Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 1 | /* |
| 2 | * TLS server tickets callbacks implementation |
| 3 | * |
Bence Szépkúti | 1e14827 | 2020-08-07 13:07:28 +0200 | [diff] [blame] | 4 | * Copyright The Mbed TLS Contributors |
Manuel Pégourié-Gonnard | 37ff140 | 2015-09-04 14:21:07 +0200 | [diff] [blame] | 5 | * SPDX-License-Identifier: Apache-2.0 |
| 6 | * |
| 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 8 | * not use this file except in compliance with the License. |
| 9 | * You may obtain a copy of the License at |
| 10 | * |
| 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | * |
| 13 | * Unless required by applicable law or agreed to in writing, software |
| 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | * See the License for the specific language governing permissions and |
| 17 | * limitations under the License. |
Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 18 | */ |
| 19 | |
Gilles Peskine | db09ef6 | 2020-06-03 01:43:33 +0200 | [diff] [blame] | 20 | #include "common.h" |
Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 21 | |
| 22 | #if defined(MBEDTLS_SSL_TICKET_C) |
| 23 | |
Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 24 | #include "mbedtls/platform.h" |
Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 25 | |
Chris Jones | 84a773f | 2021-03-05 18:38:47 +0000 | [diff] [blame] | 26 | #include "ssl_misc.h" |
SimonB | d5800b7 | 2016-04-26 07:43:27 +0100 | [diff] [blame] | 27 | #include "mbedtls/ssl_ticket.h" |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 28 | #include "mbedtls/error.h" |
Janos Follath | 73c616b | 2019-12-18 15:07:04 +0000 | [diff] [blame] | 29 | #include "mbedtls/platform_util.h" |
SimonB | d5800b7 | 2016-04-26 07:43:27 +0100 | [diff] [blame] | 30 | |
Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 31 | #include <string.h> |
| 32 | |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 33 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 34 | #define PSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \ |
| 35 | psa_to_ssl_errors, \ |
| 36 | psa_generic_status_to_mbedtls) |
| 37 | #endif |
| 38 | |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 39 | /* |
Shaun Case | 8b0ecbc | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 40 | * Initialize context |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 41 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 42 | void mbedtls_ssl_ticket_init(mbedtls_ssl_ticket_context *ctx) |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 43 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 44 | memset(ctx, 0, sizeof(mbedtls_ssl_ticket_context)); |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 45 | |
| 46 | #if defined(MBEDTLS_THREADING_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 47 | mbedtls_mutex_init(&ctx->mutex); |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 48 | #endif |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 49 | } |
| 50 | |
Glenn Strauss | a941b62 | 2022-02-09 15:24:56 -0500 | [diff] [blame] | 51 | #define MAX_KEY_BYTES MBEDTLS_SSL_TICKET_MAX_KEY_BYTES |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 52 | |
Glenn Strauss | a941b62 | 2022-02-09 15:24:56 -0500 | [diff] [blame] | 53 | #define TICKET_KEY_NAME_BYTES MBEDTLS_SSL_TICKET_KEY_NAME_BYTES |
Hanno Becker | d140d08 | 2018-11-17 21:18:01 +0000 | [diff] [blame] | 54 | #define TICKET_IV_BYTES 12 |
| 55 | #define TICKET_CRYPT_LEN_BYTES 2 |
| 56 | #define TICKET_AUTH_TAG_BYTES 16 |
| 57 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 58 | #define TICKET_MIN_LEN (TICKET_KEY_NAME_BYTES + \ |
| 59 | TICKET_IV_BYTES + \ |
| 60 | TICKET_CRYPT_LEN_BYTES + \ |
| 61 | TICKET_AUTH_TAG_BYTES) |
| 62 | #define TICKET_ADD_DATA_LEN (TICKET_KEY_NAME_BYTES + \ |
| 63 | TICKET_IV_BYTES + \ |
| 64 | TICKET_CRYPT_LEN_BYTES) |
Hanno Becker | d140d08 | 2018-11-17 21:18:01 +0000 | [diff] [blame] | 65 | |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 66 | /* |
| 67 | * Generate/update a key |
| 68 | */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 69 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 70 | static int ssl_ticket_gen_key(mbedtls_ssl_ticket_context *ctx, |
| 71 | unsigned char index) |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 72 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 73 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 74 | unsigned char buf[MAX_KEY_BYTES] = { 0 }; |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 75 | mbedtls_ssl_ticket_key *key = ctx->keys + index; |
| 76 | |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 77 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 78 | psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; |
| 79 | #endif |
| 80 | |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 81 | #if defined(MBEDTLS_HAVE_TIME) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 82 | key->generation_time = mbedtls_time(NULL); |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 83 | #endif |
| 84 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 85 | if ((ret = ctx->f_rng(ctx->p_rng, key->name, sizeof(key->name))) != 0) { |
| 86 | return ret; |
| 87 | } |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 88 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 89 | if ((ret = ctx->f_rng(ctx->p_rng, buf, sizeof(buf))) != 0) { |
| 90 | return ret; |
| 91 | } |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 92 | |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 93 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 94 | psa_set_key_usage_flags(&attributes, |
| 95 | PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT); |
| 96 | psa_set_key_algorithm(&attributes, key->alg); |
| 97 | psa_set_key_type(&attributes, key->key_type); |
| 98 | psa_set_key_bits(&attributes, key->key_bits); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 99 | |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 100 | ret = PSA_TO_MBEDTLS_ERR( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 101 | psa_import_key(&attributes, buf, |
| 102 | PSA_BITS_TO_BYTES(key->key_bits), |
| 103 | &key->key)); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 104 | #else |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 105 | /* With GCM and CCM, same context can encrypt & decrypt */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 106 | ret = mbedtls_cipher_setkey(&key->ctx, buf, |
| 107 | mbedtls_cipher_get_key_bitlen(&key->ctx), |
| 108 | MBEDTLS_ENCRYPT); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 109 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 110 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 111 | mbedtls_platform_zeroize(buf, sizeof(buf)); |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 112 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 113 | return ret; |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 114 | } |
| 115 | |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 116 | /* |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 117 | * Rotate/generate keys if necessary |
| 118 | */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 119 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 120 | static int ssl_ticket_update_keys(mbedtls_ssl_ticket_context *ctx) |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 121 | { |
| 122 | #if !defined(MBEDTLS_HAVE_TIME) |
| 123 | ((void) ctx); |
| 124 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 125 | if (ctx->ticket_lifetime != 0) { |
| 126 | mbedtls_time_t current_time = mbedtls_time(NULL); |
Dave Rodgman | 392f714 | 2022-08-17 11:19:41 +0100 | [diff] [blame] | 127 | mbedtls_time_t key_time = ctx->keys[ctx->active].generation_time; |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 128 | |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 129 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 130 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 131 | #endif |
| 132 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 133 | if (current_time >= key_time && |
| 134 | (uint64_t) (current_time - key_time) < ctx->ticket_lifetime) { |
| 135 | return 0; |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 136 | } |
| 137 | |
| 138 | ctx->active = 1 - ctx->active; |
| 139 | |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 140 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 141 | if ((status = psa_destroy_key(ctx->keys[ctx->active].key)) != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 142 | return PSA_TO_MBEDTLS_ERR(status); |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 143 | } |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 144 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 145 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 146 | return ssl_ticket_gen_key(ctx, ctx->active); |
| 147 | } else |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 148 | #endif /* MBEDTLS_HAVE_TIME */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 149 | return 0; |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 150 | } |
| 151 | |
| 152 | /* |
Glenn Strauss | a950938 | 2022-02-02 23:32:18 -0500 | [diff] [blame] | 153 | * Rotate active session ticket encryption key |
| 154 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 155 | int mbedtls_ssl_ticket_rotate(mbedtls_ssl_ticket_context *ctx, |
| 156 | const unsigned char *name, size_t nlength, |
| 157 | const unsigned char *k, size_t klength, |
| 158 | uint32_t lifetime) |
Glenn Strauss | a950938 | 2022-02-02 23:32:18 -0500 | [diff] [blame] | 159 | { |
| 160 | const unsigned char idx = 1 - ctx->active; |
| 161 | mbedtls_ssl_ticket_key * const key = ctx->keys + idx; |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 162 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 163 | |
| 164 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 165 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 166 | psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; |
Gabor Mezei | 36c9f51 | 2022-03-16 12:55:32 +0100 | [diff] [blame] | 167 | const size_t bitlen = key->key_bits; |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 168 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 169 | const int bitlen = mbedtls_cipher_get_key_bitlen(&key->ctx); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 170 | #endif |
| 171 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 172 | if (nlength < TICKET_KEY_NAME_BYTES || klength * 8 < (size_t) bitlen) { |
| 173 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
| 174 | } |
Glenn Strauss | a950938 | 2022-02-02 23:32:18 -0500 | [diff] [blame] | 175 | |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 176 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 177 | if ((status = psa_destroy_key(key->key)) != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 178 | ret = PSA_TO_MBEDTLS_ERR(status); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 179 | return ret; |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 180 | } |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 181 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 182 | psa_set_key_usage_flags(&attributes, |
| 183 | PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT); |
| 184 | psa_set_key_algorithm(&attributes, key->alg); |
| 185 | psa_set_key_type(&attributes, key->key_type); |
| 186 | psa_set_key_bits(&attributes, key->key_bits); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 187 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 188 | if ((status = psa_import_key(&attributes, k, |
| 189 | PSA_BITS_TO_BYTES(key->key_bits), |
| 190 | &key->key)) != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 191 | ret = PSA_TO_MBEDTLS_ERR(status); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 192 | return ret; |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 193 | } |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 194 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 195 | ret = mbedtls_cipher_setkey(&key->ctx, k, bitlen, MBEDTLS_ENCRYPT); |
| 196 | if (ret != 0) { |
| 197 | return ret; |
| 198 | } |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 199 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 200 | |
Glenn Strauss | a950938 | 2022-02-02 23:32:18 -0500 | [diff] [blame] | 201 | ctx->active = idx; |
| 202 | ctx->ticket_lifetime = lifetime; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 203 | memcpy(key->name, name, TICKET_KEY_NAME_BYTES); |
Glenn Strauss | a950938 | 2022-02-02 23:32:18 -0500 | [diff] [blame] | 204 | #if defined(MBEDTLS_HAVE_TIME) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 205 | key->generation_time = mbedtls_time(NULL); |
Glenn Strauss | a950938 | 2022-02-02 23:32:18 -0500 | [diff] [blame] | 206 | #endif |
| 207 | return 0; |
| 208 | } |
| 209 | |
| 210 | /* |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 211 | * Setup context for actual use |
| 212 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 213 | int mbedtls_ssl_ticket_setup(mbedtls_ssl_ticket_context *ctx, |
| 214 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, |
| 215 | mbedtls_cipher_type_t cipher, |
| 216 | uint32_t lifetime) |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 217 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 218 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Neil Armstrong | 3bf040e | 2022-04-27 10:35:24 +0200 | [diff] [blame] | 219 | size_t key_bits; |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 220 | |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 221 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 222 | psa_algorithm_t alg; |
| 223 | psa_key_type_t key_type; |
Neil Armstrong | 858581e | 2022-04-01 18:03:15 +0200 | [diff] [blame] | 224 | #else |
| 225 | const mbedtls_cipher_info_t *cipher_info; |
| 226 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 227 | |
Neil Armstrong | 858581e | 2022-04-01 18:03:15 +0200 | [diff] [blame] | 228 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 229 | if (mbedtls_ssl_cipher_to_psa(cipher, TICKET_AUTH_TAG_BYTES, |
| 230 | &alg, &key_type, &key_bits) != PSA_SUCCESS) { |
| 231 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 232 | } |
| 233 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 234 | if (PSA_ALG_IS_AEAD(alg) == 0) { |
| 235 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 236 | } |
| 237 | #else |
| 238 | cipher_info = mbedtls_cipher_info_from_type(cipher); |
| 239 | |
| 240 | if (mbedtls_cipher_info_get_mode(cipher_info) != MBEDTLS_MODE_GCM && |
| 241 | mbedtls_cipher_info_get_mode(cipher_info) != MBEDTLS_MODE_CCM && |
| 242 | mbedtls_cipher_info_get_mode(cipher_info) != MBEDTLS_MODE_CHACHAPOLY) { |
| 243 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 244 | } |
| 245 | |
| 246 | key_bits = mbedtls_cipher_info_get_key_bitlen(cipher_info); |
Neil Armstrong | 3bf040e | 2022-04-27 10:35:24 +0200 | [diff] [blame] | 247 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 248 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 249 | if (key_bits > 8 * MAX_KEY_BYTES) { |
| 250 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 251 | } |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 252 | |
Neil Armstrong | 3bf040e | 2022-04-27 10:35:24 +0200 | [diff] [blame] | 253 | ctx->f_rng = f_rng; |
| 254 | ctx->p_rng = p_rng; |
| 255 | |
| 256 | ctx->ticket_lifetime = lifetime; |
| 257 | |
| 258 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 259 | ctx->keys[0].alg = alg; |
| 260 | ctx->keys[0].key_type = key_type; |
| 261 | ctx->keys[0].key_bits = key_bits; |
| 262 | |
| 263 | ctx->keys[1].alg = alg; |
| 264 | ctx->keys[1].key_type = key_type; |
| 265 | ctx->keys[1].key_bits = key_bits; |
| 266 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 267 | if ((ret = mbedtls_cipher_setup(&ctx->keys[0].ctx, cipher_info)) != 0) { |
| 268 | return ret; |
Manuel Pégourié-Gonnard | a0adc1b | 2015-05-25 10:35:16 +0200 | [diff] [blame] | 269 | } |
| 270 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 271 | if ((ret = mbedtls_cipher_setup(&ctx->keys[1].ctx, cipher_info)) != 0) { |
| 272 | return ret; |
| 273 | } |
| 274 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 275 | |
| 276 | if ((ret = ssl_ticket_gen_key(ctx, 0)) != 0 || |
| 277 | (ret = ssl_ticket_gen_key(ctx, 1)) != 0) { |
| 278 | return ret; |
| 279 | } |
| 280 | |
| 281 | return 0; |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 282 | } |
| 283 | |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 284 | /* |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 285 | * Create session ticket, with the following structure: |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 286 | * |
| 287 | * struct { |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 288 | * opaque key_name[4]; |
| 289 | * opaque iv[12]; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 290 | * opaque encrypted_state<0..2^16-1>; |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 291 | * opaque tag[16]; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 292 | * } ticket; |
| 293 | * |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 294 | * The key_name, iv, and length of encrypted_state are the additional |
| 295 | * authenticated data. |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 296 | */ |
Hanno Becker | d140d08 | 2018-11-17 21:18:01 +0000 | [diff] [blame] | 297 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 298 | int mbedtls_ssl_ticket_write(void *p_ticket, |
| 299 | const mbedtls_ssl_session *session, |
| 300 | unsigned char *start, |
| 301 | const unsigned char *end, |
| 302 | size_t *tlen, |
| 303 | uint32_t *ticket_lifetime) |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 304 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 305 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 306 | mbedtls_ssl_ticket_context *ctx = p_ticket; |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 307 | mbedtls_ssl_ticket_key *key; |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 308 | unsigned char *key_name = start; |
Hanno Becker | d140d08 | 2018-11-17 21:18:01 +0000 | [diff] [blame] | 309 | unsigned char *iv = start + TICKET_KEY_NAME_BYTES; |
| 310 | unsigned char *state_len_bytes = iv + TICKET_IV_BYTES; |
| 311 | unsigned char *state = state_len_bytes + TICKET_CRYPT_LEN_BYTES; |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 312 | size_t clear_len, ciph_len; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 313 | |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 314 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 315 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 316 | #endif |
| 317 | |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 318 | *tlen = 0; |
| 319 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 320 | if (ctx == NULL || ctx->f_rng == NULL) { |
| 321 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 322 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 323 | |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 324 | /* We need at least 4 bytes for key_name, 12 for IV, 2 for len 16 for tag, |
| 325 | * in addition to session itself, that will be checked when writing it. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 326 | MBEDTLS_SSL_CHK_BUF_PTR(start, end, TICKET_MIN_LEN); |
Manuel Pégourié-Gonnard | 69f1728 | 2015-05-18 14:35:08 +0200 | [diff] [blame] | 327 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 328 | #if defined(MBEDTLS_THREADING_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 329 | if ((ret = mbedtls_mutex_lock(&ctx->mutex)) != 0) { |
| 330 | return ret; |
| 331 | } |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 332 | #endif |
| 333 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 334 | if ((ret = ssl_ticket_update_keys(ctx)) != 0) { |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 335 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 336 | } |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 337 | |
| 338 | key = &ctx->keys[ctx->active]; |
| 339 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 340 | *ticket_lifetime = ctx->ticket_lifetime; |
| 341 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 342 | memcpy(key_name, key->name, TICKET_KEY_NAME_BYTES); |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 343 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 344 | if ((ret = ctx->f_rng(ctx->p_rng, iv, TICKET_IV_BYTES)) != 0) { |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 345 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 346 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 347 | |
Manuel Pégourié-Gonnard | 69f1728 | 2015-05-18 14:35:08 +0200 | [diff] [blame] | 348 | /* Dump session state */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 349 | if ((ret = mbedtls_ssl_session_save(session, |
| 350 | state, end - state, |
| 351 | &clear_len)) != 0 || |
| 352 | (unsigned long) clear_len > 65535) { |
| 353 | goto cleanup; |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 354 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 355 | MBEDTLS_PUT_UINT16_BE(clear_len, state_len_bytes, 0); |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 356 | |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 357 | /* Encrypt and authenticate */ |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 358 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 359 | if ((status = psa_aead_encrypt(key->key, key->alg, iv, TICKET_IV_BYTES, |
| 360 | key_name, TICKET_ADD_DATA_LEN, |
| 361 | state, clear_len, |
| 362 | state, end - state, |
| 363 | &ciph_len)) != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 364 | ret = PSA_TO_MBEDTLS_ERR(status); |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 365 | goto cleanup; |
| 366 | } |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 367 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 368 | if ((ret = mbedtls_cipher_auth_encrypt_ext(&key->ctx, |
| 369 | iv, TICKET_IV_BYTES, |
| 370 | /* Additional data: key name, IV and length */ |
| 371 | key_name, TICKET_ADD_DATA_LEN, |
| 372 | state, clear_len, |
| 373 | state, end - state, &ciph_len, |
| 374 | TICKET_AUTH_TAG_BYTES)) != 0) { |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 375 | goto cleanup; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 376 | } |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 377 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 378 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 379 | if (ciph_len != clear_len + TICKET_AUTH_TAG_BYTES) { |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 380 | ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 381 | goto cleanup; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 382 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 383 | |
Manuel Pégourié-Gonnard | f5cf71e | 2020-12-01 11:43:40 +0100 | [diff] [blame] | 384 | *tlen = TICKET_MIN_LEN + ciph_len - TICKET_AUTH_TAG_BYTES; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 385 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 386 | cleanup: |
| 387 | #if defined(MBEDTLS_THREADING_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 388 | if (mbedtls_mutex_unlock(&ctx->mutex) != 0) { |
| 389 | return MBEDTLS_ERR_THREADING_MUTEX_ERROR; |
| 390 | } |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 391 | #endif |
| 392 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 393 | return ret; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 394 | } |
| 395 | |
| 396 | /* |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 397 | * Select key based on name |
| 398 | */ |
| 399 | static mbedtls_ssl_ticket_key *ssl_ticket_select_key( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 400 | mbedtls_ssl_ticket_context *ctx, |
| 401 | const unsigned char name[4]) |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 402 | { |
| 403 | unsigned char i; |
| 404 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 405 | for (i = 0; i < sizeof(ctx->keys) / sizeof(*ctx->keys); i++) { |
| 406 | if (memcmp(name, ctx->keys[i].name, 4) == 0) { |
| 407 | return &ctx->keys[i]; |
| 408 | } |
| 409 | } |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 410 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 411 | return NULL; |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 412 | } |
| 413 | |
| 414 | /* |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 415 | * Load session ticket (see mbedtls_ssl_ticket_write for structure) |
| 416 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 417 | int mbedtls_ssl_ticket_parse(void *p_ticket, |
| 418 | mbedtls_ssl_session *session, |
| 419 | unsigned char *buf, |
| 420 | size_t len) |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 421 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 422 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 423 | mbedtls_ssl_ticket_context *ctx = p_ticket; |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 424 | mbedtls_ssl_ticket_key *key; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 425 | unsigned char *key_name = buf; |
Hanno Becker | d140d08 | 2018-11-17 21:18:01 +0000 | [diff] [blame] | 426 | unsigned char *iv = buf + TICKET_KEY_NAME_BYTES; |
| 427 | unsigned char *enc_len_p = iv + TICKET_IV_BYTES; |
| 428 | unsigned char *ticket = enc_len_p + TICKET_CRYPT_LEN_BYTES; |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 429 | size_t enc_len, clear_len; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 430 | |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 431 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 432 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 433 | #endif |
| 434 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 435 | if (ctx == NULL || ctx->f_rng == NULL) { |
| 436 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 437 | } |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 438 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 439 | if (len < TICKET_MIN_LEN) { |
| 440 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 441 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 442 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 443 | #if defined(MBEDTLS_THREADING_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 444 | if ((ret = mbedtls_mutex_lock(&ctx->mutex)) != 0) { |
| 445 | return ret; |
| 446 | } |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 447 | #endif |
| 448 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 449 | if ((ret = ssl_ticket_update_keys(ctx)) != 0) { |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 450 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 451 | } |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 452 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 453 | enc_len = (enc_len_p[0] << 8) | enc_len_p[1]; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 454 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 455 | if (len != TICKET_MIN_LEN + enc_len) { |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 456 | ret = MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 457 | goto cleanup; |
| 458 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 459 | |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 460 | /* Select key */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 461 | if ((key = ssl_ticket_select_key(ctx, key_name)) == NULL) { |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 462 | /* We can't know for sure but this is a likely option unless we're |
| 463 | * under attack - this is only informative anyway */ |
| 464 | ret = MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED; |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 465 | goto cleanup; |
| 466 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 467 | |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 468 | /* Decrypt and authenticate */ |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 469 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 470 | if ((status = psa_aead_decrypt(key->key, key->alg, iv, TICKET_IV_BYTES, |
| 471 | key_name, TICKET_ADD_DATA_LEN, |
| 472 | ticket, enc_len + TICKET_AUTH_TAG_BYTES, |
| 473 | ticket, enc_len, &clear_len)) != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame^] | 474 | ret = PSA_TO_MBEDTLS_ERR(status); |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 475 | goto cleanup; |
| 476 | } |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 477 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 478 | if ((ret = mbedtls_cipher_auth_decrypt_ext(&key->ctx, |
| 479 | iv, TICKET_IV_BYTES, |
| 480 | /* Additional data: key name, IV and length */ |
| 481 | key_name, TICKET_ADD_DATA_LEN, |
| 482 | ticket, enc_len + TICKET_AUTH_TAG_BYTES, |
| 483 | ticket, enc_len, &clear_len, |
| 484 | TICKET_AUTH_TAG_BYTES)) != 0) { |
| 485 | if (ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED) { |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 486 | ret = MBEDTLS_ERR_SSL_INVALID_MAC; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 487 | } |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 488 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 489 | goto cleanup; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 490 | } |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 491 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 492 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 493 | if (clear_len != enc_len) { |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 494 | ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 495 | goto cleanup; |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 496 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 497 | |
| 498 | /* Actually load session */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 499 | if ((ret = mbedtls_ssl_session_load(session, ticket, clear_len)) != 0) { |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 500 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 501 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 502 | |
| 503 | #if defined(MBEDTLS_HAVE_TIME) |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 504 | { |
Manuel Pégourié-Gonnard | 8eff512 | 2015-05-20 11:41:36 +0200 | [diff] [blame] | 505 | /* Check for expiration */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 506 | mbedtls_time_t current_time = mbedtls_time(NULL); |
Manuel Pégourié-Gonnard | 8eff512 | 2015-05-20 11:41:36 +0200 | [diff] [blame] | 507 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 508 | if (current_time < session->start || |
| 509 | (uint32_t) (current_time - session->start) > ctx->ticket_lifetime) { |
Manuel Pégourié-Gonnard | 8eff512 | 2015-05-20 11:41:36 +0200 | [diff] [blame] | 510 | ret = MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED; |
| 511 | goto cleanup; |
| 512 | } |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 513 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 514 | #endif |
| 515 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 516 | cleanup: |
| 517 | #if defined(MBEDTLS_THREADING_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 518 | if (mbedtls_mutex_unlock(&ctx->mutex) != 0) { |
| 519 | return MBEDTLS_ERR_THREADING_MUTEX_ERROR; |
| 520 | } |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 521 | #endif |
| 522 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 523 | return ret; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 524 | } |
| 525 | |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 526 | /* |
| 527 | * Free context |
| 528 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 529 | void mbedtls_ssl_ticket_free(mbedtls_ssl_ticket_context *ctx) |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 530 | { |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 531 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 532 | psa_destroy_key(ctx->keys[0].key); |
| 533 | psa_destroy_key(ctx->keys[1].key); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 534 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 535 | mbedtls_cipher_free(&ctx->keys[0].ctx); |
| 536 | mbedtls_cipher_free(&ctx->keys[1].ctx); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 537 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 538 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 539 | #if defined(MBEDTLS_THREADING_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 540 | mbedtls_mutex_free(&ctx->mutex); |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 541 | #endif |
| 542 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 543 | mbedtls_platform_zeroize(ctx, sizeof(mbedtls_ssl_ticket_context)); |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 544 | } |
| 545 | |
Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 546 | #endif /* MBEDTLS_SSL_TICKET_C */ |