Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 1 | /* |
| 2 | * TLS server tickets callbacks implementation |
| 3 | * |
Bence Szépkúti | 1e14827 | 2020-08-07 13:07:28 +0200 | [diff] [blame] | 4 | * Copyright The Mbed TLS Contributors |
Dave Rodgman | 16799db | 2023-11-02 19:47:20 +0000 | [diff] [blame] | 5 | * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later |
Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 6 | */ |
| 7 | |
Gilles Peskine | db09ef6 | 2020-06-03 01:43:33 +0200 | [diff] [blame] | 8 | #include "common.h" |
Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 9 | |
| 10 | #if defined(MBEDTLS_SSL_TICKET_C) |
| 11 | |
Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 12 | #include "mbedtls/platform.h" |
Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 13 | |
Chris Jones | 84a773f | 2021-03-05 18:38:47 +0000 | [diff] [blame] | 14 | #include "ssl_misc.h" |
SimonB | d5800b7 | 2016-04-26 07:43:27 +0100 | [diff] [blame] | 15 | #include "mbedtls/ssl_ticket.h" |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 16 | #include "mbedtls/error.h" |
Janos Follath | 73c616b | 2019-12-18 15:07:04 +0000 | [diff] [blame] | 17 | #include "mbedtls/platform_util.h" |
SimonB | d5800b7 | 2016-04-26 07:43:27 +0100 | [diff] [blame] | 18 | |
Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 19 | #include <string.h> |
| 20 | |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 21 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Andrzej Kurek | 0064484 | 2023-05-30 05:45:00 -0400 | [diff] [blame] | 22 | /* Define a local translating function to save code size by not using too many |
| 23 | * arguments in each translating place. */ |
| 24 | static int local_err_translation(psa_status_t status) |
| 25 | { |
| 26 | return psa_status_to_mbedtls(status, psa_to_ssl_errors, |
Andrzej Kurek | 1e4a030 | 2023-05-30 09:45:17 -0400 | [diff] [blame] | 27 | ARRAY_LENGTH(psa_to_ssl_errors), |
Andrzej Kurek | 0064484 | 2023-05-30 05:45:00 -0400 | [diff] [blame] | 28 | psa_generic_status_to_mbedtls); |
| 29 | } |
| 30 | #define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status) |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 31 | #endif |
| 32 | |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 33 | /* |
Shaun Case | 8b0ecbc | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 34 | * Initialize context |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 35 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 36 | void mbedtls_ssl_ticket_init(mbedtls_ssl_ticket_context *ctx) |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 37 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 38 | memset(ctx, 0, sizeof(mbedtls_ssl_ticket_context)); |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 39 | |
| 40 | #if defined(MBEDTLS_THREADING_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 41 | mbedtls_mutex_init(&ctx->mutex); |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 42 | #endif |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 43 | } |
| 44 | |
Glenn Strauss | a941b62 | 2022-02-09 15:24:56 -0500 | [diff] [blame] | 45 | #define MAX_KEY_BYTES MBEDTLS_SSL_TICKET_MAX_KEY_BYTES |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 46 | |
Glenn Strauss | a941b62 | 2022-02-09 15:24:56 -0500 | [diff] [blame] | 47 | #define TICKET_KEY_NAME_BYTES MBEDTLS_SSL_TICKET_KEY_NAME_BYTES |
Hanno Becker | d140d08 | 2018-11-17 21:18:01 +0000 | [diff] [blame] | 48 | #define TICKET_IV_BYTES 12 |
| 49 | #define TICKET_CRYPT_LEN_BYTES 2 |
| 50 | #define TICKET_AUTH_TAG_BYTES 16 |
| 51 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 52 | #define TICKET_MIN_LEN (TICKET_KEY_NAME_BYTES + \ |
| 53 | TICKET_IV_BYTES + \ |
| 54 | TICKET_CRYPT_LEN_BYTES + \ |
| 55 | TICKET_AUTH_TAG_BYTES) |
| 56 | #define TICKET_ADD_DATA_LEN (TICKET_KEY_NAME_BYTES + \ |
| 57 | TICKET_IV_BYTES + \ |
| 58 | TICKET_CRYPT_LEN_BYTES) |
Hanno Becker | d140d08 | 2018-11-17 21:18:01 +0000 | [diff] [blame] | 59 | |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 60 | /* |
| 61 | * Generate/update a key |
| 62 | */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 63 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 64 | static int ssl_ticket_gen_key(mbedtls_ssl_ticket_context *ctx, |
| 65 | unsigned char index) |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 66 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 67 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 68 | unsigned char buf[MAX_KEY_BYTES] = { 0 }; |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 69 | mbedtls_ssl_ticket_key *key = ctx->keys + index; |
| 70 | |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 71 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 72 | psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; |
| 73 | #endif |
| 74 | |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 75 | #if defined(MBEDTLS_HAVE_TIME) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 76 | key->generation_time = mbedtls_time(NULL); |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 77 | #endif |
| 78 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 79 | if ((ret = ctx->f_rng(ctx->p_rng, key->name, sizeof(key->name))) != 0) { |
| 80 | return ret; |
| 81 | } |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 82 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 83 | if ((ret = ctx->f_rng(ctx->p_rng, buf, sizeof(buf))) != 0) { |
| 84 | return ret; |
| 85 | } |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 86 | |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 87 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 88 | psa_set_key_usage_flags(&attributes, |
| 89 | PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT); |
| 90 | psa_set_key_algorithm(&attributes, key->alg); |
| 91 | psa_set_key_type(&attributes, key->key_type); |
| 92 | psa_set_key_bits(&attributes, key->key_bits); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 93 | |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 94 | ret = PSA_TO_MBEDTLS_ERR( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 95 | psa_import_key(&attributes, buf, |
| 96 | PSA_BITS_TO_BYTES(key->key_bits), |
| 97 | &key->key)); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 98 | #else |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 99 | /* With GCM and CCM, same context can encrypt & decrypt */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 100 | ret = mbedtls_cipher_setkey(&key->ctx, buf, |
| 101 | mbedtls_cipher_get_key_bitlen(&key->ctx), |
| 102 | MBEDTLS_ENCRYPT); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 103 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 104 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 105 | mbedtls_platform_zeroize(buf, sizeof(buf)); |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 106 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 107 | return ret; |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 108 | } |
| 109 | |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 110 | /* |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 111 | * Rotate/generate keys if necessary |
| 112 | */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 113 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 114 | static int ssl_ticket_update_keys(mbedtls_ssl_ticket_context *ctx) |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 115 | { |
| 116 | #if !defined(MBEDTLS_HAVE_TIME) |
| 117 | ((void) ctx); |
| 118 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 119 | if (ctx->ticket_lifetime != 0) { |
| 120 | mbedtls_time_t current_time = mbedtls_time(NULL); |
Dave Rodgman | 392f714 | 2022-08-17 11:19:41 +0100 | [diff] [blame] | 121 | mbedtls_time_t key_time = ctx->keys[ctx->active].generation_time; |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 122 | |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 123 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 124 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 125 | #endif |
| 126 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 127 | if (current_time >= key_time && |
| 128 | (uint64_t) (current_time - key_time) < ctx->ticket_lifetime) { |
| 129 | return 0; |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 130 | } |
| 131 | |
| 132 | ctx->active = 1 - ctx->active; |
| 133 | |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 134 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 135 | if ((status = psa_destroy_key(ctx->keys[ctx->active].key)) != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 136 | return PSA_TO_MBEDTLS_ERR(status); |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 137 | } |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 138 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 139 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 140 | return ssl_ticket_gen_key(ctx, ctx->active); |
| 141 | } else |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 142 | #endif /* MBEDTLS_HAVE_TIME */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 143 | return 0; |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 144 | } |
| 145 | |
| 146 | /* |
Glenn Strauss | a950938 | 2022-02-02 23:32:18 -0500 | [diff] [blame] | 147 | * Rotate active session ticket encryption key |
| 148 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 149 | int mbedtls_ssl_ticket_rotate(mbedtls_ssl_ticket_context *ctx, |
| 150 | const unsigned char *name, size_t nlength, |
| 151 | const unsigned char *k, size_t klength, |
| 152 | uint32_t lifetime) |
Glenn Strauss | a950938 | 2022-02-02 23:32:18 -0500 | [diff] [blame] | 153 | { |
| 154 | const unsigned char idx = 1 - ctx->active; |
| 155 | mbedtls_ssl_ticket_key * const key = ctx->keys + idx; |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 156 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 157 | |
| 158 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 159 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 160 | psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; |
Gabor Mezei | 36c9f51 | 2022-03-16 12:55:32 +0100 | [diff] [blame] | 161 | const size_t bitlen = key->key_bits; |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 162 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 163 | const int bitlen = mbedtls_cipher_get_key_bitlen(&key->ctx); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 164 | #endif |
| 165 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 166 | if (nlength < TICKET_KEY_NAME_BYTES || klength * 8 < (size_t) bitlen) { |
| 167 | return MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA; |
| 168 | } |
Glenn Strauss | a950938 | 2022-02-02 23:32:18 -0500 | [diff] [blame] | 169 | |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 170 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 171 | if ((status = psa_destroy_key(key->key)) != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 172 | ret = PSA_TO_MBEDTLS_ERR(status); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 173 | return ret; |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 174 | } |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 175 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 176 | psa_set_key_usage_flags(&attributes, |
| 177 | PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT); |
| 178 | psa_set_key_algorithm(&attributes, key->alg); |
| 179 | psa_set_key_type(&attributes, key->key_type); |
| 180 | psa_set_key_bits(&attributes, key->key_bits); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 181 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 182 | if ((status = psa_import_key(&attributes, k, |
| 183 | PSA_BITS_TO_BYTES(key->key_bits), |
| 184 | &key->key)) != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 185 | ret = PSA_TO_MBEDTLS_ERR(status); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 186 | return ret; |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 187 | } |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 188 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 189 | ret = mbedtls_cipher_setkey(&key->ctx, k, bitlen, MBEDTLS_ENCRYPT); |
| 190 | if (ret != 0) { |
| 191 | return ret; |
| 192 | } |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 193 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 194 | |
Glenn Strauss | a950938 | 2022-02-02 23:32:18 -0500 | [diff] [blame] | 195 | ctx->active = idx; |
| 196 | ctx->ticket_lifetime = lifetime; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 197 | memcpy(key->name, name, TICKET_KEY_NAME_BYTES); |
Glenn Strauss | a950938 | 2022-02-02 23:32:18 -0500 | [diff] [blame] | 198 | #if defined(MBEDTLS_HAVE_TIME) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 199 | key->generation_time = mbedtls_time(NULL); |
Glenn Strauss | a950938 | 2022-02-02 23:32:18 -0500 | [diff] [blame] | 200 | #endif |
| 201 | return 0; |
| 202 | } |
| 203 | |
| 204 | /* |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 205 | * Setup context for actual use |
| 206 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 207 | int mbedtls_ssl_ticket_setup(mbedtls_ssl_ticket_context *ctx, |
| 208 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, |
| 209 | mbedtls_cipher_type_t cipher, |
| 210 | uint32_t lifetime) |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 211 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 212 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Neil Armstrong | 3bf040e | 2022-04-27 10:35:24 +0200 | [diff] [blame] | 213 | size_t key_bits; |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 214 | |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 215 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 216 | psa_algorithm_t alg; |
| 217 | psa_key_type_t key_type; |
Neil Armstrong | 858581e | 2022-04-01 18:03:15 +0200 | [diff] [blame] | 218 | #else |
| 219 | const mbedtls_cipher_info_t *cipher_info; |
| 220 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 221 | |
Neil Armstrong | 858581e | 2022-04-01 18:03:15 +0200 | [diff] [blame] | 222 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 223 | if (mbedtls_ssl_cipher_to_psa(cipher, TICKET_AUTH_TAG_BYTES, |
| 224 | &alg, &key_type, &key_bits) != PSA_SUCCESS) { |
| 225 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 226 | } |
| 227 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 228 | if (PSA_ALG_IS_AEAD(alg) == 0) { |
| 229 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 230 | } |
| 231 | #else |
| 232 | cipher_info = mbedtls_cipher_info_from_type(cipher); |
| 233 | |
| 234 | if (mbedtls_cipher_info_get_mode(cipher_info) != MBEDTLS_MODE_GCM && |
| 235 | mbedtls_cipher_info_get_mode(cipher_info) != MBEDTLS_MODE_CCM && |
| 236 | mbedtls_cipher_info_get_mode(cipher_info) != MBEDTLS_MODE_CHACHAPOLY) { |
| 237 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 238 | } |
| 239 | |
| 240 | key_bits = mbedtls_cipher_info_get_key_bitlen(cipher_info); |
Neil Armstrong | 3bf040e | 2022-04-27 10:35:24 +0200 | [diff] [blame] | 241 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 242 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 243 | if (key_bits > 8 * MAX_KEY_BYTES) { |
| 244 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 245 | } |
Manuel Pégourié-Gonnard | 887674a | 2015-05-25 11:00:19 +0200 | [diff] [blame] | 246 | |
Neil Armstrong | 3bf040e | 2022-04-27 10:35:24 +0200 | [diff] [blame] | 247 | ctx->f_rng = f_rng; |
| 248 | ctx->p_rng = p_rng; |
| 249 | |
| 250 | ctx->ticket_lifetime = lifetime; |
| 251 | |
| 252 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 253 | ctx->keys[0].alg = alg; |
| 254 | ctx->keys[0].key_type = key_type; |
| 255 | ctx->keys[0].key_bits = key_bits; |
| 256 | |
| 257 | ctx->keys[1].alg = alg; |
| 258 | ctx->keys[1].key_type = key_type; |
| 259 | ctx->keys[1].key_bits = key_bits; |
| 260 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 261 | if ((ret = mbedtls_cipher_setup(&ctx->keys[0].ctx, cipher_info)) != 0) { |
| 262 | return ret; |
Manuel Pégourié-Gonnard | a0adc1b | 2015-05-25 10:35:16 +0200 | [diff] [blame] | 263 | } |
| 264 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 265 | if ((ret = mbedtls_cipher_setup(&ctx->keys[1].ctx, cipher_info)) != 0) { |
| 266 | return ret; |
| 267 | } |
| 268 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 269 | |
| 270 | if ((ret = ssl_ticket_gen_key(ctx, 0)) != 0 || |
| 271 | (ret = ssl_ticket_gen_key(ctx, 1)) != 0) { |
| 272 | return ret; |
| 273 | } |
| 274 | |
| 275 | return 0; |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 276 | } |
| 277 | |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 278 | /* |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 279 | * Create session ticket, with the following structure: |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 280 | * |
| 281 | * struct { |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 282 | * opaque key_name[4]; |
| 283 | * opaque iv[12]; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 284 | * opaque encrypted_state<0..2^16-1>; |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 285 | * opaque tag[16]; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 286 | * } ticket; |
| 287 | * |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 288 | * The key_name, iv, and length of encrypted_state are the additional |
| 289 | * authenticated data. |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 290 | */ |
Hanno Becker | d140d08 | 2018-11-17 21:18:01 +0000 | [diff] [blame] | 291 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 292 | int mbedtls_ssl_ticket_write(void *p_ticket, |
| 293 | const mbedtls_ssl_session *session, |
| 294 | unsigned char *start, |
| 295 | const unsigned char *end, |
| 296 | size_t *tlen, |
| 297 | uint32_t *ticket_lifetime) |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 298 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 299 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 300 | mbedtls_ssl_ticket_context *ctx = p_ticket; |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 301 | mbedtls_ssl_ticket_key *key; |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 302 | unsigned char *key_name = start; |
Hanno Becker | d140d08 | 2018-11-17 21:18:01 +0000 | [diff] [blame] | 303 | unsigned char *iv = start + TICKET_KEY_NAME_BYTES; |
| 304 | unsigned char *state_len_bytes = iv + TICKET_IV_BYTES; |
| 305 | unsigned char *state = state_len_bytes + TICKET_CRYPT_LEN_BYTES; |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 306 | size_t clear_len, ciph_len; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 307 | |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 308 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 309 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 310 | #endif |
| 311 | |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 312 | *tlen = 0; |
| 313 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 314 | if (ctx == NULL || ctx->f_rng == NULL) { |
| 315 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 316 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 317 | |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 318 | /* We need at least 4 bytes for key_name, 12 for IV, 2 for len 16 for tag, |
| 319 | * in addition to session itself, that will be checked when writing it. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 320 | MBEDTLS_SSL_CHK_BUF_PTR(start, end, TICKET_MIN_LEN); |
Manuel Pégourié-Gonnard | 69f1728 | 2015-05-18 14:35:08 +0200 | [diff] [blame] | 321 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 322 | #if defined(MBEDTLS_THREADING_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 323 | if ((ret = mbedtls_mutex_lock(&ctx->mutex)) != 0) { |
| 324 | return ret; |
| 325 | } |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 326 | #endif |
| 327 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 328 | if ((ret = ssl_ticket_update_keys(ctx)) != 0) { |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 329 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 330 | } |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 331 | |
| 332 | key = &ctx->keys[ctx->active]; |
| 333 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 334 | *ticket_lifetime = ctx->ticket_lifetime; |
| 335 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 336 | memcpy(key_name, key->name, TICKET_KEY_NAME_BYTES); |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 337 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 338 | if ((ret = ctx->f_rng(ctx->p_rng, iv, TICKET_IV_BYTES)) != 0) { |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 339 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 340 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 341 | |
Manuel Pégourié-Gonnard | 69f1728 | 2015-05-18 14:35:08 +0200 | [diff] [blame] | 342 | /* Dump session state */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 343 | if ((ret = mbedtls_ssl_session_save(session, |
| 344 | state, end - state, |
| 345 | &clear_len)) != 0 || |
| 346 | (unsigned long) clear_len > 65535) { |
| 347 | goto cleanup; |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 348 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 349 | MBEDTLS_PUT_UINT16_BE(clear_len, state_len_bytes, 0); |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 350 | |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 351 | /* Encrypt and authenticate */ |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 352 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 353 | if ((status = psa_aead_encrypt(key->key, key->alg, iv, TICKET_IV_BYTES, |
| 354 | key_name, TICKET_ADD_DATA_LEN, |
| 355 | state, clear_len, |
| 356 | state, end - state, |
| 357 | &ciph_len)) != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 358 | ret = PSA_TO_MBEDTLS_ERR(status); |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 359 | goto cleanup; |
| 360 | } |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 361 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 362 | if ((ret = mbedtls_cipher_auth_encrypt_ext(&key->ctx, |
| 363 | iv, TICKET_IV_BYTES, |
| 364 | /* Additional data: key name, IV and length */ |
| 365 | key_name, TICKET_ADD_DATA_LEN, |
| 366 | state, clear_len, |
| 367 | state, end - state, &ciph_len, |
| 368 | TICKET_AUTH_TAG_BYTES)) != 0) { |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 369 | goto cleanup; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 370 | } |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 371 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 372 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 373 | if (ciph_len != clear_len + TICKET_AUTH_TAG_BYTES) { |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 374 | ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 375 | goto cleanup; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 376 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 377 | |
Manuel Pégourié-Gonnard | f5cf71e | 2020-12-01 11:43:40 +0100 | [diff] [blame] | 378 | *tlen = TICKET_MIN_LEN + ciph_len - TICKET_AUTH_TAG_BYTES; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 379 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 380 | cleanup: |
| 381 | #if defined(MBEDTLS_THREADING_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 382 | if (mbedtls_mutex_unlock(&ctx->mutex) != 0) { |
| 383 | return MBEDTLS_ERR_THREADING_MUTEX_ERROR; |
| 384 | } |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 385 | #endif |
| 386 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 387 | return ret; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 388 | } |
| 389 | |
| 390 | /* |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 391 | * Select key based on name |
| 392 | */ |
| 393 | static mbedtls_ssl_ticket_key *ssl_ticket_select_key( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 394 | mbedtls_ssl_ticket_context *ctx, |
| 395 | const unsigned char name[4]) |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 396 | { |
| 397 | unsigned char i; |
| 398 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 399 | for (i = 0; i < sizeof(ctx->keys) / sizeof(*ctx->keys); i++) { |
| 400 | if (memcmp(name, ctx->keys[i].name, 4) == 0) { |
| 401 | return &ctx->keys[i]; |
| 402 | } |
| 403 | } |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 404 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 405 | return NULL; |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 406 | } |
| 407 | |
| 408 | /* |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 409 | * Load session ticket (see mbedtls_ssl_ticket_write for structure) |
| 410 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 411 | int mbedtls_ssl_ticket_parse(void *p_ticket, |
| 412 | mbedtls_ssl_session *session, |
| 413 | unsigned char *buf, |
| 414 | size_t len) |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 415 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 416 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 417 | mbedtls_ssl_ticket_context *ctx = p_ticket; |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 418 | mbedtls_ssl_ticket_key *key; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 419 | unsigned char *key_name = buf; |
Hanno Becker | d140d08 | 2018-11-17 21:18:01 +0000 | [diff] [blame] | 420 | unsigned char *iv = buf + TICKET_KEY_NAME_BYTES; |
| 421 | unsigned char *enc_len_p = iv + TICKET_IV_BYTES; |
| 422 | unsigned char *ticket = enc_len_p + TICKET_CRYPT_LEN_BYTES; |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 423 | size_t enc_len, clear_len; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 424 | |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 425 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 426 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 427 | #endif |
| 428 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 429 | if (ctx == NULL || ctx->f_rng == NULL) { |
| 430 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 431 | } |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 432 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 433 | if (len < TICKET_MIN_LEN) { |
| 434 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 435 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 436 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 437 | #if defined(MBEDTLS_THREADING_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 438 | if ((ret = mbedtls_mutex_lock(&ctx->mutex)) != 0) { |
| 439 | return ret; |
| 440 | } |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 441 | #endif |
| 442 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 443 | if ((ret = ssl_ticket_update_keys(ctx)) != 0) { |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 444 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 445 | } |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 446 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 447 | enc_len = (enc_len_p[0] << 8) | enc_len_p[1]; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 448 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 449 | if (len != TICKET_MIN_LEN + enc_len) { |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 450 | ret = MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
| 451 | goto cleanup; |
| 452 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 453 | |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 454 | /* Select key */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 455 | if ((key = ssl_ticket_select_key(ctx, key_name)) == NULL) { |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 456 | /* We can't know for sure but this is a likely option unless we're |
| 457 | * under attack - this is only informative anyway */ |
| 458 | ret = MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED; |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 459 | goto cleanup; |
| 460 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 461 | |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 462 | /* Decrypt and authenticate */ |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 463 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 464 | if ((status = psa_aead_decrypt(key->key, key->alg, iv, TICKET_IV_BYTES, |
| 465 | key_name, TICKET_ADD_DATA_LEN, |
| 466 | ticket, enc_len + TICKET_AUTH_TAG_BYTES, |
| 467 | ticket, enc_len, &clear_len)) != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 468 | ret = PSA_TO_MBEDTLS_ERR(status); |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 469 | goto cleanup; |
| 470 | } |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 471 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 472 | if ((ret = mbedtls_cipher_auth_decrypt_ext(&key->ctx, |
| 473 | iv, TICKET_IV_BYTES, |
| 474 | /* Additional data: key name, IV and length */ |
| 475 | key_name, TICKET_ADD_DATA_LEN, |
| 476 | ticket, enc_len + TICKET_AUTH_TAG_BYTES, |
| 477 | ticket, enc_len, &clear_len, |
| 478 | TICKET_AUTH_TAG_BYTES)) != 0) { |
| 479 | if (ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED) { |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 480 | ret = MBEDTLS_ERR_SSL_INVALID_MAC; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 481 | } |
Manuel Pégourié-Gonnard | 1e9c4db | 2015-05-25 14:07:08 +0200 | [diff] [blame] | 482 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 483 | goto cleanup; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 484 | } |
Gabor Mezei | 5b8b890 | 2022-03-16 12:56:58 +0100 | [diff] [blame] | 485 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 486 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 487 | if (clear_len != enc_len) { |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 488 | ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 489 | goto cleanup; |
Manuel Pégourié-Gonnard | 1041a39 | 2015-05-20 19:59:39 +0200 | [diff] [blame] | 490 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 491 | |
| 492 | /* Actually load session */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 493 | if ((ret = mbedtls_ssl_session_load(session, ticket, clear_len)) != 0) { |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 494 | goto cleanup; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 495 | } |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 496 | |
| 497 | #if defined(MBEDTLS_HAVE_TIME) |
Jerry Yu | cebffc3 | 2022-12-15 18:00:05 +0800 | [diff] [blame^] | 498 | #if defined(MBEDTLS_SSL_PROTO_TLS1_3) |
| 499 | if (session->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { |
| 500 | /* Check for expiration */ |
| 501 | mbedtls_ms_time_t ticket_age = mbedtls_ms_time() - session->start; |
| 502 | mbedtls_ms_time_t ticket_lifetime = ctx->ticket_lifetime * 1000; |
| 503 | |
| 504 | if (ticket_age < 0 || ticket_age > ticket_lifetime) { |
| 505 | ret = MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED; |
| 506 | goto cleanup; |
| 507 | } |
| 508 | } else |
| 509 | #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 510 | { |
Manuel Pégourié-Gonnard | 8eff512 | 2015-05-20 11:41:36 +0200 | [diff] [blame] | 511 | /* Check for expiration */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 512 | mbedtls_time_t current_time = mbedtls_time(NULL); |
Manuel Pégourié-Gonnard | 8eff512 | 2015-05-20 11:41:36 +0200 | [diff] [blame] | 513 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 514 | if (current_time < session->start || |
| 515 | (uint32_t) (current_time - session->start) > ctx->ticket_lifetime) { |
Manuel Pégourié-Gonnard | 8eff512 | 2015-05-20 11:41:36 +0200 | [diff] [blame] | 516 | ret = MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED; |
| 517 | goto cleanup; |
| 518 | } |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 519 | } |
Jerry Yu | cebffc3 | 2022-12-15 18:00:05 +0800 | [diff] [blame^] | 520 | #endif /* MBEDTLS_HAVE_TIME */ |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 521 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 522 | cleanup: |
| 523 | #if defined(MBEDTLS_THREADING_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 524 | if (mbedtls_mutex_unlock(&ctx->mutex) != 0) { |
| 525 | return MBEDTLS_ERR_THREADING_MUTEX_ERROR; |
| 526 | } |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 527 | #endif |
| 528 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 529 | return ret; |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 530 | } |
| 531 | |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 532 | /* |
| 533 | * Free context |
| 534 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 535 | void mbedtls_ssl_ticket_free(mbedtls_ssl_ticket_context *ctx) |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 536 | { |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 537 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 538 | psa_destroy_key(ctx->keys[0].key); |
| 539 | psa_destroy_key(ctx->keys[1].key); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 540 | #else |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 541 | mbedtls_cipher_free(&ctx->keys[0].ctx); |
| 542 | mbedtls_cipher_free(&ctx->keys[1].ctx); |
Gabor Mezei | 2a02051 | 2022-03-10 15:15:46 +0100 | [diff] [blame] | 543 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 544 | |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 545 | #if defined(MBEDTLS_THREADING_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 546 | mbedtls_mutex_free(&ctx->mutex); |
Manuel Pégourié-Gonnard | 0849a0a | 2015-05-20 11:34:54 +0200 | [diff] [blame] | 547 | #endif |
| 548 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 549 | mbedtls_platform_zeroize(ctx, sizeof(mbedtls_ssl_ticket_context)); |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 550 | } |
| 551 | |
Manuel Pégourié-Gonnard | fd6d897 | 2015-05-15 12:09:00 +0200 | [diff] [blame] | 552 | #endif /* MBEDTLS_SSL_TICKET_C */ |