022-02-17 14:25:15 +08007777 const char *sender;
Jerry Yu615bd6f2022-02-17 14:25:15 +08007778#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yu615bd6f2022-02-17 14:25:15 +08007779 psa_status_t status;
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007780 psa_hash_operation_t *hs_op = ctx;
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007781 psa_hash_operation_t cloned_op = PSA_HASH_OPERATION_INIT;
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007782 size_t hash_size;
Jerry Yu615bd6f2022-02-17 14:25:15 +08007783#else
Manuel Pégourié-Gonnarde1a4caa2023-02-06 10:14:25 +01007784 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007785 mbedtls_md_context_t *hs_ctx = ctx;
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007786 mbedtls_md_context_t cloned_ctx;
7787 mbedtls_md_init(&cloned_ctx);
Jerry Yu615bd6f2022-02-17 14:25:15 +08007788#endif
7789
7790 mbedtls_ssl_session *session = ssl->session_negotiate;
Gilles Peskine449bd832023-01-11 14:50:10 +01007791 if (!session) {
Jerry Yu615bd6f2022-02-17 14:25:15 +08007792 session = ssl->session;
Gilles Peskine449bd832023-01-11 14:50:10 +01007793 }
Jerry Yu615bd6f2022-02-17 14:25:15 +08007794
Gilles Peskine449bd832023-01-11 14:50:10 +01007795 sender = (from == MBEDTLS_SSL_IS_CLIENT)
Jerry Yu615bd6f2022-02-17 14:25:15 +08007796 ? "client finished"
7797 : "server finished";
7798
7799#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007800 MBEDTLS_SSL_DEBUG_MSG(2, ("=> calc PSA finished tls"));
Jerry Yu615bd6f2022-02-17 14:25:15 +08007801
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007802 status = psa_hash_clone(hs_op, &cloned_op);
Gilles Peskine449bd832023-01-11 14:50:10 +01007803 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnarde1a4caa2023-02-06 10:14:25 +01007804 goto exit;
Jerry Yu615bd6f2022-02-17 14:25:15 +08007805 }
7806
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007807 status = psa_hash_finish(&cloned_op, padbuf, hlen, &hash_size);
Gilles Peskine449bd832023-01-11 14:50:10 +01007808 if (status != PSA_SUCCESS) {
Manuel Pégourié-Gonnarde1a4caa2023-02-06 10:14:25 +01007809 goto exit;
Jerry Yu615bd6f2022-02-17 14:25:15 +08007810 }
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007811 MBEDTLS_SSL_DEBUG_BUF(3, "PSA calculated padbuf", padbuf, hlen);
Jerry Yu615bd6f2022-02-17 14:25:15 +08007812#else
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007813 MBEDTLS_SSL_DEBUG_MSG(2, ("=> calc finished tls"));
Jerry Yu615bd6f2022-02-17 14:25:15 +08007814
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007815 ret = mbedtls_md_setup(&cloned_ctx, mbedtls_md_info_from_ctx(hs_ctx), 0);
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01007816 if (ret != 0) {
7817 goto exit;
7818 }
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007819 ret = mbedtls_md_clone(&cloned_ctx, hs_ctx);
Manuel Pégourié-Gonnardf057ecf2023-02-24 13:19:17 +01007820 if (ret != 0) {
7821 goto exit;
7822 }
Jerry Yu615bd6f2022-02-17 14:25:15 +08007823
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007824 ret = mbedtls_md_finish(&cloned_ctx, padbuf);
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007825 if (ret != 0) {
7826 goto exit;
7827 }
7828#endif /* MBEDTLS_USE_PSA_CRYPTO */
7829
7830 MBEDTLS_SSL_DEBUG_BUF(4, "finished output", padbuf, hlen);
7831
Jerry Yu615bd6f2022-02-17 14:25:15 +08007832 /*
7833 * TLSv1.2:
7834 * hash = PRF( master, finished_label,
7835 * Hash( handshake ) )[0.11]
7836 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007837 ssl->handshake->tls_prf(session->master, 48, sender,
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007838 padbuf, hlen, buf, len);
Jerry Yu615bd6f2022-02-17 14:25:15 +08007839
Gilles Peskine449bd832023-01-11 14:50:10 +01007840 MBEDTLS_SSL_DEBUG_BUF(3, "calc finished result", buf, len);
Jerry Yu615bd6f2022-02-17 14:25:15 +08007841
Paul Elliottecb95be2023-08-11 16:41:04 +01007842 mbedtls_platform_zeroize(padbuf, hlen);
Jerry Yu615bd6f2022-02-17 14:25:15 +08007843
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007844 MBEDTLS_SSL_DEBUG_MSG(2, ("<= calc finished"));
Manuel Pégourié-Gonnarde1a4caa2023-02-06 10:14:25 +01007845
7846exit:
7847#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007848 psa_hash_abort(&cloned_op);
Manuel Pégourié-Gonnard3761e9e2023-03-28 12:54:56 +02007849 return mbedtls_md_error_from_psa(status);
Manuel Pégourié-Gonnarde1a4caa2023-02-06 10:14:25 +01007850#else
Manuel Pégourié-Gonnardaaad2b62023-07-04 11:35:16 +02007851 mbedtls_md_free(&cloned_ctx);
Manuel Pégourié-Gonnarde1a4caa2023-02-06 10:14:25 +01007852 return ret;
7853#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu615bd6f2022-02-17 14:25:15 +08007854}
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007855
7856#if defined(MBEDTLS_MD_CAN_SHA256)
7857static int ssl_calc_finished_tls_sha256(
7858 mbedtls_ssl_context *ssl, unsigned char *buf, int from)
7859{
7860 unsigned char padbuf[32];
7861 return ssl_calc_finished_tls_generic(ssl,
7862#if defined(MBEDTLS_USE_PSA_CRYPTO)
7863 &ssl->handshake->fin_sha256_psa,
7864#else
7865 &ssl->handshake->fin_sha256,
7866#endif
7867 padbuf, sizeof(padbuf),
7868 buf, from);
7869}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01007870#endif /* MBEDTLS_MD_CAN_SHA256*/
Jerry Yu615bd6f2022-02-17 14:25:15 +08007871
Jerry Yub7ba49e2022-02-17 14:25:53 +08007872
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01007873#if defined(MBEDTLS_MD_CAN_SHA384)
Manuel Pégourié-Gonnard226aa152023-02-05 09:46:59 +01007874static int ssl_calc_finished_tls_sha384(
Gilles Peskine449bd832023-01-11 14:50:10 +01007875 mbedtls_ssl_context *ssl, unsigned char *buf, int from)
Jerry Yub7ba49e2022-02-17 14:25:53 +08007876{
Jerry Yub7ba49e2022-02-17 14:25:53 +08007877 unsigned char padbuf[48];
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007878 return ssl_calc_finished_tls_generic(ssl,
Jerry Yub7ba49e2022-02-17 14:25:53 +08007879#if defined(MBEDTLS_USE_PSA_CRYPTO)
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007880 &ssl->handshake->fin_sha384_psa,
Jerry Yub7ba49e2022-02-17 14:25:53 +08007881#else
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007882 &ssl->handshake->fin_sha384,
Jerry Yub7ba49e2022-02-17 14:25:53 +08007883#endif
Manuel Pégourié-Gonnardde332782023-06-24 10:13:41 +02007884 padbuf, sizeof(padbuf),
7885 buf, from);
Jerry Yub7ba49e2022-02-17 14:25:53 +08007886}
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01007887#endif /* MBEDTLS_MD_CAN_SHA384*/
Jerry Yub7ba49e2022-02-17 14:25:53 +08007888
Gilles Peskine449bd832023-01-11 14:50:10 +01007889void mbedtls_ssl_handshake_wrapup_free_hs_transform(mbedtls_ssl_context *ssl)
Jerry Yuaef00152022-02-17 14:27:31 +08007890{
Gilles Peskine449bd832023-01-11 14:50:10 +01007891 MBEDTLS_SSL_DEBUG_MSG(3, ("=> handshake wrapup: final free"));
Jerry Yuaef00152022-02-17 14:27:31 +08007892
7893 /*
7894 * Free our handshake params
7895 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007896 mbedtls_ssl_handshake_free(ssl);
7897 mbedtls_free(ssl->handshake);
Jerry Yuaef00152022-02-17 14:27:31 +08007898 ssl->handshake = NULL;
7899
7900 /*
Shaun Case8b0ecbc2021-12-20 21:14:10 -08007901 * Free the previous transform and switch in the current one
Jerry Yuaef00152022-02-17 14:27:31 +08007902 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007903 if (ssl->transform) {
7904 mbedtls_ssl_transform_free(ssl->transform);
7905 mbedtls_free(ssl->transform);
Jerry Yuaef00152022-02-17 14:27:31 +08007906 }
7907 ssl->transform = ssl->transform_negotiate;
7908 ssl->transform_negotiate = NULL;
7909
Gilles Peskine449bd832023-01-11 14:50:10 +01007910 MBEDTLS_SSL_DEBUG_MSG(3, ("<= handshake wrapup: final free"));
Jerry Yuaef00152022-02-17 14:27:31 +08007911}
7912
Gilles Peskine449bd832023-01-11 14:50:10 +01007913void mbedtls_ssl_handshake_wrapup(mbedtls_ssl_context *ssl)
Jerry Yu2a9fff52022-02-17 14:28:51 +08007914{
7915 int resume = ssl->handshake->resume;
7916
Gilles Peskine449bd832023-01-11 14:50:10 +01007917 MBEDTLS_SSL_DEBUG_MSG(3, ("=> handshake wrapup"));
Jerry Yu2a9fff52022-02-17 14:28:51 +08007918
7919#if defined(MBEDTLS_SSL_RENEGOTIATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01007920 if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
Jerry Yu2a9fff52022-02-17 14:28:51 +08007921 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
7922 ssl->renego_records_seen = 0;
7923 }
7924#endif
7925
7926 /*
7927 * Free the previous session and switch in the current one
7928 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007929 if (ssl->session) {
Jerry Yu2a9fff52022-02-17 14:28:51 +08007930#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7931 /* RFC 7366 3.1: keep the EtM state */
7932 ssl->session_negotiate->encrypt_then_mac =
Gilles Peskine449bd832023-01-11 14:50:10 +01007933 ssl->session->encrypt_then_mac;
Jerry Yu2a9fff52022-02-17 14:28:51 +08007934#endif
7935
Gilles Peskine449bd832023-01-11 14:50:10 +01007936 mbedtls_ssl_session_free(ssl->session);
7937 mbedtls_free(ssl->session);
Jerry Yu2a9fff52022-02-17 14:28:51 +08007938 }
7939 ssl->session = ssl->session_negotiate;
7940 ssl->session_negotiate = NULL;
7941
7942 /*
7943 * Add cache entry
7944 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007945 if (ssl->conf->f_set_cache != NULL &&
Jerry Yu2a9fff52022-02-17 14:28:51 +08007946 ssl->session->id_len != 0 &&
Gilles Peskine449bd832023-01-11 14:50:10 +01007947 resume == 0) {
7948 if (ssl->conf->f_set_cache(ssl->conf->p_cache,
7949 ssl->session->id,
7950 ssl->session->id_len,
7951 ssl->session) != 0) {
7952 MBEDTLS_SSL_DEBUG_MSG(1, ("cache did not store session"));
7953 }
Jerry Yu2a9fff52022-02-17 14:28:51 +08007954 }
7955
7956#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007957 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
7958 ssl->handshake->flight != NULL) {
Jerry Yu2a9fff52022-02-17 14:28:51 +08007959 /* Cancel handshake timer */
Gilles Peskine449bd832023-01-11 14:50:10 +01007960 mbedtls_ssl_set_timer(ssl, 0);
Jerry Yu2a9fff52022-02-17 14:28:51 +08007961
7962 /* Keep last flight around in case we need to resend it:
7963 * we need the handshake and transform structures for that */
Gilles Peskine449bd832023-01-11 14:50:10 +01007964 MBEDTLS_SSL_DEBUG_MSG(3, ("skip freeing handshake and transform"));
7965 } else
Jerry Yu2a9fff52022-02-17 14:28:51 +08007966#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01007967 mbedtls_ssl_handshake_wrapup_free_hs_transform(ssl);
Jerry Yu2a9fff52022-02-17 14:28:51 +08007968
Jerry Yu5ed73ff2022-10-27 13:08:42 +08007969 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER;
Jerry Yu2a9fff52022-02-17 14:28:51 +08007970
Gilles Peskine449bd832023-01-11 14:50:10 +01007971 MBEDTLS_SSL_DEBUG_MSG(3, ("<= handshake wrapup"));
Jerry Yu2a9fff52022-02-17 14:28:51 +08007972}
7973
Gilles Peskine449bd832023-01-11 14:50:10 +01007974int mbedtls_ssl_write_finished(mbedtls_ssl_context *ssl)
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007975{
Dave Rodgmanc37ad442023-11-03 23:36:06 +00007976 int ret;
7977 unsigned int hash_len;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007978
Gilles Peskine449bd832023-01-11 14:50:10 +01007979 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write finished"));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007980
Gilles Peskine449bd832023-01-11 14:50:10 +01007981 mbedtls_ssl_update_out_pointers(ssl, ssl->transform_negotiate);
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007982
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01007983 ret = ssl->handshake->calc_finished(ssl, ssl->out_msg + 4, ssl->conf->endpoint);
7984 if (ret != 0) {
7985 MBEDTLS_SSL_DEBUG_RET(1, "calc_finished", ret);
7986 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007987
7988 /*
7989 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
7990 * may define some other value. Currently (early 2016), no defined
7991 * ciphersuite does this (and this is unlikely to change as activity has
7992 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
7993 */
7994 hash_len = 12;
7995
7996#if defined(MBEDTLS_SSL_RENEGOTIATION)
7997 ssl->verify_data_len = hash_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01007998 memcpy(ssl->own_verify_data, ssl->out_msg + 4, hash_len);
Jerry Yu3c8e47b2022-02-17 14:30:01 +08007999#endif
8000
8001 ssl->out_msglen = 4 + hash_len;
8002 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
8003 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
8004
8005 /*
8006 * In case of session resuming, invert the client and server
8007 * ChangeCipherSpec messages order.
8008 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008009 if (ssl->handshake->resume != 0) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008010#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008011 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008012 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Gilles Peskine449bd832023-01-11 14:50:10 +01008013 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008014#endif
8015#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008016 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008017 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Gilles Peskine449bd832023-01-11 14:50:10 +01008018 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008019#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01008020 } else {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008021 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01008022 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008023
8024 /*
8025 * Switch to our negotiated transform and session parameters for outbound
8026 * data.
8027 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008028 MBEDTLS_SSL_DEBUG_MSG(3, ("switching to new transform spec for outbound data"));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008029
8030#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01008031 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008032 unsigned char i;
8033
8034 /* Remember current epoch settings for resending */
8035 ssl->handshake->alt_transform_out = ssl->transform_out;
Gilles Peskine449bd832023-01-11 14:50:10 +01008036 memcpy(ssl->handshake->alt_out_ctr, ssl->cur_out_ctr,
8037 sizeof(ssl->handshake->alt_out_ctr));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008038
8039 /* Set sequence_number to zero */
Gilles Peskine449bd832023-01-11 14:50:10 +01008040 memset(&ssl->cur_out_ctr[2], 0, sizeof(ssl->cur_out_ctr) - 2);
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008041
8042
8043 /* Increment epoch */
Gilles Peskine449bd832023-01-11 14:50:10 +01008044 for (i = 2; i > 0; i--) {
8045 if (++ssl->cur_out_ctr[i - 1] != 0) {
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008046 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01008047 }
8048 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008049
8050 /* The loop goes to its end iff the counter is wrapping */
Gilles Peskine449bd832023-01-11 14:50:10 +01008051 if (i == 0) {
8052 MBEDTLS_SSL_DEBUG_MSG(1, ("DTLS epoch would wrap"));
8053 return MBEDTLS_ERR_SSL_COUNTER_WRAPPING;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008054 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008055 } else
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008056#endif /* MBEDTLS_SSL_PROTO_DTLS */
Gilles Peskine449bd832023-01-11 14:50:10 +01008057 memset(ssl->cur_out_ctr, 0, sizeof(ssl->cur_out_ctr));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008058
8059 ssl->transform_out = ssl->transform_negotiate;
8060 ssl->session_out = ssl->session_negotiate;
8061
8062#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01008063 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
8064 mbedtls_ssl_send_flight_completed(ssl);
8065 }
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008066#endif
8067
Gilles Peskine449bd832023-01-11 14:50:10 +01008068 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
8069 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
8070 return ret;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008071 }
8072
8073#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01008074 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
8075 (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) {
8076 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret);
8077 return ret;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008078 }
8079#endif
8080
Gilles Peskine449bd832023-01-11 14:50:10 +01008081 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write finished"));
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008082
Gilles Peskine449bd832023-01-11 14:50:10 +01008083 return 0;
Jerry Yu3c8e47b2022-02-17 14:30:01 +08008084}
8085
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008086#define SSL_MAX_HASH_LEN 12
8087
Gilles Peskine449bd832023-01-11 14:50:10 +01008088int mbedtls_ssl_parse_finished(mbedtls_ssl_context *ssl)
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008089{
8090 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
8091 unsigned int hash_len = 12;
8092 unsigned char buf[SSL_MAX_HASH_LEN];
8093
Gilles Peskine449bd832023-01-11 14:50:10 +01008094 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse finished"));
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008095
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01008096 ret = ssl->handshake->calc_finished(ssl, buf, ssl->conf->endpoint ^ 1);
8097 if (ret != 0) {
8098 MBEDTLS_SSL_DEBUG_RET(1, "calc_finished", ret);
8099 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008100
Gilles Peskine449bd832023-01-11 14:50:10 +01008101 if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) {
8102 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008103 goto exit;
8104 }
8105
Gilles Peskine449bd832023-01-11 14:50:10 +01008106 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) {
8107 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
8108 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8109 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008110 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
8111 goto exit;
8112 }
8113
Gilles Peskine449bd832023-01-11 14:50:10 +01008114 if (ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED) {
8115 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8116 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008117 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
8118 goto exit;
8119 }
8120
Gilles Peskine449bd832023-01-11 14:50:10 +01008121 if (ssl->in_hslen != mbedtls_ssl_hs_hdr_len(ssl) + hash_len) {
8122 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
8123 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8124 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008125 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
8126 goto exit;
8127 }
8128
Gilles Peskine449bd832023-01-11 14:50:10 +01008129 if (mbedtls_ct_memcmp(ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl),
8130 buf, hash_len) != 0) {
8131 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
8132 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8133 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008134 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
8135 goto exit;
8136 }
8137
8138#if defined(MBEDTLS_SSL_RENEGOTIATION)
8139 ssl->verify_data_len = hash_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01008140 memcpy(ssl->peer_verify_data, buf, hash_len);
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008141#endif
8142
Gilles Peskine449bd832023-01-11 14:50:10 +01008143 if (ssl->handshake->resume != 0) {
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008144#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008145 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008146 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Gilles Peskine449bd832023-01-11 14:50:10 +01008147 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008148#endif
8149#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008150 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008151 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Gilles Peskine449bd832023-01-11 14:50:10 +01008152 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008153#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01008154 } else {
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008155 ssl->state++;
Gilles Peskine449bd832023-01-11 14:50:10 +01008156 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008157
8158#if defined(MBEDTLS_SSL_PROTO_DTLS)
Gilles Peskine449bd832023-01-11 14:50:10 +01008159 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
8160 mbedtls_ssl_recv_flight_completed(ssl);
8161 }
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008162#endif
8163
Gilles Peskine449bd832023-01-11 14:50:10 +01008164 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse finished"));
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008165
8166exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01008167 mbedtls_platform_zeroize(buf, hash_len);
8168 return ret;
Jerry Yu0b3d7c12022-02-17 14:30:51 +08008169}
8170
Jerry Yu392112c2022-02-17 14:34:10 +08008171#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
8172/*
8173 * Helper to get TLS 1.2 PRF from ciphersuite
8174 * (Duplicates bits of logic from ssl_set_handshake_prfs().)
8175 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008176static tls_prf_fn ssl_tls12prf_from_cs(int ciphersuite_id)
Jerry Yu392112c2022-02-17 14:34:10 +08008177{
Jerry Yu392112c2022-02-17 14:34:10 +08008178 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01008179 mbedtls_ssl_ciphersuite_from_id(ciphersuite_id);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008180#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +01008181 if (ciphersuite_info != NULL && ciphersuite_info->mac == MBEDTLS_MD_SHA384) {
8182 return tls_prf_sha384;
8183 } else
Jerry Yu392112c2022-02-17 14:34:10 +08008184#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008185#if defined(MBEDTLS_MD_CAN_SHA256)
Andrzej Kurek894edde2022-09-29 06:31:14 -04008186 {
Gilles Peskine449bd832023-01-11 14:50:10 +01008187 if (ciphersuite_info != NULL && ciphersuite_info->mac == MBEDTLS_MD_SHA256) {
8188 return tls_prf_sha256;
8189 }
Andrzej Kurek894edde2022-09-29 06:31:14 -04008190 }
8191#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008192#if !defined(MBEDTLS_MD_CAN_SHA384) && \
8193 !defined(MBEDTLS_MD_CAN_SHA256)
Andrzej Kurek894edde2022-09-29 06:31:14 -04008194 (void) ciphersuite_info;
8195#endif
Andrzej Kurekeabeb302022-10-17 07:52:51 -04008196
Gilles Peskine449bd832023-01-11 14:50:10 +01008197 return NULL;
Jerry Yu392112c2022-02-17 14:34:10 +08008198}
8199#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */
Jerry Yue93ffcd2022-02-17 14:37:06 +08008200
Gilles Peskine449bd832023-01-11 14:50:10 +01008201static mbedtls_tls_prf_types tls_prf_get_type(mbedtls_ssl_tls_prf_cb *tls_prf)
Jerry Yue93ffcd2022-02-17 14:37:06 +08008202{
8203 ((void) tls_prf);
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008204#if defined(MBEDTLS_MD_CAN_SHA384)
Gilles Peskine449bd832023-01-11 14:50:10 +01008205 if (tls_prf == tls_prf_sha384) {
8206 return MBEDTLS_SSL_TLS_PRF_SHA384;
8207 } else
Jerry Yue93ffcd2022-02-17 14:37:06 +08008208#endif
Manuel Pégourié-Gonnardbef824d2023-03-17 12:50:01 +01008209#if defined(MBEDTLS_MD_CAN_SHA256)
Gilles Peskine449bd832023-01-11 14:50:10 +01008210 if (tls_prf == tls_prf_sha256) {
8211 return MBEDTLS_SSL_TLS_PRF_SHA256;
8212 } else
Jerry Yue93ffcd2022-02-17 14:37:06 +08008213#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01008214 return MBEDTLS_SSL_TLS_PRF_NONE;
Jerry Yue93ffcd2022-02-17 14:37:06 +08008215}
8216
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008217/*
8218 * Populate a transform structure with session keys and all the other
8219 * necessary information.
8220 *
8221 * Parameters:
8222 * - [in/out]: transform: structure to populate
8223 * [in] must be just initialised with mbedtls_ssl_transform_init()
8224 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf()
8225 * - [in] ciphersuite
8226 * - [in] master
8227 * - [in] encrypt_then_mac
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008228 * - [in] tls_prf: pointer to PRF to use for key derivation
8229 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random
Glenn Strauss07c64162022-03-14 12:34:51 -04008230 * - [in] tls_version: TLS version
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008231 * - [in] endpoint: client or server
8232 * - [in] ssl: used for:
8233 * - ssl->conf->{f,p}_export_keys
8234 * [in] optionally used for:
8235 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg
8236 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02008237MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01008238static int ssl_tls12_populate_transform(mbedtls_ssl_transform *transform,
8239 int ciphersuite,
8240 const unsigned char master[48],
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008241#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01008242 int encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008243#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01008244 ssl_tls_prf_t tls_prf,
8245 const unsigned char randbytes[64],
8246 mbedtls_ssl_protocol_version tls_version,
8247 unsigned endpoint,
8248 const mbedtls_ssl_context *ssl)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008249{
8250 int ret = 0;
8251 unsigned char keyblk[256];
8252 unsigned char *key1;
8253 unsigned char *key2;
8254 unsigned char *mac_enc;
8255 unsigned char *mac_dec;
8256 size_t mac_key_len = 0;
8257 size_t iv_copy_len;
8258 size_t keylen;
8259 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008260 mbedtls_ssl_mode_t ssl_mode;
Neil Armstronge4512952022-03-08 09:08:22 +01008261#if !defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008262 const mbedtls_cipher_info_t *cipher_info;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008263 const mbedtls_md_info_t *md_info;
Neil Armstronge4512952022-03-08 09:08:22 +01008264#endif /* !MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008265
8266#if defined(MBEDTLS_USE_PSA_CRYPTO)
8267 psa_key_type_t key_type;
8268 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
8269 psa_algorithm_t alg;
Neil Armstronge4512952022-03-08 09:08:22 +01008270 psa_algorithm_t mac_alg = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008271 size_t key_bits;
8272 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
8273#endif
8274
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008275 /*
8276 * Some data just needs copying into the structure
8277 */
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008278#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008279 transform->encrypt_then_mac = encrypt_then_mac;
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008280#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Glenn Strauss07c64162022-03-14 12:34:51 -04008281 transform->tls_version = tls_version;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008282
8283#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01008284 memcpy(transform->randbytes, randbytes, sizeof(transform->randbytes));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008285#endif
8286
8287#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01008288 if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008289 /* At the moment, we keep TLS <= 1.2 and TLS 1.3 transform
8290 * generation separate. This should never happen. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008291 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008292 }
8293#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
8294
8295 /*
8296 * Get various info structures
8297 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008298 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(ciphersuite);
8299 if (ciphersuite_info == NULL) {
8300 MBEDTLS_SSL_DEBUG_MSG(1, ("ciphersuite info for %d not found",
8301 ciphersuite));
8302 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008303 }
8304
Neil Armstrongab555e02022-04-04 11:07:59 +02008305 ssl_mode = mbedtls_ssl_get_mode_from_ciphersuite(
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008306#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01008307 encrypt_then_mac,
Neil Armstrongf2c82f02022-04-05 11:16:53 +02008308#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
Gilles Peskine449bd832023-01-11 14:50:10 +01008309 ciphersuite_info);
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008310
Gilles Peskine449bd832023-01-11 14:50:10 +01008311 if (ssl_mode == MBEDTLS_SSL_MODE_AEAD) {
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008312 transform->taglen =
8313 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Gilles Peskine449bd832023-01-11 14:50:10 +01008314 }
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008315
8316#if defined(MBEDTLS_USE_PSA_CRYPTO)
Dave Rodgman2eab4622023-10-05 13:30:37 +01008317 if ((status = mbedtls_ssl_cipher_to_psa((mbedtls_cipher_type_t) ciphersuite_info->cipher,
Gilles Peskine449bd832023-01-11 14:50:10 +01008318 transform->taglen,
8319 &alg,
8320 &key_type,
8321 &key_bits)) != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05008322 ret = PSA_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +01008323 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_cipher_to_psa", ret);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008324 goto end;
8325 }
8326#else
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01008327 cipher_info = mbedtls_cipher_info_from_type((mbedtls_cipher_type_t) ciphersuite_info->cipher);
Gilles Peskine449bd832023-01-11 14:50:10 +01008328 if (cipher_info == NULL) {
8329 MBEDTLS_SSL_DEBUG_MSG(1, ("cipher info for %u not found",
8330 ciphersuite_info->cipher));
8331 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008332 }
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008333#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008334
Neil Armstronge4512952022-03-08 09:08:22 +01008335#if defined(MBEDTLS_USE_PSA_CRYPTO)
Dave Rodgman2eab4622023-10-05 13:30:37 +01008336 mac_alg = mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) ciphersuite_info->mac);
Gilles Peskine449bd832023-01-11 14:50:10 +01008337 if (mac_alg == 0) {
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +02008338 MBEDTLS_SSL_DEBUG_MSG(1, ("mbedtls_md_psa_alg_from_type for %u not found",
Gilles Peskine449bd832023-01-11 14:50:10 +01008339 (unsigned) ciphersuite_info->mac));
8340 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Neil Armstronge4512952022-03-08 09:08:22 +01008341 }
8342#else
Agathiyan Bragadeesh8b52b882023-07-13 13:12:40 +01008343 md_info = mbedtls_md_info_from_type((mbedtls_md_type_t) ciphersuite_info->mac);
Gilles Peskine449bd832023-01-11 14:50:10 +01008344 if (md_info == NULL) {
8345 MBEDTLS_SSL_DEBUG_MSG(1, ("mbedtls_md info for %u not found",
8346 (unsigned) ciphersuite_info->mac));
8347 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008348 }
Neil Armstronge4512952022-03-08 09:08:22 +01008349#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008350
8351#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
8352 /* Copy own and peer's CID if the use of the CID
8353 * extension has been negotiated. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008354 if (ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED) {
8355 MBEDTLS_SSL_DEBUG_MSG(3, ("Copy CIDs into SSL transform"));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008356
8357 transform->in_cid_len = ssl->own_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01008358 memcpy(transform->in_cid, ssl->own_cid, ssl->own_cid_len);
8359 MBEDTLS_SSL_DEBUG_BUF(3, "Incoming CID", transform->in_cid,
8360 transform->in_cid_len);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008361
8362 transform->out_cid_len = ssl->handshake->peer_cid_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01008363 memcpy(transform->out_cid, ssl->handshake->peer_cid,
8364 ssl->handshake->peer_cid_len);
8365 MBEDTLS_SSL_DEBUG_BUF(3, "Outgoing CID", transform->out_cid,
8366 transform->out_cid_len);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008367 }
8368#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
8369
8370 /*
8371 * Compute key block using the PRF
8372 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008373 ret = tls_prf(master, 48, "key expansion", randbytes, 64, keyblk, 256);
8374 if (ret != 0) {
8375 MBEDTLS_SSL_DEBUG_RET(1, "prf", ret);
8376 return ret;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008377 }
8378
Gilles Peskine449bd832023-01-11 14:50:10 +01008379 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite = %s",
8380 mbedtls_ssl_get_ciphersuite_name(ciphersuite)));
8381 MBEDTLS_SSL_DEBUG_BUF(3, "master secret", master, 48);
8382 MBEDTLS_SSL_DEBUG_BUF(4, "random bytes", randbytes, 64);
8383 MBEDTLS_SSL_DEBUG_BUF(4, "key block", keyblk, 256);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008384
8385 /*
8386 * Determine the appropriate key, IV and MAC length.
8387 */
8388
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008389#if defined(MBEDTLS_USE_PSA_CRYPTO)
8390 keylen = PSA_BITS_TO_BYTES(key_bits);
8391#else
Gilles Peskine449bd832023-01-11 14:50:10 +01008392 keylen = mbedtls_cipher_info_get_key_bitlen(cipher_info) / 8;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008393#endif
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008394
Valerio Settie5707042023-10-11 11:54:42 +02008395#if defined(MBEDTLS_SSL_HAVE_AEAD)
Gilles Peskine449bd832023-01-11 14:50:10 +01008396 if (ssl_mode == MBEDTLS_SSL_MODE_AEAD) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008397 size_t explicit_ivlen;
8398
8399 transform->maclen = 0;
8400 mac_key_len = 0;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008401
8402 /* All modes haves 96-bit IVs, but the length of the static parts vary
8403 * with mode and version:
8404 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes
8405 * (to be concatenated with a dynamically chosen IV of 8 Bytes)
8406 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's
8407 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record
8408 * sequence number).
8409 */
8410 transform->ivlen = 12;
David Horstmann3b2276a2022-10-06 14:49:08 +01008411
8412 int is_chachapoly = 0;
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008413#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008414 is_chachapoly = (key_type == PSA_KEY_TYPE_CHACHA20);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008415#else
Gilles Peskine449bd832023-01-11 14:50:10 +01008416 is_chachapoly = (mbedtls_cipher_info_get_mode(cipher_info)
8417 == MBEDTLS_MODE_CHACHAPOLY);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008418#endif /* MBEDTLS_USE_PSA_CRYPTO */
David Horstmann3b2276a2022-10-06 14:49:08 +01008419
Gilles Peskine449bd832023-01-11 14:50:10 +01008420 if (is_chachapoly) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008421 transform->fixed_ivlen = 12;
Gilles Peskine449bd832023-01-11 14:50:10 +01008422 } else {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008423 transform->fixed_ivlen = 4;
Gilles Peskine449bd832023-01-11 14:50:10 +01008424 }
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008425
8426 /* Minimum length of encrypted record */
8427 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
8428 transform->minlen = explicit_ivlen + transform->taglen;
Gilles Peskine449bd832023-01-11 14:50:10 +01008429 } else
Valerio Settie5707042023-10-11 11:54:42 +02008430#endif /* MBEDTLS_SSL_HAVE_AEAD */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008431#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01008432 if (ssl_mode == MBEDTLS_SSL_MODE_STREAM ||
Neil Armstrong7fea33e2022-04-01 15:40:25 +02008433 ssl_mode == MBEDTLS_SSL_MODE_CBC ||
Gilles Peskine449bd832023-01-11 14:50:10 +01008434 ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM) {
Neil Armstronge4512952022-03-08 09:08:22 +01008435#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008436 size_t block_size = PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008437#else
Dave Rodgman85a88132023-06-24 11:41:50 +01008438 size_t block_size = mbedtls_cipher_info_get_block_size(cipher_info);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008439#endif /* MBEDTLS_USE_PSA_CRYPTO */
8440
8441#if defined(MBEDTLS_USE_PSA_CRYPTO)
Neil Armstronge4512952022-03-08 09:08:22 +01008442 /* Get MAC length */
8443 mac_key_len = PSA_HASH_LENGTH(mac_alg);
8444#else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008445 /* Initialize HMAC contexts */
Gilles Peskine449bd832023-01-11 14:50:10 +01008446 if ((ret = mbedtls_md_setup(&transform->md_ctx_enc, md_info, 1)) != 0 ||
8447 (ret = mbedtls_md_setup(&transform->md_ctx_dec, md_info, 1)) != 0) {
8448 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_setup", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008449 goto end;
8450 }
8451
8452 /* Get MAC length */
Gilles Peskine449bd832023-01-11 14:50:10 +01008453 mac_key_len = mbedtls_md_get_size(md_info);
Neil Armstronge4512952022-03-08 09:08:22 +01008454#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008455 transform->maclen = mac_key_len;
8456
8457 /* IV length */
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008458#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008459 transform->ivlen = PSA_CIPHER_IV_LENGTH(key_type, alg);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008460#else
Dave Rodgmanbb521fd2023-06-24 11:21:25 +01008461 transform->ivlen = mbedtls_cipher_info_get_iv_size(cipher_info);
Neil Armstronga0eeb7f2022-04-01 17:36:10 +02008462#endif /* MBEDTLS_USE_PSA_CRYPTO */
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008463
8464 /* Minimum length */
Gilles Peskine449bd832023-01-11 14:50:10 +01008465 if (ssl_mode == MBEDTLS_SSL_MODE_STREAM) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008466 transform->minlen = transform->maclen;
Gilles Peskine449bd832023-01-11 14:50:10 +01008467 } else {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008468 /*
8469 * GenericBlockCipher:
8470 * 1. if EtM is in use: one block plus MAC
8471 * otherwise: * first multiple of blocklen greater than maclen
8472 * 2. IV
8473 */
8474#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01008475 if (ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008476 transform->minlen = transform->maclen
Gilles Peskine449bd832023-01-11 14:50:10 +01008477 + block_size;
8478 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008479#endif
8480 {
8481 transform->minlen = transform->maclen
Gilles Peskine449bd832023-01-11 14:50:10 +01008482 + block_size
8483 - transform->maclen % block_size;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008484 }
8485
Gilles Peskine449bd832023-01-11 14:50:10 +01008486 if (tls_version == MBEDTLS_SSL_VERSION_TLS1_2) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008487 transform->minlen += transform->ivlen;
Gilles Peskine449bd832023-01-11 14:50:10 +01008488 } else {
8489 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008490 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
8491 goto end;
8492 }
8493 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008494 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008495#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
8496 {
Gilles Peskine449bd832023-01-11 14:50:10 +01008497 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
8498 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008499 }
8500
Gilles Peskine449bd832023-01-11 14:50:10 +01008501 MBEDTLS_SSL_DEBUG_MSG(3, ("keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
8502 (unsigned) keylen,
8503 (unsigned) transform->minlen,
8504 (unsigned) transform->ivlen,
8505 (unsigned) transform->maclen));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008506
8507 /*
8508 * Finally setup the cipher contexts, IVs and MAC secrets.
8509 */
8510#if defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008511 if (endpoint == MBEDTLS_SSL_IS_CLIENT) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008512 key1 = keyblk + mac_key_len * 2;
8513 key2 = keyblk + mac_key_len * 2 + keylen;
8514
8515 mac_enc = keyblk;
8516 mac_dec = keyblk + mac_key_len;
8517
Gilles Peskine449bd832023-01-11 14:50:10 +01008518 iv_copy_len = (transform->fixed_ivlen) ?
8519 transform->fixed_ivlen : transform->ivlen;
8520 memcpy(transform->iv_enc, key2 + keylen, iv_copy_len);
8521 memcpy(transform->iv_dec, key2 + keylen + iv_copy_len,
8522 iv_copy_len);
8523 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008524#endif /* MBEDTLS_SSL_CLI_C */
8525#if defined(MBEDTLS_SSL_SRV_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01008526 if (endpoint == MBEDTLS_SSL_IS_SERVER) {
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008527 key1 = keyblk + mac_key_len * 2 + keylen;
8528 key2 = keyblk + mac_key_len * 2;
8529
8530 mac_enc = keyblk + mac_key_len;
8531 mac_dec = keyblk;
8532
Gilles Peskine449bd832023-01-11 14:50:10 +01008533 iv_copy_len = (transform->fixed_ivlen) ?
8534 transform->fixed_ivlen : transform->ivlen;
8535 memcpy(transform->iv_dec, key1 + keylen, iv_copy_len);
8536 memcpy(transform->iv_enc, key1 + keylen + iv_copy_len,
8537 iv_copy_len);
8538 } else
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008539#endif /* MBEDTLS_SSL_SRV_C */
8540 {
Gilles Peskine449bd832023-01-11 14:50:10 +01008541 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008542 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
8543 goto end;
8544 }
8545
Paul Elliott4fb19552023-10-18 12:15:30 +01008546 if (ssl->f_export_keys != NULL) {
Gilles Peskine449bd832023-01-11 14:50:10 +01008547 ssl->f_export_keys(ssl->p_export_keys,
8548 MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET,
8549 master, 48,
8550 randbytes + 32,
8551 randbytes,
8552 tls_prf_get_type(tls_prf));
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008553 }
8554
8555#if defined(MBEDTLS_USE_PSA_CRYPTO)
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008556 transform->psa_alg = alg;
8557
Gilles Peskine449bd832023-01-11 14:50:10 +01008558 if (alg != MBEDTLS_SSL_NULL_CIPHER) {
8559 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT);
8560 psa_set_key_algorithm(&attributes, alg);
8561 psa_set_key_type(&attributes, key_type);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008562
Gilles Peskine449bd832023-01-11 14:50:10 +01008563 if ((status = psa_import_key(&attributes,
8564 key1,
8565 PSA_BITS_TO_BYTES(key_bits),
8566 &transform->psa_key_enc)) != PSA_SUCCESS) {
8567 MBEDTLS_SSL_DEBUG_RET(3, "psa_import_key", (int) status);
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05008568 ret = PSA_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +01008569 MBEDTLS_SSL_DEBUG_RET(1, "psa_import_key", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008570 goto end;
8571 }
8572
Gilles Peskine449bd832023-01-11 14:50:10 +01008573 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008574
Gilles Peskine449bd832023-01-11 14:50:10 +01008575 if ((status = psa_import_key(&attributes,
8576 key2,
8577 PSA_BITS_TO_BYTES(key_bits),
8578 &transform->psa_key_dec)) != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05008579 ret = PSA_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +01008580 MBEDTLS_SSL_DEBUG_RET(1, "psa_import_key", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008581 goto end;
8582 }
8583 }
8584#else
Gilles Peskine449bd832023-01-11 14:50:10 +01008585 if ((ret = mbedtls_cipher_setup(&transform->cipher_ctx_enc,
8586 cipher_info)) != 0) {
8587 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setup", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008588 goto end;
8589 }
8590
Gilles Peskine449bd832023-01-11 14:50:10 +01008591 if ((ret = mbedtls_cipher_setup(&transform->cipher_ctx_dec,
8592 cipher_info)) != 0) {
8593 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setup", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008594 goto end;
8595 }
8596
Gilles Peskine449bd832023-01-11 14:50:10 +01008597 if ((ret = mbedtls_cipher_setkey(&transform->cipher_ctx_enc, key1,
8598 (int) mbedtls_cipher_info_get_key_bitlen(cipher_info),
8599 MBEDTLS_ENCRYPT)) != 0) {
8600 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setkey", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008601 goto end;
8602 }
8603
Gilles Peskine449bd832023-01-11 14:50:10 +01008604 if ((ret = mbedtls_cipher_setkey(&transform->cipher_ctx_dec, key2,
8605 (int) mbedtls_cipher_info_get_key_bitlen(cipher_info),
8606 MBEDTLS_DECRYPT)) != 0) {
8607 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setkey", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008608 goto end;
8609 }
8610
8611#if defined(MBEDTLS_CIPHER_MODE_CBC)
Gilles Peskine449bd832023-01-11 14:50:10 +01008612 if (mbedtls_cipher_info_get_mode(cipher_info) == MBEDTLS_MODE_CBC) {
8613 if ((ret = mbedtls_cipher_set_padding_mode(&transform->cipher_ctx_enc,
8614 MBEDTLS_PADDING_NONE)) != 0) {
8615 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_set_padding_mode", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008616 goto end;
8617 }
8618
Gilles Peskine449bd832023-01-11 14:50:10 +01008619 if ((ret = mbedtls_cipher_set_padding_mode(&transform->cipher_ctx_dec,
8620 MBEDTLS_PADDING_NONE)) != 0) {
8621 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_set_padding_mode", ret);
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008622 goto end;
8623 }
8624 }
8625#endif /* MBEDTLS_CIPHER_MODE_CBC */
8626#endif /* MBEDTLS_USE_PSA_CRYPTO */
8627
Neil Armstrong29c0c042022-03-17 17:47:28 +01008628#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
8629 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
8630 For AEAD-based ciphersuites, there is nothing to do here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008631 if (mac_key_len != 0) {
Neil Armstrong29c0c042022-03-17 17:47:28 +01008632#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008633 transform->psa_mac_alg = PSA_ALG_HMAC(mac_alg);
Neil Armstrong29c0c042022-03-17 17:47:28 +01008634
Gilles Peskine449bd832023-01-11 14:50:10 +01008635 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
8636 psa_set_key_algorithm(&attributes, PSA_ALG_HMAC(mac_alg));
8637 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
Neil Armstrong29c0c042022-03-17 17:47:28 +01008638
Gilles Peskine449bd832023-01-11 14:50:10 +01008639 if ((status = psa_import_key(&attributes,
8640 mac_enc, mac_key_len,
8641 &transform->psa_mac_enc)) != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05008642 ret = PSA_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +01008643 MBEDTLS_SSL_DEBUG_RET(1, "psa_import_mac_key", ret);
Neil Armstrong29c0c042022-03-17 17:47:28 +01008644 goto end;
8645 }
8646
Gilles Peskine449bd832023-01-11 14:50:10 +01008647 if ((transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER) ||
8648 ((transform->psa_alg == PSA_ALG_CBC_NO_PADDING)
Andrzej Kurek8c95ac42022-08-17 16:17:00 -04008649#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
Gilles Peskine449bd832023-01-11 14:50:10 +01008650 && (transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED)
Andrzej Kurek8c95ac42022-08-17 16:17:00 -04008651#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01008652 )) {
Neil Armstrong29c0c042022-03-17 17:47:28 +01008653 /* mbedtls_ct_hmac() requires the key to be exportable */
Gilles Peskine449bd832023-01-11 14:50:10 +01008654 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT |
8655 PSA_KEY_USAGE_VERIFY_HASH);
8656 } else {
8657 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_VERIFY_HASH);
8658 }
Neil Armstrong29c0c042022-03-17 17:47:28 +01008659
Gilles Peskine449bd832023-01-11 14:50:10 +01008660 if ((status = psa_import_key(&attributes,
8661 mac_dec, mac_key_len,
8662 &transform->psa_mac_dec)) != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05008663 ret = PSA_TO_MBEDTLS_ERR(status);
Gilles Peskine449bd832023-01-11 14:50:10 +01008664 MBEDTLS_SSL_DEBUG_RET(1, "psa_import_mac_key", ret);
Neil Armstrong29c0c042022-03-17 17:47:28 +01008665 goto end;
8666 }
8667#else
Gilles Peskine449bd832023-01-11 14:50:10 +01008668 ret = mbedtls_md_hmac_starts(&transform->md_ctx_enc, mac_enc, mac_key_len);
8669 if (ret != 0) {
Neil Armstrong29c0c042022-03-17 17:47:28 +01008670 goto end;
Gilles Peskine449bd832023-01-11 14:50:10 +01008671 }
8672 ret = mbedtls_md_hmac_starts(&transform->md_ctx_dec, mac_dec, mac_key_len);
8673 if (ret != 0) {
Neil Armstrong29c0c042022-03-17 17:47:28 +01008674 goto end;
Gilles Peskine449bd832023-01-11 14:50:10 +01008675 }
Neil Armstrong29c0c042022-03-17 17:47:28 +01008676#endif /* MBEDTLS_USE_PSA_CRYPTO */
8677 }
8678#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
8679
8680 ((void) mac_dec);
8681 ((void) mac_enc);
8682
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008683end:
Gilles Peskine449bd832023-01-11 14:50:10 +01008684 mbedtls_platform_zeroize(keyblk, sizeof(keyblk));
8685 return ret;
Jerry Yu9bccc4c2022-02-17 14:38:28 +08008686}
8687
Valerio Settia08b1a42022-11-17 15:10:02 +01008688#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \
8689 defined(MBEDTLS_USE_PSA_CRYPTO)
Valerio Setti6b3dab02022-11-17 17:14:54 +01008690int mbedtls_psa_ecjpake_read_round(
Gilles Peskine449bd832023-01-11 14:50:10 +01008691 psa_pake_operation_t *pake_ctx,
8692 const unsigned char *buf,
8693 size_t len, mbedtls_ecjpake_rounds_t round)
Valerio Settia08b1a42022-11-17 15:10:02 +01008694{
8695 psa_status_t status;
8696 size_t input_offset = 0;
Valerio Setti819de862022-11-17 18:05:19 +01008697 /*
Valerio Setti6b3dab02022-11-17 17:14:54 +01008698 * At round one repeat the KEY_SHARE, ZK_PUBLIC & ZF_PROOF twice
8699 * At round two perform a single cycle
8700 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008701 unsigned int remaining_steps = (round == MBEDTLS_ECJPAKE_ROUND_ONE) ? 2 : 1;
Valerio Settia08b1a42022-11-17 15:10:02 +01008702
Gilles Peskine449bd832023-01-11 14:50:10 +01008703 for (; remaining_steps > 0; remaining_steps--) {
8704 for (psa_pake_step_t step = PSA_PAKE_STEP_KEY_SHARE;
Valerio Settia08b1a42022-11-17 15:10:02 +01008705 step <= PSA_PAKE_STEP_ZK_PROOF;
Gilles Peskine449bd832023-01-11 14:50:10 +01008706 ++step) {
Valerio Settia08b1a42022-11-17 15:10:02 +01008707 /* Length is stored at the first byte */
8708 size_t length = buf[input_offset];
8709 input_offset += 1;
8710
Gilles Peskine449bd832023-01-11 14:50:10 +01008711 if (input_offset + length > len) {
Valerio Settia08b1a42022-11-17 15:10:02 +01008712 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
8713 }
8714
Gilles Peskine449bd832023-01-11 14:50:10 +01008715 status = psa_pake_input(pake_ctx, step,
8716 buf + input_offset, length);
8717 if (status != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05008718 return PSA_TO_MBEDTLS_ERR(status);
Valerio Settia08b1a42022-11-17 15:10:02 +01008719 }
8720
8721 input_offset += length;
8722 }
8723 }
8724
Gilles Peskine449bd832023-01-11 14:50:10 +01008725 if (input_offset != len) {
Valerio Setti61ea17d2022-11-18 12:11:00 +01008726 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01008727 }
Valerio Setti30ebe112022-11-17 16:23:34 +01008728
Gilles Peskine449bd832023-01-11 14:50:10 +01008729 return 0;
Valerio Settia08b1a42022-11-17 15:10:02 +01008730}
8731
Valerio Setti6b3dab02022-11-17 17:14:54 +01008732int mbedtls_psa_ecjpake_write_round(
Gilles Peskine449bd832023-01-11 14:50:10 +01008733 psa_pake_operation_t *pake_ctx,
8734 unsigned char *buf,
8735 size_t len, size_t *olen,
8736 mbedtls_ecjpake_rounds_t round)
Valerio Settia08b1a42022-11-17 15:10:02 +01008737{
8738 psa_status_t status;
8739 size_t output_offset = 0;
8740 size_t output_len;
Valerio Setti819de862022-11-17 18:05:19 +01008741 /*
Valerio Setti6b3dab02022-11-17 17:14:54 +01008742 * At round one repeat the KEY_SHARE, ZK_PUBLIC & ZF_PROOF twice
8743 * At round two perform a single cycle
8744 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008745 unsigned int remaining_steps = (round == MBEDTLS_ECJPAKE_ROUND_ONE) ? 2 : 1;
Valerio Settia08b1a42022-11-17 15:10:02 +01008746
Gilles Peskine449bd832023-01-11 14:50:10 +01008747 for (; remaining_steps > 0; remaining_steps--) {
8748 for (psa_pake_step_t step = PSA_PAKE_STEP_KEY_SHARE;
8749 step <= PSA_PAKE_STEP_ZK_PROOF;
8750 ++step) {
Valerio Setti79f6b6b2022-11-21 14:17:03 +01008751 /*
Valerio Settid4a9b1a2022-11-22 11:11:10 +01008752 * For each step, prepend 1 byte with the length of the data as
8753 * given by psa_pake_output().
Valerio Setti79f6b6b2022-11-21 14:17:03 +01008754 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008755 status = psa_pake_output(pake_ctx, step,
8756 buf + output_offset + 1,
8757 len - output_offset - 1,
8758 &output_len);
8759 if (status != PSA_SUCCESS) {
Andrzej Kurek8a045ce2022-12-23 11:00:06 -05008760 return PSA_TO_MBEDTLS_ERR(status);
Valerio Settia08b1a42022-11-17 15:10:02 +01008761 }
8762
Valerio Setti99d88c12022-11-22 16:03:43 +01008763 *(buf + output_offset) = (uint8_t) output_len;
Valerio Setti79f6b6b2022-11-21 14:17:03 +01008764
8765 output_offset += output_len + 1;
Valerio Settia08b1a42022-11-17 15:10:02 +01008766 }
8767 }
8768
8769 *olen = output_offset;
8770
Gilles Peskine449bd832023-01-11 14:50:10 +01008771 return 0;
Valerio Settia08b1a42022-11-17 15:10:02 +01008772}
Valerio Settia08b1a42022-11-17 15:10:02 +01008773#endif //MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED && MBEDTLS_USE_PSA_CRYPTO
8774
Jerry Yuee40f9d2022-02-17 14:55:16 +08008775#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008776int mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context *ssl,
8777 unsigned char *hash, size_t *hashlen,
8778 unsigned char *data, size_t data_len,
8779 mbedtls_md_type_t md_alg)
Jerry Yuee40f9d2022-02-17 14:55:16 +08008780{
8781 psa_status_t status;
8782 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT;
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +02008783 psa_algorithm_t hash_alg = mbedtls_md_psa_alg_from_type(md_alg);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008784
Gilles Peskine449bd832023-01-11 14:50:10 +01008785 MBEDTLS_SSL_DEBUG_MSG(3, ("Perform PSA-based computation of digest of ServerKeyExchange"));
Jerry Yuee40f9d2022-02-17 14:55:16 +08008786
Gilles Peskine449bd832023-01-11 14:50:10 +01008787 if ((status = psa_hash_setup(&hash_operation,
8788 hash_alg)) != PSA_SUCCESS) {
8789 MBEDTLS_SSL_DEBUG_RET(1, "psa_hash_setup", status);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008790 goto exit;
8791 }
8792
Gilles Peskine449bd832023-01-11 14:50:10 +01008793 if ((status = psa_hash_update(&hash_operation, ssl->handshake->randbytes,
8794 64)) != PSA_SUCCESS) {
8795 MBEDTLS_SSL_DEBUG_RET(1, "psa_hash_update", status);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008796 goto exit;
8797 }
8798
Gilles Peskine449bd832023-01-11 14:50:10 +01008799 if ((status = psa_hash_update(&hash_operation,
8800 data, data_len)) != PSA_SUCCESS) {
8801 MBEDTLS_SSL_DEBUG_RET(1, "psa_hash_update", status);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008802 goto exit;
8803 }
8804
Gilles Peskine449bd832023-01-11 14:50:10 +01008805 if ((status = psa_hash_finish(&hash_operation, hash, PSA_HASH_MAX_SIZE,
8806 hashlen)) != PSA_SUCCESS) {
8807 MBEDTLS_SSL_DEBUG_RET(1, "psa_hash_finish", status);
8808 goto exit;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008809 }
8810
8811exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01008812 if (status != PSA_SUCCESS) {
8813 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8814 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
8815 switch (status) {
Jerry Yuee40f9d2022-02-17 14:55:16 +08008816 case PSA_ERROR_NOT_SUPPORTED:
Gilles Peskine449bd832023-01-11 14:50:10 +01008817 return MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008818 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */
8819 case PSA_ERROR_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +01008820 return MBEDTLS_ERR_MD_BAD_INPUT_DATA;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008821 case PSA_ERROR_INSUFFICIENT_MEMORY:
Gilles Peskine449bd832023-01-11 14:50:10 +01008822 return MBEDTLS_ERR_MD_ALLOC_FAILED;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008823 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01008824 return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008825 }
8826 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008827 return 0;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008828}
8829
8830#else
8831
Gilles Peskine449bd832023-01-11 14:50:10 +01008832int mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context *ssl,
8833 unsigned char *hash, size_t *hashlen,
8834 unsigned char *data, size_t data_len,
8835 mbedtls_md_type_t md_alg)
Jerry Yuee40f9d2022-02-17 14:55:16 +08008836{
8837 int ret = 0;
8838 mbedtls_md_context_t ctx;
Gilles Peskine449bd832023-01-11 14:50:10 +01008839 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_alg);
8840 *hashlen = mbedtls_md_get_size(md_info);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008841
Gilles Peskine449bd832023-01-11 14:50:10 +01008842 MBEDTLS_SSL_DEBUG_MSG(3, ("Perform mbedtls-based computation of digest of ServerKeyExchange"));
Jerry Yuee40f9d2022-02-17 14:55:16 +08008843
Gilles Peskine449bd832023-01-11 14:50:10 +01008844 mbedtls_md_init(&ctx);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008845
8846 /*
8847 * digitally-signed struct {
8848 * opaque client_random[32];
8849 * opaque server_random[32];
8850 * ServerDHParams params;
8851 * };
8852 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008853 if ((ret = mbedtls_md_setup(&ctx, md_info, 0)) != 0) {
8854 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_setup", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008855 goto exit;
8856 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008857 if ((ret = mbedtls_md_starts(&ctx)) != 0) {
8858 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_starts", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008859 goto exit;
8860 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008861 if ((ret = mbedtls_md_update(&ctx, ssl->handshake->randbytes, 64)) != 0) {
8862 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_update", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008863 goto exit;
8864 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008865 if ((ret = mbedtls_md_update(&ctx, data, data_len)) != 0) {
8866 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_update", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008867 goto exit;
8868 }
Gilles Peskine449bd832023-01-11 14:50:10 +01008869 if ((ret = mbedtls_md_finish(&ctx, hash)) != 0) {
8870 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_md_finish", ret);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008871 goto exit;
8872 }
8873
8874exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01008875 mbedtls_md_free(&ctx);
Jerry Yuee40f9d2022-02-17 14:55:16 +08008876
Gilles Peskine449bd832023-01-11 14:50:10 +01008877 if (ret != 0) {
8878 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8879 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
8880 }
Jerry Yuee40f9d2022-02-17 14:55:16 +08008881
Gilles Peskine449bd832023-01-11 14:50:10 +01008882 return ret;
Jerry Yuee40f9d2022-02-17 14:55:16 +08008883}
8884#endif /* MBEDTLS_USE_PSA_CRYPTO */
8885
Jerry Yud9d91da2022-02-17 14:57:06 +08008886#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
8887
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008888/* Find the preferred hash for a given signature algorithm. */
8889unsigned int mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
Gilles Peskine449bd832023-01-11 14:50:10 +01008890 mbedtls_ssl_context *ssl,
8891 unsigned int sig_alg)
Jerry Yud9d91da2022-02-17 14:57:06 +08008892{
Gabor Mezei078e8032022-04-27 21:17:56 +02008893 unsigned int i;
Gabor Mezeia3d016c2022-05-10 12:44:09 +02008894 uint16_t *received_sig_algs = ssl->handshake->received_sig_algs;
Gabor Mezei078e8032022-04-27 21:17:56 +02008895
Gilles Peskine449bd832023-01-11 14:50:10 +01008896 if (sig_alg == MBEDTLS_SSL_SIG_ANON) {
8897 return MBEDTLS_SSL_HASH_NONE;
8898 }
Gabor Mezei078e8032022-04-27 21:17:56 +02008899
Gilles Peskine449bd832023-01-11 14:50:10 +01008900 for (i = 0; received_sig_algs[i] != MBEDTLS_TLS_SIG_NONE; i++) {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008901 unsigned int hash_alg_received =
Gilles Peskine449bd832023-01-11 14:50:10 +01008902 MBEDTLS_SSL_TLS12_HASH_ALG_FROM_SIG_AND_HASH_ALG(
8903 received_sig_algs[i]);
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008904 unsigned int sig_alg_received =
Gilles Peskine449bd832023-01-11 14:50:10 +01008905 MBEDTLS_SSL_TLS12_SIG_ALG_FROM_SIG_AND_HASH_ALG(
8906 received_sig_algs[i]);
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008907
Manuel Pégourié-Gonnard47bb3802023-06-05 12:40:32 +02008908 mbedtls_md_type_t md_alg =
8909 mbedtls_ssl_md_alg_from_hash((unsigned char) hash_alg_received);
8910 if (md_alg == MBEDTLS_MD_NONE) {
8911 continue;
8912 }
8913
Gilles Peskine449bd832023-01-11 14:50:10 +01008914 if (sig_alg == sig_alg_received) {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008915#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01008916 if (ssl->handshake->key_cert && ssl->handshake->key_cert->key) {
Neil Armstrong96eceb82022-06-30 18:05:05 +02008917 psa_algorithm_t psa_hash_alg =
Manuel Pégourié-Gonnard47bb3802023-06-05 12:40:32 +02008918 mbedtls_md_psa_alg_from_type(md_alg);
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008919
Gilles Peskine449bd832023-01-11 14:50:10 +01008920 if (sig_alg_received == MBEDTLS_SSL_SIG_ECDSA &&
8921 !mbedtls_pk_can_do_ext(ssl->handshake->key_cert->key,
8922 PSA_ALG_ECDSA(psa_hash_alg),
8923 PSA_KEY_USAGE_SIGN_HASH)) {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008924 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01008925 }
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008926
Gilles Peskine449bd832023-01-11 14:50:10 +01008927 if (sig_alg_received == MBEDTLS_SSL_SIG_RSA &&
8928 !mbedtls_pk_can_do_ext(ssl->handshake->key_cert->key,
8929 PSA_ALG_RSA_PKCS1V15_SIGN(
8930 psa_hash_alg),
8931 PSA_KEY_USAGE_SIGN_HASH)) {
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008932 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01008933 }
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008934 }
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008935#endif /* MBEDTLS_USE_PSA_CRYPTO */
Neil Armstrong96eceb82022-06-30 18:05:05 +02008936
Gilles Peskine449bd832023-01-11 14:50:10 +01008937 return hash_alg_received;
Neil Armstrong9f1176a2022-06-24 18:19:19 +02008938 }
Jerry Yud9d91da2022-02-17 14:57:06 +08008939 }
Jerry Yud9d91da2022-02-17 14:57:06 +08008940
Gilles Peskine449bd832023-01-11 14:50:10 +01008941 return MBEDTLS_SSL_HASH_NONE;
Jerry Yud9d91da2022-02-17 14:57:06 +08008942}
8943
8944#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
8945
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008946/* Serialization of TLS 1.2 sessions:
8947 *
8948 * struct {
8949 * uint64 start_time;
8950 * uint8 ciphersuite[2]; // defined by the standard
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008951 * uint8 session_id_len; // at most 32
8952 * opaque session_id[32];
8953 * opaque master[48]; // fixed length in the standard
8954 * uint32 verify_result;
8955 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert
8956 * opaque ticket<0..2^24-1>; // length 0 means no ticket
8957 * uint32 ticket_lifetime;
8958 * uint8 mfl_code; // up to 255 according to standard
8959 * uint8 encrypt_then_mac; // 0 or 1
8960 * } serialized_session_tls12;
8961 *
8962 */
Gilles Peskine449bd832023-01-11 14:50:10 +01008963static size_t ssl_tls12_session_save(const mbedtls_ssl_session *session,
8964 unsigned char *buf,
8965 size_t buf_len)
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008966{
8967 unsigned char *p = buf;
8968 size_t used = 0;
8969
8970#if defined(MBEDTLS_HAVE_TIME)
8971 uint64_t start;
8972#endif
8973#if defined(MBEDTLS_X509_CRT_PARSE_C)
8974#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
8975 size_t cert_len;
8976#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
8977#endif /* MBEDTLS_X509_CRT_PARSE_C */
8978
8979 /*
8980 * Time
8981 */
8982#if defined(MBEDTLS_HAVE_TIME)
8983 used += 8;
8984
Gilles Peskine449bd832023-01-11 14:50:10 +01008985 if (used <= buf_len) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008986 start = (uint64_t) session->start;
8987
Gilles Peskine449bd832023-01-11 14:50:10 +01008988 MBEDTLS_PUT_UINT64_BE(start, p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08008989 p += 8;
8990 }
8991#endif /* MBEDTLS_HAVE_TIME */
8992
8993 /*
8994 * Basic mandatory fields
8995 */
8996 used += 2 /* ciphersuite */
Gilles Peskine449bd832023-01-11 14:50:10 +01008997 + 1 /* id_len */
8998 + sizeof(session->id)
8999 + sizeof(session->master)
9000 + 4; /* verify_result */
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009001
Gilles Peskine449bd832023-01-11 14:50:10 +01009002 if (used <= buf_len) {
9003 MBEDTLS_PUT_UINT16_BE(session->ciphersuite, p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009004 p += 2;
9005
Gilles Peskine449bd832023-01-11 14:50:10 +01009006 *p++ = MBEDTLS_BYTE_0(session->id_len);
9007 memcpy(p, session->id, 32);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009008 p += 32;
9009
Gilles Peskine449bd832023-01-11 14:50:10 +01009010 memcpy(p, session->master, 48);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009011 p += 48;
9012
Gilles Peskine449bd832023-01-11 14:50:10 +01009013 MBEDTLS_PUT_UINT32_BE(session->verify_result, p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009014 p += 4;
9015 }
9016
9017 /*
9018 * Peer's end-entity certificate
9019 */
9020#if defined(MBEDTLS_X509_CRT_PARSE_C)
9021#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01009022 if (session->peer_cert == NULL) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009023 cert_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01009024 } else {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009025 cert_len = session->peer_cert->raw.len;
Gilles Peskine449bd832023-01-11 14:50:10 +01009026 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009027
9028 used += 3 + cert_len;
9029
Gilles Peskine449bd832023-01-11 14:50:10 +01009030 if (used <= buf_len) {
9031 *p++ = MBEDTLS_BYTE_2(cert_len);
9032 *p++ = MBEDTLS_BYTE_1(cert_len);
9033 *p++ = MBEDTLS_BYTE_0(cert_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009034
Gilles Peskine449bd832023-01-11 14:50:10 +01009035 if (session->peer_cert != NULL) {
9036 memcpy(p, session->peer_cert->raw.p, cert_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009037 p += cert_len;
9038 }
9039 }
9040#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Gilles Peskine449bd832023-01-11 14:50:10 +01009041 if (session->peer_cert_digest != NULL) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009042 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01009043 if (used <= buf_len) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009044 *p++ = (unsigned char) session->peer_cert_digest_type;
9045 *p++ = (unsigned char) session->peer_cert_digest_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01009046 memcpy(p, session->peer_cert_digest,
9047 session->peer_cert_digest_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009048 p += session->peer_cert_digest_len;
9049 }
Gilles Peskine449bd832023-01-11 14:50:10 +01009050 } else {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009051 used += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01009052 if (used <= buf_len) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009053 *p++ = (unsigned char) MBEDTLS_MD_NONE;
9054 *p++ = 0;
9055 }
9056 }
9057#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
9058#endif /* MBEDTLS_X509_CRT_PARSE_C */
9059
9060 /*
9061 * Session ticket if any, plus associated data
9062 */
9063#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
9064 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */
9065
Gilles Peskine449bd832023-01-11 14:50:10 +01009066 if (used <= buf_len) {
9067 *p++ = MBEDTLS_BYTE_2(session->ticket_len);
9068 *p++ = MBEDTLS_BYTE_1(session->ticket_len);
9069 *p++ = MBEDTLS_BYTE_0(session->ticket_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009070
Gilles Peskine449bd832023-01-11 14:50:10 +01009071 if (session->ticket != NULL) {
9072 memcpy(p, session->ticket, session->ticket_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009073 p += session->ticket_len;
9074 }
9075
Gilles Peskine449bd832023-01-11 14:50:10 +01009076 MBEDTLS_PUT_UINT32_BE(session->ticket_lifetime, p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009077 p += 4;
9078 }
9079#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
9080
9081 /*
9082 * Misc extension-related info
9083 */
9084#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
9085 used += 1;
9086
Gilles Peskine449bd832023-01-11 14:50:10 +01009087 if (used <= buf_len) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009088 *p++ = session->mfl_code;
Gilles Peskine449bd832023-01-11 14:50:10 +01009089 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009090#endif
9091
9092#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
9093 used += 1;
9094
Gilles Peskine449bd832023-01-11 14:50:10 +01009095 if (used <= buf_len) {
9096 *p++ = MBEDTLS_BYTE_0(session->encrypt_then_mac);
9097 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009098#endif
9099
Gilles Peskine449bd832023-01-11 14:50:10 +01009100 return used;
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009101}
9102
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02009103MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01009104static int ssl_tls12_session_load(mbedtls_ssl_session *session,
9105 const unsigned char *buf,
9106 size_t len)
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009107{
9108#if defined(MBEDTLS_HAVE_TIME)
9109 uint64_t start;
9110#endif
9111#if defined(MBEDTLS_X509_CRT_PARSE_C)
9112#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
9113 size_t cert_len;
9114#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
9115#endif /* MBEDTLS_X509_CRT_PARSE_C */
9116
9117 const unsigned char *p = buf;
9118 const unsigned char * const end = buf + len;
9119
9120 /*
9121 * Time
9122 */
9123#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +01009124 if (8 > (size_t) (end - p)) {
9125 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9126 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009127
Thomas Daubneyf9f0ba82023-05-23 17:34:33 +01009128 start = MBEDTLS_GET_UINT64_BE(p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009129 p += 8;
9130
9131 session->start = (time_t) start;
9132#endif /* MBEDTLS_HAVE_TIME */
9133
9134 /*
9135 * Basic mandatory fields
9136 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009137 if (2 + 1 + 32 + 48 + 4 > (size_t) (end - p)) {
9138 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9139 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009140
Dave Rodgmana3d0f612023-11-03 23:34:02 +00009141 session->ciphersuite = MBEDTLS_GET_UINT16_BE(p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009142 p += 2;
9143
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009144 session->id_len = *p++;
Gilles Peskine449bd832023-01-11 14:50:10 +01009145 memcpy(session->id, p, 32);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009146 p += 32;
9147
Gilles Peskine449bd832023-01-11 14:50:10 +01009148 memcpy(session->master, p, 48);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009149 p += 48;
9150
Thomas Daubneyf9f0ba82023-05-23 17:34:33 +01009151 session->verify_result = MBEDTLS_GET_UINT32_BE(p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009152 p += 4;
9153
9154 /* Immediately clear invalid pointer values that have been read, in case
9155 * we exit early before we replaced them with valid ones. */
9156#if defined(MBEDTLS_X509_CRT_PARSE_C)
9157#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
9158 session->peer_cert = NULL;
9159#else
9160 session->peer_cert_digest = NULL;
9161#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
9162#endif /* MBEDTLS_X509_CRT_PARSE_C */
9163#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
9164 session->ticket = NULL;
9165#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
9166
9167 /*
9168 * Peer certificate
9169 */
9170#if defined(MBEDTLS_X509_CRT_PARSE_C)
9171#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
9172 /* Deserialize CRT from the end of the ticket. */
Gilles Peskine449bd832023-01-11 14:50:10 +01009173 if (3 > (size_t) (end - p)) {
9174 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9175 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009176
Dave Rodgmana3d0f612023-11-03 23:34:02 +00009177 cert_len = MBEDTLS_GET_UINT24_BE(p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009178 p += 3;
9179
Gilles Peskine449bd832023-01-11 14:50:10 +01009180 if (cert_len != 0) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009181 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
9182
Gilles Peskine449bd832023-01-11 14:50:10 +01009183 if (cert_len > (size_t) (end - p)) {
9184 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9185 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009186
Gilles Peskine449bd832023-01-11 14:50:10 +01009187 session->peer_cert = mbedtls_calloc(1, sizeof(mbedtls_x509_crt));
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009188
Gilles Peskine449bd832023-01-11 14:50:10 +01009189 if (session->peer_cert == NULL) {
9190 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
9191 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009192
Gilles Peskine449bd832023-01-11 14:50:10 +01009193 mbedtls_x509_crt_init(session->peer_cert);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009194
Gilles Peskine449bd832023-01-11 14:50:10 +01009195 if ((ret = mbedtls_x509_crt_parse_der(session->peer_cert,
9196 p, cert_len)) != 0) {
9197 mbedtls_x509_crt_free(session->peer_cert);
9198 mbedtls_free(session->peer_cert);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009199 session->peer_cert = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01009200 return ret;
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009201 }
9202
9203 p += cert_len;
9204 }
9205#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
9206 /* Deserialize CRT digest from the end of the ticket. */
Gilles Peskine449bd832023-01-11 14:50:10 +01009207 if (2 > (size_t) (end - p)) {
9208 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9209 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009210
9211 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++;
9212 session->peer_cert_digest_len = (size_t) *p++;
9213
Gilles Peskine449bd832023-01-11 14:50:10 +01009214 if (session->peer_cert_digest_len != 0) {
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009215 const mbedtls_md_info_t *md_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01009216 mbedtls_md_info_from_type(session->peer_cert_digest_type);
9217 if (md_info == NULL) {
9218 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9219 }
9220 if (session->peer_cert_digest_len != mbedtls_md_get_size(md_info)) {
9221 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9222 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009223
Gilles Peskine449bd832023-01-11 14:50:10 +01009224 if (session->peer_cert_digest_len > (size_t) (end - p)) {
9225 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9226 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009227
9228 session->peer_cert_digest =
Gilles Peskine449bd832023-01-11 14:50:10 +01009229 mbedtls_calloc(1, session->peer_cert_digest_len);
9230 if (session->peer_cert_digest == NULL) {
9231 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
9232 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009233
Gilles Peskine449bd832023-01-11 14:50:10 +01009234 memcpy(session->peer_cert_digest, p,
9235 session->peer_cert_digest_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009236 p += session->peer_cert_digest_len;
9237 }
9238#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
9239#endif /* MBEDTLS_X509_CRT_PARSE_C */
9240
9241 /*
9242 * Session ticket and associated data
9243 */
9244#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01009245 if (3 > (size_t) (end - p)) {
9246 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9247 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009248
Dave Rodgmana3d0f612023-11-03 23:34:02 +00009249 session->ticket_len = MBEDTLS_GET_UINT24_BE(p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009250 p += 3;
9251
Gilles Peskine449bd832023-01-11 14:50:10 +01009252 if (session->ticket_len != 0) {
9253 if (session->ticket_len > (size_t) (end - p)) {
9254 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9255 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009256
Gilles Peskine449bd832023-01-11 14:50:10 +01009257 session->ticket = mbedtls_calloc(1, session->ticket_len);
9258 if (session->ticket == NULL) {
9259 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
9260 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009261
Gilles Peskine449bd832023-01-11 14:50:10 +01009262 memcpy(session->ticket, p, session->ticket_len);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009263 p += session->ticket_len;
9264 }
9265
Gilles Peskine449bd832023-01-11 14:50:10 +01009266 if (4 > (size_t) (end - p)) {
9267 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9268 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009269
Thomas Daubneyf9f0ba82023-05-23 17:34:33 +01009270 session->ticket_lifetime = MBEDTLS_GET_UINT32_BE(p, 0);
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009271 p += 4;
9272#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
9273
9274 /*
9275 * Misc extension-related info
9276 */
9277#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Gilles Peskine449bd832023-01-11 14:50:10 +01009278 if (1 > (size_t) (end - p)) {
9279 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9280 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009281
9282 session->mfl_code = *p++;
9283#endif
9284
9285#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Gilles Peskine449bd832023-01-11 14:50:10 +01009286 if (1 > (size_t) (end - p)) {
9287 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9288 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009289
9290 session->encrypt_then_mac = *p++;
9291#endif
9292
9293 /* Done, should have consumed entire buffer */
Gilles Peskine449bd832023-01-11 14:50:10 +01009294 if (p != end) {
9295 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9296 }
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009297
Gilles Peskine449bd832023-01-11 14:50:10 +01009298 return 0;
Jerry Yu4f9e3ef2022-02-17 14:58:27 +08009299}
Jerry Yudc7bd172022-02-17 13:44:15 +08009300#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
9301
XiaokangQian75d40ef2022-04-20 11:05:24 +00009302int mbedtls_ssl_validate_ciphersuite(
9303 const mbedtls_ssl_context *ssl,
9304 const mbedtls_ssl_ciphersuite_t *suite_info,
9305 mbedtls_ssl_protocol_version min_tls_version,
Gilles Peskine449bd832023-01-11 14:50:10 +01009306 mbedtls_ssl_protocol_version max_tls_version)
XiaokangQian75d40ef2022-04-20 11:05:24 +00009307{
9308 (void) ssl;
9309
Gilles Peskine449bd832023-01-11 14:50:10 +01009310 if (suite_info == NULL) {
9311 return -1;
9312 }
XiaokangQian75d40ef2022-04-20 11:05:24 +00009313
Gilles Peskine449bd832023-01-11 14:50:10 +01009314 if ((suite_info->min_tls_version > max_tls_version) ||
9315 (suite_info->max_tls_version < min_tls_version)) {
9316 return -1;
XiaokangQian75d40ef2022-04-20 11:05:24 +00009317 }
9318
XiaokangQian060d8672022-04-21 09:24:56 +00009319#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_CLI_C)
XiaokangQian75d40ef2022-04-20 11:05:24 +00009320#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Neil Armstrongca7d5062022-05-31 14:43:23 +02009321#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01009322 if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
9323 ssl->handshake->psa_pake_ctx_is_ok != 1)
Neil Armstrongca7d5062022-05-31 14:43:23 +02009324#else
Gilles Peskine449bd832023-01-11 14:50:10 +01009325 if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
9326 mbedtls_ecjpake_check(&ssl->handshake->ecjpake_ctx) != 0)
Neil Armstrongca7d5062022-05-31 14:43:23 +02009327#endif /* MBEDTLS_USE_PSA_CRYPTO */
XiaokangQian75d40ef2022-04-20 11:05:24 +00009328 {
Gilles Peskine449bd832023-01-11 14:50:10 +01009329 return -1;
XiaokangQian75d40ef2022-04-20 11:05:24 +00009330 }
9331#endif
9332
9333 /* Don't suggest PSK-based ciphersuite if no PSK is available. */
9334#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01009335 if (mbedtls_ssl_ciphersuite_uses_psk(suite_info) &&
9336 mbedtls_ssl_conf_has_static_psk(ssl->conf) == 0) {
9337 return -1;
XiaokangQian75d40ef2022-04-20 11:05:24 +00009338 }
9339#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
9340#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
9341
Gilles Peskine449bd832023-01-11 14:50:10 +01009342 return 0;
XiaokangQian75d40ef2022-04-20 11:05:24 +00009343}
9344
Ronald Crone68ab4f2022-10-05 12:46:29 +02009345#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
XiaokangQianeaf36512022-04-24 09:07:44 +00009346/*
9347 * Function for writing a signature algorithm extension.
9348 *
9349 * The `extension_data` field of signature algorithm contains a `SignatureSchemeList`
9350 * value (TLS 1.3 RFC8446):
9351 * enum {
9352 * ....
9353 * ecdsa_secp256r1_sha256( 0x0403 ),
9354 * ecdsa_secp384r1_sha384( 0x0503 ),
9355 * ecdsa_secp521r1_sha512( 0x0603 ),
9356 * ....
9357 * } SignatureScheme;
9358 *
9359 * struct {
9360 * SignatureScheme supported_signature_algorithms<2..2^16-2>;
9361 * } SignatureSchemeList;
9362 *
9363 * The `extension_data` field of signature algorithm contains a `SignatureAndHashAlgorithm`
9364 * value (TLS 1.2 RFC5246):
9365 * enum {
9366 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
9367 * sha512(6), (255)
9368 * } HashAlgorithm;
9369 *
9370 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
9371 * SignatureAlgorithm;
9372 *
9373 * struct {
9374 * HashAlgorithm hash;
9375 * SignatureAlgorithm signature;
9376 * } SignatureAndHashAlgorithm;
9377 *
9378 * SignatureAndHashAlgorithm
9379 * supported_signature_algorithms<2..2^16-2>;
9380 *
9381 * The TLS 1.3 signature algorithm extension was defined to be a compatible
9382 * generalization of the TLS 1.2 signature algorithm extension.
9383 * `SignatureAndHashAlgorithm` field of TLS 1.2 can be represented by
9384 * `SignatureScheme` field of TLS 1.3
9385 *
9386 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009387int mbedtls_ssl_write_sig_alg_ext(mbedtls_ssl_context *ssl, unsigned char *buf,
9388 const unsigned char *end, size_t *out_len)
XiaokangQianeaf36512022-04-24 09:07:44 +00009389{
9390 unsigned char *p = buf;
9391 unsigned char *supported_sig_alg; /* Start of supported_signature_algorithms */
9392 size_t supported_sig_alg_len = 0; /* Length of supported_signature_algorithms */
9393
9394 *out_len = 0;
9395
Gilles Peskine449bd832023-01-11 14:50:10 +01009396 MBEDTLS_SSL_DEBUG_MSG(3, ("adding signature_algorithms extension"));
XiaokangQianeaf36512022-04-24 09:07:44 +00009397
9398 /* Check if we have space for header and length field:
9399 * - extension_type (2 bytes)
9400 * - extension_data_length (2 bytes)
9401 * - supported_signature_algorithms_length (2 bytes)
9402 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009403 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 6);
XiaokangQianeaf36512022-04-24 09:07:44 +00009404 p += 6;
9405
9406 /*
9407 * Write supported_signature_algorithms
9408 */
9409 supported_sig_alg = p;
Gilles Peskine449bd832023-01-11 14:50:10 +01009410 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs(ssl);
9411 if (sig_alg == NULL) {
9412 return MBEDTLS_ERR_SSL_BAD_CONFIG;
9413 }
XiaokangQianeaf36512022-04-24 09:07:44 +00009414
Gilles Peskine449bd832023-01-11 14:50:10 +01009415 for (; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++) {
9416 MBEDTLS_SSL_DEBUG_MSG(3, ("got signature scheme [%x] %s",
9417 *sig_alg,
9418 mbedtls_ssl_sig_alg_to_str(*sig_alg)));
9419 if (!mbedtls_ssl_sig_alg_is_supported(ssl, *sig_alg)) {
XiaokangQianeaf36512022-04-24 09:07:44 +00009420 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01009421 }
9422 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
9423 MBEDTLS_PUT_UINT16_BE(*sig_alg, p, 0);
XiaokangQianeaf36512022-04-24 09:07:44 +00009424 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01009425 MBEDTLS_SSL_DEBUG_MSG(3, ("sent signature scheme [%x] %s",
9426 *sig_alg,
9427 mbedtls_ssl_sig_alg_to_str(*sig_alg)));
XiaokangQianeaf36512022-04-24 09:07:44 +00009428 }
9429
9430 /* Length of supported_signature_algorithms */
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00009431 supported_sig_alg_len = (size_t) (p - supported_sig_alg);
Gilles Peskine449bd832023-01-11 14:50:10 +01009432 if (supported_sig_alg_len == 0) {
9433 MBEDTLS_SSL_DEBUG_MSG(1, ("No signature algorithms defined."));
9434 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
XiaokangQianeaf36512022-04-24 09:07:44 +00009435 }
9436
Gilles Peskine449bd832023-01-11 14:50:10 +01009437 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SIG_ALG, buf, 0);
9438 MBEDTLS_PUT_UINT16_BE(supported_sig_alg_len + 2, buf, 2);
9439 MBEDTLS_PUT_UINT16_BE(supported_sig_alg_len, buf, 4);
XiaokangQianeaf36512022-04-24 09:07:44 +00009440
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00009441 *out_len = (size_t) (p - buf);
XiaokangQianeaf36512022-04-24 09:07:44 +00009442
9443#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01009444 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_SIG_ALG);
XiaokangQianeaf36512022-04-24 09:07:44 +00009445#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yu0c354a22022-08-29 15:25:36 +08009446
Gilles Peskine449bd832023-01-11 14:50:10 +01009447 return 0;
XiaokangQianeaf36512022-04-24 09:07:44 +00009448}
Ronald Crone68ab4f2022-10-05 12:46:29 +02009449#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
XiaokangQianeaf36512022-04-24 09:07:44 +00009450
XiaokangQian40a35232022-05-07 09:02:40 +00009451#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
XiaokangQian9b2b7712022-05-17 02:57:00 +00009452/*
9453 * mbedtls_ssl_parse_server_name_ext
9454 *
9455 * Structure of server_name extension:
9456 *
9457 * enum {
9458 * host_name(0), (255)
9459 * } NameType;
9460 * opaque HostName<1..2^16-1>;
9461 *
9462 * struct {
9463 * NameType name_type;
9464 * select (name_type) {
9465 * case host_name: HostName;
9466 * } name;
9467 * } ServerName;
9468 * struct {
9469 * ServerName server_name_list<1..2^16-1>
9470 * } ServerNameList;
9471 */
Ronald Cronce7d76e2022-07-08 18:56:49 +02009472MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01009473int mbedtls_ssl_parse_server_name_ext(mbedtls_ssl_context *ssl,
9474 const unsigned char *buf,
9475 const unsigned char *end)
XiaokangQian40a35232022-05-07 09:02:40 +00009476{
9477 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
9478 const unsigned char *p = buf;
XiaokangQian9b2b7712022-05-17 02:57:00 +00009479 size_t server_name_list_len, hostname_len;
9480 const unsigned char *server_name_list_end;
XiaokangQian40a35232022-05-07 09:02:40 +00009481
Gilles Peskine449bd832023-01-11 14:50:10 +01009482 MBEDTLS_SSL_DEBUG_MSG(3, ("parse ServerName extension"));
XiaokangQian40a35232022-05-07 09:02:40 +00009483
Gilles Peskine449bd832023-01-11 14:50:10 +01009484 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
9485 server_name_list_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian40a35232022-05-07 09:02:40 +00009486 p += 2;
9487
Gilles Peskine449bd832023-01-11 14:50:10 +01009488 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, server_name_list_len);
XiaokangQian9b2b7712022-05-17 02:57:00 +00009489 server_name_list_end = p + server_name_list_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01009490 while (p < server_name_list_end) {
9491 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, server_name_list_end, 3);
9492 hostname_len = MBEDTLS_GET_UINT16_BE(p, 1);
9493 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, server_name_list_end,
9494 hostname_len + 3);
XiaokangQian40a35232022-05-07 09:02:40 +00009495
Gilles Peskine449bd832023-01-11 14:50:10 +01009496 if (p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME) {
XiaokangQian75fe8c72022-06-15 09:42:45 +00009497 /* sni_name is intended to be used only during the parsing of the
9498 * ClientHello message (it is reset to NULL before the end of
9499 * the message parsing). Thus it is ok to just point to the
9500 * reception buffer and not make a copy of it.
9501 */
XiaokangQianf2a94202022-05-20 06:44:24 +00009502 ssl->handshake->sni_name = p + 3;
9503 ssl->handshake->sni_name_len = hostname_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01009504 if (ssl->conf->f_sni == NULL) {
9505 return 0;
XiaokangQian40a35232022-05-07 09:02:40 +00009506 }
Gilles Peskine449bd832023-01-11 14:50:10 +01009507 ret = ssl->conf->f_sni(ssl->conf->p_sni,
9508 ssl, p + 3, hostname_len);
9509 if (ret != 0) {
9510 MBEDTLS_SSL_DEBUG_RET(1, "ssl_sni_wrapper", ret);
9511 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME,
9512 MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME);
9513 return MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME;
9514 }
9515 return 0;
XiaokangQian40a35232022-05-07 09:02:40 +00009516 }
9517
9518 p += hostname_len + 3;
9519 }
9520
Gilles Peskine449bd832023-01-11 14:50:10 +01009521 return 0;
XiaokangQian40a35232022-05-07 09:02:40 +00009522}
9523#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
9524
XiaokangQianacb39922022-06-17 10:18:48 +00009525#if defined(MBEDTLS_SSL_ALPN)
Ronald Cronce7d76e2022-07-08 18:56:49 +02009526MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01009527int mbedtls_ssl_parse_alpn_ext(mbedtls_ssl_context *ssl,
9528 const unsigned char *buf,
9529 const unsigned char *end)
XiaokangQianacb39922022-06-17 10:18:48 +00009530{
9531 const unsigned char *p = buf;
XiaokangQianc7403452022-06-23 03:24:12 +00009532 size_t protocol_name_list_len;
XiaokangQian95d5f542022-06-24 02:29:26 +00009533 const unsigned char *protocol_name_list;
9534 const unsigned char *protocol_name_list_end;
XiaokangQianc7403452022-06-23 03:24:12 +00009535 size_t protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009536
9537 /* If ALPN not configured, just ignore the extension */
Gilles Peskine449bd832023-01-11 14:50:10 +01009538 if (ssl->conf->alpn_list == NULL) {
9539 return 0;
9540 }
XiaokangQianacb39922022-06-17 10:18:48 +00009541
9542 /*
XiaokangQianc7403452022-06-23 03:24:12 +00009543 * RFC7301, section 3.1
9544 * opaque ProtocolName<1..2^8-1>;
XiaokangQianacb39922022-06-17 10:18:48 +00009545 *
XiaokangQianc7403452022-06-23 03:24:12 +00009546 * struct {
9547 * ProtocolName protocol_name_list<2..2^16-1>
9548 * } ProtocolNameList;
XiaokangQianacb39922022-06-17 10:18:48 +00009549 */
9550
XiaokangQianc7403452022-06-23 03:24:12 +00009551 /*
XiaokangQian0b776e22022-06-24 09:04:59 +00009552 * protocol_name_list_len 2 bytes
9553 * protocol_name_len 1 bytes
9554 * protocol_name >=1 byte
XiaokangQianc7403452022-06-23 03:24:12 +00009555 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009556 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 4);
XiaokangQianacb39922022-06-17 10:18:48 +00009557
Gilles Peskine449bd832023-01-11 14:50:10 +01009558 protocol_name_list_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQianacb39922022-06-17 10:18:48 +00009559 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01009560 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, protocol_name_list_len);
XiaokangQian95d5f542022-06-24 02:29:26 +00009561 protocol_name_list = p;
9562 protocol_name_list_end = p + protocol_name_list_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009563
9564 /* Validate peer's list (lengths) */
Gilles Peskine449bd832023-01-11 14:50:10 +01009565 while (p < protocol_name_list_end) {
XiaokangQian95d5f542022-06-24 02:29:26 +00009566 protocol_name_len = *p++;
Gilles Peskine449bd832023-01-11 14:50:10 +01009567 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, protocol_name_list_end,
9568 protocol_name_len);
9569 if (protocol_name_len == 0) {
XiaokangQian95d5f542022-06-24 02:29:26 +00009570 MBEDTLS_SSL_PEND_FATAL_ALERT(
9571 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
Gilles Peskine449bd832023-01-11 14:50:10 +01009572 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
9573 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
XiaokangQian95d5f542022-06-24 02:29:26 +00009574 }
9575
9576 p += protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009577 }
9578
9579 /* Use our order of preference */
Gilles Peskine449bd832023-01-11 14:50:10 +01009580 for (const char **alpn = ssl->conf->alpn_list; *alpn != NULL; alpn++) {
9581 size_t const alpn_len = strlen(*alpn);
XiaokangQian95d5f542022-06-24 02:29:26 +00009582 p = protocol_name_list;
Gilles Peskine449bd832023-01-11 14:50:10 +01009583 while (p < protocol_name_list_end) {
XiaokangQian95d5f542022-06-24 02:29:26 +00009584 protocol_name_len = *p++;
Gilles Peskine449bd832023-01-11 14:50:10 +01009585 if (protocol_name_len == alpn_len &&
9586 memcmp(p, *alpn, alpn_len) == 0) {
XiaokangQianacb39922022-06-17 10:18:48 +00009587 ssl->alpn_chosen = *alpn;
Gilles Peskine449bd832023-01-11 14:50:10 +01009588 return 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009589 }
XiaokangQian95d5f542022-06-24 02:29:26 +00009590
9591 p += protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009592 }
9593 }
9594
XiaokangQian95d5f542022-06-24 02:29:26 +00009595 /* If we get here, no match was found */
XiaokangQianacb39922022-06-17 10:18:48 +00009596 MBEDTLS_SSL_PEND_FATAL_ALERT(
Gilles Peskine449bd832023-01-11 14:50:10 +01009597 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL,
9598 MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL);
9599 return MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL;
XiaokangQianacb39922022-06-17 10:18:48 +00009600}
9601
Gilles Peskine449bd832023-01-11 14:50:10 +01009602int mbedtls_ssl_write_alpn_ext(mbedtls_ssl_context *ssl,
9603 unsigned char *buf,
9604 unsigned char *end,
9605 size_t *out_len)
XiaokangQianacb39922022-06-17 10:18:48 +00009606{
9607 unsigned char *p = buf;
XiaokangQian95d5f542022-06-24 02:29:26 +00009608 size_t protocol_name_len;
XiaokangQianc7403452022-06-23 03:24:12 +00009609 *out_len = 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009610
Gilles Peskine449bd832023-01-11 14:50:10 +01009611 if (ssl->alpn_chosen == NULL) {
9612 return 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009613 }
9614
Gilles Peskine449bd832023-01-11 14:50:10 +01009615 protocol_name_len = strlen(ssl->alpn_chosen);
9616 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 7 + protocol_name_len);
XiaokangQianacb39922022-06-17 10:18:48 +00009617
Gilles Peskine449bd832023-01-11 14:50:10 +01009618 MBEDTLS_SSL_DEBUG_MSG(3, ("server side, adding alpn extension"));
XiaokangQianacb39922022-06-17 10:18:48 +00009619 /*
9620 * 0 . 1 ext identifier
9621 * 2 . 3 ext length
9622 * 4 . 5 protocol list length
9623 * 6 . 6 protocol name length
9624 * 7 . 7+n protocol name
9625 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009626 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ALPN, p, 0);
XiaokangQianacb39922022-06-17 10:18:48 +00009627
XiaokangQian95d5f542022-06-24 02:29:26 +00009628 *out_len = 7 + protocol_name_len;
XiaokangQianacb39922022-06-17 10:18:48 +00009629
Gilles Peskine449bd832023-01-11 14:50:10 +01009630 MBEDTLS_PUT_UINT16_BE(protocol_name_len + 3, p, 2);
9631 MBEDTLS_PUT_UINT16_BE(protocol_name_len + 1, p, 4);
XiaokangQian0b776e22022-06-24 09:04:59 +00009632 /* Note: the length of the chosen protocol has been checked to be less
9633 * than 255 bytes in `mbedtls_ssl_conf_alpn_protocols`.
9634 */
Gilles Peskine449bd832023-01-11 14:50:10 +01009635 p[6] = MBEDTLS_BYTE_0(protocol_name_len);
XiaokangQianacb39922022-06-17 10:18:48 +00009636
Gilles Peskine449bd832023-01-11 14:50:10 +01009637 memcpy(p + 7, ssl->alpn_chosen, protocol_name_len);
Jerry Yub95dd362022-11-08 21:19:34 +08009638
9639#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Gilles Peskine449bd832023-01-11 14:50:10 +01009640 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_ALPN);
Jerry Yub95dd362022-11-08 21:19:34 +08009641#endif
9642
Gilles Peskine449bd832023-01-11 14:50:10 +01009643 return 0;
XiaokangQianacb39922022-06-17 10:18:48 +00009644}
9645#endif /* MBEDTLS_SSL_ALPN */
9646
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009647#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
Xiaokang Qian03409292022-10-12 02:49:52 +00009648 defined(MBEDTLS_SSL_SESSION_TICKETS) && \
Xiaokang Qianed0620c2022-10-12 06:58:13 +00009649 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \
Xiaokang Qianed3afcd2022-10-12 08:31:11 +00009650 defined(MBEDTLS_SSL_CLI_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01009651int mbedtls_ssl_session_set_hostname(mbedtls_ssl_session *session,
9652 const char *hostname)
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009653{
9654 /* Initialize to suppress unnecessary compiler warning */
9655 size_t hostname_len = 0;
9656
9657 /* Check if new hostname is valid before
9658 * making any change to current one */
Gilles Peskine449bd832023-01-11 14:50:10 +01009659 if (hostname != NULL) {
9660 hostname_len = strlen(hostname);
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009661
Gilles Peskine449bd832023-01-11 14:50:10 +01009662 if (hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN) {
9663 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
9664 }
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009665 }
9666
9667 /* Now it's clear that we will overwrite the old hostname,
9668 * so we can free it safely */
Gilles Peskine449bd832023-01-11 14:50:10 +01009669 if (session->hostname != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01009670 mbedtls_zeroize_and_free(session->hostname,
Gilles Peskine449bd832023-01-11 14:50:10 +01009671 strlen(session->hostname));
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009672 }
9673
9674 /* Passing NULL as hostname shall clear the old one */
Gilles Peskine449bd832023-01-11 14:50:10 +01009675 if (hostname == NULL) {
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009676 session->hostname = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01009677 } else {
9678 session->hostname = mbedtls_calloc(1, hostname_len + 1);
9679 if (session->hostname == NULL) {
9680 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
9681 }
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009682
Gilles Peskine449bd832023-01-11 14:50:10 +01009683 memcpy(session->hostname, hostname, hostname_len);
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009684 }
9685
Gilles Peskine449bd832023-01-11 14:50:10 +01009686 return 0;
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009687}
Xiaokang Qian03409292022-10-12 02:49:52 +00009688#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
9689 MBEDTLS_SSL_SESSION_TICKETS &&
Xiaokang Qianed0620c2022-10-12 06:58:13 +00009690 MBEDTLS_SSL_SERVER_NAME_INDICATION &&
Xiaokang Qianed3afcd2022-10-12 08:31:11 +00009691 MBEDTLS_SSL_CLI_C */
Xiaokang Qiana3b451f2022-10-11 06:20:56 +00009692
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009693#endif /* MBEDTLS_SSL_TLS_C */