blob: b075a8a9ad545563787a8904c7b6933d0d346059 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 shared functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21/*
22 * The SSL 3.0 specification was drafted by Netscape in 1996,
23 * and became an IETF standard in 1999.
24 *
25 * http://wp.netscape.com/eng/ssl3/
26 * http://www.ietf.org/rfc/rfc2246.txt
27 * http://www.ietf.org/rfc/rfc4346.txt
28 */
29
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020030#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000031#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020032#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020033#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020034#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020036#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000037
SimonBd5800b72016-04-26 07:43:27 +010038#if defined(MBEDTLS_PLATFORM_C)
39#include "mbedtls/platform.h"
40#else
41#include <stdlib.h>
42#define mbedtls_calloc calloc
43#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010044#endif
45
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000046#include "mbedtls/debug.h"
47#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020048#include "mbedtls/ssl_internal.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050049#include "mbedtls/platform_util.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020050
Rich Evans00ab4702015-02-06 13:43:58 +000051#include <string.h>
52
Janos Follath23bdca02016-10-07 14:47:14 +010053#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000054#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020055#endif
56
Hanno Becker2a43f6f2018-08-10 11:12:52 +010057static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl );
Hanno Beckercd9dcda2018-08-28 17:18:56 +010058static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +010059
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +010060/* Length of the "epoch" field in the record header */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020061static inline size_t ssl_ep_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +010062{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020063#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020064 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +010065 return( 2 );
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +010066#else
67 ((void) ssl);
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +010068#endif
69 return( 0 );
70}
71
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020072/*
73 * Start a timer.
74 * Passing millisecs = 0 cancels a running timer.
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020075 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020076static void ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020077{
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +020078 if( ssl->f_set_timer == NULL )
79 return;
80
81 MBEDTLS_SSL_DEBUG_MSG( 3, ( "set_timer to %d ms", (int) millisecs ) );
82 ssl->f_set_timer( ssl->p_timer, millisecs / 4, millisecs );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020083}
84
85/*
86 * Return -1 is timer is expired, 0 if it isn't.
87 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020088static int ssl_check_timer( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020089{
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +020090 if( ssl->f_get_timer == NULL )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +020091 return( 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +020092
93 if( ssl->f_get_timer( ssl->p_timer ) == 2 )
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020094 {
95 MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020096 return( -1 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +020097 }
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020098
99 return( 0 );
100}
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200101
Hanno Becker5aa4e2c2018-08-06 09:26:08 +0100102static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
103 mbedtls_ssl_transform *transform );
Hanno Beckerf5970a02019-05-08 09:38:41 +0100104static void ssl_update_in_pointers( mbedtls_ssl_context *ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100105
106#define SSL_DONT_FORCE_FLUSH 0
107#define SSL_FORCE_FLUSH 1
108
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200109#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +0100110
Hanno Beckerba8cd672019-04-23 12:31:42 +0100111#if defined(MBEDTLS_SSL_CID)
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100112/* Top-level Connection ID API */
113
Hanno Becker07489862019-04-25 16:01:49 +0100114/* WARNING: The CID feature isn't fully implemented yet
115 * and will not be used. */
Hanno Beckere8eff9a2019-05-14 11:30:10 +0100116int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf,
117 size_t len,
118 int ignore_other_cid )
Hanno Beckereec2be92019-05-03 13:06:44 +0100119{
120 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX )
121 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
122
Hanno Beckere8eff9a2019-05-14 11:30:10 +0100123 conf->ignore_unexpected_cid =
124 ( ignore_other_cid == MBEDTLS_SSL_UNEXPECTED_CID_IGNORE );
Hanno Beckereec2be92019-05-03 13:06:44 +0100125 conf->cid_len = len;
126 return( 0 );
127}
128
129/* WARNING: The CID feature isn't fully implemented yet
130 * and will not be used. */
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100131int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl,
132 int enable,
133 unsigned char const *own_cid,
134 size_t own_cid_len )
135{
Hanno Becker78c43022019-05-03 14:38:32 +0100136 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
137 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
138
Hanno Becker07489862019-04-25 16:01:49 +0100139 ssl->negotiate_cid = enable;
140 if( enable == MBEDTLS_SSL_CID_DISABLED )
141 {
142 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) );
143 return( 0 );
144 }
145 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) );
Hanno Beckereec2be92019-05-03 13:06:44 +0100146 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len );
Hanno Becker07489862019-04-25 16:01:49 +0100147
Hanno Beckereec2be92019-05-03 13:06:44 +0100148 if( own_cid_len != ssl->conf->cid_len )
Hanno Becker07489862019-04-25 16:01:49 +0100149 {
Hanno Beckereec2be92019-05-03 13:06:44 +0100150 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config",
151 (unsigned) own_cid_len,
152 (unsigned) ssl->conf->cid_len ) );
Hanno Becker07489862019-04-25 16:01:49 +0100153 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
154 }
155
156 memcpy( ssl->own_cid, own_cid, own_cid_len );
Hanno Beckerb4a56062019-04-30 14:07:31 +0100157 /* Truncation is not an issue here because
158 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */
159 ssl->own_cid_len = (uint8_t) own_cid_len;
Hanno Becker07489862019-04-25 16:01:49 +0100160
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100161 return( 0 );
162}
163
164int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl,
165 int *enabled,
166 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ],
167 size_t *peer_cid_len )
168{
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100169 *enabled = MBEDTLS_SSL_CID_DISABLED;
Hanno Becker2de89fa2019-04-26 17:08:02 +0100170
Hanno Becker78c43022019-05-03 14:38:32 +0100171 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
172 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
173 {
Hanno Becker2de89fa2019-04-26 17:08:02 +0100174 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Hanno Becker78c43022019-05-03 14:38:32 +0100175 }
Hanno Becker2de89fa2019-04-26 17:08:02 +0100176
Hanno Beckercb063f52019-05-03 12:54:52 +0100177 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions
178 * were used, but client and server requested the empty CID.
179 * This is indistinguishable from not using the CID extension
180 * in the first place. */
Hanno Becker2de89fa2019-04-26 17:08:02 +0100181 if( ssl->transform_in->in_cid_len == 0 &&
182 ssl->transform_in->out_cid_len == 0 )
183 {
184 return( 0 );
185 }
186
187 *peer_cid_len = ssl->transform_in->out_cid_len;
188 memcpy( peer_cid, ssl->transform_in->out_cid,
189 ssl->transform_in->out_cid_len );
190
191 *enabled = MBEDTLS_SSL_CID_ENABLED;
192
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100193 return( 0 );
194}
Hanno Beckerba8cd672019-04-23 12:31:42 +0100195#endif /* MBEDTLS_SSL_CID */
Hanno Beckerb9e7dea2019-04-09 15:22:03 +0100196
Hanno Beckerd5847772018-08-28 10:09:23 +0100197/* Forward declarations for functions related to message buffering. */
198static void ssl_buffering_free( mbedtls_ssl_context *ssl );
199static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
200 uint8_t slot );
201static void ssl_free_buffered_record( mbedtls_ssl_context *ssl );
202static int ssl_load_buffered_message( mbedtls_ssl_context *ssl );
203static int ssl_load_buffered_record( mbedtls_ssl_context *ssl );
204static int ssl_buffer_message( mbedtls_ssl_context *ssl );
205static int ssl_buffer_future_record( mbedtls_ssl_context *ssl );
Hanno Beckeref7afdf2018-08-28 17:16:31 +0100206static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl );
Hanno Beckerd5847772018-08-28 10:09:23 +0100207
Hanno Beckera67dee22018-08-22 10:05:20 +0100208static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl );
Hanno Becker11682cc2018-08-22 14:41:02 +0100209static size_t ssl_get_maximum_datagram_size( mbedtls_ssl_context const *ssl )
Hanno Becker2b1e3542018-08-06 11:19:13 +0100210{
Hanno Becker11682cc2018-08-22 14:41:02 +0100211 size_t mtu = ssl_get_current_mtu( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100212
213 if( mtu != 0 && mtu < MBEDTLS_SSL_OUT_BUFFER_LEN )
Hanno Becker11682cc2018-08-22 14:41:02 +0100214 return( mtu );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100215
216 return( MBEDTLS_SSL_OUT_BUFFER_LEN );
217}
218
Hanno Becker67bc7c32018-08-06 11:33:50 +0100219static int ssl_get_remaining_space_in_datagram( mbedtls_ssl_context const *ssl )
220{
Hanno Becker11682cc2018-08-22 14:41:02 +0100221 size_t const bytes_written = ssl->out_left;
222 size_t const mtu = ssl_get_maximum_datagram_size( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100223
224 /* Double-check that the write-index hasn't gone
225 * past what we can transmit in a single datagram. */
Hanno Becker11682cc2018-08-22 14:41:02 +0100226 if( bytes_written > mtu )
Hanno Becker67bc7c32018-08-06 11:33:50 +0100227 {
228 /* Should never happen... */
229 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
230 }
231
232 return( (int) ( mtu - bytes_written ) );
233}
234
235static int ssl_get_remaining_payload_in_datagram( mbedtls_ssl_context const *ssl )
236{
237 int ret;
238 size_t remaining, expansion;
Andrzej Kurek748face2018-10-11 07:20:19 -0400239 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100240
241#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
242 const size_t mfl = mbedtls_ssl_get_max_frag_len( ssl );
243
244 if( max_len > mfl )
245 max_len = mfl;
Hanno Beckerf4b010e2018-08-24 10:47:29 +0100246
247 /* By the standard (RFC 6066 Sect. 4), the MFL extension
248 * only limits the maximum record payload size, so in theory
249 * we would be allowed to pack multiple records of payload size
250 * MFL into a single datagram. However, this would mean that there's
251 * no way to explicitly communicate MTU restrictions to the peer.
252 *
253 * The following reduction of max_len makes sure that we never
254 * write datagrams larger than MFL + Record Expansion Overhead.
255 */
256 if( max_len <= ssl->out_left )
257 return( 0 );
258
259 max_len -= ssl->out_left;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100260#endif
261
262 ret = ssl_get_remaining_space_in_datagram( ssl );
263 if( ret < 0 )
264 return( ret );
265 remaining = (size_t) ret;
266
267 ret = mbedtls_ssl_get_record_expansion( ssl );
268 if( ret < 0 )
269 return( ret );
270 expansion = (size_t) ret;
271
272 if( remaining <= expansion )
273 return( 0 );
274
275 remaining -= expansion;
276 if( remaining >= max_len )
277 remaining = max_len;
278
279 return( (int) remaining );
280}
281
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200282/*
283 * Double the retransmit timeout value, within the allowed range,
284 * returning -1 if the maximum value has already been reached.
285 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200286static int ssl_double_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200287{
288 uint32_t new_timeout;
289
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200290 if( ssl->handshake->retransmit_timeout >= ssl->conf->hs_timeout_max )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200291 return( -1 );
292
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200293 /* Implement the final paragraph of RFC 6347 section 4.1.1.1
294 * in the following way: after the initial transmission and a first
295 * retransmission, back off to a temporary estimated MTU of 508 bytes.
296 * This value is guaranteed to be deliverable (if not guaranteed to be
297 * delivered) of any compliant IPv4 (and IPv6) network, and should work
298 * on most non-IP stacks too. */
299 if( ssl->handshake->retransmit_timeout != ssl->conf->hs_timeout_min )
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400300 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200301 ssl->handshake->mtu = 508;
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400302 MBEDTLS_SSL_DEBUG_MSG( 2, ( "mtu autoreduction to %d bytes", ssl->handshake->mtu ) );
303 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200304
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200305 new_timeout = 2 * ssl->handshake->retransmit_timeout;
306
307 /* Avoid arithmetic overflow and range overflow */
308 if( new_timeout < ssl->handshake->retransmit_timeout ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200309 new_timeout > ssl->conf->hs_timeout_max )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200310 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200311 new_timeout = ssl->conf->hs_timeout_max;
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200312 }
313
314 ssl->handshake->retransmit_timeout = new_timeout;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200315 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200316 ssl->handshake->retransmit_timeout ) );
317
318 return( 0 );
319}
320
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200321static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200322{
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200323 ssl->handshake->retransmit_timeout = ssl->conf->hs_timeout_min;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200324 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200325 ssl->handshake->retransmit_timeout ) );
326}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200327#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200328
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200329#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200330/*
331 * Convert max_fragment_length codes to length.
332 * RFC 6066 says:
333 * enum{
334 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
335 * } MaxFragmentLength;
336 * and we add 0 -> extension unused
337 */
Angus Grattond8213d02016-05-25 20:56:48 +1000338static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200339{
Angus Grattond8213d02016-05-25 20:56:48 +1000340 switch( mfl )
341 {
342 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
343 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
344 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
345 return 512;
346 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
347 return 1024;
348 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
349 return 2048;
350 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
351 return 4096;
352 default:
353 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
354 }
355}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200356#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200357
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +0200358#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200359static int ssl_session_copy( mbedtls_ssl_session *dst, const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200360{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200361 mbedtls_ssl_session_free( dst );
362 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200363
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200364#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200365 if( src->peer_cert != NULL )
366 {
Paul Bakker2292d1f2013-09-15 17:06:49 +0200367 int ret;
368
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200369 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200370 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200371 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200372
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200373 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200374
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200375 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200376 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200377 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200378 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200379 dst->peer_cert = NULL;
380 return( ret );
381 }
382 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200383#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200384
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200385#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200386 if( src->ticket != NULL )
387 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200388 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200389 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200390 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200391
392 memcpy( dst->ticket, src->ticket, src->ticket_len );
393 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200394#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200395
396 return( 0 );
397}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +0200398#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200399
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200400#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
401int (*mbedtls_ssl_hw_record_init)( mbedtls_ssl_context *ssl,
Paul Bakker9af723c2014-05-01 13:03:14 +0200402 const unsigned char *key_enc, const unsigned char *key_dec,
403 size_t keylen,
404 const unsigned char *iv_enc, const unsigned char *iv_dec,
405 size_t ivlen,
406 const unsigned char *mac_enc, const unsigned char *mac_dec,
Paul Bakker66d5d072014-06-17 16:39:18 +0200407 size_t maclen ) = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200408int (*mbedtls_ssl_hw_record_activate)( mbedtls_ssl_context *ssl, int direction) = NULL;
409int (*mbedtls_ssl_hw_record_reset)( mbedtls_ssl_context *ssl ) = NULL;
410int (*mbedtls_ssl_hw_record_write)( mbedtls_ssl_context *ssl ) = NULL;
411int (*mbedtls_ssl_hw_record_read)( mbedtls_ssl_context *ssl ) = NULL;
412int (*mbedtls_ssl_hw_record_finish)( mbedtls_ssl_context *ssl ) = NULL;
413#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +0000414
Paul Bakker5121ce52009-01-03 21:22:43 +0000415/*
416 * Key material generation
417 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200418#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200419static int ssl3_prf( const unsigned char *secret, size_t slen,
420 const char *label,
421 const unsigned char *random, size_t rlen,
Paul Bakker5f70b252012-09-13 14:23:06 +0000422 unsigned char *dstbuf, size_t dlen )
423{
Andres Amaya Garcia33952502017-07-20 16:29:16 +0100424 int ret = 0;
Paul Bakker5f70b252012-09-13 14:23:06 +0000425 size_t i;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200426 mbedtls_md5_context md5;
427 mbedtls_sha1_context sha1;
Paul Bakker5f70b252012-09-13 14:23:06 +0000428 unsigned char padding[16];
429 unsigned char sha1sum[20];
430 ((void)label);
431
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200432 mbedtls_md5_init( &md5 );
433 mbedtls_sha1_init( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +0200434
Paul Bakker5f70b252012-09-13 14:23:06 +0000435 /*
436 * SSLv3:
437 * block =
438 * MD5( secret + SHA1( 'A' + secret + random ) ) +
439 * MD5( secret + SHA1( 'BB' + secret + random ) ) +
440 * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
441 * ...
442 */
443 for( i = 0; i < dlen / 16; i++ )
444 {
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200445 memset( padding, (unsigned char) ('A' + i), 1 + i );
Paul Bakker5f70b252012-09-13 14:23:06 +0000446
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100447 if( ( ret = mbedtls_sha1_starts_ret( &sha1 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100448 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100449 if( ( ret = mbedtls_sha1_update_ret( &sha1, padding, 1 + i ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100450 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100451 if( ( ret = mbedtls_sha1_update_ret( &sha1, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100452 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100453 if( ( ret = mbedtls_sha1_update_ret( &sha1, random, rlen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100454 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100455 if( ( ret = mbedtls_sha1_finish_ret( &sha1, sha1sum ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100456 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000457
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100458 if( ( ret = mbedtls_md5_starts_ret( &md5 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100459 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100460 if( ( ret = mbedtls_md5_update_ret( &md5, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100461 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100462 if( ( ret = mbedtls_md5_update_ret( &md5, sha1sum, 20 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100463 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100464 if( ( ret = mbedtls_md5_finish_ret( &md5, dstbuf + i * 16 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100465 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000466 }
467
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100468exit:
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200469 mbedtls_md5_free( &md5 );
470 mbedtls_sha1_free( &sha1 );
Paul Bakker5f70b252012-09-13 14:23:06 +0000471
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500472 mbedtls_platform_zeroize( padding, sizeof( padding ) );
473 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
Paul Bakker5f70b252012-09-13 14:23:06 +0000474
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100475 return( ret );
Paul Bakker5f70b252012-09-13 14:23:06 +0000476}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200477#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +0000478
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200479#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200480static int tls1_prf( const unsigned char *secret, size_t slen,
481 const char *label,
482 const unsigned char *random, size_t rlen,
Paul Bakker23986e52011-04-24 08:57:21 +0000483 unsigned char *dstbuf, size_t dlen )
Paul Bakker5121ce52009-01-03 21:22:43 +0000484{
Paul Bakker23986e52011-04-24 08:57:21 +0000485 size_t nb, hs;
486 size_t i, j, k;
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200487 const unsigned char *S1, *S2;
Paul Bakker5121ce52009-01-03 21:22:43 +0000488 unsigned char tmp[128];
489 unsigned char h_i[20];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200490 const mbedtls_md_info_t *md_info;
491 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100492 int ret;
493
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200494 mbedtls_md_init( &md_ctx );
Paul Bakker5121ce52009-01-03 21:22:43 +0000495
496 if( sizeof( tmp ) < 20 + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200497 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000498
499 hs = ( slen + 1 ) / 2;
500 S1 = secret;
501 S2 = secret + slen - hs;
502
503 nb = strlen( label );
504 memcpy( tmp + 20, label, nb );
505 memcpy( tmp + 20 + nb, random, rlen );
506 nb += rlen;
507
508 /*
509 * First compute P_md5(secret,label+random)[0..dlen]
510 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200511 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) == NULL )
512 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100513
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200514 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100515 return( ret );
516
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200517 mbedtls_md_hmac_starts( &md_ctx, S1, hs );
518 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
519 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000520
521 for( i = 0; i < dlen; i += 16 )
522 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200523 mbedtls_md_hmac_reset ( &md_ctx );
524 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb );
525 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100526
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200527 mbedtls_md_hmac_reset ( &md_ctx );
528 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 );
529 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000530
531 k = ( i + 16 > dlen ) ? dlen % 16 : 16;
532
533 for( j = 0; j < k; j++ )
534 dstbuf[i + j] = h_i[j];
535 }
536
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200537 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100538
Paul Bakker5121ce52009-01-03 21:22:43 +0000539 /*
540 * XOR out with P_sha1(secret,label+random)[0..dlen]
541 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200542 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) == NULL )
543 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100544
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200545 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100546 return( ret );
547
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200548 mbedtls_md_hmac_starts( &md_ctx, S2, hs );
549 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
550 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000551
552 for( i = 0; i < dlen; i += 20 )
553 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200554 mbedtls_md_hmac_reset ( &md_ctx );
555 mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb );
556 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100557
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200558 mbedtls_md_hmac_reset ( &md_ctx );
559 mbedtls_md_hmac_update( &md_ctx, tmp, 20 );
560 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000561
562 k = ( i + 20 > dlen ) ? dlen % 20 : 20;
563
564 for( j = 0; j < k; j++ )
565 dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
566 }
567
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200568 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100569
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500570 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
571 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000572
573 return( 0 );
574}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200575#endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker5121ce52009-01-03 21:22:43 +0000576
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200577#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
578static int tls_prf_generic( mbedtls_md_type_t md_type,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100579 const unsigned char *secret, size_t slen,
580 const char *label,
581 const unsigned char *random, size_t rlen,
582 unsigned char *dstbuf, size_t dlen )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000583{
584 size_t nb;
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100585 size_t i, j, k, md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000586 unsigned char tmp[128];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200587 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
588 const mbedtls_md_info_t *md_info;
589 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100590 int ret;
591
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200592 mbedtls_md_init( &md_ctx );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000593
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200594 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
595 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100596
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200597 md_len = mbedtls_md_get_size( md_info );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100598
599 if( sizeof( tmp ) < md_len + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200600 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000601
602 nb = strlen( label );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100603 memcpy( tmp + md_len, label, nb );
604 memcpy( tmp + md_len + nb, random, rlen );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000605 nb += rlen;
606
607 /*
608 * Compute P_<hash>(secret, label + random)[0..dlen]
609 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200610 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100611 return( ret );
612
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200613 mbedtls_md_hmac_starts( &md_ctx, secret, slen );
614 mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
615 mbedtls_md_hmac_finish( &md_ctx, tmp );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100616
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100617 for( i = 0; i < dlen; i += md_len )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000618 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200619 mbedtls_md_hmac_reset ( &md_ctx );
620 mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
621 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100622
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200623 mbedtls_md_hmac_reset ( &md_ctx );
624 mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
625 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000626
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100627 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000628
629 for( j = 0; j < k; j++ )
630 dstbuf[i + j] = h_i[j];
631 }
632
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200633 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100634
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500635 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
636 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000637
638 return( 0 );
639}
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100640
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200641#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100642static int tls_prf_sha256( const unsigned char *secret, size_t slen,
643 const char *label,
644 const unsigned char *random, size_t rlen,
645 unsigned char *dstbuf, size_t dlen )
646{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200647 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100648 label, random, rlen, dstbuf, dlen ) );
649}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200650#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000651
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200652#if defined(MBEDTLS_SHA512_C)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200653static int tls_prf_sha384( const unsigned char *secret, size_t slen,
654 const char *label,
655 const unsigned char *random, size_t rlen,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000656 unsigned char *dstbuf, size_t dlen )
657{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200658 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100659 label, random, rlen, dstbuf, dlen ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +0000660}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200661#endif /* MBEDTLS_SHA512_C */
662#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +0000663
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200664static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200665
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200666#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
667 defined(MBEDTLS_SSL_PROTO_TLS1_1)
668static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *, const unsigned char *, size_t );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200669#endif
Paul Bakker380da532012-04-18 16:10:25 +0000670
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200671#if defined(MBEDTLS_SSL_PROTO_SSL3)
672static void ssl_calc_verify_ssl( mbedtls_ssl_context *, unsigned char * );
673static void ssl_calc_finished_ssl( mbedtls_ssl_context *, unsigned char *, int );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200674#endif
675
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200676#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
677static void ssl_calc_verify_tls( mbedtls_ssl_context *, unsigned char * );
678static void ssl_calc_finished_tls( mbedtls_ssl_context *, unsigned char *, int );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200679#endif
680
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200681#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
682#if defined(MBEDTLS_SHA256_C)
683static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
684static void ssl_calc_verify_tls_sha256( mbedtls_ssl_context *,unsigned char * );
685static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200686#endif
Paul Bakker769075d2012-11-24 11:26:46 +0100687
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200688#if defined(MBEDTLS_SHA512_C)
689static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
690static void ssl_calc_verify_tls_sha384( mbedtls_ssl_context *, unsigned char * );
691static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
Paul Bakker769075d2012-11-24 11:26:46 +0100692#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200693#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000694
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200695int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +0000696{
Paul Bakkerda02a7f2013-08-31 17:25:14 +0200697 int ret = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +0000698 unsigned char tmp[64];
Paul Bakker5121ce52009-01-03 21:22:43 +0000699 unsigned char keyblk[256];
700 unsigned char *key1;
701 unsigned char *key2;
Paul Bakker68884e32013-01-07 18:20:04 +0100702 unsigned char *mac_enc;
703 unsigned char *mac_dec;
Hanno Becker81c7b182017-11-09 18:39:33 +0000704 size_t mac_key_len;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200705 size_t iv_copy_len;
Hanno Beckere7f2df02017-12-27 08:17:40 +0000706 unsigned keylen;
Hanno Becker8759e162017-12-27 21:34:08 +0000707 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200708 const mbedtls_cipher_info_t *cipher_info;
709 const mbedtls_md_info_t *md_info;
Paul Bakker68884e32013-01-07 18:20:04 +0100710
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200711 mbedtls_ssl_session *session = ssl->session_negotiate;
712 mbedtls_ssl_transform *transform = ssl->transform_negotiate;
713 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Paul Bakker5121ce52009-01-03 21:22:43 +0000714
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200715 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000716
Hanno Becker3307b532017-12-27 21:37:21 +0000717#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
718 transform->encrypt_then_mac = session->encrypt_then_mac;
719#endif
720 transform->minor_ver = ssl->minor_ver;
721
Hanno Becker8759e162017-12-27 21:34:08 +0000722 ciphersuite_info = handshake->ciphersuite_info;
723 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
Paul Bakker68884e32013-01-07 18:20:04 +0100724 if( cipher_info == NULL )
725 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200726 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %d not found",
Hanno Becker8759e162017-12-27 21:34:08 +0000727 ciphersuite_info->cipher ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200728 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +0100729 }
730
Hanno Becker8759e162017-12-27 21:34:08 +0000731 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
Paul Bakker68884e32013-01-07 18:20:04 +0100732 if( md_info == NULL )
733 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200734 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %d not found",
Hanno Becker8759e162017-12-27 21:34:08 +0000735 ciphersuite_info->mac ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200736 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +0100737 }
738
Hanno Beckerdd0afca2019-04-26 16:22:27 +0100739#if defined(MBEDTLS_SSL_CID)
740 /* Copy own and peer's CID if the use of the CID
741 * extension has been negotiated. */
742 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED )
743 {
744 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) );
Hanno Beckerd91dc372019-04-30 13:52:29 +0100745
Hanno Becker4932f9f2019-05-03 15:23:51 +0100746 transform->in_cid_len = ssl->own_cid_len;
747 transform->out_cid_len = ssl->handshake->peer_cid_len;
748 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len );
749 memcpy( transform->out_cid, ssl->handshake->peer_cid,
750 ssl->handshake->peer_cid_len );
Hanno Beckerdd0afca2019-04-26 16:22:27 +0100751
752 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid,
753 transform->out_cid_len );
Hanno Becker8013b272019-05-03 12:55:51 +0100754 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid,
Hanno Beckerdd0afca2019-04-26 16:22:27 +0100755 transform->in_cid_len );
756 }
757#endif /* MBEDTLS_SSL_CID */
758
Paul Bakker5121ce52009-01-03 21:22:43 +0000759 /*
Paul Bakkerca4ab492012-04-18 14:23:57 +0000760 * Set appropriate PRF function and other SSL / TLS / TLS1.2 functions
Paul Bakker1ef83d62012-04-11 12:09:53 +0000761 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200762#if defined(MBEDTLS_SSL_PROTO_SSL3)
763 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakkerca4ab492012-04-18 14:23:57 +0000764 {
Paul Bakker48916f92012-09-16 19:57:18 +0000765 handshake->tls_prf = ssl3_prf;
766 handshake->calc_verify = ssl_calc_verify_ssl;
767 handshake->calc_finished = ssl_calc_finished_ssl;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000768 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200769 else
770#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200771#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
772 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakkerca4ab492012-04-18 14:23:57 +0000773 {
Paul Bakker48916f92012-09-16 19:57:18 +0000774 handshake->tls_prf = tls1_prf;
775 handshake->calc_verify = ssl_calc_verify_tls;
776 handshake->calc_finished = ssl_calc_finished_tls;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000777 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200778 else
779#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200780#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
781#if defined(MBEDTLS_SHA512_C)
782 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
Hanno Becker8759e162017-12-27 21:34:08 +0000783 ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Paul Bakkerca4ab492012-04-18 14:23:57 +0000784 {
Paul Bakker48916f92012-09-16 19:57:18 +0000785 handshake->tls_prf = tls_prf_sha384;
786 handshake->calc_verify = ssl_calc_verify_tls_sha384;
787 handshake->calc_finished = ssl_calc_finished_tls_sha384;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000788 }
Paul Bakker1ef83d62012-04-11 12:09:53 +0000789 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200790#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200791#if defined(MBEDTLS_SHA256_C)
792 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakkerca4ab492012-04-18 14:23:57 +0000793 {
Paul Bakker48916f92012-09-16 19:57:18 +0000794 handshake->tls_prf = tls_prf_sha256;
795 handshake->calc_verify = ssl_calc_verify_tls_sha256;
796 handshake->calc_finished = ssl_calc_finished_tls_sha256;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000797 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200798 else
799#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200800#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +0200801 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200802 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
803 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +0200804 }
Paul Bakker1ef83d62012-04-11 12:09:53 +0000805
806 /*
Paul Bakker5121ce52009-01-03 21:22:43 +0000807 * SSLv3:
808 * master =
809 * MD5( premaster + SHA1( 'A' + premaster + randbytes ) ) +
810 * MD5( premaster + SHA1( 'BB' + premaster + randbytes ) ) +
811 * MD5( premaster + SHA1( 'CCC' + premaster + randbytes ) )
Paul Bakkerf7abd422013-04-16 13:15:56 +0200812 *
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200813 * TLSv1+:
Paul Bakker5121ce52009-01-03 21:22:43 +0000814 * master = PRF( premaster, "master secret", randbytes )[0..47]
815 */
Paul Bakker0a597072012-09-25 21:55:46 +0000816 if( handshake->resume == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000817 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200818 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret", handshake->premaster,
Paul Bakker48916f92012-09-16 19:57:18 +0000819 handshake->pmslen );
Paul Bakker5121ce52009-01-03 21:22:43 +0000820
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200821#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
822 if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200823 {
824 unsigned char session_hash[48];
825 size_t hash_len;
826
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200827 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using extended master secret" ) );
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200828
829 ssl->handshake->calc_verify( ssl, session_hash );
830
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200831#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
832 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200833 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200834#if defined(MBEDTLS_SHA512_C)
Hanno Becker8759e162017-12-27 21:34:08 +0000835 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200836 {
837 hash_len = 48;
838 }
839 else
840#endif
841 hash_len = 32;
842 }
843 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200844#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200845 hash_len = 36;
846
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200847 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash", session_hash, hash_len );
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200848
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100849 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
850 "extended master secret",
851 session_hash, hash_len,
852 session->master, 48 );
853 if( ret != 0 )
854 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200855 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100856 return( ret );
857 }
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200858
859 }
860 else
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200861#endif
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100862 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
863 "master secret",
864 handshake->randbytes, 64,
865 session->master, 48 );
866 if( ret != 0 )
867 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200868 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100869 return( ret );
870 }
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200871
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500872 mbedtls_platform_zeroize( handshake->premaster,
873 sizeof(handshake->premaster) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000874 }
875 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200876 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000877
878 /*
879 * Swap the client and server random values.
880 */
Paul Bakker48916f92012-09-16 19:57:18 +0000881 memcpy( tmp, handshake->randbytes, 64 );
882 memcpy( handshake->randbytes, tmp + 32, 32 );
883 memcpy( handshake->randbytes + 32, tmp, 32 );
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500884 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000885
886 /*
887 * SSLv3:
888 * key block =
889 * MD5( master + SHA1( 'A' + master + randbytes ) ) +
890 * MD5( master + SHA1( 'BB' + master + randbytes ) ) +
891 * MD5( master + SHA1( 'CCC' + master + randbytes ) ) +
892 * MD5( master + SHA1( 'DDDD' + master + randbytes ) ) +
893 * ...
894 *
895 * TLSv1:
896 * key block = PRF( master, "key expansion", randbytes )
897 */
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100898 ret = handshake->tls_prf( session->master, 48, "key expansion",
899 handshake->randbytes, 64, keyblk, 256 );
900 if( ret != 0 )
901 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200902 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100903 return( ret );
904 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000905
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200906 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
907 mbedtls_ssl_get_ciphersuite_name( session->ciphersuite ) ) );
908 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", session->master, 48 );
909 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", handshake->randbytes, 64 );
910 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000911
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500912 mbedtls_platform_zeroize( handshake->randbytes,
913 sizeof( handshake->randbytes ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000914
915 /*
916 * Determine the appropriate key, IV and MAC length.
917 */
Paul Bakker68884e32013-01-07 18:20:04 +0100918
Hanno Beckere7f2df02017-12-27 08:17:40 +0000919 keylen = cipher_info->key_bitlen / 8;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200920
Hanno Beckerf1229442018-01-03 15:32:31 +0000921#if defined(MBEDTLS_GCM_C) || \
922 defined(MBEDTLS_CCM_C) || \
923 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200924 if( cipher_info->mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200925 cipher_info->mode == MBEDTLS_MODE_CCM ||
926 cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakker5121ce52009-01-03 21:22:43 +0000927 {
Hanno Becker8759e162017-12-27 21:34:08 +0000928 size_t explicit_ivlen;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200929
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200930 transform->maclen = 0;
Hanno Becker81c7b182017-11-09 18:39:33 +0000931 mac_key_len = 0;
Hanno Becker8759e162017-12-27 21:34:08 +0000932 transform->taglen =
933 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200934
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200935 /* All modes haves 96-bit IVs;
936 * GCM and CCM has 4 implicit and 8 explicit bytes
937 * ChachaPoly has all 12 bytes implicit
938 */
Paul Bakker68884e32013-01-07 18:20:04 +0100939 transform->ivlen = 12;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200940 if( cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
941 transform->fixed_ivlen = 12;
942 else
943 transform->fixed_ivlen = 4;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200944
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200945 /* Minimum length of encrypted record */
946 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
Hanno Becker8759e162017-12-27 21:34:08 +0000947 transform->minlen = explicit_ivlen + transform->taglen;
Paul Bakker68884e32013-01-07 18:20:04 +0100948 }
949 else
Hanno Beckerf1229442018-01-03 15:32:31 +0000950#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
951#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
952 if( cipher_info->mode == MBEDTLS_MODE_STREAM ||
953 cipher_info->mode == MBEDTLS_MODE_CBC )
Paul Bakker68884e32013-01-07 18:20:04 +0100954 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200955 /* Initialize HMAC contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200956 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
957 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
Paul Bakker68884e32013-01-07 18:20:04 +0100958 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200959 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200960 return( ret );
Paul Bakker68884e32013-01-07 18:20:04 +0100961 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000962
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200963 /* Get MAC length */
Hanno Becker81c7b182017-11-09 18:39:33 +0000964 mac_key_len = mbedtls_md_get_size( md_info );
965 transform->maclen = mac_key_len;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200966
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200967#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200968 /*
969 * If HMAC is to be truncated, we shall keep the leftmost bytes,
970 * (rfc 6066 page 13 or rfc 2104 section 4),
971 * so we only need to adjust the length here.
972 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200973 if( session->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Hanno Beckere89353a2017-11-20 16:36:41 +0000974 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200975 transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN;
Hanno Beckere89353a2017-11-20 16:36:41 +0000976
977#if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT)
978 /* Fall back to old, non-compliant version of the truncated
Hanno Becker563423f2017-11-21 17:20:17 +0000979 * HMAC implementation which also truncates the key
980 * (Mbed TLS versions from 1.3 to 2.6.0) */
Hanno Beckere89353a2017-11-20 16:36:41 +0000981 mac_key_len = transform->maclen;
982#endif
983 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200984#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200985
986 /* IV length */
Paul Bakker68884e32013-01-07 18:20:04 +0100987 transform->ivlen = cipher_info->iv_size;
Paul Bakker5121ce52009-01-03 21:22:43 +0000988
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200989 /* Minimum length */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200990 if( cipher_info->mode == MBEDTLS_MODE_STREAM )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200991 transform->minlen = transform->maclen;
992 else
Paul Bakker68884e32013-01-07 18:20:04 +0100993 {
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200994 /*
995 * GenericBlockCipher:
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +0100996 * 1. if EtM is in use: one block plus MAC
997 * otherwise: * first multiple of blocklen greater than maclen
998 * 2. IV except for SSL3 and TLS 1.0
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200999 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001000#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1001 if( session->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +01001002 {
1003 transform->minlen = transform->maclen
1004 + cipher_info->block_size;
1005 }
1006 else
1007#endif
1008 {
1009 transform->minlen = transform->maclen
1010 + cipher_info->block_size
1011 - transform->maclen % cipher_info->block_size;
1012 }
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +02001013
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001014#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
1015 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
1016 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_1 )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +02001017 ; /* No need to adjust minlen */
Paul Bakker68884e32013-01-07 18:20:04 +01001018 else
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +02001019#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001020#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
1021 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_2 ||
1022 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +02001023 {
1024 transform->minlen += transform->ivlen;
1025 }
1026 else
1027#endif
1028 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001029 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1030 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +02001031 }
Paul Bakker68884e32013-01-07 18:20:04 +01001032 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001033 }
Hanno Beckerf1229442018-01-03 15:32:31 +00001034 else
1035#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
1036 {
1037 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1038 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1039 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001040
Hanno Beckere7f2df02017-12-27 08:17:40 +00001041 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
1042 (unsigned) keylen,
1043 (unsigned) transform->minlen,
1044 (unsigned) transform->ivlen,
1045 (unsigned) transform->maclen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001046
1047 /*
1048 * Finally setup the cipher contexts, IVs and MAC secrets.
1049 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001050#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001051 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00001052 {
Hanno Becker81c7b182017-11-09 18:39:33 +00001053 key1 = keyblk + mac_key_len * 2;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001054 key2 = keyblk + mac_key_len * 2 + keylen;
Paul Bakker5121ce52009-01-03 21:22:43 +00001055
Paul Bakker68884e32013-01-07 18:20:04 +01001056 mac_enc = keyblk;
Hanno Becker81c7b182017-11-09 18:39:33 +00001057 mac_dec = keyblk + mac_key_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00001058
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001059 /*
1060 * This is not used in TLS v1.1.
1061 */
Paul Bakker48916f92012-09-16 19:57:18 +00001062 iv_copy_len = ( transform->fixed_ivlen ) ?
1063 transform->fixed_ivlen : transform->ivlen;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001064 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len );
1065 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001066 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001067 }
1068 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001069#endif /* MBEDTLS_SSL_CLI_C */
1070#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001071 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00001072 {
Hanno Beckere7f2df02017-12-27 08:17:40 +00001073 key1 = keyblk + mac_key_len * 2 + keylen;
Hanno Becker81c7b182017-11-09 18:39:33 +00001074 key2 = keyblk + mac_key_len * 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00001075
Hanno Becker81c7b182017-11-09 18:39:33 +00001076 mac_enc = keyblk + mac_key_len;
Paul Bakker68884e32013-01-07 18:20:04 +01001077 mac_dec = keyblk;
Paul Bakker5121ce52009-01-03 21:22:43 +00001078
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001079 /*
1080 * This is not used in TLS v1.1.
1081 */
Paul Bakker48916f92012-09-16 19:57:18 +00001082 iv_copy_len = ( transform->fixed_ivlen ) ?
1083 transform->fixed_ivlen : transform->ivlen;
Hanno Beckere7f2df02017-12-27 08:17:40 +00001084 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len );
1085 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +00001086 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001087 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001088 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001089#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001090 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001091 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1092 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01001093 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001094
Hanno Becker92231322018-01-03 15:32:51 +00001095#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001096#if defined(MBEDTLS_SSL_PROTO_SSL3)
1097 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker68884e32013-01-07 18:20:04 +01001098 {
Hanno Becker92231322018-01-03 15:32:51 +00001099 if( mac_key_len > sizeof( transform->mac_enc ) )
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001100 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001101 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1102 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001103 }
1104
Hanno Becker81c7b182017-11-09 18:39:33 +00001105 memcpy( transform->mac_enc, mac_enc, mac_key_len );
1106 memcpy( transform->mac_dec, mac_dec, mac_key_len );
Paul Bakker68884e32013-01-07 18:20:04 +01001107 }
1108 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001109#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1110#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1111 defined(MBEDTLS_SSL_PROTO_TLS1_2)
1112 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
Paul Bakker68884e32013-01-07 18:20:04 +01001113 {
Gilles Peskine039fd122018-03-19 19:06:08 +01001114 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
1115 For AEAD-based ciphersuites, there is nothing to do here. */
1116 if( mac_key_len != 0 )
1117 {
1118 mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
1119 mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
1120 }
Paul Bakker68884e32013-01-07 18:20:04 +01001121 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001122 else
1123#endif
Paul Bakker577e0062013-08-28 11:57:20 +02001124 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001125 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1126 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02001127 }
Hanno Becker92231322018-01-03 15:32:51 +00001128#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Paul Bakker68884e32013-01-07 18:20:04 +01001129
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001130#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1131 if( mbedtls_ssl_hw_record_init != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00001132 {
1133 int ret = 0;
1134
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001135 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00001136
Hanno Beckere7f2df02017-12-27 08:17:40 +00001137 if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, keylen,
Paul Bakker07eb38b2012-12-19 14:42:06 +01001138 transform->iv_enc, transform->iv_dec,
1139 iv_copy_len,
Paul Bakker68884e32013-01-07 18:20:04 +01001140 mac_enc, mac_dec,
Hanno Becker81c7b182017-11-09 18:39:33 +00001141 mac_key_len ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00001142 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001143 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret );
1144 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00001145 }
1146 }
Hanno Becker92231322018-01-03 15:32:51 +00001147#else
1148 ((void) mac_dec);
1149 ((void) mac_enc);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001150#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00001151
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001152#if defined(MBEDTLS_SSL_EXPORT_KEYS)
1153 if( ssl->conf->f_export_keys != NULL )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001154 {
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001155 ssl->conf->f_export_keys( ssl->conf->p_export_keys,
1156 session->master, keyblk,
Hanno Beckere7f2df02017-12-27 08:17:40 +00001157 mac_key_len, keylen,
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001158 iv_copy_len );
1159 }
1160#endif
1161
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001162 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001163 cipher_info ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001164 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001165 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001166 return( ret );
1167 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001168
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001169 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001170 cipher_info ) ) != 0 )
1171 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001172 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001173 return( ret );
1174 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001175
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001176 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001177 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001178 MBEDTLS_ENCRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001179 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001180 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001181 return( ret );
1182 }
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001183
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001184 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001185 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001186 MBEDTLS_DECRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001187 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001188 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001189 return( ret );
1190 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001191
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001192#if defined(MBEDTLS_CIPHER_MODE_CBC)
1193 if( cipher_info->mode == MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001194 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001195 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1196 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001197 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001198 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001199 return( ret );
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001200 }
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001201
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001202 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1203 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001204 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001205 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001206 return( ret );
1207 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001208 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001209#endif /* MBEDTLS_CIPHER_MODE_CBC */
Paul Bakker5121ce52009-01-03 21:22:43 +00001210
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001211 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001212
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001213#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker2770fbd2012-07-03 13:30:23 +00001214 // Initialize compression
1215 //
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001216 if( session->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001217 {
Paul Bakker16770332013-10-11 09:59:44 +02001218 if( ssl->compress_buf == NULL )
1219 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001220 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
Angus Grattond8213d02016-05-25 20:56:48 +10001221 ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
Paul Bakker16770332013-10-11 09:59:44 +02001222 if( ssl->compress_buf == NULL )
1223 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02001224 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
Angus Grattond8213d02016-05-25 20:56:48 +10001225 MBEDTLS_SSL_COMPRESS_BUFFER_LEN ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001226 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker16770332013-10-11 09:59:44 +02001227 }
1228 }
1229
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001230 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001231
Paul Bakker48916f92012-09-16 19:57:18 +00001232 memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) );
1233 memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001234
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001235 if( deflateInit( &transform->ctx_deflate,
1236 Z_DEFAULT_COMPRESSION ) != Z_OK ||
Paul Bakker48916f92012-09-16 19:57:18 +00001237 inflateInit( &transform->ctx_inflate ) != Z_OK )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001238 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001239 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
1240 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001241 }
1242 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001243#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00001244
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001245 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001246
1247 return( 0 );
1248}
1249
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001250#if defined(MBEDTLS_SSL_PROTO_SSL3)
1251void ssl_calc_verify_ssl( mbedtls_ssl_context *ssl, unsigned char hash[36] )
Paul Bakker5121ce52009-01-03 21:22:43 +00001252{
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001253 mbedtls_md5_context md5;
1254 mbedtls_sha1_context sha1;
Paul Bakker5121ce52009-01-03 21:22:43 +00001255 unsigned char pad_1[48];
1256 unsigned char pad_2[48];
1257
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001258 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001259
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001260 mbedtls_md5_init( &md5 );
1261 mbedtls_sha1_init( &sha1 );
1262
1263 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1264 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001265
Paul Bakker380da532012-04-18 16:10:25 +00001266 memset( pad_1, 0x36, 48 );
1267 memset( pad_2, 0x5C, 48 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001268
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001269 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1270 mbedtls_md5_update_ret( &md5, pad_1, 48 );
1271 mbedtls_md5_finish_ret( &md5, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00001272
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001273 mbedtls_md5_starts_ret( &md5 );
1274 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1275 mbedtls_md5_update_ret( &md5, pad_2, 48 );
1276 mbedtls_md5_update_ret( &md5, hash, 16 );
1277 mbedtls_md5_finish_ret( &md5, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00001278
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001279 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1280 mbedtls_sha1_update_ret( &sha1, pad_1, 40 );
1281 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
Paul Bakker380da532012-04-18 16:10:25 +00001282
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001283 mbedtls_sha1_starts_ret( &sha1 );
1284 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1285 mbedtls_sha1_update_ret( &sha1, pad_2, 40 );
1286 mbedtls_sha1_update_ret( &sha1, hash + 16, 20 );
1287 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
Paul Bakker380da532012-04-18 16:10:25 +00001288
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001289 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 );
1290 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001291
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001292 mbedtls_md5_free( &md5 );
1293 mbedtls_sha1_free( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +02001294
Paul Bakker380da532012-04-18 16:10:25 +00001295 return;
1296}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001297#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker380da532012-04-18 16:10:25 +00001298
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001299#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
1300void ssl_calc_verify_tls( mbedtls_ssl_context *ssl, unsigned char hash[36] )
Paul Bakker380da532012-04-18 16:10:25 +00001301{
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001302 mbedtls_md5_context md5;
1303 mbedtls_sha1_context sha1;
Paul Bakker380da532012-04-18 16:10:25 +00001304
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001305 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001306
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001307 mbedtls_md5_init( &md5 );
1308 mbedtls_sha1_init( &sha1 );
1309
1310 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1311 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
Paul Bakker380da532012-04-18 16:10:25 +00001312
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001313 mbedtls_md5_finish_ret( &md5, hash );
1314 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
Paul Bakker380da532012-04-18 16:10:25 +00001315
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001316 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 );
1317 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001318
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001319 mbedtls_md5_free( &md5 );
1320 mbedtls_sha1_free( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +02001321
Paul Bakker380da532012-04-18 16:10:25 +00001322 return;
1323}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001324#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker380da532012-04-18 16:10:25 +00001325
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001326#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1327#if defined(MBEDTLS_SHA256_C)
1328void ssl_calc_verify_tls_sha256( mbedtls_ssl_context *ssl, unsigned char hash[32] )
Paul Bakker380da532012-04-18 16:10:25 +00001329{
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001330 mbedtls_sha256_context sha256;
Paul Bakker380da532012-04-18 16:10:25 +00001331
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001332 mbedtls_sha256_init( &sha256 );
1333
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001334 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001335
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001336 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001337 mbedtls_sha256_finish_ret( &sha256, hash );
Paul Bakker380da532012-04-18 16:10:25 +00001338
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001339 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 32 );
1340 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001341
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001342 mbedtls_sha256_free( &sha256 );
Paul Bakker5b4af392014-06-26 12:09:34 +02001343
Paul Bakker380da532012-04-18 16:10:25 +00001344 return;
1345}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001346#endif /* MBEDTLS_SHA256_C */
Paul Bakker380da532012-04-18 16:10:25 +00001347
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001348#if defined(MBEDTLS_SHA512_C)
1349void ssl_calc_verify_tls_sha384( mbedtls_ssl_context *ssl, unsigned char hash[48] )
Paul Bakker380da532012-04-18 16:10:25 +00001350{
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001351 mbedtls_sha512_context sha512;
Paul Bakker380da532012-04-18 16:10:25 +00001352
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001353 mbedtls_sha512_init( &sha512 );
1354
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001355 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001356
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001357 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001358 mbedtls_sha512_finish_ret( &sha512, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00001359
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001360 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 48 );
1361 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001362
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001363 mbedtls_sha512_free( &sha512 );
Paul Bakker5b4af392014-06-26 12:09:34 +02001364
Paul Bakker5121ce52009-01-03 21:22:43 +00001365 return;
1366}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001367#endif /* MBEDTLS_SHA512_C */
1368#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001369
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001370#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
1371int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001372{
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001373 unsigned char *p = ssl->handshake->premaster;
1374 unsigned char *end = p + sizeof( ssl->handshake->premaster );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001375 const unsigned char *psk = ssl->conf->psk;
1376 size_t psk_len = ssl->conf->psk_len;
1377
1378 /* If the psk callback was called, use its result */
1379 if( ssl->handshake->psk != NULL )
1380 {
1381 psk = ssl->handshake->psk;
1382 psk_len = ssl->handshake->psk_len;
1383 }
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001384
1385 /*
1386 * PMS = struct {
1387 * opaque other_secret<0..2^16-1>;
1388 * opaque psk<0..2^16-1>;
1389 * };
1390 * with "other_secret" depending on the particular key exchange
1391 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001392#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1393 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001394 {
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001395 if( end - p < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001396 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001397
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001398 *(p++) = (unsigned char)( psk_len >> 8 );
1399 *(p++) = (unsigned char)( psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001400
1401 if( end < p || (size_t)( end - p ) < psk_len )
1402 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1403
1404 memset( p, 0, psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001405 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001406 }
1407 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001408#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
1409#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
1410 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02001411 {
1412 /*
1413 * other_secret already set by the ClientKeyExchange message,
1414 * and is 48 bytes long
1415 */
Philippe Antoine747fd532018-05-30 09:13:21 +02001416 if( end - p < 2 )
1417 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1418
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02001419 *p++ = 0;
1420 *p++ = 48;
1421 p += 48;
1422 }
1423 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001424#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
1425#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
1426 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001427 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02001428 int ret;
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01001429 size_t len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001430
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02001431 /* Write length only when we know the actual value */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001432 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01001433 p + 2, end - ( p + 2 ), &len,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001434 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001435 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001436 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001437 return( ret );
1438 }
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02001439 *(p++) = (unsigned char)( len >> 8 );
1440 *(p++) = (unsigned char)( len );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001441 p += len;
1442
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001443 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001444 }
1445 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001446#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
1447#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
1448 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001449 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02001450 int ret;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001451 size_t zlen;
1452
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001453 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
Paul Bakker66d5d072014-06-17 16:39:18 +02001454 p + 2, end - ( p + 2 ),
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001455 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001456 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001457 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001458 return( ret );
1459 }
1460
1461 *(p++) = (unsigned char)( zlen >> 8 );
1462 *(p++) = (unsigned char)( zlen );
1463 p += zlen;
1464
Janos Follath3fbdada2018-08-15 10:26:53 +01001465 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
1466 MBEDTLS_DEBUG_ECDH_Z );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001467 }
1468 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001469#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001470 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001471 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1472 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001473 }
1474
1475 /* opaque psk<0..2^16-1>; */
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001476 if( end - p < 2 )
1477 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01001478
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001479 *(p++) = (unsigned char)( psk_len >> 8 );
1480 *(p++) = (unsigned char)( psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001481
1482 if( end < p || (size_t)( end - p ) < psk_len )
1483 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1484
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001485 memcpy( p, psk, psk_len );
1486 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001487
1488 ssl->handshake->pmslen = p - ssl->handshake->premaster;
1489
1490 return( 0 );
1491}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001492#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001493
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001494#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00001495/*
1496 * SSLv3.0 MAC functions
1497 */
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01001498#define SSL_MAC_MAX_BYTES 20 /* MD-5 or SHA-1 */
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001499static void ssl_mac( mbedtls_md_context_t *md_ctx,
1500 const unsigned char *secret,
1501 const unsigned char *buf, size_t len,
1502 const unsigned char *ctr, int type,
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01001503 unsigned char out[SSL_MAC_MAX_BYTES] )
Paul Bakker5121ce52009-01-03 21:22:43 +00001504{
1505 unsigned char header[11];
1506 unsigned char padding[48];
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02001507 int padlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001508 int md_size = mbedtls_md_get_size( md_ctx->md_info );
1509 int md_type = mbedtls_md_get_type( md_ctx->md_info );
Paul Bakker68884e32013-01-07 18:20:04 +01001510
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02001511 /* Only MD5 and SHA-1 supported */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001512 if( md_type == MBEDTLS_MD_MD5 )
Paul Bakker68884e32013-01-07 18:20:04 +01001513 padlen = 48;
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02001514 else
Paul Bakker68884e32013-01-07 18:20:04 +01001515 padlen = 40;
Paul Bakker5121ce52009-01-03 21:22:43 +00001516
1517 memcpy( header, ctr, 8 );
1518 header[ 8] = (unsigned char) type;
1519 header[ 9] = (unsigned char)( len >> 8 );
1520 header[10] = (unsigned char)( len );
1521
Paul Bakker68884e32013-01-07 18:20:04 +01001522 memset( padding, 0x36, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001523 mbedtls_md_starts( md_ctx );
1524 mbedtls_md_update( md_ctx, secret, md_size );
1525 mbedtls_md_update( md_ctx, padding, padlen );
1526 mbedtls_md_update( md_ctx, header, 11 );
1527 mbedtls_md_update( md_ctx, buf, len );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001528 mbedtls_md_finish( md_ctx, out );
Paul Bakker5121ce52009-01-03 21:22:43 +00001529
Paul Bakker68884e32013-01-07 18:20:04 +01001530 memset( padding, 0x5C, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001531 mbedtls_md_starts( md_ctx );
1532 mbedtls_md_update( md_ctx, secret, md_size );
1533 mbedtls_md_update( md_ctx, padding, padlen );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001534 mbedtls_md_update( md_ctx, out, md_size );
1535 mbedtls_md_finish( md_ctx, out );
Paul Bakker5f70b252012-09-13 14:23:06 +00001536}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001537#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +00001538
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02001539/* The function below is only used in the Lucky 13 counter-measure in
Hanno Becker30d02cd2018-10-18 15:43:13 +01001540 * mbedtls_ssl_decrypt_buf(). These are the defines that guard the call site. */
Hanno Becker5cc04d52018-01-03 15:24:20 +00001541#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) && \
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02001542 ( defined(MBEDTLS_SSL_PROTO_TLS1) || \
1543 defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1544 defined(MBEDTLS_SSL_PROTO_TLS1_2) )
1545/* This function makes sure every byte in the memory region is accessed
1546 * (in ascending addresses order) */
1547static void ssl_read_memory( unsigned char *p, size_t len )
1548{
1549 unsigned char acc = 0;
1550 volatile unsigned char force;
1551
1552 for( ; len != 0; p++, len-- )
1553 acc ^= *p;
1554
1555 force = acc;
1556 (void) force;
1557}
1558#endif /* SSL_SOME_MODES_USE_MAC && ( TLS1 || TLS1_1 || TLS1_2 ) */
1559
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01001560/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001561 * Encryption/decryption functions
Paul Bakkerf7abd422013-04-16 13:15:56 +02001562 */
Hanno Becker3307b532017-12-27 21:37:21 +00001563
Hanno Becker92c930f2019-04-29 17:31:37 +01001564#if defined(MBEDTLS_SSL_CID)
Hanno Becker89693692019-05-20 15:06:12 +01001565/* This functions transforms a DTLS plaintext fragment and a record content
1566 * type into an instance of the DTLSInnerPlaintext structure:
Hanno Becker92c930f2019-04-29 17:31:37 +01001567 *
1568 * struct {
1569 * opaque content[DTLSPlaintext.length];
1570 * ContentType real_type;
1571 * uint8 zeros[length_of_padding];
1572 * } DTLSInnerPlaintext;
1573 *
1574 * Input:
1575 * - `content`: The beginning of the buffer holding the
1576 * plaintext to be wrapped.
1577 * - `*content_size`: The length of the plaintext in Bytes.
1578 * - `max_len`: The number of Bytes available starting from
1579 * `content`. This must be `>= *content_size`.
1580 * - `rec_type`: The desired record content type.
1581 *
1582 * Output:
1583 * - `content`: The beginning of the resulting DTLSInnerPlaintext structure.
1584 * - `*content_size`: The length of the resulting DTLSInnerPlaintext structure.
1585 *
1586 * Returns:
1587 * - `0` on success.
1588 * - A negative error code if `max_len` didn't offer enough space
1589 * for the expansion.
1590 */
1591static int ssl_cid_build_inner_plaintext( unsigned char *content,
1592 size_t *content_size,
1593 size_t remaining,
1594 uint8_t rec_type )
1595{
1596 size_t len = *content_size;
Hanno Becker78426092019-05-13 15:31:17 +01001597 size_t pad = ( MBEDTLS_SSL_CID_PADDING_GRANULARITY -
1598 ( len + 1 ) % MBEDTLS_SSL_CID_PADDING_GRANULARITY ) %
1599 MBEDTLS_SSL_CID_PADDING_GRANULARITY;
Hanno Becker92c930f2019-04-29 17:31:37 +01001600
1601 /* Write real content type */
1602 if( remaining == 0 )
1603 return( -1 );
1604 content[ len ] = rec_type;
1605 len++;
1606 remaining--;
1607
1608 if( remaining < pad )
1609 return( -1 );
1610 memset( content + len, 0, pad );
1611 len += pad;
1612 remaining -= pad;
1613
1614 *content_size = len;
1615 return( 0 );
1616}
1617
Hanno Becker7dc25772019-05-20 15:08:01 +01001618/* This function parses a DTLSInnerPlaintext structure.
1619 * See ssl_cid_build_inner_plaintext() for details. */
Hanno Becker92c930f2019-04-29 17:31:37 +01001620static int ssl_cid_parse_inner_plaintext( unsigned char const *content,
1621 size_t *content_size,
1622 uint8_t *rec_type )
1623{
1624 size_t remaining = *content_size;
1625
1626 /* Determine length of padding by skipping zeroes from the back. */
1627 do
1628 {
1629 if( remaining == 0 )
1630 return( -1 );
1631 remaining--;
1632 } while( content[ remaining ] == 0 );
1633
1634 *content_size = remaining;
1635 *rec_type = content[ remaining ];
1636
1637 return( 0 );
1638}
1639#endif /* MBEDTLS_SSL_CID */
1640
Hanno Becker99abf512019-05-20 14:50:53 +01001641/* `add_data` must have size 13 Bytes if the CID extension is disabled,
Hanno Beckeracadb0a2019-05-08 18:15:21 +01001642 * and 13 + 1 + CID-length Bytes if the CID extension is enabled. */
Hanno Becker3307b532017-12-27 21:37:21 +00001643static void ssl_extract_add_data_from_record( unsigned char* add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01001644 size_t *add_data_len,
Hanno Becker3307b532017-12-27 21:37:21 +00001645 mbedtls_record *rec )
1646{
Hanno Becker99abf512019-05-20 14:50:53 +01001647 /* Quoting RFC 5246 (TLS 1.2):
Hanno Beckere83efe62019-04-29 13:52:53 +01001648 *
1649 * additional_data = seq_num + TLSCompressed.type +
1650 * TLSCompressed.version + TLSCompressed.length;
1651 *
Hanno Becker99abf512019-05-20 14:50:53 +01001652 * For the CID extension, this is extended as follows
1653 * (quoting draft-ietf-tls-dtls-connection-id-05,
1654 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05):
Hanno Beckere83efe62019-04-29 13:52:53 +01001655 *
1656 * additional_data = seq_num + DTLSPlaintext.type +
1657 * DTLSPlaintext.version +
Hanno Becker99abf512019-05-20 14:50:53 +01001658 * cid +
1659 * cid_length +
Hanno Beckere83efe62019-04-29 13:52:53 +01001660 * length_of_DTLSInnerPlaintext;
1661 */
1662
Hanno Becker3307b532017-12-27 21:37:21 +00001663 memcpy( add_data, rec->ctr, sizeof( rec->ctr ) );
1664 add_data[8] = rec->type;
Hanno Becker24ce1eb2019-05-20 15:01:46 +01001665 memcpy( add_data + 9, rec->ver, sizeof( rec->ver ) );
Hanno Beckere83efe62019-04-29 13:52:53 +01001666
1667#if defined(MBEDTLS_SSL_CID)
Hanno Becker1f02f052019-05-09 11:38:24 +01001668 if( rec->cid_len != 0 )
1669 {
1670 memcpy( add_data + 11, rec->cid, rec->cid_len );
1671 add_data[11 + rec->cid_len + 0] = rec->cid_len;
1672 add_data[11 + rec->cid_len + 1] = ( rec->data_len >> 8 ) & 0xFF;
1673 add_data[11 + rec->cid_len + 2] = ( rec->data_len >> 0 ) & 0xFF;
1674 *add_data_len = 13 + 1 + rec->cid_len;
1675 }
1676 else
Hanno Beckere83efe62019-04-29 13:52:53 +01001677#endif /* MBEDTLS_SSL_CID */
Hanno Becker1f02f052019-05-09 11:38:24 +01001678 {
1679 add_data[11 + 0] = ( rec->data_len >> 8 ) & 0xFF;
1680 add_data[11 + 1] = ( rec->data_len >> 0 ) & 0xFF;
1681 *add_data_len = 13;
1682 }
Hanno Becker3307b532017-12-27 21:37:21 +00001683}
1684
Hanno Becker611a83b2018-01-03 14:27:32 +00001685int mbedtls_ssl_encrypt_buf( mbedtls_ssl_context *ssl,
1686 mbedtls_ssl_transform *transform,
1687 mbedtls_record *rec,
1688 int (*f_rng)(void *, unsigned char *, size_t),
1689 void *p_rng )
Paul Bakker5121ce52009-01-03 21:22:43 +00001690{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001691 mbedtls_cipher_mode_t mode;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001692 int auth_done = 0;
Hanno Becker3307b532017-12-27 21:37:21 +00001693 unsigned char * data;
Hanno Becker28a0c4e2019-05-20 14:54:26 +01001694 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_OUT_LEN_MAX ];
Hanno Beckere83efe62019-04-29 13:52:53 +01001695 size_t add_data_len;
Hanno Becker3307b532017-12-27 21:37:21 +00001696 size_t post_avail;
1697
1698 /* The SSL context is only used for debugging purposes! */
Hanno Becker611a83b2018-01-03 14:27:32 +00001699#if !defined(MBEDTLS_DEBUG_C)
Hanno Becker3307b532017-12-27 21:37:21 +00001700 ((void) ssl);
1701#endif
1702
1703 /* The PRNG is used for dynamic IV generation that's used
1704 * for CBC transformations in TLS 1.1 and TLS 1.2. */
1705#if !( defined(MBEDTLS_CIPHER_MODE_CBC) && \
1706 ( defined(MBEDTLS_AES_C) || \
1707 defined(MBEDTLS_ARIA_C) || \
1708 defined(MBEDTLS_CAMELLIA_C) ) && \
1709 ( defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2) ) )
1710 ((void) f_rng);
1711 ((void) p_rng);
1712#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001713
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001714 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001715
Hanno Becker3307b532017-12-27 21:37:21 +00001716 if( transform == NULL )
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001717 {
Hanno Becker3307b532017-12-27 21:37:21 +00001718 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no transform provided to encrypt_buf" ) );
1719 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1720 }
Hanno Becker505089d2019-05-01 09:45:57 +01001721 if( rec == NULL
1722 || rec->buf == NULL
1723 || rec->buf_len < rec->data_offset
1724 || rec->buf_len - rec->data_offset < rec->data_len
1725#if defined(MBEDTLS_SSL_CID)
1726 || rec->cid_len != 0
1727#endif
1728 )
Hanno Becker3307b532017-12-27 21:37:21 +00001729 {
1730 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to encrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001731 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001732 }
1733
Hanno Becker3307b532017-12-27 21:37:21 +00001734 data = rec->buf + rec->data_offset;
Hanno Becker92c930f2019-04-29 17:31:37 +01001735 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001736 MBEDTLS_SSL_DEBUG_BUF( 4, "before encrypt: output payload",
Hanno Becker3307b532017-12-27 21:37:21 +00001737 data, rec->data_len );
1738
1739 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc );
1740
1741 if( rec->data_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
1742 {
1743 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record content %u too large, maximum %d",
1744 (unsigned) rec->data_len,
1745 MBEDTLS_SSL_OUT_CONTENT_LEN ) );
1746 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1747 }
Manuel Pégourié-Gonnard60346be2014-11-21 11:38:37 +01001748
Hanno Beckere83efe62019-04-29 13:52:53 +01001749#if defined(MBEDTLS_SSL_CID)
1750 /*
1751 * Add CID information
1752 */
1753 rec->cid_len = transform->out_cid_len;
1754 memcpy( rec->cid, transform->out_cid, transform->out_cid_len );
1755 MBEDTLS_SSL_DEBUG_BUF( 3, "CID", rec->cid, rec->cid_len );
Hanno Becker92c930f2019-04-29 17:31:37 +01001756
1757 if( rec->cid_len != 0 )
1758 {
1759 /*
Hanno Becker7dc25772019-05-20 15:08:01 +01001760 * Wrap plaintext into DTLSInnerPlaintext structure.
1761 * See ssl_cid_build_inner_plaintext() for more information.
Hanno Becker92c930f2019-04-29 17:31:37 +01001762 *
Hanno Becker7dc25772019-05-20 15:08:01 +01001763 * Note that this changes `rec->data_len`, and hence
1764 * `post_avail` needs to be recalculated afterwards.
Hanno Becker92c930f2019-04-29 17:31:37 +01001765 */
1766 if( ssl_cid_build_inner_plaintext( data,
1767 &rec->data_len,
1768 post_avail,
1769 rec->type ) != 0 )
1770 {
1771 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
1772 }
1773
1774 rec->type = MBEDTLS_SSL_MSG_CID;
1775 }
Hanno Beckere83efe62019-04-29 13:52:53 +01001776#endif /* MBEDTLS_SSL_CID */
1777
Hanno Becker92c930f2019-04-29 17:31:37 +01001778 post_avail = rec->buf_len - ( rec->data_len + rec->data_offset );
1779
Paul Bakker5121ce52009-01-03 21:22:43 +00001780 /*
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01001781 * Add MAC before if needed
Paul Bakker5121ce52009-01-03 21:22:43 +00001782 */
Hanno Becker5cc04d52018-01-03 15:24:20 +00001783#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001784 if( mode == MBEDTLS_MODE_STREAM ||
1785 ( mode == MBEDTLS_MODE_CBC
1786#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker3307b532017-12-27 21:37:21 +00001787 && transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001788#endif
1789 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00001790 {
Hanno Becker3307b532017-12-27 21:37:21 +00001791 if( post_avail < transform->maclen )
1792 {
1793 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
1794 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
1795 }
1796
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001797#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker3307b532017-12-27 21:37:21 +00001798 if( transform->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001799 {
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01001800 unsigned char mac[SSL_MAC_MAX_BYTES];
Hanno Becker3307b532017-12-27 21:37:21 +00001801 ssl_mac( &transform->md_ctx_enc, transform->mac_enc,
1802 data, rec->data_len, rec->ctr, rec->type, mac );
1803 memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001804 }
1805 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001806#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001807#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1808 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker3307b532017-12-27 21:37:21 +00001809 if( transform->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001810 {
Hanno Becker992b6872017-11-09 18:57:39 +00001811 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
1812
Hanno Beckere83efe62019-04-29 13:52:53 +01001813 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker992b6872017-11-09 18:57:39 +00001814
Hanno Becker3307b532017-12-27 21:37:21 +00001815 mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01001816 add_data_len );
Hanno Becker3307b532017-12-27 21:37:21 +00001817 mbedtls_md_hmac_update( &transform->md_ctx_enc,
1818 data, rec->data_len );
1819 mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
1820 mbedtls_md_hmac_reset( &transform->md_ctx_enc );
1821
1822 memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001823 }
1824 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001825#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001826 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001827 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1828 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001829 }
1830
Hanno Becker3307b532017-12-27 21:37:21 +00001831 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", data + rec->data_len,
1832 transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001833
Hanno Becker3307b532017-12-27 21:37:21 +00001834 rec->data_len += transform->maclen;
1835 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001836 auth_done++;
Paul Bakker577e0062013-08-28 11:57:20 +02001837 }
Hanno Becker5cc04d52018-01-03 15:24:20 +00001838#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00001839
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001840 /*
1841 * Encrypt
1842 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001843#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
1844 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00001845 {
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001846 int ret;
Hanno Becker3307b532017-12-27 21:37:21 +00001847 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001848 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Hanno Becker3307b532017-12-27 21:37:21 +00001849 "including %d bytes of padding",
1850 rec->data_len, 0 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001851
Hanno Becker3307b532017-12-27 21:37:21 +00001852 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
1853 transform->iv_enc, transform->ivlen,
1854 data, rec->data_len,
1855 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02001856 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001857 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001858 return( ret );
1859 }
1860
Hanno Becker3307b532017-12-27 21:37:21 +00001861 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001862 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001863 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1864 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001865 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001866 }
Paul Bakker68884e32013-01-07 18:20:04 +01001867 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001868#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Hanno Becker4c6876b2017-12-27 21:28:58 +00001869
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001870#if defined(MBEDTLS_GCM_C) || \
1871 defined(MBEDTLS_CCM_C) || \
1872 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001873 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001874 mode == MBEDTLS_MODE_CCM ||
1875 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00001876 {
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001877 int ret;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001878 unsigned char iv[12];
Hanno Becker3307b532017-12-27 21:37:21 +00001879 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001880
Hanno Becker3307b532017-12-27 21:37:21 +00001881 /* Check that there's space for both the authentication tag
1882 * and the explicit IV before and after the record content. */
1883 if( post_avail < transform->taglen ||
1884 rec->data_offset < explicit_iv_len )
1885 {
1886 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
1887 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
1888 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00001889
Paul Bakker68884e32013-01-07 18:20:04 +01001890 /*
1891 * Generate IV
1892 */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001893 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
1894 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02001895 /* GCM and CCM: fixed || explicit (=seqnum) */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001896 memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
Hanno Becker3307b532017-12-27 21:37:21 +00001897 memcpy( iv + transform->fixed_ivlen, rec->ctr,
1898 explicit_iv_len );
1899 /* Prefix record content with explicit IV. */
1900 memcpy( data - explicit_iv_len, rec->ctr, explicit_iv_len );
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001901 }
1902 else if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
1903 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02001904 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001905 unsigned char i;
1906
1907 memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
1908
1909 for( i = 0; i < 8; i++ )
Hanno Becker3307b532017-12-27 21:37:21 +00001910 iv[i+4] ^= rec->ctr[i];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001911 }
1912 else
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01001913 {
1914 /* Reminder if we ever add an AEAD mode with a different size */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001915 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1916 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01001917 }
1918
Hanno Beckere83efe62019-04-29 13:52:53 +01001919 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker08885812019-04-26 13:34:37 +01001920
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001921 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (internal)",
1922 iv, transform->ivlen );
1923 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (transmitted)",
Hanno Becker3307b532017-12-27 21:37:21 +00001924 data - explicit_iv_len, explicit_iv_len );
1925 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckere83efe62019-04-29 13:52:53 +01001926 add_data, add_data_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001927 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001928 "including 0 bytes of padding",
Hanno Becker3307b532017-12-27 21:37:21 +00001929 rec->data_len ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00001930
Paul Bakker68884e32013-01-07 18:20:04 +01001931 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001932 * Encrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001933 */
Hanno Becker3307b532017-12-27 21:37:21 +00001934
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001935 if( ( ret = mbedtls_cipher_auth_encrypt( &transform->cipher_ctx_enc,
Hanno Becker3307b532017-12-27 21:37:21 +00001936 iv, transform->ivlen,
Hanno Beckere83efe62019-04-29 13:52:53 +01001937 add_data, add_data_len, /* add data */
Hanno Becker3307b532017-12-27 21:37:21 +00001938 data, rec->data_len, /* source */
1939 data, &rec->data_len, /* destination */
1940 data + rec->data_len, transform->taglen ) ) != 0 )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001941 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001942 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001943 return( ret );
1944 }
1945
Hanno Becker3307b532017-12-27 21:37:21 +00001946 MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag",
1947 data + rec->data_len, transform->taglen );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001948
Hanno Becker3307b532017-12-27 21:37:21 +00001949 rec->data_len += transform->taglen + explicit_iv_len;
1950 rec->data_offset -= explicit_iv_len;
1951 post_avail -= transform->taglen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001952 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001953 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001954 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001955#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
1956#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00001957 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) || defined(MBEDTLS_ARIA_C) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001958 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00001959 {
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001960 int ret;
Hanno Becker3307b532017-12-27 21:37:21 +00001961 size_t padlen, i;
1962 size_t olen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001963
Hanno Becker3307b532017-12-27 21:37:21 +00001964 /* Currently we're always using minimal padding
1965 * (up to 255 bytes would be allowed). */
1966 padlen = transform->ivlen - ( rec->data_len + 1 ) % transform->ivlen;
1967 if( padlen == transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00001968 padlen = 0;
1969
Hanno Becker3307b532017-12-27 21:37:21 +00001970 /* Check there's enough space in the buffer for the padding. */
1971 if( post_avail < padlen + 1 )
1972 {
1973 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
1974 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
1975 }
1976
Paul Bakker5121ce52009-01-03 21:22:43 +00001977 for( i = 0; i <= padlen; i++ )
Hanno Becker3307b532017-12-27 21:37:21 +00001978 data[rec->data_len + i] = (unsigned char) padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00001979
Hanno Becker3307b532017-12-27 21:37:21 +00001980 rec->data_len += padlen + 1;
1981 post_avail -= padlen + 1;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001982
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001983#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001984 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00001985 * Prepend per-record IV for block cipher in TLS v1.1 and up as per
1986 * Method 1 (6.2.3.2. in RFC4346 and RFC5246)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001987 */
Hanno Becker3307b532017-12-27 21:37:21 +00001988 if( transform->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001989 {
Hanno Becker3307b532017-12-27 21:37:21 +00001990 if( f_rng == NULL )
1991 {
1992 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No PRNG provided to encrypt_record routine" ) );
1993 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1994 }
1995
1996 if( rec->data_offset < transform->ivlen )
1997 {
1998 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
1999 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2000 }
2001
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002002 /*
2003 * Generate IV
2004 */
Hanno Becker3307b532017-12-27 21:37:21 +00002005 ret = f_rng( p_rng, transform->iv_enc, transform->ivlen );
Paul Bakkera3d195c2011-11-27 21:07:34 +00002006 if( ret != 0 )
2007 return( ret );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002008
Hanno Becker3307b532017-12-27 21:37:21 +00002009 memcpy( data - transform->ivlen, transform->iv_enc,
2010 transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002011
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002012 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002013#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002014
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002015 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002016 "including %d bytes of IV and %d bytes of padding",
Hanno Becker3307b532017-12-27 21:37:21 +00002017 rec->data_len, transform->ivlen,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02002018 padlen + 1 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002019
Hanno Becker3307b532017-12-27 21:37:21 +00002020 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_enc,
2021 transform->iv_enc,
2022 transform->ivlen,
2023 data, rec->data_len,
2024 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02002025 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002026 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02002027 return( ret );
2028 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02002029
Hanno Becker3307b532017-12-27 21:37:21 +00002030 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02002031 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002032 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2033 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02002034 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02002035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002036#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
Hanno Becker3307b532017-12-27 21:37:21 +00002037 if( transform->minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakkercca5b812013-08-31 17:40:26 +02002038 {
2039 /*
2040 * Save IV in SSL3 and TLS1
2041 */
Hanno Becker3307b532017-12-27 21:37:21 +00002042 memcpy( transform->iv_enc, transform->cipher_ctx_enc.iv,
2043 transform->ivlen );
Paul Bakker5121ce52009-01-03 21:22:43 +00002044 }
Hanno Becker3307b532017-12-27 21:37:21 +00002045 else
Paul Bakkercca5b812013-08-31 17:40:26 +02002046#endif
Hanno Becker3307b532017-12-27 21:37:21 +00002047 {
2048 data -= transform->ivlen;
2049 rec->data_offset -= transform->ivlen;
2050 rec->data_len += transform->ivlen;
2051 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002052
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002053#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002054 if( auth_done == 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002055 {
Hanno Becker3d8c9072018-01-05 16:24:22 +00002056 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
2057
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002058 /*
2059 * MAC(MAC_write_key, seq_num +
2060 * TLSCipherText.type +
2061 * TLSCipherText.version +
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01002062 * length_of( (IV +) ENC(...) ) +
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002063 * IV + // except for TLS 1.0
2064 * ENC(content + padding + padding_length));
2065 */
Hanno Becker3307b532017-12-27 21:37:21 +00002066
2067 if( post_avail < transform->maclen)
2068 {
2069 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Buffer provided for encrypted record not large enough" ) );
2070 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2071 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002072
Hanno Beckere83efe62019-04-29 13:52:53 +01002073 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002074
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002075 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Hanno Becker3307b532017-12-27 21:37:21 +00002076 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002077 add_data_len );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002078
Hanno Becker3307b532017-12-27 21:37:21 +00002079 mbedtls_md_hmac_update( &transform->md_ctx_enc, add_data,
Hanno Beckere83efe62019-04-29 13:52:53 +01002080 add_data_len );
Hanno Becker3307b532017-12-27 21:37:21 +00002081 mbedtls_md_hmac_update( &transform->md_ctx_enc,
2082 data, rec->data_len );
2083 mbedtls_md_hmac_finish( &transform->md_ctx_enc, mac );
2084 mbedtls_md_hmac_reset( &transform->md_ctx_enc );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01002085
Hanno Becker3307b532017-12-27 21:37:21 +00002086 memcpy( data + rec->data_len, mac, transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002087
Hanno Becker3307b532017-12-27 21:37:21 +00002088 rec->data_len += transform->maclen;
2089 post_avail -= transform->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002090 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002091 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002092#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00002093 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002094 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002095#endif /* MBEDTLS_CIPHER_MODE_CBC &&
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00002096 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C || MBEDTLS_ARIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002097 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002098 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2099 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002100 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002101
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002102 /* Make extra sure authentication was performed, exactly once */
2103 if( auth_done != 1 )
2104 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002105 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2106 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002107 }
2108
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002109 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002110
2111 return( 0 );
2112}
2113
Hanno Becker611a83b2018-01-03 14:27:32 +00002114int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context *ssl,
2115 mbedtls_ssl_transform *transform,
2116 mbedtls_record *rec )
Paul Bakker5121ce52009-01-03 21:22:43 +00002117{
Hanno Becker4c6876b2017-12-27 21:28:58 +00002118 size_t olen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002119 mbedtls_cipher_mode_t mode;
Hanno Becker4c6876b2017-12-27 21:28:58 +00002120 int ret, auth_done = 0;
Hanno Becker5cc04d52018-01-03 15:24:20 +00002121#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Paul Bakker1e5369c2013-12-19 16:40:57 +01002122 size_t padlen = 0, correct = 1;
2123#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00002124 unsigned char* data;
Hanno Becker28a0c4e2019-05-20 14:54:26 +01002125 unsigned char add_data[13 + 1 + MBEDTLS_SSL_CID_IN_LEN_MAX ];
Hanno Beckere83efe62019-04-29 13:52:53 +01002126 size_t add_data_len;
Hanno Becker4c6876b2017-12-27 21:28:58 +00002127
Hanno Becker611a83b2018-01-03 14:27:32 +00002128#if !defined(MBEDTLS_DEBUG_C)
Hanno Becker4c6876b2017-12-27 21:28:58 +00002129 ((void) ssl);
2130#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002131
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002132 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
Hanno Becker4c6876b2017-12-27 21:28:58 +00002133 if( transform == NULL )
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002134 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00002135 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no transform provided to decrypt_buf" ) );
2136 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2137 }
2138 if( rec == NULL ||
2139 rec->buf == NULL ||
2140 rec->buf_len < rec->data_offset ||
2141 rec->buf_len - rec->data_offset < rec->data_len )
2142 {
2143 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad record structure provided to decrypt_buf" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002144 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002145 }
2146
Hanno Becker4c6876b2017-12-27 21:28:58 +00002147 data = rec->buf + rec->data_offset;
2148 mode = mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_dec );
Paul Bakker5121ce52009-01-03 21:22:43 +00002149
Hanno Beckere83efe62019-04-29 13:52:53 +01002150#if defined(MBEDTLS_SSL_CID)
2151 /*
2152 * Match record's CID with incoming CID.
2153 */
Hanno Beckerabd7c892019-05-08 13:02:22 +01002154 if( rec->cid_len != transform->in_cid_len ||
2155 memcmp( rec->cid, transform->in_cid, rec->cid_len ) != 0 )
2156 {
Hanno Beckere8eff9a2019-05-14 11:30:10 +01002157 return( MBEDTLS_ERR_SSL_UNEXPECTED_CID );
Hanno Beckerabd7c892019-05-08 13:02:22 +01002158 }
Hanno Beckere83efe62019-04-29 13:52:53 +01002159#endif /* MBEDTLS_SSL_CID */
2160
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002161#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
2162 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker68884e32013-01-07 18:20:04 +01002163 {
2164 padlen = 0;
Hanno Becker4c6876b2017-12-27 21:28:58 +00002165 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
2166 transform->iv_dec,
2167 transform->ivlen,
2168 data, rec->data_len,
2169 data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02002170 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002171 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002172 return( ret );
2173 }
2174
Hanno Becker4c6876b2017-12-27 21:28:58 +00002175 if( rec->data_len != olen )
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002176 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002177 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2178 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02002179 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002180 }
Paul Bakker68884e32013-01-07 18:20:04 +01002181 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002182#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002183#if defined(MBEDTLS_GCM_C) || \
2184 defined(MBEDTLS_CCM_C) || \
2185 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002186 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002187 mode == MBEDTLS_MODE_CCM ||
2188 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00002189 {
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002190 unsigned char iv[12];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002191 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00002192
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002193 /*
2194 * Compute and update sizes
2195 */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002196 if( rec->data_len < explicit_iv_len + transform->taglen )
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02002197 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002198 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < explicit_iv_len (%d) "
Hanno Becker4c6876b2017-12-27 21:28:58 +00002199 "+ taglen (%d)", rec->data_len,
2200 explicit_iv_len, transform->taglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002201 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02002202 }
Paul Bakker68884e32013-01-07 18:20:04 +01002203
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002204 /*
2205 * Prepare IV
2206 */
2207 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
2208 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02002209 /* GCM and CCM: fixed || explicit (transmitted) */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002210 memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
Hanno Becker4c6876b2017-12-27 21:28:58 +00002211 memcpy( iv + transform->fixed_ivlen, data, 8 );
Paul Bakker68884e32013-01-07 18:20:04 +01002212
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002213 }
2214 else if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
2215 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02002216 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002217 unsigned char i;
2218
2219 memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
2220
2221 for( i = 0; i < 8; i++ )
Hanno Becker4c6876b2017-12-27 21:28:58 +00002222 iv[i+4] ^= rec->ctr[i];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002223 }
2224 else
2225 {
2226 /* Reminder if we ever add an AEAD mode with a different size */
2227 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2228 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2229 }
2230
Hanno Becker4c6876b2017-12-27 21:28:58 +00002231 data += explicit_iv_len;
2232 rec->data_offset += explicit_iv_len;
2233 rec->data_len -= explicit_iv_len + transform->taglen;
2234
Hanno Beckere83efe62019-04-29 13:52:53 +01002235 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Hanno Becker4c6876b2017-12-27 21:28:58 +00002236 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
Hanno Beckere83efe62019-04-29 13:52:53 +01002237 add_data, add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00002238
2239 memcpy( transform->iv_dec + transform->fixed_ivlen,
2240 data - explicit_iv_len, explicit_iv_len );
2241
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002242 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", iv, transform->ivlen );
Hanno Becker4c6876b2017-12-27 21:28:58 +00002243 MBEDTLS_SSL_DEBUG_BUF( 4, "TAG used", data + rec->data_len,
Hanno Becker8759e162017-12-27 21:34:08 +00002244 transform->taglen );
Paul Bakker68884e32013-01-07 18:20:04 +01002245
Paul Bakker68884e32013-01-07 18:20:04 +01002246
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002247 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02002248 * Decrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002249 */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002250 if( ( ret = mbedtls_cipher_auth_decrypt( &transform->cipher_ctx_dec,
2251 iv, transform->ivlen,
Hanno Beckere83efe62019-04-29 13:52:53 +01002252 add_data, add_data_len,
Hanno Becker4c6876b2017-12-27 21:28:58 +00002253 data, rec->data_len,
2254 data, &olen,
2255 data + rec->data_len,
2256 transform->taglen ) ) != 0 )
Paul Bakkerca4ab492012-04-18 14:23:57 +00002257 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002258 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02002259
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002260 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
2261 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02002262
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002263 return( ret );
2264 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002265 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00002266
Hanno Becker4c6876b2017-12-27 21:28:58 +00002267 if( olen != rec->data_len )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002268 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002269 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2270 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02002271 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00002272 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002273 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002274#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
2275#if defined(MBEDTLS_CIPHER_MODE_CBC) && \
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00002276 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) || defined(MBEDTLS_ARIA_C) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002277 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00002278 {
Paul Bakkere47b34b2013-02-27 14:48:00 +01002279 size_t minlen = 0;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002280
Paul Bakker5121ce52009-01-03 21:22:43 +00002281 /*
Paul Bakker45829992013-01-03 14:52:21 +01002282 * Check immediate ciphertext sanity
Paul Bakker5121ce52009-01-03 21:22:43 +00002283 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002284#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker4c6876b2017-12-27 21:28:58 +00002285 if( transform->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
2286 {
2287 /* The ciphertext is prefixed with the CBC IV. */
2288 minlen += transform->ivlen;
2289 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002290#endif
Paul Bakker45829992013-01-03 14:52:21 +01002291
Hanno Becker4c6876b2017-12-27 21:28:58 +00002292 /* Size considerations:
2293 *
2294 * - The CBC cipher text must not be empty and hence
2295 * at least of size transform->ivlen.
2296 *
2297 * Together with the potential IV-prefix, this explains
2298 * the first of the two checks below.
2299 *
2300 * - The record must contain a MAC, either in plain or
2301 * encrypted, depending on whether Encrypt-then-MAC
2302 * is used or not.
2303 * - If it is, the message contains the IV-prefix,
2304 * the CBC ciphertext, and the MAC.
2305 * - If it is not, the padded plaintext, and hence
2306 * the CBC ciphertext, has at least length maclen + 1
2307 * because there is at least the padding length byte.
2308 *
2309 * As the CBC ciphertext is not empty, both cases give the
2310 * lower bound minlen + maclen + 1 on the record size, which
2311 * we test for in the second check below.
2312 */
2313 if( rec->data_len < minlen + transform->ivlen ||
2314 rec->data_len < minlen + transform->maclen + 1 )
Paul Bakker45829992013-01-03 14:52:21 +01002315 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002316 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < max( ivlen(%d), maclen (%d) "
Hanno Becker4c6876b2017-12-27 21:28:58 +00002317 "+ 1 ) ( + expl IV )", rec->data_len,
2318 transform->ivlen,
2319 transform->maclen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002320 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker45829992013-01-03 14:52:21 +01002321 }
2322
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002323 /*
2324 * Authenticate before decrypt if enabled
2325 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002326#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker4c6876b2017-12-27 21:28:58 +00002327 if( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002328 {
Hanno Becker992b6872017-11-09 18:57:39 +00002329 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002330
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002331 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002332
Hanno Becker4c6876b2017-12-27 21:28:58 +00002333 /* Safe due to the check data_len >= minlen + maclen + 1 above. */
2334 rec->data_len -= transform->maclen;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002335
Hanno Beckere83efe62019-04-29 13:52:53 +01002336 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01002337
Hanno Beckere83efe62019-04-29 13:52:53 +01002338 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", add_data,
2339 add_data_len );
2340 mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
2341 add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00002342 mbedtls_md_hmac_update( &transform->md_ctx_dec,
2343 data, rec->data_len );
2344 mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
2345 mbedtls_md_hmac_reset( &transform->md_ctx_dec );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01002346
Hanno Becker4c6876b2017-12-27 21:28:58 +00002347 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len,
2348 transform->maclen );
Hanno Becker992b6872017-11-09 18:57:39 +00002349 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect,
Hanno Becker4c6876b2017-12-27 21:28:58 +00002350 transform->maclen );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002351
Hanno Becker4c6876b2017-12-27 21:28:58 +00002352 if( mbedtls_ssl_safer_memcmp( data + rec->data_len, mac_expect,
2353 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002354 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002355 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002356 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002357 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002358 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002359 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002360#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002361
2362 /*
2363 * Check length sanity
2364 */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002365 if( rec->data_len % transform->ivlen != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002366 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002367 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0",
Hanno Becker4c6876b2017-12-27 21:28:58 +00002368 rec->data_len, transform->ivlen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002369 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002370 }
2371
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002372#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002373 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00002374 * Initialize for prepended IV for block cipher in TLS v1.1 and up
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002375 */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002376 if( transform->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002377 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00002378 /* This is safe because data_len >= minlen + maclen + 1 initially,
2379 * and at this point we have at most subtracted maclen (note that
2380 * minlen == transform->ivlen here). */
2381 memcpy( transform->iv_dec, data, transform->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002382
Hanno Becker4c6876b2017-12-27 21:28:58 +00002383 data += transform->ivlen;
2384 rec->data_offset += transform->ivlen;
2385 rec->data_len -= transform->ivlen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002386 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002387#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002388
Hanno Becker4c6876b2017-12-27 21:28:58 +00002389 if( ( ret = mbedtls_cipher_crypt( &transform->cipher_ctx_dec,
2390 transform->iv_dec, transform->ivlen,
2391 data, rec->data_len, data, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02002392 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002393 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02002394 return( ret );
2395 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02002396
Hanno Becker4c6876b2017-12-27 21:28:58 +00002397 if( rec->data_len != olen )
Paul Bakkercca5b812013-08-31 17:40:26 +02002398 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002399 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2400 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02002401 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02002402
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002403#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
Hanno Becker4c6876b2017-12-27 21:28:58 +00002404 if( transform->minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakkercca5b812013-08-31 17:40:26 +02002405 {
2406 /*
2407 * Save IV in SSL3 and TLS1
2408 */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002409 memcpy( transform->iv_dec, transform->cipher_ctx_dec.iv,
2410 transform->ivlen );
Paul Bakker5121ce52009-01-03 21:22:43 +00002411 }
Paul Bakkercca5b812013-08-31 17:40:26 +02002412#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002413
Hanno Becker4c6876b2017-12-27 21:28:58 +00002414 /* Safe since data_len >= minlen + maclen + 1, so after having
2415 * subtracted at most minlen and maclen up to this point,
2416 * data_len > 0. */
2417 padlen = data[rec->data_len - 1];
Paul Bakker45829992013-01-03 14:52:21 +01002418
Hanno Becker4c6876b2017-12-27 21:28:58 +00002419 if( auth_done == 1 )
2420 {
2421 correct *= ( rec->data_len >= padlen + 1 );
2422 padlen *= ( rec->data_len >= padlen + 1 );
2423 }
2424 else
Paul Bakker45829992013-01-03 14:52:21 +01002425 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002426#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker4c6876b2017-12-27 21:28:58 +00002427 if( rec->data_len < transform->maclen + padlen + 1 )
2428 {
2429 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
2430 rec->data_len,
2431 transform->maclen,
2432 padlen + 1 ) );
2433 }
Paul Bakkerd66f0702013-01-31 16:57:45 +01002434#endif
Hanno Becker4c6876b2017-12-27 21:28:58 +00002435
2436 correct *= ( rec->data_len >= transform->maclen + padlen + 1 );
2437 padlen *= ( rec->data_len >= transform->maclen + padlen + 1 );
Paul Bakker45829992013-01-03 14:52:21 +01002438 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002439
Hanno Becker4c6876b2017-12-27 21:28:58 +00002440 padlen++;
2441
2442 /* Regardless of the validity of the padding,
2443 * we have data_len >= padlen here. */
2444
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002445#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker4c6876b2017-12-27 21:28:58 +00002446 if( transform->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002447 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00002448 if( padlen > transform->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00002449 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002450#if defined(MBEDTLS_SSL_DEBUG_ALL)
2451 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
Hanno Becker4c6876b2017-12-27 21:28:58 +00002452 "should be no more than %d",
2453 padlen, transform->ivlen ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01002454#endif
Paul Bakker45829992013-01-03 14:52:21 +01002455 correct = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00002456 }
2457 }
2458 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002459#endif /* MBEDTLS_SSL_PROTO_SSL3 */
2460#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2461 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker4c6876b2017-12-27 21:28:58 +00002462 if( transform->minor_ver > MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002463 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00002464 /* The padding check involves a series of up to 256
2465 * consecutive memory reads at the end of the record
2466 * plaintext buffer. In order to hide the length and
2467 * validity of the padding, always perform exactly
2468 * `min(256,plaintext_len)` reads (but take into account
2469 * only the last `padlen` bytes for the padding check). */
2470 size_t pad_count = 0;
2471 size_t real_count = 0;
2472 volatile unsigned char* const check = data;
Paul Bakkere47b34b2013-02-27 14:48:00 +01002473
Hanno Becker4c6876b2017-12-27 21:28:58 +00002474 /* Index of first padding byte; it has been ensured above
2475 * that the subtraction is safe. */
2476 size_t const padding_idx = rec->data_len - padlen;
2477 size_t const num_checks = rec->data_len <= 256 ? rec->data_len : 256;
2478 size_t const start_idx = rec->data_len - num_checks;
2479 size_t idx;
Paul Bakker956c9e02013-12-19 14:42:28 +01002480
Hanno Becker4c6876b2017-12-27 21:28:58 +00002481 for( idx = start_idx; idx < rec->data_len; idx++ )
Paul Bakkerca9c87e2013-09-25 18:52:37 +02002482 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00002483 real_count |= ( idx >= padding_idx );
2484 pad_count += real_count * ( check[idx] == padlen - 1 );
Paul Bakkerca9c87e2013-09-25 18:52:37 +02002485 }
Hanno Becker4c6876b2017-12-27 21:28:58 +00002486 correct &= ( pad_count == padlen );
Paul Bakkere47b34b2013-02-27 14:48:00 +01002487
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002488#if defined(MBEDTLS_SSL_DEBUG_ALL)
Paul Bakker66d5d072014-06-17 16:39:18 +02002489 if( padlen > 0 && correct == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002490 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01002491#endif
Paul Bakkere47b34b2013-02-27 14:48:00 +01002492 padlen &= correct * 0x1FF;
Paul Bakker5121ce52009-01-03 21:22:43 +00002493 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002494 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002495#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
2496 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02002497 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002498 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2499 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02002500 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002501
Hanno Becker4c6876b2017-12-27 21:28:58 +00002502 /* If the padding was found to be invalid, padlen == 0
2503 * and the subtraction is safe. If the padding was found valid,
2504 * padlen hasn't been changed and the previous assertion
2505 * data_len >= padlen still holds. */
2506 rec->data_len -= padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00002507 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002508 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002509#endif /* MBEDTLS_CIPHER_MODE_CBC &&
Markku-Juhani O. Saarinenc06e1012017-12-07 11:51:13 +00002510 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C || MBEDTLS_ARIA_C ) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002511 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002512 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2513 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002514 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002515
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02002516#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002517 MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption",
Hanno Becker4c6876b2017-12-27 21:28:58 +00002518 data, rec->data_len );
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02002519#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002520
2521 /*
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002522 * Authenticate if not done yet.
2523 * Compute the MAC regardless of the padding result (RFC4346, CBCTIME).
Paul Bakker5121ce52009-01-03 21:22:43 +00002524 */
Hanno Becker5cc04d52018-01-03 15:24:20 +00002525#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002526 if( auth_done == 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002527 {
Hanno Becker992b6872017-11-09 18:57:39 +00002528 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Paul Bakker1e5369c2013-12-19 16:40:57 +01002529
Hanno Becker4c6876b2017-12-27 21:28:58 +00002530 /* If the initial value of padlen was such that
2531 * data_len < maclen + padlen + 1, then padlen
2532 * got reset to 1, and the initial check
2533 * data_len >= minlen + maclen + 1
2534 * guarantees that at this point we still
2535 * have at least data_len >= maclen.
2536 *
2537 * If the initial value of padlen was such that
2538 * data_len >= maclen + padlen + 1, then we have
2539 * subtracted either padlen + 1 (if the padding was correct)
2540 * or 0 (if the padding was incorrect) since then,
2541 * hence data_len >= maclen in any case.
2542 */
2543 rec->data_len -= transform->maclen;
Paul Bakker5121ce52009-01-03 21:22:43 +00002544
Hanno Beckere83efe62019-04-29 13:52:53 +01002545 ssl_extract_add_data_from_record( add_data, &add_data_len, rec );
Paul Bakker5121ce52009-01-03 21:22:43 +00002546
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002547#if defined(MBEDTLS_SSL_PROTO_SSL3)
Hanno Becker4c6876b2017-12-27 21:28:58 +00002548 if( transform->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002549 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00002550 ssl_mac( &transform->md_ctx_dec,
2551 transform->mac_dec,
2552 data, rec->data_len,
2553 rec->ctr, rec->type,
2554 mac_expect );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002555 }
2556 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002557#endif /* MBEDTLS_SSL_PROTO_SSL3 */
2558#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2559 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker4c6876b2017-12-27 21:28:58 +00002560 if( transform->minor_ver > MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002561 {
2562 /*
2563 * Process MAC and always update for padlen afterwards to make
Gilles Peskine20b44082018-05-29 14:06:49 +02002564 * total time independent of padlen.
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002565 *
2566 * Known timing attacks:
2567 * - Lucky Thirteen (http://www.isg.rhul.ac.uk/tls/TLStiming.pdf)
2568 *
Gilles Peskine20b44082018-05-29 14:06:49 +02002569 * To compensate for different timings for the MAC calculation
2570 * depending on how much padding was removed (which is determined
2571 * by padlen), process extra_run more blocks through the hash
2572 * function.
2573 *
2574 * The formula in the paper is
2575 * extra_run = ceil( (L1-55) / 64 ) - ceil( (L2-55) / 64 )
2576 * where L1 is the size of the header plus the decrypted message
2577 * plus CBC padding and L2 is the size of the header plus the
2578 * decrypted message. This is for an underlying hash function
2579 * with 64-byte blocks.
2580 * We use ( (Lx+8) / 64 ) to handle 'negative Lx' values
2581 * correctly. We round down instead of up, so -56 is the correct
2582 * value for our calculations instead of -55.
2583 *
Gilles Peskine1bd9d582018-06-04 11:58:44 +02002584 * Repeat the formula rather than defining a block_size variable.
2585 * This avoids requiring division by a variable at runtime
2586 * (which would be marginally less efficient and would require
2587 * linking an extra division function in some builds).
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002588 */
2589 size_t j, extra_run = 0;
Hanno Becker4c6876b2017-12-27 21:28:58 +00002590 unsigned char tmp[MBEDTLS_MD_MAX_BLOCK_SIZE];
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002591
2592 /*
2593 * The next two sizes are the minimum and maximum values of
2594 * in_msglen over all padlen values.
2595 *
2596 * They're independent of padlen, since we previously did
2597 * in_msglen -= padlen.
2598 *
2599 * Note that max_len + maclen is never more than the buffer
2600 * length, as we previously did in_msglen -= maclen too.
2601 */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002602 const size_t max_len = rec->data_len + padlen;
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002603 const size_t min_len = ( max_len > 256 ) ? max_len - 256 : 0;
2604
Hanno Becker4c6876b2017-12-27 21:28:58 +00002605 memset( tmp, 0, sizeof( tmp ) );
2606
2607 switch( mbedtls_md_get_type( transform->md_ctx_dec.md_info ) )
Gilles Peskine20b44082018-05-29 14:06:49 +02002608 {
Gilles Peskined0e55a42018-06-04 12:03:30 +02002609#if defined(MBEDTLS_MD5_C) || defined(MBEDTLS_SHA1_C) || \
2610 defined(MBEDTLS_SHA256_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02002611 case MBEDTLS_MD_MD5:
2612 case MBEDTLS_MD_SHA1:
Gilles Peskine20b44082018-05-29 14:06:49 +02002613 case MBEDTLS_MD_SHA256:
Gilles Peskine20b44082018-05-29 14:06:49 +02002614 /* 8 bytes of message size, 64-byte compression blocks */
Hanno Beckere83efe62019-04-29 13:52:53 +01002615 extra_run =
2616 ( add_data_len + rec->data_len + padlen + 8 ) / 64 -
2617 ( add_data_len + rec->data_len + 8 ) / 64;
Gilles Peskine20b44082018-05-29 14:06:49 +02002618 break;
2619#endif
Gilles Peskinea7fe25d2018-06-04 12:01:18 +02002620#if defined(MBEDTLS_SHA512_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02002621 case MBEDTLS_MD_SHA384:
Gilles Peskine20b44082018-05-29 14:06:49 +02002622 /* 16 bytes of message size, 128-byte compression blocks */
Hanno Beckere83efe62019-04-29 13:52:53 +01002623 extra_run =
2624 ( add_data_len + rec->data_len + padlen + 16 ) / 128 -
2625 ( add_data_len + rec->data_len + 16 ) / 128;
Gilles Peskine20b44082018-05-29 14:06:49 +02002626 break;
2627#endif
2628 default:
Gilles Peskine5c389842018-06-04 12:02:43 +02002629 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Gilles Peskine20b44082018-05-29 14:06:49 +02002630 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2631 }
Paul Bakkere47b34b2013-02-27 14:48:00 +01002632
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002633 extra_run &= correct * 0xFF;
Paul Bakkere47b34b2013-02-27 14:48:00 +01002634
Hanno Beckere83efe62019-04-29 13:52:53 +01002635 mbedtls_md_hmac_update( &transform->md_ctx_dec, add_data,
2636 add_data_len );
Hanno Becker4c6876b2017-12-27 21:28:58 +00002637 mbedtls_md_hmac_update( &transform->md_ctx_dec, data,
2638 rec->data_len );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002639 /* Make sure we access everything even when padlen > 0. This
2640 * makes the synchronisation requirements for just-in-time
2641 * Prime+Probe attacks much tighter and hopefully impractical. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002642 ssl_read_memory( data + rec->data_len, padlen );
2643 mbedtls_md_hmac_finish( &transform->md_ctx_dec, mac_expect );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002644
2645 /* Call mbedtls_md_process at least once due to cache attacks
2646 * that observe whether md_process() was called of not */
Manuel Pégourié-Gonnard47fede02015-04-29 01:35:48 +02002647 for( j = 0; j < extra_run + 1; j++ )
Hanno Becker4c6876b2017-12-27 21:28:58 +00002648 mbedtls_md_process( &transform->md_ctx_dec, tmp );
Paul Bakkere47b34b2013-02-27 14:48:00 +01002649
Hanno Becker4c6876b2017-12-27 21:28:58 +00002650 mbedtls_md_hmac_reset( &transform->md_ctx_dec );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002651
2652 /* Make sure we access all the memory that could contain the MAC,
2653 * before we check it in the next code block. This makes the
2654 * synchronisation requirements for just-in-time Prime+Probe
2655 * attacks much tighter and hopefully impractical. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00002656 ssl_read_memory( data + min_len,
2657 max_len - min_len + transform->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002658 }
2659 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002660#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
2661 MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002662 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002663 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2664 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002665 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002666
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002667#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker4c6876b2017-12-27 21:28:58 +00002668 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect, transform->maclen );
2669 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", data + rec->data_len, transform->maclen );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002670#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002671
Hanno Becker4c6876b2017-12-27 21:28:58 +00002672 if( mbedtls_ssl_safer_memcmp( data + rec->data_len, mac_expect,
2673 transform->maclen ) != 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002674 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002675#if defined(MBEDTLS_SSL_DEBUG_ALL)
2676 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Paul Bakkere47b34b2013-02-27 14:48:00 +01002677#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002678 correct = 0;
2679 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002680 auth_done++;
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002681 }
Hanno Beckerdd3ab132018-10-17 14:43:14 +01002682
2683 /*
2684 * Finally check the correct flag
2685 */
2686 if( correct == 0 )
2687 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Hanno Becker5cc04d52018-01-03 15:24:20 +00002688#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002689
2690 /* Make extra sure authentication was performed, exactly once */
2691 if( auth_done != 1 )
2692 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002693 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2694 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002695 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002696
Hanno Becker92c930f2019-04-29 17:31:37 +01002697#if defined(MBEDTLS_SSL_CID)
2698 if( rec->cid_len != 0 )
2699 {
2700 ret = ssl_cid_parse_inner_plaintext( data, &rec->data_len,
2701 &rec->type );
2702 if( ret != 0 )
2703 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
2704 }
2705#endif /* MBEDTLS_SSL_CID */
2706
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002707 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002708
2709 return( 0 );
2710}
2711
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002712#undef MAC_NONE
2713#undef MAC_PLAINTEXT
2714#undef MAC_CIPHERTEXT
2715
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002716#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker2770fbd2012-07-03 13:30:23 +00002717/*
2718 * Compression/decompression functions
2719 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002720static int ssl_compress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00002721{
2722 int ret;
2723 unsigned char *msg_post = ssl->out_msg;
Andrzej Kurek5462e022018-04-20 07:58:53 -04002724 ptrdiff_t bytes_written = ssl->out_msg - ssl->out_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002725 size_t len_pre = ssl->out_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02002726 unsigned char *msg_pre = ssl->compress_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002727
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002728 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002729
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02002730 if( len_pre == 0 )
2731 return( 0 );
2732
Paul Bakker2770fbd2012-07-03 13:30:23 +00002733 memcpy( msg_pre, ssl->out_msg, len_pre );
2734
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002735 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002736 ssl->out_msglen ) );
2737
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002738 MBEDTLS_SSL_DEBUG_BUF( 4, "before compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002739 ssl->out_msg, ssl->out_msglen );
2740
Paul Bakker48916f92012-09-16 19:57:18 +00002741 ssl->transform_out->ctx_deflate.next_in = msg_pre;
2742 ssl->transform_out->ctx_deflate.avail_in = len_pre;
2743 ssl->transform_out->ctx_deflate.next_out = msg_post;
Angus Grattond8213d02016-05-25 20:56:48 +10002744 ssl->transform_out->ctx_deflate.avail_out = MBEDTLS_SSL_OUT_BUFFER_LEN - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002745
Paul Bakker48916f92012-09-16 19:57:18 +00002746 ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002747 if( ret != Z_OK )
2748 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002749 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform compression (%d)", ret ) );
2750 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002751 }
2752
Angus Grattond8213d02016-05-25 20:56:48 +10002753 ssl->out_msglen = MBEDTLS_SSL_OUT_BUFFER_LEN -
Andrzej Kurek5462e022018-04-20 07:58:53 -04002754 ssl->transform_out->ctx_deflate.avail_out - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002755
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002756 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002757 ssl->out_msglen ) );
2758
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002759 MBEDTLS_SSL_DEBUG_BUF( 4, "after compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002760 ssl->out_msg, ssl->out_msglen );
2761
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002762 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002763
2764 return( 0 );
2765}
2766
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002767static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00002768{
2769 int ret;
2770 unsigned char *msg_post = ssl->in_msg;
Andrzej Kureka9ceef82018-04-24 06:32:44 -04002771 ptrdiff_t header_bytes = ssl->in_msg - ssl->in_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002772 size_t len_pre = ssl->in_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02002773 unsigned char *msg_pre = ssl->compress_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002774
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002775 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002776
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02002777 if( len_pre == 0 )
2778 return( 0 );
2779
Paul Bakker2770fbd2012-07-03 13:30:23 +00002780 memcpy( msg_pre, ssl->in_msg, len_pre );
2781
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002782 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002783 ssl->in_msglen ) );
2784
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002785 MBEDTLS_SSL_DEBUG_BUF( 4, "before decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002786 ssl->in_msg, ssl->in_msglen );
2787
Paul Bakker48916f92012-09-16 19:57:18 +00002788 ssl->transform_in->ctx_inflate.next_in = msg_pre;
2789 ssl->transform_in->ctx_inflate.avail_in = len_pre;
2790 ssl->transform_in->ctx_inflate.next_out = msg_post;
Angus Grattond8213d02016-05-25 20:56:48 +10002791 ssl->transform_in->ctx_inflate.avail_out = MBEDTLS_SSL_IN_BUFFER_LEN -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04002792 header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002793
Paul Bakker48916f92012-09-16 19:57:18 +00002794 ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002795 if( ret != Z_OK )
2796 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002797 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform decompression (%d)", ret ) );
2798 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002799 }
2800
Angus Grattond8213d02016-05-25 20:56:48 +10002801 ssl->in_msglen = MBEDTLS_SSL_IN_BUFFER_LEN -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04002802 ssl->transform_in->ctx_inflate.avail_out - header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002803
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002804 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002805 ssl->in_msglen ) );
2806
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002807 MBEDTLS_SSL_DEBUG_BUF( 4, "after decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002808 ssl->in_msg, ssl->in_msglen );
2809
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002810 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002811
2812 return( 0 );
2813}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002814#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00002815
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002816#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
2817static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002818
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002819#if defined(MBEDTLS_SSL_PROTO_DTLS)
2820static int ssl_resend_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002821{
2822 /* If renegotiation is not enforced, retransmit until we would reach max
2823 * timeout if we were using the usual handshake doubling scheme */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002824 if( ssl->conf->renego_max_records < 0 )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002825 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002826 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002827 unsigned char doublings = 1;
2828
2829 while( ratio != 0 )
2830 {
2831 ++doublings;
2832 ratio >>= 1;
2833 }
2834
2835 if( ++ssl->renego_records_seen > doublings )
2836 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02002837 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002838 return( 0 );
2839 }
2840 }
2841
2842 return( ssl_write_hello_request( ssl ) );
2843}
2844#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002845#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02002846
Paul Bakker5121ce52009-01-03 21:22:43 +00002847/*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002848 * Fill the input message buffer by appending data to it.
2849 * The amount of data already fetched is in ssl->in_left.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002850 *
2851 * If we return 0, is it guaranteed that (at least) nb_want bytes are
2852 * available (from this read and/or a previous one). Otherwise, an error code
2853 * is returned (possibly EOF or WANT_READ).
2854 *
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002855 * With stream transport (TLS) on success ssl->in_left == nb_want, but
2856 * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
2857 * since we always read a whole datagram at once.
2858 *
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02002859 * For DTLS, it is up to the caller to set ssl->next_record_offset when
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002860 * they're done reading a record.
Paul Bakker5121ce52009-01-03 21:22:43 +00002861 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002862int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want )
Paul Bakker5121ce52009-01-03 21:22:43 +00002863{
Paul Bakker23986e52011-04-24 08:57:21 +00002864 int ret;
2865 size_t len;
Paul Bakker5121ce52009-01-03 21:22:43 +00002866
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002867 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002868
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002869 if( ssl->f_recv == NULL && ssl->f_recv_timeout == NULL )
2870 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002871 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01002872 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002873 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002874 }
2875
Angus Grattond8213d02016-05-25 20:56:48 +10002876 if( nb_want > MBEDTLS_SSL_IN_BUFFER_LEN - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02002877 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002878 MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
2879 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02002880 }
2881
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002882#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002883 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00002884 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002885 uint32_t timeout;
2886
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02002887 /* Just to be sure */
2888 if( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL )
2889 {
2890 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
2891 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
2892 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2893 }
2894
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002895 /*
2896 * The point is, we need to always read a full datagram at once, so we
2897 * sometimes read more then requested, and handle the additional data.
2898 * It could be the rest of the current record (while fetching the
2899 * header) and/or some other records in the same datagram.
2900 */
2901
2902 /*
2903 * Move to the next record in the already read datagram if applicable
2904 */
2905 if( ssl->next_record_offset != 0 )
2906 {
2907 if( ssl->in_left < ssl->next_record_offset )
2908 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002909 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2910 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002911 }
2912
2913 ssl->in_left -= ssl->next_record_offset;
2914
2915 if( ssl->in_left != 0 )
2916 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002917 MBEDTLS_SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002918 ssl->next_record_offset ) );
2919 memmove( ssl->in_hdr,
2920 ssl->in_hdr + ssl->next_record_offset,
2921 ssl->in_left );
2922 }
2923
2924 ssl->next_record_offset = 0;
2925 }
2926
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002927 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Paul Bakker5121ce52009-01-03 21:22:43 +00002928 ssl->in_left, nb_want ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002929
2930 /*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002931 * Done if we already have enough data.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002932 */
2933 if( nb_want <= ssl->in_left)
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02002934 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002935 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002936 return( 0 );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02002937 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002938
2939 /*
2940 * A record can't be split accross datagrams. If we need to read but
2941 * are not at the beginning of a new record, the caller did something
2942 * wrong.
2943 */
2944 if( ssl->in_left != 0 )
2945 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002946 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2947 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002948 }
2949
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002950 /*
2951 * Don't even try to read if time's out already.
2952 * This avoids by-passing the timer when repeatedly receiving messages
2953 * that will end up being dropped.
2954 */
2955 if( ssl_check_timer( ssl ) != 0 )
Hanno Beckere65ce782017-05-22 14:47:48 +01002956 {
2957 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timer has expired" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002958 ret = MBEDTLS_ERR_SSL_TIMEOUT;
Hanno Beckere65ce782017-05-22 14:47:48 +01002959 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002960 else
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002961 {
Angus Grattond8213d02016-05-25 20:56:48 +10002962 len = MBEDTLS_SSL_IN_BUFFER_LEN - ( ssl->in_hdr - ssl->in_buf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002963
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002964 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002965 timeout = ssl->handshake->retransmit_timeout;
2966 else
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002967 timeout = ssl->conf->read_timeout;
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002968
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002969 MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002970
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02002971 if( ssl->f_recv_timeout != NULL )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002972 ret = ssl->f_recv_timeout( ssl->p_bio, ssl->in_hdr, len,
2973 timeout );
2974 else
2975 ret = ssl->f_recv( ssl->p_bio, ssl->in_hdr, len );
2976
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002977 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002978
2979 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002980 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002981 }
2982
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002983 if( ret == MBEDTLS_ERR_SSL_TIMEOUT )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002984 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002985 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002986 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002987
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002988 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02002989 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002990 if( ssl_double_retransmit_timeout( ssl ) != 0 )
2991 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002992 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002993 return( MBEDTLS_ERR_SSL_TIMEOUT );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002994 }
2995
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002996 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002997 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002998 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002999 return( ret );
3000 }
3001
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01003002 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02003003 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003004#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003005 else if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003006 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02003007 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02003008 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02003009 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003010 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02003011 return( ret );
3012 }
3013
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01003014 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02003015 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003016#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003017 }
3018
Paul Bakker5121ce52009-01-03 21:22:43 +00003019 if( ret < 0 )
3020 return( ret );
3021
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003022 ssl->in_left = ret;
3023 }
3024 else
3025#endif
3026 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003027 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02003028 ssl->in_left, nb_want ) );
3029
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003030 while( ssl->in_left < nb_want )
3031 {
3032 len = nb_want - ssl->in_left;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02003033
3034 if( ssl_check_timer( ssl ) != 0 )
3035 ret = MBEDTLS_ERR_SSL_TIMEOUT;
3036 else
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02003037 {
3038 if( ssl->f_recv_timeout != NULL )
3039 {
3040 ret = ssl->f_recv_timeout( ssl->p_bio,
3041 ssl->in_hdr + ssl->in_left, len,
3042 ssl->conf->read_timeout );
3043 }
3044 else
3045 {
3046 ret = ssl->f_recv( ssl->p_bio,
3047 ssl->in_hdr + ssl->in_left, len );
3048 }
3049 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003050
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003051 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02003052 ssl->in_left, nb_want ) );
3053 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003054
3055 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003056 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003057
3058 if( ret < 0 )
3059 return( ret );
3060
mohammad160352aecb92018-03-28 23:41:40 -07003061 if ( (size_t)ret > len || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16035bd15cb2018-02-28 04:30:59 -08003062 {
Darryl Green11999bb2018-03-13 15:22:58 +00003063 MBEDTLS_SSL_DEBUG_MSG( 1,
3064 ( "f_recv returned %d bytes but only %lu were requested",
mohammad160319d392b2018-04-02 07:25:26 -07003065 ret, (unsigned long)len ) );
mohammad16035bd15cb2018-02-28 04:30:59 -08003066 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3067 }
3068
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01003069 ssl->in_left += ret;
3070 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003071 }
3072
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003073 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003074
3075 return( 0 );
3076}
3077
3078/*
3079 * Flush any data not yet written
3080 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003081int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003082{
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01003083 int ret;
Hanno Becker04484622018-08-06 09:49:38 +01003084 unsigned char *buf;
Paul Bakker5121ce52009-01-03 21:22:43 +00003085
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003086 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003087
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02003088 if( ssl->f_send == NULL )
3089 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003090 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01003091 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003092 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02003093 }
3094
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01003095 /* Avoid incrementing counter if data is flushed */
3096 if( ssl->out_left == 0 )
3097 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003098 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01003099 return( 0 );
3100 }
3101
Paul Bakker5121ce52009-01-03 21:22:43 +00003102 while( ssl->out_left > 0 )
3103 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003104 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
Hanno Becker43395762019-05-03 14:46:38 +01003105 mbedtls_ssl_out_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003106
Hanno Becker2b1e3542018-08-06 11:19:13 +01003107 buf = ssl->out_hdr - ssl->out_left;
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02003108 ret = ssl->f_send( ssl->p_bio, buf, ssl->out_left );
Paul Bakker186751d2012-05-08 13:16:14 +00003109
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003110 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003111
3112 if( ret <= 0 )
3113 return( ret );
3114
mohammad160352aecb92018-03-28 23:41:40 -07003115 if( (size_t)ret > ssl->out_left || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16034bbaeb42018-02-22 04:29:04 -08003116 {
Darryl Green11999bb2018-03-13 15:22:58 +00003117 MBEDTLS_SSL_DEBUG_MSG( 1,
3118 ( "f_send returned %d bytes but only %lu bytes were sent",
mohammad160319d392b2018-04-02 07:25:26 -07003119 ret, (unsigned long)ssl->out_left ) );
mohammad16034bbaeb42018-02-22 04:29:04 -08003120 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3121 }
3122
Paul Bakker5121ce52009-01-03 21:22:43 +00003123 ssl->out_left -= ret;
3124 }
3125
Hanno Becker2b1e3542018-08-06 11:19:13 +01003126#if defined(MBEDTLS_SSL_PROTO_DTLS)
3127 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01003128 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01003129 ssl->out_hdr = ssl->out_buf;
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01003130 }
Hanno Becker2b1e3542018-08-06 11:19:13 +01003131 else
3132#endif
3133 {
3134 ssl->out_hdr = ssl->out_buf + 8;
3135 }
3136 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01003137
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003138 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003139
3140 return( 0 );
3141}
3142
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003143/*
3144 * Functions to handle the DTLS retransmission state machine
3145 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003146#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003147/*
3148 * Append current handshake message to current outgoing flight
3149 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003150static int ssl_flight_append( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003151{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003152 mbedtls_ssl_flight_item *msg;
Hanno Becker3b235902018-08-06 09:54:53 +01003153 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_flight_append" ) );
3154 MBEDTLS_SSL_DEBUG_BUF( 4, "message appended to flight",
3155 ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003156
3157 /* Allocate space for current message */
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02003158 if( ( msg = mbedtls_calloc( 1, sizeof( mbedtls_ssl_flight_item ) ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003159 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02003160 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003161 sizeof( mbedtls_ssl_flight_item ) ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02003162 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003163 }
3164
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02003165 if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003166 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02003167 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl->out_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003168 mbedtls_free( msg );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02003169 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003170 }
3171
3172 /* Copy current handshake message with headers */
3173 memcpy( msg->p, ssl->out_msg, ssl->out_msglen );
3174 msg->len = ssl->out_msglen;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003175 msg->type = ssl->out_msgtype;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003176 msg->next = NULL;
3177
3178 /* Append to the current flight */
3179 if( ssl->handshake->flight == NULL )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003180 ssl->handshake->flight = msg;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003181 else
3182 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003183 mbedtls_ssl_flight_item *cur = ssl->handshake->flight;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003184 while( cur->next != NULL )
3185 cur = cur->next;
3186 cur->next = msg;
3187 }
3188
Hanno Becker3b235902018-08-06 09:54:53 +01003189 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_flight_append" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003190 return( 0 );
3191}
3192
3193/*
3194 * Free the current flight of handshake messages
3195 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003196static void ssl_flight_free( mbedtls_ssl_flight_item *flight )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003197{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003198 mbedtls_ssl_flight_item *cur = flight;
3199 mbedtls_ssl_flight_item *next;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003200
3201 while( cur != NULL )
3202 {
3203 next = cur->next;
3204
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003205 mbedtls_free( cur->p );
3206 mbedtls_free( cur );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003207
3208 cur = next;
3209 }
3210}
3211
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003212#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3213static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02003214#endif
3215
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003216/*
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003217 * Swap transform_out and out_ctr with the alternative ones
3218 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003219static void ssl_swap_epochs( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003220{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003221 mbedtls_ssl_transform *tmp_transform;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003222 unsigned char tmp_out_ctr[8];
3223
3224 if( ssl->transform_out == ssl->handshake->alt_transform_out )
3225 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003226 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003227 return;
3228 }
3229
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003230 MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003231
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003232 /* Swap transforms */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003233 tmp_transform = ssl->transform_out;
3234 ssl->transform_out = ssl->handshake->alt_transform_out;
3235 ssl->handshake->alt_transform_out = tmp_transform;
3236
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003237 /* Swap epoch + sequence_number */
Hanno Becker19859472018-08-06 09:40:20 +01003238 memcpy( tmp_out_ctr, ssl->cur_out_ctr, 8 );
3239 memcpy( ssl->cur_out_ctr, ssl->handshake->alt_out_ctr, 8 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003240 memcpy( ssl->handshake->alt_out_ctr, tmp_out_ctr, 8 );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003241
3242 /* Adjust to the newly activated transform */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01003243 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003244
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003245#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
3246 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003247 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003248 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003249 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003250 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
3251 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003252 }
3253 }
3254#endif
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003255}
3256
3257/*
3258 * Retransmit the current flight of messages.
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003259 */
3260int mbedtls_ssl_resend( mbedtls_ssl_context *ssl )
3261{
3262 int ret = 0;
3263
3264 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_resend" ) );
3265
3266 ret = mbedtls_ssl_flight_transmit( ssl );
3267
3268 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) );
3269
3270 return( ret );
3271}
3272
3273/*
3274 * Transmit or retransmit the current flight of messages.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003275 *
3276 * Need to remember the current message in case flush_output returns
3277 * WANT_WRITE, causing us to exit this function and come back later.
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003278 * This function must be called until state is no longer SENDING.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003279 */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003280int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003281{
Hanno Becker67bc7c32018-08-06 11:33:50 +01003282 int ret;
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003283 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003284
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003285 if( ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003286 {
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02003287 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialise flight transmission" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003288
3289 ssl->handshake->cur_msg = ssl->handshake->flight;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003290 ssl->handshake->cur_msg_p = ssl->handshake->flight->p + 12;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003291 ssl_swap_epochs( ssl );
3292
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003293 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003294 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003295
3296 while( ssl->handshake->cur_msg != NULL )
3297 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01003298 size_t max_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003299 const mbedtls_ssl_flight_item * const cur = ssl->handshake->cur_msg;
Hanno Becker67bc7c32018-08-06 11:33:50 +01003300
Hanno Beckere1dcb032018-08-17 16:47:58 +01003301 int const is_finished =
3302 ( cur->type == MBEDTLS_SSL_MSG_HANDSHAKE &&
3303 cur->p[0] == MBEDTLS_SSL_HS_FINISHED );
3304
Hanno Becker04da1892018-08-14 13:22:10 +01003305 uint8_t const force_flush = ssl->disable_datagram_packing == 1 ?
3306 SSL_FORCE_FLUSH : SSL_DONT_FORCE_FLUSH;
3307
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003308 /* Swap epochs before sending Finished: we can't do it after
3309 * sending ChangeCipherSpec, in case write returns WANT_READ.
3310 * Must be done before copying, may change out_msg pointer */
Hanno Beckere1dcb032018-08-17 16:47:58 +01003311 if( is_finished && ssl->handshake->cur_msg_p == ( cur->p + 12 ) )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003312 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01003313 MBEDTLS_SSL_DEBUG_MSG( 2, ( "swap epochs to send finished message" ) );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003314 ssl_swap_epochs( ssl );
3315 }
3316
Hanno Becker67bc7c32018-08-06 11:33:50 +01003317 ret = ssl_get_remaining_payload_in_datagram( ssl );
3318 if( ret < 0 )
3319 return( ret );
3320 max_frag_len = (size_t) ret;
3321
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003322 /* CCS is copied as is, while HS messages may need fragmentation */
3323 if( cur->type == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
3324 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01003325 if( max_frag_len == 0 )
3326 {
3327 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
3328 return( ret );
3329
3330 continue;
3331 }
3332
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003333 memcpy( ssl->out_msg, cur->p, cur->len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01003334 ssl->out_msglen = cur->len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003335 ssl->out_msgtype = cur->type;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003336
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003337 /* Update position inside current message */
3338 ssl->handshake->cur_msg_p += cur->len;
3339 }
3340 else
3341 {
3342 const unsigned char * const p = ssl->handshake->cur_msg_p;
3343 const size_t hs_len = cur->len - 12;
3344 const size_t frag_off = p - ( cur->p + 12 );
3345 const size_t rem_len = hs_len - frag_off;
Hanno Becker67bc7c32018-08-06 11:33:50 +01003346 size_t cur_hs_frag_len, max_hs_frag_len;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003347
Hanno Beckere1dcb032018-08-17 16:47:58 +01003348 if( ( max_frag_len < 12 ) || ( max_frag_len == 12 && hs_len != 0 ) )
Manuel Pégourié-Gonnarda1071a52018-08-20 11:56:14 +02003349 {
Hanno Beckere1dcb032018-08-17 16:47:58 +01003350 if( is_finished )
Hanno Becker67bc7c32018-08-06 11:33:50 +01003351 ssl_swap_epochs( ssl );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003352
Hanno Becker67bc7c32018-08-06 11:33:50 +01003353 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
3354 return( ret );
3355
3356 continue;
3357 }
3358 max_hs_frag_len = max_frag_len - 12;
3359
3360 cur_hs_frag_len = rem_len > max_hs_frag_len ?
3361 max_hs_frag_len : rem_len;
3362
3363 if( frag_off == 0 && cur_hs_frag_len != hs_len )
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02003364 {
3365 MBEDTLS_SSL_DEBUG_MSG( 2, ( "fragmenting handshake message (%u > %u)",
Hanno Becker67bc7c32018-08-06 11:33:50 +01003366 (unsigned) cur_hs_frag_len,
3367 (unsigned) max_hs_frag_len ) );
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02003368 }
Manuel Pégourié-Gonnardb747c6c2018-08-12 13:28:53 +02003369
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003370 /* Messages are stored with handshake headers as if not fragmented,
3371 * copy beginning of headers then fill fragmentation fields.
3372 * Handshake headers: type(1) len(3) seq(2) f_off(3) f_len(3) */
3373 memcpy( ssl->out_msg, cur->p, 6 );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003374
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003375 ssl->out_msg[6] = ( ( frag_off >> 16 ) & 0xff );
3376 ssl->out_msg[7] = ( ( frag_off >> 8 ) & 0xff );
3377 ssl->out_msg[8] = ( ( frag_off ) & 0xff );
3378
Hanno Becker67bc7c32018-08-06 11:33:50 +01003379 ssl->out_msg[ 9] = ( ( cur_hs_frag_len >> 16 ) & 0xff );
3380 ssl->out_msg[10] = ( ( cur_hs_frag_len >> 8 ) & 0xff );
3381 ssl->out_msg[11] = ( ( cur_hs_frag_len ) & 0xff );
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003382
3383 MBEDTLS_SSL_DEBUG_BUF( 3, "handshake header", ssl->out_msg, 12 );
3384
Hanno Becker3f7b9732018-08-28 09:53:25 +01003385 /* Copy the handshake message content and set records fields */
Hanno Becker67bc7c32018-08-06 11:33:50 +01003386 memcpy( ssl->out_msg + 12, p, cur_hs_frag_len );
3387 ssl->out_msglen = cur_hs_frag_len + 12;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003388 ssl->out_msgtype = cur->type;
3389
3390 /* Update position inside current message */
Hanno Becker67bc7c32018-08-06 11:33:50 +01003391 ssl->handshake->cur_msg_p += cur_hs_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003392 }
3393
3394 /* If done with the current message move to the next one if any */
3395 if( ssl->handshake->cur_msg_p >= cur->p + cur->len )
3396 {
3397 if( cur->next != NULL )
3398 {
3399 ssl->handshake->cur_msg = cur->next;
3400 ssl->handshake->cur_msg_p = cur->next->p + 12;
3401 }
3402 else
3403 {
3404 ssl->handshake->cur_msg = NULL;
3405 ssl->handshake->cur_msg_p = NULL;
3406 }
3407 }
3408
3409 /* Actually send the message out */
Hanno Becker04da1892018-08-14 13:22:10 +01003410 if( ( ret = mbedtls_ssl_write_record( ssl, force_flush ) ) != 0 )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003411 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003412 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003413 return( ret );
3414 }
3415 }
3416
Hanno Becker67bc7c32018-08-06 11:33:50 +01003417 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
3418 return( ret );
3419
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003420 /* Update state and set timer */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003421 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
3422 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard23b7b702014-09-25 13:50:12 +02003423 else
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003424 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003425 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003426 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
3427 }
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003428
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003429 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003430
3431 return( 0 );
3432}
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003433
3434/*
3435 * To be called when the last message of an incoming flight is received.
3436 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003437void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003438{
3439 /* We won't need to resend that one any more */
3440 ssl_flight_free( ssl->handshake->flight );
3441 ssl->handshake->flight = NULL;
3442 ssl->handshake->cur_msg = NULL;
3443
3444 /* The next incoming flight will start with this msg_seq */
3445 ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq;
3446
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003447 /* We don't want to remember CCS's across flight boundaries. */
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01003448 ssl->handshake->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003449
Hanno Becker0271f962018-08-16 13:23:47 +01003450 /* Clear future message buffering structure. */
3451 ssl_buffering_free( ssl );
3452
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02003453 /* Cancel timer */
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003454 ssl_set_timer( ssl, 0 );
3455
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003456 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
3457 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003458 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003459 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003460 }
3461 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003462 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003463}
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003464
3465/*
3466 * To be called when the last message of an outgoing flight is send.
3467 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003468void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003469{
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02003470 ssl_reset_retransmit_timeout( ssl );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02003471 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003472
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003473 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
3474 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003475 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003476 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003477 }
3478 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003479 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003480}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003481#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003482
Paul Bakker5121ce52009-01-03 21:22:43 +00003483/*
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003484 * Handshake layer functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003485 */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003486
3487/*
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003488 * Write (DTLS: or queue) current handshake (including CCS) message.
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003489 *
3490 * - fill in handshake headers
3491 * - update handshake checksum
3492 * - DTLS: save message for resending
3493 * - then pass to the record layer
3494 *
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003495 * DTLS: except for HelloRequest, messages are only queued, and will only be
3496 * actually sent when calling flight_transmit() or resend().
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003497 *
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003498 * Inputs:
3499 * - ssl->out_msglen: 4 + actual handshake message len
3500 * (4 is the size of handshake headers for TLS)
3501 * - ssl->out_msg[0]: the handshake type (ClientHello, ServerHello, etc)
3502 * - ssl->out_msg + 4: the handshake message body
3503 *
Manuel Pégourié-Gonnard065a2a32018-08-20 11:09:26 +02003504 * Outputs, ie state before passing to flight_append() or write_record():
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003505 * - ssl->out_msglen: the length of the record contents
3506 * (including handshake headers but excluding record headers)
3507 * - ssl->out_msg: the record contents (handshake headers + content)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003508 */
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003509int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003510{
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003511 int ret;
3512 const size_t hs_len = ssl->out_msglen - 4;
3513 const unsigned char hs_type = ssl->out_msg[0];
Paul Bakker5121ce52009-01-03 21:22:43 +00003514
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003515 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write handshake message" ) );
3516
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003517 /*
3518 * Sanity checks
3519 */
Hanno Beckerc83d2b32018-08-22 16:05:47 +01003520 if( ssl->out_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE &&
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003521 ssl->out_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
3522 {
Hanno Beckerc83d2b32018-08-22 16:05:47 +01003523 /* In SSLv3, the client might send a NoCertificate alert. */
3524#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
3525 if( ! ( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
3526 ssl->out_msgtype == MBEDTLS_SSL_MSG_ALERT &&
3527 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) )
3528#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
3529 {
3530 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3531 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3532 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003533 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003534
Hanno Beckerf6d6e302018-11-07 11:57:51 +00003535 /* Whenever we send anything different from a
3536 * HelloRequest we should be in a handshake - double check. */
3537 if( ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
3538 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) &&
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003539 ssl->handshake == NULL )
3540 {
3541 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3542 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3543 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003544
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003545#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003546 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003547 ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003548 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003549 {
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003550 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3551 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003552 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003553#endif
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003554
Hanno Beckerb50a2532018-08-06 11:52:54 +01003555 /* Double-check that we did not exceed the bounds
3556 * of the outgoing record buffer.
3557 * This should never fail as the various message
3558 * writing functions must obey the bounds of the
3559 * outgoing record buffer, but better be safe.
3560 *
3561 * Note: We deliberately do not check for the MTU or MFL here.
3562 */
3563 if( ssl->out_msglen > MBEDTLS_SSL_OUT_CONTENT_LEN )
3564 {
3565 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record too large: "
3566 "size %u, maximum %u",
3567 (unsigned) ssl->out_msglen,
3568 (unsigned) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
3569 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3570 }
3571
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003572 /*
3573 * Fill handshake headers
3574 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003575 if( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003576 {
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003577 ssl->out_msg[1] = (unsigned char)( hs_len >> 16 );
3578 ssl->out_msg[2] = (unsigned char)( hs_len >> 8 );
3579 ssl->out_msg[3] = (unsigned char)( hs_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00003580
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003581 /*
3582 * DTLS has additional fields in the Handshake layer,
3583 * between the length field and the actual payload:
3584 * uint16 message_seq;
3585 * uint24 fragment_offset;
3586 * uint24 fragment_length;
3587 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003588#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003589 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003590 {
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01003591 /* Make room for the additional DTLS fields */
Angus Grattond8213d02016-05-25 20:56:48 +10003592 if( MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen < 8 )
Hanno Becker9648f8b2017-09-18 10:55:54 +01003593 {
3594 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS handshake message too large: "
3595 "size %u, maximum %u",
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003596 (unsigned) ( hs_len ),
Angus Grattond8213d02016-05-25 20:56:48 +10003597 (unsigned) ( MBEDTLS_SSL_OUT_CONTENT_LEN - 12 ) ) );
Hanno Becker9648f8b2017-09-18 10:55:54 +01003598 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3599 }
3600
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003601 memmove( ssl->out_msg + 12, ssl->out_msg + 4, hs_len );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003602 ssl->out_msglen += 8;
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003603
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02003604 /* Write message_seq and update it, except for HelloRequest */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003605 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02003606 {
Manuel Pégourié-Gonnardd9ba0d92014-09-02 18:30:26 +02003607 ssl->out_msg[4] = ( ssl->handshake->out_msg_seq >> 8 ) & 0xFF;
3608 ssl->out_msg[5] = ( ssl->handshake->out_msg_seq ) & 0xFF;
3609 ++( ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02003610 }
3611 else
3612 {
3613 ssl->out_msg[4] = 0;
3614 ssl->out_msg[5] = 0;
3615 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01003616
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003617 /* Handshake hashes are computed without fragmentation,
3618 * so set frag_offset = 0 and frag_len = hs_len for now */
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01003619 memset( ssl->out_msg + 6, 0x00, 3 );
3620 memcpy( ssl->out_msg + 9, ssl->out_msg + 1, 3 );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003621 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003622#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003623
Hanno Becker0207e532018-08-28 10:28:28 +01003624 /* Update running hashes of handshake messages seen */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003625 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
3626 ssl->handshake->update_checksum( ssl, ssl->out_msg, ssl->out_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00003627 }
3628
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003629 /* Either send now, or just save to be sent (and resent) later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003630#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003631 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Hanno Beckerf6d6e302018-11-07 11:57:51 +00003632 ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
3633 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003634 {
3635 if( ( ret = ssl_flight_append( ssl ) ) != 0 )
3636 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003637 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003638 return( ret );
3639 }
3640 }
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003641 else
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003642#endif
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003643 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01003644 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003645 {
3646 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_record", ret );
3647 return( ret );
3648 }
3649 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003650
3651 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write handshake message" ) );
3652
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003653 return( 0 );
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003654}
3655
3656/*
3657 * Record layer functions
3658 */
3659
3660/*
3661 * Write current record.
3662 *
3663 * Uses:
3664 * - ssl->out_msgtype: type of the message (AppData, Handshake, Alert, CCS)
3665 * - ssl->out_msglen: length of the record content (excl headers)
3666 * - ssl->out_msg: record content
3667 */
Hanno Becker67bc7c32018-08-06 11:33:50 +01003668int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush )
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003669{
3670 int ret, done = 0;
3671 size_t len = ssl->out_msglen;
Hanno Becker67bc7c32018-08-06 11:33:50 +01003672 uint8_t flush = force_flush;
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003673
3674 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003675
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003676#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00003677 if( ssl->transform_out != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003678 ssl->session_out->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003679 {
3680 if( ( ret = ssl_compress_buf( ssl ) ) != 0 )
3681 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003682 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compress_buf", ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003683 return( ret );
3684 }
3685
3686 len = ssl->out_msglen;
3687 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003688#endif /*MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00003689
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003690#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
3691 if( mbedtls_ssl_hw_record_write != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003692 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003693 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_write()" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003694
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003695 ret = mbedtls_ssl_hw_record_write( ssl );
3696 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00003697 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003698 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_write", ret );
3699 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00003700 }
Paul Bakkerc7878112012-12-19 14:41:14 +01003701
3702 if( ret == 0 )
3703 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00003704 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003705#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00003706 if( !done )
3707 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01003708 unsigned i;
3709 size_t protected_record_size;
3710
Hanno Beckerff3e9c22019-05-08 11:57:13 +01003711 /* Skip writing the record content type to after the encryption,
3712 * as it may change when using the CID extension. */
3713
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003714 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003715 ssl->conf->transport, ssl->out_hdr + 1 );
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01003716
Hanno Becker19859472018-08-06 09:40:20 +01003717 memcpy( ssl->out_ctr, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01003718 ssl->out_len[0] = (unsigned char)( len >> 8 );
3719 ssl->out_len[1] = (unsigned char)( len );
Paul Bakker05ef8352012-05-08 09:17:57 +00003720
Paul Bakker48916f92012-09-16 19:57:18 +00003721 if( ssl->transform_out != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00003722 {
Hanno Becker3307b532017-12-27 21:37:21 +00003723 mbedtls_record rec;
3724
3725 rec.buf = ssl->out_iv;
3726 rec.buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN -
3727 ( ssl->out_iv - ssl->out_buf );
3728 rec.data_len = ssl->out_msglen;
3729 rec.data_offset = ssl->out_msg - rec.buf;
3730
3731 memcpy( &rec.ctr[0], ssl->out_ctr, 8 );
3732 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
3733 ssl->conf->transport, rec.ver );
3734 rec.type = ssl->out_msgtype;
3735
Hanno Becker505089d2019-05-01 09:45:57 +01003736#if defined(MBEDTLS_SSL_CID)
3737 /* The CID is set by mbedtls_ssl_encrypt_buf(). */
Hanno Beckere83efe62019-04-29 13:52:53 +01003738 rec.cid_len = 0;
Hanno Becker505089d2019-05-01 09:45:57 +01003739#endif /* MBEDTLS_SSL_CID */
Hanno Beckere83efe62019-04-29 13:52:53 +01003740
Hanno Becker611a83b2018-01-03 14:27:32 +00003741 if( ( ret = mbedtls_ssl_encrypt_buf( ssl, ssl->transform_out, &rec,
Hanno Becker3307b532017-12-27 21:37:21 +00003742 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00003743 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003744 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
Paul Bakker05ef8352012-05-08 09:17:57 +00003745 return( ret );
3746 }
3747
Hanno Becker3307b532017-12-27 21:37:21 +00003748 if( rec.data_offset != 0 )
3749 {
3750 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3751 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3752 }
3753
Hanno Beckerff3e9c22019-05-08 11:57:13 +01003754 /* Update the record content type and CID. */
3755 ssl->out_msgtype = rec.type;
Hanno Becker70e79282019-05-03 14:34:53 +01003756#if defined(MBEDTLS_SSL_CID )
3757 memcpy( ssl->out_cid, rec.cid, rec.cid_len );
3758#endif /* MBEDTLS_SSL_CID */
Hanno Beckerc5aee962019-03-14 12:56:23 +00003759 ssl->out_msglen = len = rec.data_len;
Hanno Becker3307b532017-12-27 21:37:21 +00003760 ssl->out_len[0] = (unsigned char)( rec.data_len >> 8 );
3761 ssl->out_len[1] = (unsigned char)( rec.data_len );
Paul Bakker05ef8352012-05-08 09:17:57 +00003762 }
3763
Hanno Becker43395762019-05-03 14:46:38 +01003764 protected_record_size = len + mbedtls_ssl_out_hdr_len( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01003765
3766#if defined(MBEDTLS_SSL_PROTO_DTLS)
3767 /* In case of DTLS, double-check that we don't exceed
3768 * the remaining space in the datagram. */
3769 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3770 {
Hanno Becker554b0af2018-08-22 20:33:41 +01003771 ret = ssl_get_remaining_space_in_datagram( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01003772 if( ret < 0 )
3773 return( ret );
3774
3775 if( protected_record_size > (size_t) ret )
3776 {
3777 /* Should never happen */
3778 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3779 }
3780 }
3781#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker05ef8352012-05-08 09:17:57 +00003782
Hanno Beckerff3e9c22019-05-08 11:57:13 +01003783 /* Now write the potentially updated record content type. */
3784 ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
3785
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003786 MBEDTLS_SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01003787 "version = [%d:%d], msglen = %d",
3788 ssl->out_hdr[0], ssl->out_hdr[1],
3789 ssl->out_hdr[2], len ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00003790
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003791 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01003792 ssl->out_hdr, protected_record_size );
Hanno Becker2b1e3542018-08-06 11:19:13 +01003793
3794 ssl->out_left += protected_record_size;
3795 ssl->out_hdr += protected_record_size;
3796 ssl_update_out_pointers( ssl, ssl->transform_out );
3797
Hanno Becker04484622018-08-06 09:49:38 +01003798 for( i = 8; i > ssl_ep_len( ssl ); i-- )
3799 if( ++ssl->cur_out_ctr[i - 1] != 0 )
3800 break;
3801
3802 /* The loop goes to its end iff the counter is wrapping */
3803 if( i == ssl_ep_len( ssl ) )
3804 {
3805 MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
3806 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
3807 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003808 }
3809
Hanno Becker67bc7c32018-08-06 11:33:50 +01003810#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker47db8772018-08-21 13:32:13 +01003811 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3812 flush == SSL_DONT_FORCE_FLUSH )
Hanno Becker67bc7c32018-08-06 11:33:50 +01003813 {
Hanno Becker1f5a15d2018-08-21 13:31:31 +01003814 size_t remaining;
3815 ret = ssl_get_remaining_payload_in_datagram( ssl );
3816 if( ret < 0 )
3817 {
3818 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_remaining_payload_in_datagram",
3819 ret );
3820 return( ret );
3821 }
3822
3823 remaining = (size_t) ret;
Hanno Becker67bc7c32018-08-06 11:33:50 +01003824 if( remaining == 0 )
Hanno Beckerf0da6672018-08-28 09:55:10 +01003825 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01003826 flush = SSL_FORCE_FLUSH;
Hanno Beckerf0da6672018-08-28 09:55:10 +01003827 }
Hanno Becker67bc7c32018-08-06 11:33:50 +01003828 else
3829 {
Hanno Becker513815a2018-08-20 11:56:09 +01003830 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Still %u bytes available in current datagram", (unsigned) remaining ) );
Hanno Becker67bc7c32018-08-06 11:33:50 +01003831 }
3832 }
3833#endif /* MBEDTLS_SSL_PROTO_DTLS */
3834
3835 if( ( flush == SSL_FORCE_FLUSH ) &&
3836 ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003837 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003838 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003839 return( ret );
3840 }
3841
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003842 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003843
3844 return( 0 );
3845}
3846
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003847#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckere25e3b72018-08-16 09:30:53 +01003848
3849static int ssl_hs_is_proper_fragment( mbedtls_ssl_context *ssl )
3850{
3851 if( ssl->in_msglen < ssl->in_hslen ||
3852 memcmp( ssl->in_msg + 6, "\0\0\0", 3 ) != 0 ||
3853 memcmp( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 )
3854 {
3855 return( 1 );
3856 }
3857 return( 0 );
3858}
Hanno Becker44650b72018-08-16 12:51:11 +01003859
Hanno Beckercd9dcda2018-08-28 17:18:56 +01003860static uint32_t ssl_get_hs_frag_len( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01003861{
3862 return( ( ssl->in_msg[9] << 16 ) |
3863 ( ssl->in_msg[10] << 8 ) |
3864 ssl->in_msg[11] );
3865}
3866
Hanno Beckercd9dcda2018-08-28 17:18:56 +01003867static uint32_t ssl_get_hs_frag_off( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01003868{
3869 return( ( ssl->in_msg[6] << 16 ) |
3870 ( ssl->in_msg[7] << 8 ) |
3871 ssl->in_msg[8] );
3872}
3873
Hanno Beckercd9dcda2018-08-28 17:18:56 +01003874static int ssl_check_hs_header( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01003875{
3876 uint32_t msg_len, frag_off, frag_len;
3877
3878 msg_len = ssl_get_hs_total_len( ssl );
3879 frag_off = ssl_get_hs_frag_off( ssl );
3880 frag_len = ssl_get_hs_frag_len( ssl );
3881
3882 if( frag_off > msg_len )
3883 return( -1 );
3884
3885 if( frag_len > msg_len - frag_off )
3886 return( -1 );
3887
3888 if( frag_len + 12 > ssl->in_msglen )
3889 return( -1 );
3890
3891 return( 0 );
3892}
3893
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003894/*
3895 * Mark bits in bitmask (used for DTLS HS reassembly)
3896 */
3897static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len )
3898{
3899 unsigned int start_bits, end_bits;
3900
3901 start_bits = 8 - ( offset % 8 );
3902 if( start_bits != 8 )
3903 {
3904 size_t first_byte_idx = offset / 8;
3905
Manuel Pégourié-Gonnardac030522014-09-02 14:23:40 +02003906 /* Special case */
3907 if( len <= start_bits )
3908 {
3909 for( ; len != 0; len-- )
3910 mask[first_byte_idx] |= 1 << ( start_bits - len );
3911
3912 /* Avoid potential issues with offset or len becoming invalid */
3913 return;
3914 }
3915
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003916 offset += start_bits; /* Now offset % 8 == 0 */
3917 len -= start_bits;
3918
3919 for( ; start_bits != 0; start_bits-- )
3920 mask[first_byte_idx] |= 1 << ( start_bits - 1 );
3921 }
3922
3923 end_bits = len % 8;
3924 if( end_bits != 0 )
3925 {
3926 size_t last_byte_idx = ( offset + len ) / 8;
3927
3928 len -= end_bits; /* Now len % 8 == 0 */
3929
3930 for( ; end_bits != 0; end_bits-- )
3931 mask[last_byte_idx] |= 1 << ( 8 - end_bits );
3932 }
3933
3934 memset( mask + offset / 8, 0xFF, len / 8 );
3935}
3936
3937/*
3938 * Check that bitmask is full
3939 */
3940static int ssl_bitmask_check( unsigned char *mask, size_t len )
3941{
3942 size_t i;
3943
3944 for( i = 0; i < len / 8; i++ )
3945 if( mask[i] != 0xFF )
3946 return( -1 );
3947
3948 for( i = 0; i < len % 8; i++ )
3949 if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 )
3950 return( -1 );
3951
3952 return( 0 );
3953}
3954
Hanno Becker56e205e2018-08-16 09:06:12 +01003955/* msg_len does not include the handshake header */
Hanno Becker65dc8852018-08-23 09:40:49 +01003956static size_t ssl_get_reassembly_buffer_size( size_t msg_len,
Hanno Becker2a97b0e2018-08-21 15:47:49 +01003957 unsigned add_bitmap )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003958{
Hanno Becker56e205e2018-08-16 09:06:12 +01003959 size_t alloc_len;
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003960
Hanno Becker56e205e2018-08-16 09:06:12 +01003961 alloc_len = 12; /* Handshake header */
3962 alloc_len += msg_len; /* Content buffer */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003963
Hanno Beckerd07df862018-08-16 09:14:58 +01003964 if( add_bitmap )
3965 alloc_len += msg_len / 8 + ( msg_len % 8 != 0 ); /* Bitmap */
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003966
Hanno Becker2a97b0e2018-08-21 15:47:49 +01003967 return( alloc_len );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003968}
Hanno Becker56e205e2018-08-16 09:06:12 +01003969
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003970#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003971
Hanno Beckercd9dcda2018-08-28 17:18:56 +01003972static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl )
Hanno Becker12555c62018-08-16 12:47:53 +01003973{
3974 return( ( ssl->in_msg[1] << 16 ) |
3975 ( ssl->in_msg[2] << 8 ) |
3976 ssl->in_msg[3] );
3977}
Hanno Beckere25e3b72018-08-16 09:30:53 +01003978
Simon Butcher99000142016-10-13 17:21:01 +01003979int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003980{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003981 if( ssl->in_msglen < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02003982 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003983 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %d",
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02003984 ssl->in_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003985 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02003986 }
3987
Hanno Becker12555c62018-08-16 12:47:53 +01003988 ssl->in_hslen = mbedtls_ssl_hs_hdr_len( ssl ) + ssl_get_hs_total_len( ssl );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003989
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003990 MBEDTLS_SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003991 " %d, type = %d, hslen = %d",
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003992 ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003993
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003994#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003995 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003996 {
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003997 int ret;
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003998 unsigned int recv_msg_seq = ( ssl->in_msg[4] << 8 ) | ssl->in_msg[5];
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003999
Hanno Becker44650b72018-08-16 12:51:11 +01004000 if( ssl_check_hs_header( ssl ) != 0 )
4001 {
4002 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid handshake header" ) );
4003 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4004 }
4005
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004006 if( ssl->handshake != NULL &&
Hanno Beckerc76c6192017-06-06 10:03:17 +01004007 ( ( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER &&
4008 recv_msg_seq != ssl->handshake->in_msg_seq ) ||
4009 ( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
4010 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO ) ) )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004011 {
Hanno Becker9e1ec222018-08-15 15:54:43 +01004012 if( recv_msg_seq > ssl->handshake->in_msg_seq )
4013 {
4014 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received future handshake message of sequence number %u (next %u)",
4015 recv_msg_seq,
4016 ssl->handshake->in_msg_seq ) );
4017 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
4018 }
4019
Manuel Pégourié-Gonnardfc572dd2014-10-09 17:56:57 +02004020 /* Retransmit only on last message from previous flight, to avoid
4021 * too many retransmissions.
4022 * Besides, No sane server ever retransmits HelloVerifyRequest */
4023 if( recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004024 ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004025 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004026 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received message from last flight, "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004027 "message_seq = %d, start_of_flight = %d",
4028 recv_msg_seq,
4029 ssl->handshake->in_flight_start_seq ) );
4030
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004031 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004032 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004033 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004034 return( ret );
4035 }
4036 }
4037 else
4038 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004039 MBEDTLS_SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02004040 "message_seq = %d, expected = %d",
4041 recv_msg_seq,
4042 ssl->handshake->in_msg_seq ) );
4043 }
4044
Hanno Becker90333da2017-10-10 11:27:13 +01004045 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004046 }
4047 /* Wait until message completion to increment in_msg_seq */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004048
Hanno Becker6d97ef52018-08-16 13:09:04 +01004049 /* Message reassembly is handled alongside buffering of future
4050 * messages; the commonality is that both handshake fragments and
Hanno Becker83ab41c2018-08-28 17:19:38 +01004051 * future messages cannot be forwarded immediately to the
Hanno Becker6d97ef52018-08-16 13:09:04 +01004052 * handshake logic layer. */
Hanno Beckere25e3b72018-08-16 09:30:53 +01004053 if( ssl_hs_is_proper_fragment( ssl ) == 1 )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004054 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004055 MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
Hanno Becker6d97ef52018-08-16 13:09:04 +01004056 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004057 }
4058 }
4059 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004060#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02004061 /* With TLS we don't handle fragmentation (for now) */
4062 if( ssl->in_msglen < ssl->in_hslen )
4063 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004064 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
4065 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004066 }
4067
Simon Butcher99000142016-10-13 17:21:01 +01004068 return( 0 );
4069}
4070
4071void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl )
4072{
Hanno Becker0271f962018-08-16 13:23:47 +01004073 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Simon Butcher99000142016-10-13 17:21:01 +01004074
Hanno Becker0271f962018-08-16 13:23:47 +01004075 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER && hs != NULL )
Manuel Pégourié-Gonnard14bf7062015-06-23 14:07:13 +02004076 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004077 ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
Manuel Pégourié-Gonnard14bf7062015-06-23 14:07:13 +02004078 }
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004079
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004080 /* Handshake message is complete, increment counter */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004081#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004082 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004083 ssl->handshake != NULL )
4084 {
Hanno Becker0271f962018-08-16 13:23:47 +01004085 unsigned offset;
4086 mbedtls_ssl_hs_buffer *hs_buf;
Hanno Beckere25e3b72018-08-16 09:30:53 +01004087
Hanno Becker0271f962018-08-16 13:23:47 +01004088 /* Increment handshake sequence number */
4089 hs->in_msg_seq++;
4090
4091 /*
4092 * Clear up handshake buffering and reassembly structure.
4093 */
4094
4095 /* Free first entry */
Hanno Beckere605b192018-08-21 15:59:07 +01004096 ssl_buffering_free_slot( ssl, 0 );
Hanno Becker0271f962018-08-16 13:23:47 +01004097
4098 /* Shift all other entries */
Hanno Beckere605b192018-08-21 15:59:07 +01004099 for( offset = 0, hs_buf = &hs->buffering.hs[0];
4100 offset + 1 < MBEDTLS_SSL_MAX_BUFFERED_HS;
Hanno Becker0271f962018-08-16 13:23:47 +01004101 offset++, hs_buf++ )
4102 {
4103 *hs_buf = *(hs_buf + 1);
4104 }
4105
4106 /* Create a fresh last entry */
4107 memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02004108 }
4109#endif
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01004110}
4111
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004112/*
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004113 * DTLS anti-replay: RFC 6347 4.1.2.6
4114 *
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02004115 * in_window is a field of bits numbered from 0 (lsb) to 63 (msb).
4116 * Bit n is set iff record number in_window_top - n has been seen.
4117 *
4118 * Usually, in_window_top is the last record number seen and the lsb of
4119 * in_window is set. The only exception is the initial state (record number 0
4120 * not seen yet).
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004121 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004122#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4123static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004124{
4125 ssl->in_window_top = 0;
4126 ssl->in_window = 0;
4127}
4128
4129static inline uint64_t ssl_load_six_bytes( unsigned char *buf )
4130{
4131 return( ( (uint64_t) buf[0] << 40 ) |
4132 ( (uint64_t) buf[1] << 32 ) |
4133 ( (uint64_t) buf[2] << 24 ) |
4134 ( (uint64_t) buf[3] << 16 ) |
4135 ( (uint64_t) buf[4] << 8 ) |
4136 ( (uint64_t) buf[5] ) );
4137}
4138
4139/*
4140 * Return 0 if sequence number is acceptable, -1 otherwise
4141 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004142int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004143{
4144 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
4145 uint64_t bit;
4146
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004147 if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02004148 return( 0 );
4149
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004150 if( rec_seqnum > ssl->in_window_top )
4151 return( 0 );
4152
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02004153 bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004154
4155 if( bit >= 64 )
4156 return( -1 );
4157
4158 if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 )
4159 return( -1 );
4160
4161 return( 0 );
4162}
4163
4164/*
4165 * Update replay window on new validated record
4166 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004167void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004168{
4169 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
4170
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004171 if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02004172 return;
4173
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004174 if( rec_seqnum > ssl->in_window_top )
4175 {
4176 /* Update window_top and the contents of the window */
4177 uint64_t shift = rec_seqnum - ssl->in_window_top;
4178
4179 if( shift >= 64 )
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02004180 ssl->in_window = 1;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004181 else
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02004182 {
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004183 ssl->in_window <<= shift;
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02004184 ssl->in_window |= 1;
4185 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004186
4187 ssl->in_window_top = rec_seqnum;
4188 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004189 else
4190 {
4191 /* Mark that number as seen in the current window */
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02004192 uint64_t bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004193
4194 if( bit < 64 ) /* Always true, but be extra sure */
4195 ssl->in_window |= (uint64_t) 1 << bit;
4196 }
4197}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004198#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004199
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02004200#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004201/* Forward declaration */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02004202static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial );
4203
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004204/*
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004205 * Without any SSL context, check if a datagram looks like a ClientHello with
4206 * a valid cookie, and if it doesn't, generate a HelloVerifyRequest message.
Simon Butcher0789aed2015-09-11 17:15:17 +01004207 * Both input and output include full DTLS headers.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004208 *
4209 * - if cookie is valid, return 0
4210 * - if ClientHello looks superficially valid but cookie is not,
4211 * fill obuf and set olen, then
4212 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
4213 * - otherwise return a specific error code
4214 */
4215static int ssl_check_dtls_clihlo_cookie(
4216 mbedtls_ssl_cookie_write_t *f_cookie_write,
4217 mbedtls_ssl_cookie_check_t *f_cookie_check,
4218 void *p_cookie,
4219 const unsigned char *cli_id, size_t cli_id_len,
4220 const unsigned char *in, size_t in_len,
4221 unsigned char *obuf, size_t buf_len, size_t *olen )
4222{
4223 size_t sid_len, cookie_len;
4224 unsigned char *p;
4225
4226 if( f_cookie_write == NULL || f_cookie_check == NULL )
4227 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4228
4229 /*
4230 * Structure of ClientHello with record and handshake headers,
4231 * and expected values. We don't need to check a lot, more checks will be
4232 * done when actually parsing the ClientHello - skipping those checks
4233 * avoids code duplication and does not make cookie forging any easier.
4234 *
4235 * 0-0 ContentType type; copied, must be handshake
4236 * 1-2 ProtocolVersion version; copied
4237 * 3-4 uint16 epoch; copied, must be 0
4238 * 5-10 uint48 sequence_number; copied
4239 * 11-12 uint16 length; (ignored)
4240 *
4241 * 13-13 HandshakeType msg_type; (ignored)
4242 * 14-16 uint24 length; (ignored)
4243 * 17-18 uint16 message_seq; copied
4244 * 19-21 uint24 fragment_offset; copied, must be 0
4245 * 22-24 uint24 fragment_length; (ignored)
4246 *
4247 * 25-26 ProtocolVersion client_version; (ignored)
4248 * 27-58 Random random; (ignored)
4249 * 59-xx SessionID session_id; 1 byte len + sid_len content
4250 * 60+ opaque cookie<0..2^8-1>; 1 byte len + content
4251 * ...
4252 *
4253 * Minimum length is 61 bytes.
4254 */
4255 if( in_len < 61 ||
4256 in[0] != MBEDTLS_SSL_MSG_HANDSHAKE ||
4257 in[3] != 0 || in[4] != 0 ||
4258 in[19] != 0 || in[20] != 0 || in[21] != 0 )
4259 {
4260 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
4261 }
4262
4263 sid_len = in[59];
4264 if( sid_len > in_len - 61 )
4265 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
4266
4267 cookie_len = in[60 + sid_len];
4268 if( cookie_len > in_len - 60 )
4269 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
4270
4271 if( f_cookie_check( p_cookie, in + sid_len + 61, cookie_len,
4272 cli_id, cli_id_len ) == 0 )
4273 {
4274 /* Valid cookie */
4275 return( 0 );
4276 }
4277
4278 /*
4279 * If we get here, we've got an invalid cookie, let's prepare HVR.
4280 *
4281 * 0-0 ContentType type; copied
4282 * 1-2 ProtocolVersion version; copied
4283 * 3-4 uint16 epoch; copied
4284 * 5-10 uint48 sequence_number; copied
4285 * 11-12 uint16 length; olen - 13
4286 *
4287 * 13-13 HandshakeType msg_type; hello_verify_request
4288 * 14-16 uint24 length; olen - 25
4289 * 17-18 uint16 message_seq; copied
4290 * 19-21 uint24 fragment_offset; copied
4291 * 22-24 uint24 fragment_length; olen - 25
4292 *
4293 * 25-26 ProtocolVersion server_version; 0xfe 0xff
4294 * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie
4295 *
4296 * Minimum length is 28.
4297 */
4298 if( buf_len < 28 )
4299 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
4300
4301 /* Copy most fields and adapt others */
4302 memcpy( obuf, in, 25 );
4303 obuf[13] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
4304 obuf[25] = 0xfe;
4305 obuf[26] = 0xff;
4306
4307 /* Generate and write actual cookie */
4308 p = obuf + 28;
4309 if( f_cookie_write( p_cookie,
4310 &p, obuf + buf_len, cli_id, cli_id_len ) != 0 )
4311 {
4312 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4313 }
4314
4315 *olen = p - obuf;
4316
4317 /* Go back and fill length fields */
4318 obuf[27] = (unsigned char)( *olen - 28 );
4319
4320 obuf[14] = obuf[22] = (unsigned char)( ( *olen - 25 ) >> 16 );
4321 obuf[15] = obuf[23] = (unsigned char)( ( *olen - 25 ) >> 8 );
4322 obuf[16] = obuf[24] = (unsigned char)( ( *olen - 25 ) );
4323
4324 obuf[11] = (unsigned char)( ( *olen - 13 ) >> 8 );
4325 obuf[12] = (unsigned char)( ( *olen - 13 ) );
4326
4327 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
4328}
4329
4330/*
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004331 * Handle possible client reconnect with the same UDP quadruplet
4332 * (RFC 6347 Section 4.2.8).
4333 *
4334 * Called by ssl_parse_record_header() in case we receive an epoch 0 record
4335 * that looks like a ClientHello.
4336 *
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004337 * - if the input looks like a ClientHello without cookies,
4338 * send back HelloVerifyRequest, then
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004339 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004340 * - if the input looks like a ClientHello with a valid cookie,
4341 * reset the session of the current context, and
Manuel Pégourié-Gonnardbe619c12015-09-08 11:21:21 +02004342 * return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004343 * - if anything goes wrong, return a specific error code
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004344 *
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004345 * mbedtls_ssl_read_record() will ignore the record if anything else than
Simon Butcherd0bf6a32015-09-11 17:34:49 +01004346 * MBEDTLS_ERR_SSL_CLIENT_RECONNECT or 0 is returned, although this function
4347 * cannot not return 0.
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004348 */
4349static int ssl_handle_possible_reconnect( mbedtls_ssl_context *ssl )
4350{
4351 int ret;
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004352 size_t len;
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004353
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004354 ret = ssl_check_dtls_clihlo_cookie(
4355 ssl->conf->f_cookie_write,
4356 ssl->conf->f_cookie_check,
4357 ssl->conf->p_cookie,
4358 ssl->cli_id, ssl->cli_id_len,
4359 ssl->in_buf, ssl->in_left,
Angus Grattond8213d02016-05-25 20:56:48 +10004360 ssl->out_buf, MBEDTLS_SSL_OUT_CONTENT_LEN, &len );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004361
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004362 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_dtls_clihlo_cookie", ret );
4363
4364 if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004365 {
Brian J Murray1903fb32016-11-06 04:45:15 -08004366 /* Don't check write errors as we can't do anything here.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004367 * If the error is permanent we'll catch it later,
4368 * if it's not, then hopefully it'll work next time. */
4369 (void) ssl->f_send( ssl->p_bio, ssl->out_buf, len );
4370
4371 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004372 }
4373
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004374 if( ret == 0 )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004375 {
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004376 /* Got a valid cookie, partially reset context */
4377 if( ( ret = ssl_session_reset_int( ssl, 1 ) ) != 0 )
4378 {
4379 MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret );
4380 return( ret );
4381 }
4382
4383 return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004384 }
4385
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004386 return( ret );
4387}
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02004388#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004389
Hanno Becker46483f12019-05-03 13:25:54 +01004390static int ssl_check_record_type( uint8_t record_type )
4391{
4392 if( record_type != MBEDTLS_SSL_MSG_HANDSHAKE &&
4393 record_type != MBEDTLS_SSL_MSG_ALERT &&
4394 record_type != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
4395 record_type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
4396 {
4397 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4398 }
4399
4400 return( 0 );
4401}
4402
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004403/*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004404 * ContentType type;
4405 * ProtocolVersion version;
4406 * uint16 epoch; // DTLS only
4407 * uint48 sequence_number; // DTLS only
4408 * uint16 length;
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004409 *
4410 * Return 0 if header looks sane (and, for DTLS, the record is expected)
Simon Butcher207990d2015-12-16 01:51:30 +00004411 * MBEDTLS_ERR_SSL_INVALID_RECORD if the header looks bad,
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004412 * MBEDTLS_ERR_SSL_UNEXPECTED_RECORD (DTLS only) if sane but unexpected.
4413 *
4414 * With DTLS, mbedtls_ssl_read_record() will:
Simon Butcher207990d2015-12-16 01:51:30 +00004415 * 1. proceed with the record if this function returns 0
4416 * 2. drop only the current record if this function returns UNEXPECTED_RECORD
4417 * 3. return CLIENT_RECONNECT if this function return that value
4418 * 4. drop the whole datagram if this function returns anything else.
4419 * Point 2 is needed when the peer is resending, and we have already received
4420 * the first record from a datagram but are still waiting for the others.
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004421 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004422static int ssl_parse_record_header( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004423{
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01004424 int major_ver, minor_ver;
Hanno Becker8b09b732019-05-08 12:03:28 +01004425 int ret;
Paul Bakker5121ce52009-01-03 21:22:43 +00004426
Hanno Becker8b09b732019-05-08 12:03:28 +01004427 /* Parse and validate record content type and version */
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02004428
Paul Bakker5121ce52009-01-03 21:22:43 +00004429 ssl->in_msgtype = ssl->in_hdr[0];
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004430 mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, ssl->in_hdr + 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00004431
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02004432 /* Check record type */
Hanno Becker8b09b732019-05-08 12:03:28 +01004433#if defined(MBEDTLS_SSL_CID)
4434 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
4435 ssl->in_msgtype == MBEDTLS_SSL_MSG_CID &&
4436 ssl->conf->cid_len != 0 )
4437 {
4438 /* Shift pointers to account for record header including CID
4439 * struct {
4440 * ContentType special_type = tls12_cid;
4441 * ProtocolVersion version;
4442 * uint16 epoch;
4443 * uint48 sequence_number;
4444 * opaque cid[cid_length]; // New field
4445 * uint16 length;
4446 * opaque enc_content[DTLSCiphertext.length];
4447 * } DTLSCiphertext;
4448 */
4449
4450 /* So far, we only support static CID lengths
4451 * fixed in the configuration. */
4452 ssl->in_len = ssl->in_cid + ssl->conf->cid_len;
4453 ssl->in_iv = ssl->in_msg = ssl->in_len + 2;
4454 }
4455 else
4456#endif /* MBEDTLS_SSL_CID */
Hanno Becker46483f12019-05-03 13:25:54 +01004457 if( ssl_check_record_type( ssl->in_msgtype ) )
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02004458 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004459 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
Andres Amaya Garcia2fad94b2017-06-26 15:11:59 +01004460
4461#if defined(MBEDTLS_SSL_PROTO_DTLS)
Andres Amaya Garcia01692532017-06-28 09:26:46 +01004462 /* Silently ignore invalid DTLS records as recommended by RFC 6347
4463 * Section 4.1.2.7 */
Andres Amaya Garcia2fad94b2017-06-26 15:11:59 +01004464 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4465#endif /* MBEDTLS_SSL_PROTO_DTLS */
4466 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4467 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
4468
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004469 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02004470 }
4471
4472 /* Check version */
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01004473 if( major_ver != ssl->major_ver )
Paul Bakker5121ce52009-01-03 21:22:43 +00004474 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004475 MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
4476 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00004477 }
4478
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004479 if( minor_ver > ssl->conf->max_minor_ver )
Paul Bakker5121ce52009-01-03 21:22:43 +00004480 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004481 MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
4482 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00004483 }
4484
Hanno Becker8b09b732019-05-08 12:03:28 +01004485 /* Now that the total length of the record header is known, ensure
4486 * that the current datagram is large enough to hold it.
4487 * This would fail, for example, if we received a datagram of
4488 * size 13 + n Bytes where n is less than the size of incoming CIDs. */
4489 ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_in_hdr_len( ssl ) );
4490 if( ret != 0 )
4491 {
4492 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
4493 return( ret );
4494 }
4495 MBEDTLS_SSL_DEBUG_BUF( 4, "input record header", ssl->in_hdr, mbedtls_ssl_in_hdr_len( ssl ) );
4496
4497 /* Parse and validate record length
4498 * This must happen after the CID parsing because
4499 * its position in the record header depends on
4500 * the presence of a CID. */
4501
4502 ssl->in_msglen = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
Angus Grattond8213d02016-05-25 20:56:48 +10004503 if( ssl->in_msglen > MBEDTLS_SSL_IN_BUFFER_LEN
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02004504 - (size_t)( ssl->in_msg - ssl->in_buf ) )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02004505 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004506 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4507 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02004508 }
4509
Hanno Becker8b09b732019-05-08 12:03:28 +01004510 MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
4511 "version = [%d:%d], msglen = %d",
4512 ssl->in_msgtype,
4513 major_ver, minor_ver, ssl->in_msglen ) );
4514
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004515 /*
Hanno Becker52c6dc62017-05-26 16:07:36 +01004516 * DTLS-related tests.
4517 * Check epoch before checking length constraint because
4518 * the latter varies with the epoch. E.g., if a ChangeCipherSpec
4519 * message gets duplicated before the corresponding Finished message,
4520 * the second ChangeCipherSpec should be discarded because it belongs
4521 * to an old epoch, but not because its length is shorter than
4522 * the minimum record length for packets using the new record transform.
4523 * Note that these two kinds of failures are handled differently,
4524 * as an unexpected record is silently skipped but an invalid
4525 * record leads to the entire datagram being dropped.
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004526 */
4527#if defined(MBEDTLS_SSL_PROTO_DTLS)
4528 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4529 {
4530 unsigned int rec_epoch = ( ssl->in_ctr[0] << 8 ) | ssl->in_ctr[1];
4531
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004532 /* Check epoch (and sequence number) with DTLS */
4533 if( rec_epoch != ssl->in_epoch )
4534 {
4535 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: "
4536 "expected %d, received %d",
4537 ssl->in_epoch, rec_epoch ) );
4538
4539#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
4540 /*
4541 * Check for an epoch 0 ClientHello. We can't use in_msg here to
4542 * access the first byte of record content (handshake type), as we
4543 * have an active transform (possibly iv_len != 0), so use the
4544 * fact that the record header len is 13 instead.
4545 */
4546 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
4547 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
4548 rec_epoch == 0 &&
4549 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4550 ssl->in_left > 13 &&
4551 ssl->in_buf[13] == MBEDTLS_SSL_HS_CLIENT_HELLO )
4552 {
4553 MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect "
4554 "from the same port" ) );
4555 return( ssl_handle_possible_reconnect( ssl ) );
4556 }
4557 else
4558#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
Hanno Becker5f066e72018-08-16 14:56:31 +01004559 {
4560 /* Consider buffering the record. */
4561 if( rec_epoch == (unsigned int) ssl->in_epoch + 1 )
4562 {
4563 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Consider record for buffering" ) );
4564 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
4565 }
4566
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004567 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
Hanno Becker5f066e72018-08-16 14:56:31 +01004568 }
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004569 }
4570
4571#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4572 /* Replay detection only works for the current epoch */
4573 if( rec_epoch == ssl->in_epoch &&
4574 mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
4575 {
4576 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
4577 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
4578 }
4579#endif
4580 }
4581#endif /* MBEDTLS_SSL_PROTO_DTLS */
4582
Hanno Becker52c6dc62017-05-26 16:07:36 +01004583
4584 /* Check length against bounds of the current transform and version */
4585 if( ssl->transform_in == NULL )
4586 {
4587 if( ssl->in_msglen < 1 ||
Angus Grattond8213d02016-05-25 20:56:48 +10004588 ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
Hanno Becker52c6dc62017-05-26 16:07:36 +01004589 {
4590 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4591 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4592 }
4593 }
4594 else
4595 {
4596 if( ssl->in_msglen < ssl->transform_in->minlen )
4597 {
4598 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4599 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4600 }
4601
4602#if defined(MBEDTLS_SSL_PROTO_SSL3)
4603 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
Angus Grattond8213d02016-05-25 20:56:48 +10004604 ssl->in_msglen > ssl->transform_in->minlen + MBEDTLS_SSL_IN_CONTENT_LEN )
Hanno Becker52c6dc62017-05-26 16:07:36 +01004605 {
4606 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4607 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4608 }
4609#endif
4610#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
4611 defined(MBEDTLS_SSL_PROTO_TLS1_2)
4612 /*
4613 * TLS encrypted messages can have up to 256 bytes of padding
4614 */
4615 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 &&
4616 ssl->in_msglen > ssl->transform_in->minlen +
Angus Grattond8213d02016-05-25 20:56:48 +10004617 MBEDTLS_SSL_IN_CONTENT_LEN + 256 )
Hanno Becker52c6dc62017-05-26 16:07:36 +01004618 {
4619 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4620 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4621 }
4622#endif
4623 }
4624
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004625 return( 0 );
4626}
Paul Bakker5121ce52009-01-03 21:22:43 +00004627
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004628/*
4629 * If applicable, decrypt (and decompress) record content
4630 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004631static int ssl_prepare_record_content( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004632{
4633 int ret, done = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004634
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004635 MBEDTLS_SSL_DEBUG_BUF( 4, "input record from network",
Hanno Becker43395762019-05-03 14:46:38 +01004636 ssl->in_hdr, mbedtls_ssl_in_hdr_len( ssl ) + ssl->in_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00004637
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004638#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4639 if( mbedtls_ssl_hw_record_read != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00004640 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004641 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_read()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00004642
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004643 ret = mbedtls_ssl_hw_record_read( ssl );
4644 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00004645 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004646 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_read", ret );
4647 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00004648 }
Paul Bakkerc7878112012-12-19 14:41:14 +01004649
4650 if( ret == 0 )
4651 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00004652 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004653#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker48916f92012-09-16 19:57:18 +00004654 if( !done && ssl->transform_in != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004655 {
Hanno Becker4c6876b2017-12-27 21:28:58 +00004656 mbedtls_record rec;
4657
4658 rec.buf = ssl->in_iv;
4659 rec.buf_len = MBEDTLS_SSL_IN_BUFFER_LEN
4660 - ( ssl->in_iv - ssl->in_buf );
4661 rec.data_len = ssl->in_msglen;
4662 rec.data_offset = 0;
Hanno Becker70e79282019-05-03 14:34:53 +01004663#if defined(MBEDTLS_SSL_CID )
Hanno Becker7ba35682019-05-09 15:54:28 +01004664 rec.cid_len = (uint8_t)( ssl->in_len - ssl->in_cid );
Hanno Becker70e79282019-05-03 14:34:53 +01004665 memcpy( rec.cid, ssl->in_cid, rec.cid_len );
4666#endif /* MBEDTLS_SSL_CID */
Hanno Becker4c6876b2017-12-27 21:28:58 +00004667
4668 memcpy( &rec.ctr[0], ssl->in_ctr, 8 );
4669 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
4670 ssl->conf->transport, rec.ver );
4671 rec.type = ssl->in_msgtype;
Hanno Becker611a83b2018-01-03 14:27:32 +00004672 if( ( ret = mbedtls_ssl_decrypt_buf( ssl, ssl->transform_in,
4673 &rec ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004674 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004675 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
Hanno Beckere8eff9a2019-05-14 11:30:10 +01004676
4677#if defined(MBEDTLS_SSL_CID)
4678 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_CID &&
4679 ssl->conf->ignore_unexpected_cid
4680 == MBEDTLS_SSL_UNEXPECTED_CID_IGNORE )
4681 {
Hanno Becker687e0fb2019-05-08 13:02:55 +01004682 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
Hanno Beckere8eff9a2019-05-14 11:30:10 +01004683 }
4684#endif /* MBEDTLS_SSL_CID */
Hanno Becker687e0fb2019-05-08 13:02:55 +01004685
Paul Bakker5121ce52009-01-03 21:22:43 +00004686 return( ret );
4687 }
4688
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004689 if( ssl->in_msgtype != rec.type )
4690 {
4691 MBEDTLS_SSL_DEBUG_MSG( 4, ( "record type after decrypt (before %d): %d",
4692 ssl->in_msgtype, rec.type ) );
4693 }
4694
4695 /* The record content type may change during decryption,
4696 * so re-read it. */
4697 ssl->in_msgtype = rec.type;
4698 /* Also update the input buffer, because unfortunately
4699 * the server-side ssl_parse_client_hello() reparses the
4700 * record header when receiving a ClientHello initiating
4701 * a renegotiation. */
4702 ssl->in_hdr[0] = rec.type;
Hanno Beckerf5970a02019-05-08 09:38:41 +01004703 ssl->in_msg = rec.buf + rec.data_offset;
Hanno Becker4c6876b2017-12-27 21:28:58 +00004704 ssl->in_msglen = rec.data_len;
4705 ssl->in_len[0] = (unsigned char)( rec.data_len >> 8 );
4706 ssl->in_len[1] = (unsigned char)( rec.data_len );
4707
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004708 MBEDTLS_SSL_DEBUG_BUF( 4, "input payload after decrypt",
Paul Bakker5121ce52009-01-03 21:22:43 +00004709 ssl->in_msg, ssl->in_msglen );
4710
Hanno Beckerff3e9c22019-05-08 11:57:13 +01004711#if defined(MBEDTLS_SSL_CID)
4712 /* We have already checked the record content type
4713 * in ssl_parse_record_header(), failing or silently
4714 * dropping the record in the case of an unknown type.
4715 *
4716 * Since with the use of CIDs, the record content type
4717 * might change during decryption, re-check the record
4718 * content type, but treat a failure as fatal this time. */
4719 if( ssl_check_record_type( ssl->in_msgtype ) )
4720 {
4721 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
4722 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4723 }
4724#endif /* MBEDTLS_SSL_CID */
4725
Angus Grattond8213d02016-05-25 20:56:48 +10004726 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
Paul Bakker5121ce52009-01-03 21:22:43 +00004727 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004728 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4729 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00004730 }
Hanno Becker4c6876b2017-12-27 21:28:58 +00004731 else if( ssl->in_msglen == 0 )
4732 {
4733#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4734 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3
4735 && ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
4736 {
4737 /* TLS v1.2 explicitly disallows zero-length messages which are not application data */
4738 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid zero-length message type: %d", ssl->in_msgtype ) );
4739 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4740 }
4741#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4742
4743 ssl->nb_zero++;
4744
4745 /*
4746 * Three or more empty messages may be a DoS attack
4747 * (excessive CPU consumption).
4748 */
4749 if( ssl->nb_zero > 3 )
4750 {
4751 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
Hanno Becker70463db2019-05-08 10:38:32 +01004752 "messages, possible DoS attack" ) );
4753 /* Treat the records as if they were not properly authenticated,
4754 * thereby failing the connection if we see more than allowed
4755 * by the configured bad MAC threshold. */
Hanno Becker4c6876b2017-12-27 21:28:58 +00004756 return( MBEDTLS_ERR_SSL_INVALID_MAC );
4757 }
4758 }
4759 else
4760 ssl->nb_zero = 0;
4761
4762#if defined(MBEDTLS_SSL_PROTO_DTLS)
4763 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4764 {
4765 ; /* in_ctr read from peer, not maintained internally */
4766 }
4767 else
4768#endif
4769 {
4770 unsigned i;
4771 for( i = 8; i > ssl_ep_len( ssl ); i-- )
4772 if( ++ssl->in_ctr[i - 1] != 0 )
4773 break;
4774
4775 /* The loop goes to its end iff the counter is wrapping */
4776 if( i == ssl_ep_len( ssl ) )
4777 {
4778 MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
4779 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
4780 }
4781 }
4782
Paul Bakker5121ce52009-01-03 21:22:43 +00004783 }
4784
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004785#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00004786 if( ssl->transform_in != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004787 ssl->session_in->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00004788 {
4789 if( ( ret = ssl_decompress_buf( ssl ) ) != 0 )
4790 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004791 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00004792 return( ret );
4793 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00004794 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004795#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00004796
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004797#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004798 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02004799 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004800 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02004801 }
4802#endif
4803
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004804 return( 0 );
4805}
4806
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004807static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02004808
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004809/*
4810 * Read a record.
4811 *
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02004812 * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
4813 * RFC 6347 4.1.2.7) and continue reading until a valid record is found.
4814 *
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004815 */
Hanno Becker1097b342018-08-15 14:09:41 +01004816
4817/* Helper functions for mbedtls_ssl_read_record(). */
4818static int ssl_consume_current_message( mbedtls_ssl_context *ssl );
Hanno Beckere74d5562018-08-15 14:26:08 +01004819static int ssl_get_next_record( mbedtls_ssl_context *ssl );
4820static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl );
Hanno Becker4162b112018-08-15 14:05:04 +01004821
Hanno Becker327c93b2018-08-15 13:56:18 +01004822int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl,
Hanno Becker3a0aad12018-08-20 09:44:02 +01004823 unsigned update_hs_digest )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004824{
4825 int ret;
4826
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004827 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read record" ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004828
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004829 if( ssl->keep_current_message == 0 )
4830 {
4831 do {
Simon Butcher99000142016-10-13 17:21:01 +01004832
Hanno Becker26994592018-08-15 14:14:59 +01004833 ret = ssl_consume_current_message( ssl );
Hanno Becker90333da2017-10-10 11:27:13 +01004834 if( ret != 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004835 return( ret );
Hanno Becker26994592018-08-15 14:14:59 +01004836
Hanno Beckere74d5562018-08-15 14:26:08 +01004837 if( ssl_record_is_in_progress( ssl ) == 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004838 {
Hanno Becker40f50842018-08-15 14:48:01 +01004839#if defined(MBEDTLS_SSL_PROTO_DTLS)
4840 int have_buffered = 0;
Hanno Beckere74d5562018-08-15 14:26:08 +01004841
Hanno Becker40f50842018-08-15 14:48:01 +01004842 /* We only check for buffered messages if the
4843 * current datagram is fully consumed. */
4844 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Hanno Beckeref7afdf2018-08-28 17:16:31 +01004845 ssl_next_record_is_in_datagram( ssl ) == 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01004846 {
Hanno Becker40f50842018-08-15 14:48:01 +01004847 if( ssl_load_buffered_message( ssl ) == 0 )
4848 have_buffered = 1;
4849 }
4850
4851 if( have_buffered == 0 )
4852#endif /* MBEDTLS_SSL_PROTO_DTLS */
4853 {
4854 ret = ssl_get_next_record( ssl );
4855 if( ret == MBEDTLS_ERR_SSL_CONTINUE_PROCESSING )
4856 continue;
4857
4858 if( ret != 0 )
4859 {
Hanno Beckerc573ac32018-08-28 17:15:25 +01004860 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_get_next_record" ), ret );
Hanno Becker40f50842018-08-15 14:48:01 +01004861 return( ret );
4862 }
Hanno Beckere74d5562018-08-15 14:26:08 +01004863 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004864 }
4865
4866 ret = mbedtls_ssl_handle_message_type( ssl );
4867
Hanno Becker40f50842018-08-15 14:48:01 +01004868#if defined(MBEDTLS_SSL_PROTO_DTLS)
4869 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
4870 {
4871 /* Buffer future message */
4872 ret = ssl_buffer_message( ssl );
4873 if( ret != 0 )
4874 return( ret );
4875
4876 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
4877 }
4878#endif /* MBEDTLS_SSL_PROTO_DTLS */
4879
Hanno Becker90333da2017-10-10 11:27:13 +01004880 } while( MBEDTLS_ERR_SSL_NON_FATAL == ret ||
4881 MBEDTLS_ERR_SSL_CONTINUE_PROCESSING == ret );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004882
4883 if( 0 != ret )
Simon Butcher99000142016-10-13 17:21:01 +01004884 {
Hanno Becker05c4fc82017-11-09 14:34:06 +00004885 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_handle_message_type" ), ret );
Simon Butcher99000142016-10-13 17:21:01 +01004886 return( ret );
4887 }
4888
Hanno Becker327c93b2018-08-15 13:56:18 +01004889 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
Hanno Becker3a0aad12018-08-20 09:44:02 +01004890 update_hs_digest == 1 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004891 {
4892 mbedtls_ssl_update_handshake_status( ssl );
4893 }
Simon Butcher99000142016-10-13 17:21:01 +01004894 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004895 else
Simon Butcher99000142016-10-13 17:21:01 +01004896 {
Hanno Becker02f59072018-08-15 14:00:24 +01004897 MBEDTLS_SSL_DEBUG_MSG( 2, ( "reuse previously read message" ) );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004898 ssl->keep_current_message = 0;
Simon Butcher99000142016-10-13 17:21:01 +01004899 }
4900
4901 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );
4902
4903 return( 0 );
4904}
4905
Hanno Becker40f50842018-08-15 14:48:01 +01004906#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckeref7afdf2018-08-28 17:16:31 +01004907static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl )
Simon Butcher99000142016-10-13 17:21:01 +01004908{
Hanno Becker40f50842018-08-15 14:48:01 +01004909 if( ssl->in_left > ssl->next_record_offset )
4910 return( 1 );
Simon Butcher99000142016-10-13 17:21:01 +01004911
Hanno Becker40f50842018-08-15 14:48:01 +01004912 return( 0 );
4913}
4914
4915static int ssl_load_buffered_message( mbedtls_ssl_context *ssl )
4916{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004917 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker37f95322018-08-16 13:55:32 +01004918 mbedtls_ssl_hs_buffer * hs_buf;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004919 int ret = 0;
4920
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004921 if( hs == NULL )
4922 return( -1 );
4923
Hanno Beckere00ae372018-08-20 09:39:42 +01004924 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_messsage" ) );
4925
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004926 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC ||
4927 ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
4928 {
4929 /* Check if we have seen a ChangeCipherSpec before.
4930 * If yes, synthesize a CCS record. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01004931 if( !hs->buffering.seen_ccs )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004932 {
4933 MBEDTLS_SSL_DEBUG_MSG( 2, ( "CCS not seen in the current flight" ) );
4934 ret = -1;
Hanno Becker0d4b3762018-08-20 09:36:59 +01004935 goto exit;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004936 }
4937
Hanno Becker39b8bc92018-08-28 17:17:13 +01004938 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Injecting buffered CCS message" ) );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004939 ssl->in_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
4940 ssl->in_msglen = 1;
4941 ssl->in_msg[0] = 1;
4942
4943 /* As long as they are equal, the exact value doesn't matter. */
4944 ssl->in_left = 0;
4945 ssl->next_record_offset = 0;
4946
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01004947 hs->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004948 goto exit;
4949 }
Hanno Becker37f95322018-08-16 13:55:32 +01004950
Hanno Beckerb8f50142018-08-28 10:01:34 +01004951#if defined(MBEDTLS_DEBUG_C)
Hanno Becker37f95322018-08-16 13:55:32 +01004952 /* Debug only */
4953 {
4954 unsigned offset;
4955 for( offset = 1; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
4956 {
4957 hs_buf = &hs->buffering.hs[offset];
4958 if( hs_buf->is_valid == 1 )
4959 {
4960 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Future message with sequence number %u %s buffered.",
4961 hs->in_msg_seq + offset,
Hanno Beckera591c482018-08-28 17:20:00 +01004962 hs_buf->is_complete ? "fully" : "partially" ) );
Hanno Becker37f95322018-08-16 13:55:32 +01004963 }
4964 }
4965 }
Hanno Beckerb8f50142018-08-28 10:01:34 +01004966#endif /* MBEDTLS_DEBUG_C */
Hanno Becker37f95322018-08-16 13:55:32 +01004967
4968 /* Check if we have buffered and/or fully reassembled the
4969 * next handshake message. */
4970 hs_buf = &hs->buffering.hs[0];
4971 if( ( hs_buf->is_valid == 1 ) && ( hs_buf->is_complete == 1 ) )
4972 {
4973 /* Synthesize a record containing the buffered HS message. */
4974 size_t msg_len = ( hs_buf->data[1] << 16 ) |
4975 ( hs_buf->data[2] << 8 ) |
4976 hs_buf->data[3];
4977
4978 /* Double-check that we haven't accidentally buffered
4979 * a message that doesn't fit into the input buffer. */
4980 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
4981 {
4982 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4983 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4984 }
4985
4986 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message has been buffered - load" ) );
4987 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered handshake message (incl. header)",
4988 hs_buf->data, msg_len + 12 );
4989
4990 ssl->in_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4991 ssl->in_hslen = msg_len + 12;
4992 ssl->in_msglen = msg_len + 12;
4993 memcpy( ssl->in_msg, hs_buf->data, ssl->in_hslen );
4994
4995 ret = 0;
4996 goto exit;
4997 }
4998 else
4999 {
5000 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message %u not or only partially bufffered",
5001 hs->in_msg_seq ) );
5002 }
5003
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005004 ret = -1;
5005
5006exit:
5007
5008 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_message" ) );
5009 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01005010}
5011
Hanno Beckera02b0b42018-08-21 17:20:27 +01005012static int ssl_buffer_make_space( mbedtls_ssl_context *ssl,
5013 size_t desired )
5014{
5015 int offset;
5016 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker6e12c1e2018-08-24 14:39:15 +01005017 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Attempt to free buffered messages to have %u bytes available",
5018 (unsigned) desired ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01005019
Hanno Becker01315ea2018-08-21 17:22:17 +01005020 /* Get rid of future records epoch first, if such exist. */
5021 ssl_free_buffered_record( ssl );
5022
5023 /* Check if we have enough space available now. */
5024 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
5025 hs->buffering.total_bytes_buffered ) )
5026 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01005027 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing future epoch record" ) );
Hanno Becker01315ea2018-08-21 17:22:17 +01005028 return( 0 );
5029 }
Hanno Beckera02b0b42018-08-21 17:20:27 +01005030
Hanno Becker4f432ad2018-08-28 10:02:32 +01005031 /* We don't have enough space to buffer the next expected handshake
5032 * message. Remove buffers used for future messages to gain space,
5033 * starting with the most distant one. */
Hanno Beckera02b0b42018-08-21 17:20:27 +01005034 for( offset = MBEDTLS_SSL_MAX_BUFFERED_HS - 1;
5035 offset >= 0; offset-- )
5036 {
5037 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Free buffering slot %d to make space for reassembly of next handshake message",
5038 offset ) );
5039
Hanno Beckerb309b922018-08-23 13:18:05 +01005040 ssl_buffering_free_slot( ssl, (uint8_t) offset );
Hanno Beckera02b0b42018-08-21 17:20:27 +01005041
5042 /* Check if we have enough space available now. */
5043 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
5044 hs->buffering.total_bytes_buffered ) )
5045 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01005046 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing buffered HS messages" ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01005047 return( 0 );
5048 }
5049 }
5050
5051 return( -1 );
5052}
5053
Hanno Becker40f50842018-08-15 14:48:01 +01005054static int ssl_buffer_message( mbedtls_ssl_context *ssl )
5055{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005056 int ret = 0;
5057 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
5058
5059 if( hs == NULL )
5060 return( 0 );
5061
5062 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_buffer_message" ) );
5063
5064 switch( ssl->in_msgtype )
5065 {
5066 case MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC:
5067 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Remember CCS message" ) );
Hanno Beckere678eaa2018-08-21 14:57:46 +01005068
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01005069 hs->buffering.seen_ccs = 1;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005070 break;
5071
5072 case MBEDTLS_SSL_MSG_HANDSHAKE:
Hanno Becker37f95322018-08-16 13:55:32 +01005073 {
5074 unsigned recv_msg_seq_offset;
5075 unsigned recv_msg_seq = ( ssl->in_msg[4] << 8 ) | ssl->in_msg[5];
5076 mbedtls_ssl_hs_buffer *hs_buf;
5077 size_t msg_len = ssl->in_hslen - 12;
5078
5079 /* We should never receive an old handshake
5080 * message - double-check nonetheless. */
5081 if( recv_msg_seq < ssl->handshake->in_msg_seq )
5082 {
5083 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5084 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5085 }
5086
5087 recv_msg_seq_offset = recv_msg_seq - ssl->handshake->in_msg_seq;
5088 if( recv_msg_seq_offset >= MBEDTLS_SSL_MAX_BUFFERED_HS )
5089 {
5090 /* Silently ignore -- message too far in the future */
5091 MBEDTLS_SSL_DEBUG_MSG( 2,
5092 ( "Ignore future HS message with sequence number %u, "
5093 "buffering window %u - %u",
5094 recv_msg_seq, ssl->handshake->in_msg_seq,
5095 ssl->handshake->in_msg_seq + MBEDTLS_SSL_MAX_BUFFERED_HS - 1 ) );
5096
5097 goto exit;
5098 }
5099
5100 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering HS message with sequence number %u, offset %u ",
5101 recv_msg_seq, recv_msg_seq_offset ) );
5102
5103 hs_buf = &hs->buffering.hs[ recv_msg_seq_offset ];
5104
5105 /* Check if the buffering for this seq nr has already commenced. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01005106 if( !hs_buf->is_valid )
Hanno Becker37f95322018-08-16 13:55:32 +01005107 {
Hanno Becker2a97b0e2018-08-21 15:47:49 +01005108 size_t reassembly_buf_sz;
5109
Hanno Becker37f95322018-08-16 13:55:32 +01005110 hs_buf->is_fragmented =
5111 ( ssl_hs_is_proper_fragment( ssl ) == 1 );
5112
5113 /* We copy the message back into the input buffer
5114 * after reassembly, so check that it's not too large.
5115 * This is an implementation-specific limitation
5116 * and not one from the standard, hence it is not
5117 * checked in ssl_check_hs_header(). */
Hanno Becker96a6c692018-08-21 15:56:03 +01005118 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
Hanno Becker37f95322018-08-16 13:55:32 +01005119 {
5120 /* Ignore message */
5121 goto exit;
5122 }
5123
Hanno Beckere0b150f2018-08-21 15:51:03 +01005124 /* Check if we have enough space to buffer the message. */
5125 if( hs->buffering.total_bytes_buffered >
5126 MBEDTLS_SSL_DTLS_MAX_BUFFERING )
5127 {
5128 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5129 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5130 }
5131
Hanno Becker2a97b0e2018-08-21 15:47:49 +01005132 reassembly_buf_sz = ssl_get_reassembly_buffer_size( msg_len,
5133 hs_buf->is_fragmented );
Hanno Beckere0b150f2018-08-21 15:51:03 +01005134
5135 if( reassembly_buf_sz > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
5136 hs->buffering.total_bytes_buffered ) )
5137 {
5138 if( recv_msg_seq_offset > 0 )
5139 {
5140 /* If we can't buffer a future message because
5141 * of space limitations -- ignore. */
5142 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
5143 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
5144 (unsigned) hs->buffering.total_bytes_buffered ) );
5145 goto exit;
5146 }
Hanno Beckere1801392018-08-21 16:51:05 +01005147 else
5148 {
5149 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- attempt to make space by freeing buffered future messages\n",
5150 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
5151 (unsigned) hs->buffering.total_bytes_buffered ) );
5152 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01005153
Hanno Beckera02b0b42018-08-21 17:20:27 +01005154 if( ssl_buffer_make_space( ssl, reassembly_buf_sz ) != 0 )
Hanno Becker55e9e2a2018-08-21 16:07:55 +01005155 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01005156 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reassembly of next message of size %u (%u with bitmap) would exceed the compile-time limit %u (already %u bytes buffered) -- fail\n",
5157 (unsigned) msg_len,
5158 (unsigned) reassembly_buf_sz,
5159 MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Hanno Beckere0b150f2018-08-21 15:51:03 +01005160 (unsigned) hs->buffering.total_bytes_buffered ) );
Hanno Becker55e9e2a2018-08-21 16:07:55 +01005161 ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
5162 goto exit;
5163 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01005164 }
5165
5166 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %d",
5167 msg_len ) );
5168
Hanno Becker2a97b0e2018-08-21 15:47:49 +01005169 hs_buf->data = mbedtls_calloc( 1, reassembly_buf_sz );
5170 if( hs_buf->data == NULL )
Hanno Becker37f95322018-08-16 13:55:32 +01005171 {
Hanno Beckere0b150f2018-08-21 15:51:03 +01005172 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
Hanno Becker37f95322018-08-16 13:55:32 +01005173 goto exit;
5174 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01005175 hs_buf->data_len = reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01005176
5177 /* Prepare final header: copy msg_type, length and message_seq,
5178 * then add standardised fragment_offset and fragment_length */
5179 memcpy( hs_buf->data, ssl->in_msg, 6 );
5180 memset( hs_buf->data + 6, 0, 3 );
5181 memcpy( hs_buf->data + 9, hs_buf->data + 1, 3 );
5182
5183 hs_buf->is_valid = 1;
Hanno Beckere0b150f2018-08-21 15:51:03 +01005184
5185 hs->buffering.total_bytes_buffered += reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01005186 }
5187 else
5188 {
5189 /* Make sure msg_type and length are consistent */
5190 if( memcmp( hs_buf->data, ssl->in_msg, 4 ) != 0 )
5191 {
5192 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Fragment header mismatch - ignore" ) );
5193 /* Ignore */
5194 goto exit;
5195 }
5196 }
5197
Hanno Becker4422bbb2018-08-20 09:40:19 +01005198 if( !hs_buf->is_complete )
Hanno Becker37f95322018-08-16 13:55:32 +01005199 {
5200 size_t frag_len, frag_off;
5201 unsigned char * const msg = hs_buf->data + 12;
5202
5203 /*
5204 * Check and copy current fragment
5205 */
5206
5207 /* Validation of header fields already done in
5208 * mbedtls_ssl_prepare_handshake_record(). */
5209 frag_off = ssl_get_hs_frag_off( ssl );
5210 frag_len = ssl_get_hs_frag_len( ssl );
5211
5212 MBEDTLS_SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %d, length = %d",
5213 frag_off, frag_len ) );
5214 memcpy( msg + frag_off, ssl->in_msg + 12, frag_len );
5215
5216 if( hs_buf->is_fragmented )
5217 {
5218 unsigned char * const bitmask = msg + msg_len;
5219 ssl_bitmask_set( bitmask, frag_off, frag_len );
5220 hs_buf->is_complete = ( ssl_bitmask_check( bitmask,
5221 msg_len ) == 0 );
5222 }
5223 else
5224 {
5225 hs_buf->is_complete = 1;
5226 }
5227
5228 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message %scomplete",
5229 hs_buf->is_complete ? "" : "not yet " ) );
5230 }
5231
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005232 break;
Hanno Becker37f95322018-08-16 13:55:32 +01005233 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005234
5235 default:
Hanno Becker360bef32018-08-28 10:04:33 +01005236 /* We don't buffer other types of messages. */
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005237 break;
5238 }
5239
5240exit:
5241
5242 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_buffer_message" ) );
5243 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01005244}
5245#endif /* MBEDTLS_SSL_PROTO_DTLS */
5246
Hanno Becker1097b342018-08-15 14:09:41 +01005247static int ssl_consume_current_message( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005248{
Hanno Becker4a810fb2017-05-24 16:27:30 +01005249 /*
Hanno Becker4a810fb2017-05-24 16:27:30 +01005250 * Consume last content-layer message and potentially
5251 * update in_msglen which keeps track of the contents'
5252 * consumption state.
5253 *
5254 * (1) Handshake messages:
5255 * Remove last handshake message, move content
5256 * and adapt in_msglen.
5257 *
5258 * (2) Alert messages:
5259 * Consume whole record content, in_msglen = 0.
5260 *
Hanno Becker4a810fb2017-05-24 16:27:30 +01005261 * (3) Change cipher spec:
5262 * Consume whole record content, in_msglen = 0.
5263 *
5264 * (4) Application data:
5265 * Don't do anything - the record layer provides
5266 * the application data as a stream transport
5267 * and consumes through mbedtls_ssl_read only.
5268 *
5269 */
5270
5271 /* Case (1): Handshake messages */
5272 if( ssl->in_hslen != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005273 {
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01005274 /* Hard assertion to be sure that no application data
5275 * is in flight, as corrupting ssl->in_msglen during
5276 * ssl->in_offt != NULL is fatal. */
5277 if( ssl->in_offt != NULL )
5278 {
5279 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5280 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5281 }
5282
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005283 /*
5284 * Get next Handshake message in the current record
5285 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005286
Hanno Becker4a810fb2017-05-24 16:27:30 +01005287 /* Notes:
Hanno Beckere72489d2017-10-23 13:23:50 +01005288 * (1) in_hslen is not necessarily the size of the
Hanno Becker4a810fb2017-05-24 16:27:30 +01005289 * current handshake content: If DTLS handshake
5290 * fragmentation is used, that's the fragment
5291 * size instead. Using the total handshake message
Hanno Beckere72489d2017-10-23 13:23:50 +01005292 * size here is faulty and should be changed at
5293 * some point.
Hanno Becker4a810fb2017-05-24 16:27:30 +01005294 * (2) While it doesn't seem to cause problems, one
5295 * has to be very careful not to assume that in_hslen
5296 * is always <= in_msglen in a sensible communication.
5297 * Again, it's wrong for DTLS handshake fragmentation.
5298 * The following check is therefore mandatory, and
5299 * should not be treated as a silently corrected assertion.
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01005300 * Additionally, ssl->in_hslen might be arbitrarily out of
5301 * bounds after handling a DTLS message with an unexpected
5302 * sequence number, see mbedtls_ssl_prepare_handshake_record.
Hanno Becker4a810fb2017-05-24 16:27:30 +01005303 */
5304 if( ssl->in_hslen < ssl->in_msglen )
5305 {
5306 ssl->in_msglen -= ssl->in_hslen;
5307 memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
5308 ssl->in_msglen );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005309
Hanno Becker4a810fb2017-05-24 16:27:30 +01005310 MBEDTLS_SSL_DEBUG_BUF( 4, "remaining content in record",
5311 ssl->in_msg, ssl->in_msglen );
5312 }
5313 else
5314 {
5315 ssl->in_msglen = 0;
5316 }
Manuel Pégourié-Gonnard4a175362014-09-09 17:45:31 +02005317
Hanno Becker4a810fb2017-05-24 16:27:30 +01005318 ssl->in_hslen = 0;
5319 }
5320 /* Case (4): Application data */
5321 else if( ssl->in_offt != NULL )
5322 {
5323 return( 0 );
5324 }
5325 /* Everything else (CCS & Alerts) */
5326 else
5327 {
5328 ssl->in_msglen = 0;
5329 }
5330
Hanno Becker1097b342018-08-15 14:09:41 +01005331 return( 0 );
5332}
Hanno Becker4a810fb2017-05-24 16:27:30 +01005333
Hanno Beckere74d5562018-08-15 14:26:08 +01005334static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl )
5335{
Hanno Becker4a810fb2017-05-24 16:27:30 +01005336 if( ssl->in_msglen > 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01005337 return( 1 );
5338
5339 return( 0 );
5340}
5341
Hanno Becker5f066e72018-08-16 14:56:31 +01005342#if defined(MBEDTLS_SSL_PROTO_DTLS)
5343
5344static void ssl_free_buffered_record( mbedtls_ssl_context *ssl )
5345{
5346 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
5347 if( hs == NULL )
5348 return;
5349
Hanno Becker01315ea2018-08-21 17:22:17 +01005350 if( hs->buffering.future_record.data != NULL )
Hanno Becker4a810fb2017-05-24 16:27:30 +01005351 {
Hanno Becker01315ea2018-08-21 17:22:17 +01005352 hs->buffering.total_bytes_buffered -=
5353 hs->buffering.future_record.len;
5354
5355 mbedtls_free( hs->buffering.future_record.data );
5356 hs->buffering.future_record.data = NULL;
5357 }
Hanno Becker5f066e72018-08-16 14:56:31 +01005358}
5359
5360static int ssl_load_buffered_record( mbedtls_ssl_context *ssl )
5361{
5362 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
5363 unsigned char * rec;
5364 size_t rec_len;
5365 unsigned rec_epoch;
5366
5367 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
5368 return( 0 );
5369
5370 if( hs == NULL )
5371 return( 0 );
5372
Hanno Becker5f066e72018-08-16 14:56:31 +01005373 rec = hs->buffering.future_record.data;
5374 rec_len = hs->buffering.future_record.len;
5375 rec_epoch = hs->buffering.future_record.epoch;
5376
5377 if( rec == NULL )
5378 return( 0 );
5379
Hanno Becker4cb782d2018-08-20 11:19:05 +01005380 /* Only consider loading future records if the
5381 * input buffer is empty. */
Hanno Beckeref7afdf2018-08-28 17:16:31 +01005382 if( ssl_next_record_is_in_datagram( ssl ) == 1 )
Hanno Becker4cb782d2018-08-20 11:19:05 +01005383 return( 0 );
5384
Hanno Becker5f066e72018-08-16 14:56:31 +01005385 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_record" ) );
5386
5387 if( rec_epoch != ssl->in_epoch )
5388 {
5389 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffered record not from current epoch." ) );
5390 goto exit;
5391 }
5392
5393 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Found buffered record from current epoch - load" ) );
5394
5395 /* Double-check that the record is not too large */
5396 if( rec_len > MBEDTLS_SSL_IN_BUFFER_LEN -
5397 (size_t)( ssl->in_hdr - ssl->in_buf ) )
5398 {
5399 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5400 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
5401 }
5402
5403 memcpy( ssl->in_hdr, rec, rec_len );
5404 ssl->in_left = rec_len;
5405 ssl->next_record_offset = 0;
5406
5407 ssl_free_buffered_record( ssl );
5408
5409exit:
5410 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_record" ) );
5411 return( 0 );
5412}
5413
5414static int ssl_buffer_future_record( mbedtls_ssl_context *ssl )
5415{
5416 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
5417 size_t const rec_hdr_len = 13;
Hanno Becker01315ea2018-08-21 17:22:17 +01005418 size_t const total_buf_sz = rec_hdr_len + ssl->in_msglen;
Hanno Becker5f066e72018-08-16 14:56:31 +01005419
5420 /* Don't buffer future records outside handshakes. */
5421 if( hs == NULL )
5422 return( 0 );
5423
5424 /* Only buffer handshake records (we are only interested
5425 * in Finished messages). */
5426 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
5427 return( 0 );
5428
5429 /* Don't buffer more than one future epoch record. */
5430 if( hs->buffering.future_record.data != NULL )
5431 return( 0 );
5432
Hanno Becker01315ea2018-08-21 17:22:17 +01005433 /* Don't buffer record if there's not enough buffering space remaining. */
5434 if( total_buf_sz > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
5435 hs->buffering.total_bytes_buffered ) )
5436 {
5437 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future epoch record of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
5438 (unsigned) total_buf_sz, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
5439 (unsigned) hs->buffering.total_bytes_buffered ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005440 return( 0 );
5441 }
5442
Hanno Becker5f066e72018-08-16 14:56:31 +01005443 /* Buffer record */
5444 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffer record from epoch %u",
5445 ssl->in_epoch + 1 ) );
5446 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered record", ssl->in_hdr,
5447 rec_hdr_len + ssl->in_msglen );
5448
5449 /* ssl_parse_record_header() only considers records
5450 * of the next epoch as candidates for buffering. */
5451 hs->buffering.future_record.epoch = ssl->in_epoch + 1;
Hanno Becker01315ea2018-08-21 17:22:17 +01005452 hs->buffering.future_record.len = total_buf_sz;
Hanno Becker5f066e72018-08-16 14:56:31 +01005453
5454 hs->buffering.future_record.data =
5455 mbedtls_calloc( 1, hs->buffering.future_record.len );
5456 if( hs->buffering.future_record.data == NULL )
5457 {
5458 /* If we run out of RAM trying to buffer a
5459 * record from the next epoch, just ignore. */
5460 return( 0 );
5461 }
5462
Hanno Becker01315ea2018-08-21 17:22:17 +01005463 memcpy( hs->buffering.future_record.data, ssl->in_hdr, total_buf_sz );
Hanno Becker5f066e72018-08-16 14:56:31 +01005464
Hanno Becker01315ea2018-08-21 17:22:17 +01005465 hs->buffering.total_bytes_buffered += total_buf_sz;
Hanno Becker5f066e72018-08-16 14:56:31 +01005466 return( 0 );
5467}
5468
5469#endif /* MBEDTLS_SSL_PROTO_DTLS */
5470
Hanno Beckere74d5562018-08-15 14:26:08 +01005471static int ssl_get_next_record( mbedtls_ssl_context *ssl )
Hanno Becker1097b342018-08-15 14:09:41 +01005472{
5473 int ret;
5474
Hanno Becker5f066e72018-08-16 14:56:31 +01005475#if defined(MBEDTLS_SSL_PROTO_DTLS)
5476 /* We might have buffered a future record; if so,
5477 * and if the epoch matches now, load it.
5478 * On success, this call will set ssl->in_left to
5479 * the length of the buffered record, so that
5480 * the calls to ssl_fetch_input() below will
5481 * essentially be no-ops. */
5482 ret = ssl_load_buffered_record( ssl );
5483 if( ret != 0 )
5484 return( ret );
5485#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Becker4a810fb2017-05-24 16:27:30 +01005486
Hanno Becker8b09b732019-05-08 12:03:28 +01005487 /* Reset in pointers to default state for TLS/DTLS records,
5488 * assuming no CID and no offset between record content and
5489 * record plaintext. */
5490 ssl_update_in_pointers( ssl );
5491
5492 /* Ensure that we have enough space available for the default form
5493 * of TLS / DTLS record headers (5 Bytes for TLS, 13 Bytes for DTLS,
5494 * with no space for CIDs counted in). */
5495 ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_in_hdr_len( ssl ) );
5496 if( ret != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005497 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005498 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005499 return( ret );
5500 }
5501
5502 if( ( ret = ssl_parse_record_header( ssl ) ) != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005503 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005504#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardbe619c12015-09-08 11:21:21 +02005505 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5506 ret != MBEDTLS_ERR_SSL_CLIENT_RECONNECT )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005507 {
Hanno Becker5f066e72018-08-16 14:56:31 +01005508 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
5509 {
5510 ret = ssl_buffer_future_record( ssl );
5511 if( ret != 0 )
5512 return( ret );
5513
5514 /* Fall through to handling of unexpected records */
5515 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
5516 }
5517
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005518 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD )
5519 {
5520 /* Skip unexpected record (but not whole datagram) */
5521 ssl->next_record_offset = ssl->in_msglen
Hanno Becker43395762019-05-03 14:46:38 +01005522 + mbedtls_ssl_in_hdr_len( ssl );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005523
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005524 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding unexpected record "
5525 "(header)" ) );
5526 }
5527 else
5528 {
5529 /* Skip invalid record and the rest of the datagram */
5530 ssl->next_record_offset = 0;
5531 ssl->in_left = 0;
5532
5533 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record "
5534 "(header)" ) );
5535 }
5536
5537 /* Get next record */
Hanno Becker90333da2017-10-10 11:27:13 +01005538 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005539 }
5540#endif
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005541 return( ret );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005542 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005543
5544 /*
5545 * Read and optionally decrypt the message contents
5546 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005547 if( ( ret = mbedtls_ssl_fetch_input( ssl,
Hanno Becker43395762019-05-03 14:46:38 +01005548 mbedtls_ssl_in_hdr_len( ssl ) + ssl->in_msglen ) ) != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005549 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005550 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005551 return( ret );
5552 }
5553
5554 /* Done reading this record, get ready for the next one */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005555#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005556 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Hanno Beckere65ce782017-05-22 14:47:48 +01005557 {
Hanno Becker43395762019-05-03 14:46:38 +01005558 ssl->next_record_offset = ssl->in_msglen + mbedtls_ssl_in_hdr_len( ssl );
Hanno Beckere65ce782017-05-22 14:47:48 +01005559 if( ssl->next_record_offset < ssl->in_left )
5560 {
5561 MBEDTLS_SSL_DEBUG_MSG( 3, ( "more than one record within datagram" ) );
5562 }
5563 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005564 else
5565#endif
5566 ssl->in_left = 0;
5567
5568 if( ( ret = ssl_prepare_record_content( ssl ) ) != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005569 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005570#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005571 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005572 {
5573 /* Silently discard invalid records */
Hanno Becker16e9ae22019-05-03 16:36:59 +01005574 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005575 {
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02005576 /* Except when waiting for Finished as a bad mac here
5577 * probably means something went wrong in the handshake
5578 * (eg wrong psk used, mitm downgrade attempt, etc.) */
5579 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED ||
5580 ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
5581 {
5582#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
5583 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
5584 {
5585 mbedtls_ssl_send_alert_message( ssl,
5586 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5587 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
5588 }
5589#endif
5590 return( ret );
5591 }
5592
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005593#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005594 if( ssl->conf->badmac_limit != 0 &&
5595 ++ssl->badmac_seen >= ssl->conf->badmac_limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02005596 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005597 MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
5598 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02005599 }
5600#endif
5601
Hanno Becker4a810fb2017-05-24 16:27:30 +01005602 /* As above, invalid records cause
5603 * dismissal of the whole datagram. */
5604
5605 ssl->next_record_offset = 0;
5606 ssl->in_left = 0;
5607
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005608 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
Hanno Becker90333da2017-10-10 11:27:13 +01005609 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005610 }
5611
5612 return( ret );
5613 }
5614 else
5615#endif
5616 {
5617 /* Error out (and send alert) on invalid records */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005618#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
5619 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005620 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005621 mbedtls_ssl_send_alert_message( ssl,
5622 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5623 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005624 }
5625#endif
5626 return( ret );
5627 }
5628 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005629
Simon Butcher99000142016-10-13 17:21:01 +01005630 return( 0 );
5631}
5632
5633int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl )
5634{
5635 int ret;
5636
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005637 /*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005638 * Handle particular types of records
5639 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005640 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00005641 {
Simon Butcher99000142016-10-13 17:21:01 +01005642 if( ( ret = mbedtls_ssl_prepare_handshake_record( ssl ) ) != 0 )
5643 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005644 return( ret );
Simon Butcher99000142016-10-13 17:21:01 +01005645 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005646 }
5647
Hanno Beckere678eaa2018-08-21 14:57:46 +01005648 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005649 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01005650 if( ssl->in_msglen != 1 )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005651 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01005652 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, len: %d",
5653 ssl->in_msglen ) );
5654 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005655 }
5656
Hanno Beckere678eaa2018-08-21 14:57:46 +01005657 if( ssl->in_msg[0] != 1 )
5658 {
5659 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, content: %02x",
5660 ssl->in_msg[0] ) );
5661 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5662 }
5663
5664#if defined(MBEDTLS_SSL_PROTO_DTLS)
5665 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5666 ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
5667 ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
5668 {
5669 if( ssl->handshake == NULL )
5670 {
5671 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping ChangeCipherSpec outside handshake" ) );
5672 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
5673 }
5674
5675 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received out-of-order ChangeCipherSpec - remember" ) );
5676 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
5677 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005678#endif
Hanno Beckere678eaa2018-08-21 14:57:46 +01005679 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005680
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005681 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Paul Bakker5121ce52009-01-03 21:22:43 +00005682 {
Angus Gratton1a7a17e2018-06-20 15:43:50 +10005683 if( ssl->in_msglen != 2 )
5684 {
5685 /* Note: Standard allows for more than one 2 byte alert
5686 to be packed in a single message, but Mbed TLS doesn't
5687 currently support this. */
5688 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid alert message, len: %d",
5689 ssl->in_msglen ) );
5690 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5691 }
5692
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005693 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]",
Paul Bakker5121ce52009-01-03 21:22:43 +00005694 ssl->in_msg[0], ssl->in_msg[1] ) );
5695
5696 /*
Simon Butcher459a9502015-10-27 16:09:03 +00005697 * Ignore non-fatal alerts, except close_notify and no_renegotiation
Paul Bakker5121ce52009-01-03 21:22:43 +00005698 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005699 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005700 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005701 MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
Paul Bakker2770fbd2012-07-03 13:30:23 +00005702 ssl->in_msg[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005703 return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005704 }
5705
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005706 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
5707 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00005708 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005709 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
5710 return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00005711 }
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02005712
5713#if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
5714 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
5715 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION )
5716 {
Hanno Becker90333da2017-10-10 11:27:13 +01005717 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no renegotiation alert" ) );
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02005718 /* Will be handled when trying to parse ServerHello */
5719 return( 0 );
5720 }
5721#endif
5722
5723#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_SRV_C)
5724 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
5725 ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
5726 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
5727 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
5728 {
5729 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
5730 /* Will be handled in mbedtls_ssl_parse_certificate() */
5731 return( 0 );
5732 }
5733#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
5734
5735 /* Silently ignore: fetch new message */
Simon Butcher99000142016-10-13 17:21:01 +01005736 return MBEDTLS_ERR_SSL_NON_FATAL;
Paul Bakker5121ce52009-01-03 21:22:43 +00005737 }
5738
Hanno Beckerc76c6192017-06-06 10:03:17 +01005739#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker74dd3a72019-05-03 16:54:26 +01005740 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Hanno Beckerc76c6192017-06-06 10:03:17 +01005741 {
Hanno Becker74dd3a72019-05-03 16:54:26 +01005742 /* Drop unexpected ApplicationData records,
5743 * except at the beginning of renegotiations */
5744 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA &&
5745 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER
5746#if defined(MBEDTLS_SSL_RENEGOTIATION)
5747 && ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
5748 ssl->state == MBEDTLS_SSL_SERVER_HELLO )
Hanno Beckerc76c6192017-06-06 10:03:17 +01005749#endif
Hanno Becker74dd3a72019-05-03 16:54:26 +01005750 )
5751 {
5752 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
5753 return( MBEDTLS_ERR_SSL_NON_FATAL );
5754 }
5755
5756 if( ssl->handshake != NULL &&
5757 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
5758 {
5759 ssl_handshake_wrapup_free_hs_transform( ssl );
5760 }
5761 }
Hanno Beckerf65ad822019-05-08 16:26:21 +01005762#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Beckerc76c6192017-06-06 10:03:17 +01005763
Paul Bakker5121ce52009-01-03 21:22:43 +00005764 return( 0 );
5765}
5766
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005767int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00005768{
5769 int ret;
5770
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005771 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
5772 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5773 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00005774 {
5775 return( ret );
5776 }
5777
5778 return( 0 );
5779}
5780
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005781int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
Paul Bakker0a925182012-04-16 06:46:41 +00005782 unsigned char level,
5783 unsigned char message )
5784{
5785 int ret;
5786
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005787 if( ssl == NULL || ssl->conf == NULL )
5788 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5789
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005790 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005791 MBEDTLS_SSL_DEBUG_MSG( 3, ( "send alert level=%u message=%u", level, message ));
Paul Bakker0a925182012-04-16 06:46:41 +00005792
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005793 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
Paul Bakker0a925182012-04-16 06:46:41 +00005794 ssl->out_msglen = 2;
5795 ssl->out_msg[0] = level;
5796 ssl->out_msg[1] = message;
5797
Hanno Becker67bc7c32018-08-06 11:33:50 +01005798 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Paul Bakker0a925182012-04-16 06:46:41 +00005799 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005800 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker0a925182012-04-16 06:46:41 +00005801 return( ret );
5802 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005803 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
Paul Bakker0a925182012-04-16 06:46:41 +00005804
5805 return( 0 );
5806}
5807
Paul Bakker5121ce52009-01-03 21:22:43 +00005808/*
5809 * Handshake functions
5810 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005811#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
5812 !defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) && \
5813 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
5814 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
5815 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \
5816 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
5817 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
Gilles Peskinef9828522017-05-03 12:28:43 +02005818/* No certificate support -> dummy functions */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005819int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00005820{
Hanno Becker8759e162017-12-27 21:34:08 +00005821 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00005822
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005823 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005824
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005825 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
5826 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02005827 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
5828 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02005829 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005830 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02005831 ssl->state++;
5832 return( 0 );
5833 }
5834
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005835 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5836 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005837}
5838
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005839int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005840{
Hanno Becker8759e162017-12-27 21:34:08 +00005841 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->handshake->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005842
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005843 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005844
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005845 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
5846 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02005847 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
5848 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005849 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005850 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005851 ssl->state++;
5852 return( 0 );
5853 }
5854
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005855 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5856 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005857}
Gilles Peskinef9828522017-05-03 12:28:43 +02005858
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005859#else
Gilles Peskinef9828522017-05-03 12:28:43 +02005860/* Some certificate support -> implement write and parse */
5861
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005862int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005863{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005864 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005865 size_t i, n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005866 const mbedtls_x509_crt *crt;
Hanno Becker8759e162017-12-27 21:34:08 +00005867 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->handshake->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005868
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005869 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005870
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005871 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
5872 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02005873 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
5874 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005875 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005876 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005877 ssl->state++;
5878 return( 0 );
5879 }
5880
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005881#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005882 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00005883 {
5884 if( ssl->client_auth == 0 )
5885 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005886 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005887 ssl->state++;
5888 return( 0 );
5889 }
5890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005891#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00005892 /*
5893 * If using SSLv3 and got no cert, send an Alert message
5894 * (otherwise an empty Certificate message will be sent).
5895 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005896 if( mbedtls_ssl_own_cert( ssl ) == NULL &&
5897 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005898 {
5899 ssl->out_msglen = 2;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005900 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
5901 ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING;
5902 ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT;
Paul Bakker5121ce52009-01-03 21:22:43 +00005903
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005904 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005905 goto write_msg;
5906 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005907#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00005908 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005909#endif /* MBEDTLS_SSL_CLI_C */
5910#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005911 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00005912 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005913 if( mbedtls_ssl_own_cert( ssl ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005914 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005915 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
5916 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED );
Paul Bakker5121ce52009-01-03 21:22:43 +00005917 }
5918 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01005919#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00005920
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005921 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005922
5923 /*
5924 * 0 . 0 handshake type
5925 * 1 . 3 handshake length
5926 * 4 . 6 length of all certs
5927 * 7 . 9 length of cert. 1
5928 * 10 . n-1 peer certificate
5929 * n . n+2 length of cert. 2
5930 * n+3 . ... upper level cert, etc.
5931 */
5932 i = 7;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005933 crt = mbedtls_ssl_own_cert( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00005934
Paul Bakker29087132010-03-21 21:03:34 +00005935 while( crt != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005936 {
5937 n = crt->raw.len;
Angus Grattond8213d02016-05-25 20:56:48 +10005938 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
Paul Bakker5121ce52009-01-03 21:22:43 +00005939 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005940 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
Angus Grattond8213d02016-05-25 20:56:48 +10005941 i + 3 + n, MBEDTLS_SSL_OUT_CONTENT_LEN ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005942 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005943 }
5944
5945 ssl->out_msg[i ] = (unsigned char)( n >> 16 );
5946 ssl->out_msg[i + 1] = (unsigned char)( n >> 8 );
5947 ssl->out_msg[i + 2] = (unsigned char)( n );
5948
5949 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
5950 i += n; crt = crt->next;
5951 }
5952
5953 ssl->out_msg[4] = (unsigned char)( ( i - 7 ) >> 16 );
5954 ssl->out_msg[5] = (unsigned char)( ( i - 7 ) >> 8 );
5955 ssl->out_msg[6] = (unsigned char)( ( i - 7 ) );
5956
5957 ssl->out_msglen = i;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005958 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5959 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
Paul Bakker5121ce52009-01-03 21:22:43 +00005960
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02005961#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00005962write_msg:
Paul Bakkerd2f068e2013-08-27 21:19:20 +02005963#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00005964
5965 ssl->state++;
5966
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02005967 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005968 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02005969 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005970 return( ret );
5971 }
5972
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005973 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005974
Paul Bakkered27a042013-04-18 22:46:23 +02005975 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005976}
5977
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02005978/*
5979 * Once the certificate message is read, parse it into a cert chain and
5980 * perform basic checks, but leave actual verification to the caller
5981 */
5982static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00005983{
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02005984 int ret;
Paul Bakker23986e52011-04-24 08:57:21 +00005985 size_t i, n;
Gilles Peskine064a85c2017-05-10 10:46:40 +02005986 uint8_t alert;
Paul Bakker5121ce52009-01-03 21:22:43 +00005987
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005988#if defined(MBEDTLS_SSL_SRV_C)
5989#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00005990 /*
5991 * Check if the client sent an empty certificate
5992 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005993 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005994 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005995 {
Paul Bakker2e11f7d2010-07-25 14:24:53 +00005996 if( ssl->in_msglen == 2 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005997 ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT &&
5998 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
5999 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
Paul Bakker5121ce52009-01-03 21:22:43 +00006000 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006001 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006002
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006003 /* The client was asked for a certificate but didn't send
6004 one. The client should know what's going on, so we
6005 don't send an alert. */
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01006006 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02006007 return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00006008 }
6009 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006010#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00006011
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006012#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
6013 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006014 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006015 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006016 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006017 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
6018 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
6019 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
6020 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006021 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006022 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006023
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006024 /* The client was asked for a certificate but didn't send
6025 one. The client should know what's going on, so we
6026 don't send an alert. */
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01006027 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02006028 return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00006029 }
6030 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006031#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
6032 MBEDTLS_SSL_PROTO_TLS1_2 */
6033#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00006034
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006035 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00006036 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006037 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006038 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6039 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006040 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00006041 }
6042
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006043 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE ||
6044 ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006045 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006046 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006047 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6048 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006049 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00006050 }
6051
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006052 i = mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00006053
Paul Bakker5121ce52009-01-03 21:22:43 +00006054 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006055 * Same message structure as in mbedtls_ssl_write_certificate()
Paul Bakker5121ce52009-01-03 21:22:43 +00006056 */
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00006057 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
Paul Bakker5121ce52009-01-03 21:22:43 +00006058
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00006059 if( ssl->in_msg[i] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006060 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00006061 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006062 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006063 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6064 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006065 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00006066 }
6067
Manuel Pégourié-Gonnardbfb355c2013-09-07 17:27:43 +02006068 /* In case we tried to reuse a session but it failed */
6069 if( ssl->session_negotiate->peer_cert != NULL )
6070 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006071 mbedtls_x509_crt_free( ssl->session_negotiate->peer_cert );
6072 mbedtls_free( ssl->session_negotiate->peer_cert );
Manuel Pégourié-Gonnardbfb355c2013-09-07 17:27:43 +02006073 }
6074
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02006075 if( ( ssl->session_negotiate->peer_cert = mbedtls_calloc( 1,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006076 sizeof( mbedtls_x509_crt ) ) ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00006077 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02006078 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006079 sizeof( mbedtls_x509_crt ) ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006080 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6081 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02006082 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker5121ce52009-01-03 21:22:43 +00006083 }
6084
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006085 mbedtls_x509_crt_init( ssl->session_negotiate->peer_cert );
Paul Bakker5121ce52009-01-03 21:22:43 +00006086
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00006087 i += 3;
Paul Bakker5121ce52009-01-03 21:22:43 +00006088
6089 while( i < ssl->in_hslen )
6090 {
Philippe Antoine747fd532018-05-30 09:13:21 +02006091 if ( i + 3 > ssl->in_hslen ) {
6092 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
6093 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6094 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
6095 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
6096 }
Paul Bakker5121ce52009-01-03 21:22:43 +00006097 if( ssl->in_msg[i] != 0 )
6098 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006099 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006100 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6101 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006102 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00006103 }
6104
6105 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
6106 | (unsigned int) ssl->in_msg[i + 2];
6107 i += 3;
6108
6109 if( n < 128 || i + n > ssl->in_hslen )
6110 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006111 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006112 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6113 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006114 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00006115 }
6116
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006117 ret = mbedtls_x509_crt_parse_der( ssl->session_negotiate->peer_cert,
Paul Bakkerddf26b42013-09-18 13:46:23 +02006118 ssl->in_msg + i, n );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006119 switch( ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00006120 {
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006121 case 0: /*ok*/
6122 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
6123 /* Ignore certificate with an unknown algorithm: maybe a
6124 prior certificate was already trusted. */
6125 break;
6126
6127 case MBEDTLS_ERR_X509_ALLOC_FAILED:
6128 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
6129 goto crt_parse_der_failed;
6130
6131 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
6132 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6133 goto crt_parse_der_failed;
6134
6135 default:
6136 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
6137 crt_parse_der_failed:
6138 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006139 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00006140 return( ret );
6141 }
6142
6143 i += n;
6144 }
6145
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006146 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", ssl->session_negotiate->peer_cert );
Paul Bakker5121ce52009-01-03 21:22:43 +00006147
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01006148 /*
6149 * On client, make sure the server cert doesn't change during renego to
6150 * avoid "triple handshake" attack: https://secure-resumption.com/
6151 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006152#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006153 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006154 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01006155 {
6156 if( ssl->session->peer_cert == NULL )
6157 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006158 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006159 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6160 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006161 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01006162 }
6163
6164 if( ssl->session->peer_cert->raw.len !=
6165 ssl->session_negotiate->peer_cert->raw.len ||
6166 memcmp( ssl->session->peer_cert->raw.p,
6167 ssl->session_negotiate->peer_cert->raw.p,
6168 ssl->session->peer_cert->raw.len ) != 0 )
6169 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006170 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server cert changed during renegotiation" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006171 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6172 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006173 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01006174 }
6175 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006176#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01006177
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02006178 return( 0 );
6179}
6180
6181int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
6182{
6183 int ret;
6184 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00006185 ssl->handshake->ciphersuite_info;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02006186#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6187 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
6188 ? ssl->handshake->sni_authmode
6189 : ssl->conf->authmode;
6190#else
6191 const int authmode = ssl->conf->authmode;
6192#endif
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02006193 void *rs_ctx = NULL;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02006194
6195 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
6196
6197 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
6198 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
6199 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
6200 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
6201 {
6202 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
6203 ssl->state++;
6204 return( 0 );
6205 }
6206
6207#if defined(MBEDTLS_SSL_SRV_C)
6208 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
6209 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
6210 {
6211 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
6212 ssl->state++;
6213 return( 0 );
6214 }
6215
6216 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
6217 authmode == MBEDTLS_SSL_VERIFY_NONE )
6218 {
6219 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
6220 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02006221
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02006222 ssl->state++;
6223 return( 0 );
6224 }
6225#endif
6226
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02006227#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
6228 if( ssl->handshake->ecrs_enabled &&
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02006229 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02006230 {
6231 goto crt_verify;
6232 }
6233#endif
6234
Manuel Pégourié-Gonnard125af942018-09-11 11:08:12 +02006235 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02006236 {
6237 /* mbedtls_ssl_read_record may have sent an alert already. We
6238 let it decide whether to alert. */
6239 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
6240 return( ret );
6241 }
6242
6243 if( ( ret = ssl_parse_certificate_chain( ssl ) ) != 0 )
6244 {
6245#if defined(MBEDTLS_SSL_SRV_C)
6246 if( ret == MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE &&
6247 authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
6248 {
6249 ret = 0;
6250 }
6251#endif
6252
6253 ssl->state++;
6254 return( ret );
6255 }
6256
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02006257#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
6258 if( ssl->handshake->ecrs_enabled)
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02006259 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02006260
6261crt_verify:
6262 if( ssl->handshake->ecrs_enabled)
6263 rs_ctx = &ssl->handshake->ecrs_ctx;
6264#endif
6265
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02006266 if( authmode != MBEDTLS_SSL_VERIFY_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00006267 {
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02006268 mbedtls_x509_crt *ca_chain;
6269 mbedtls_x509_crl *ca_crl;
6270
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02006271#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02006272 if( ssl->handshake->sni_ca_chain != NULL )
6273 {
6274 ca_chain = ssl->handshake->sni_ca_chain;
6275 ca_crl = ssl->handshake->sni_ca_crl;
6276 }
6277 else
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02006278#endif
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02006279 {
6280 ca_chain = ssl->conf->ca_chain;
6281 ca_crl = ssl->conf->ca_crl;
6282 }
6283
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006284 /*
6285 * Main check: verify certificate
6286 */
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02006287 ret = mbedtls_x509_crt_verify_restartable(
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02006288 ssl->session_negotiate->peer_cert,
6289 ca_chain, ca_crl,
6290 ssl->conf->cert_profile,
6291 ssl->hostname,
6292 &ssl->session_negotiate->verify_result,
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02006293 ssl->conf->f_vrfy, ssl->conf->p_vrfy, rs_ctx );
Paul Bakker5121ce52009-01-03 21:22:43 +00006294
6295 if( ret != 0 )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006296 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006297 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006298 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006299
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02006300#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
6301 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
Manuel Pégourié-Gonnard558da9c2018-06-13 12:02:12 +02006302 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02006303#endif
6304
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006305 /*
6306 * Secondary checks: always done, but change 'ret' only if it was 0
6307 */
6308
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02006309#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006310 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006311 const mbedtls_pk_context *pk = &ssl->session_negotiate->peer_cert->pk;
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006312
6313 /* If certificate uses an EC key, make sure the curve is OK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006314 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02006315 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006316 {
Hanno Becker39ae8cd2017-05-08 16:31:14 +01006317 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
6318
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006319 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006320 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006321 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01006322 }
6323 }
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02006324#endif /* MBEDTLS_ECP_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00006325
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006326 if( mbedtls_ssl_check_cert_usage( ssl->session_negotiate->peer_cert,
Hanno Becker39ae8cd2017-05-08 16:31:14 +01006327 ciphersuite_info,
6328 ! ssl->conf->endpoint,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01006329 &ssl->session_negotiate->verify_result ) != 0 )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006330 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006331 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006332 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006333 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02006334 }
6335
Hanno Becker39ae8cd2017-05-08 16:31:14 +01006336 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
6337 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
6338 * with details encoded in the verification flags. All other kinds
6339 * of error codes, including those from the user provided f_vrfy
6340 * functions, are treated as fatal and lead to a failure of
6341 * ssl_parse_certificate even if verification was optional. */
6342 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
6343 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
6344 ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
6345 {
Paul Bakker5121ce52009-01-03 21:22:43 +00006346 ret = 0;
Hanno Becker39ae8cd2017-05-08 16:31:14 +01006347 }
6348
6349 if( ca_chain == NULL && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
6350 {
6351 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
6352 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
6353 }
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006354
6355 if( ret != 0 )
6356 {
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02006357 uint8_t alert;
6358
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006359 /* The certificate may have been rejected for several reasons.
6360 Pick one and send the corresponding alert. Which alert to send
6361 may be a subject of debate in some cases. */
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006362 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
6363 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
6364 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
6365 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
6366 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
6367 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6368 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
6369 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6370 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
6371 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6372 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
6373 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6374 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
6375 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
6376 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
6377 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
6378 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
6379 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
6380 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
6381 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
Gilles Peskine8498cb32017-05-10 15:39:40 +02006382 else
6383 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006384 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6385 alert );
6386 }
Hanno Becker39ae8cd2017-05-08 16:31:14 +01006387
Hanno Beckere6706e62017-05-15 16:05:15 +01006388#if defined(MBEDTLS_DEBUG_C)
6389 if( ssl->session_negotiate->verify_result != 0 )
6390 {
6391 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %x",
6392 ssl->session_negotiate->verify_result ) );
6393 }
6394 else
6395 {
6396 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
6397 }
6398#endif /* MBEDTLS_DEBUG_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00006399 }
6400
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02006401 ssl->state++;
6402
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006403 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006404
6405 return( ret );
6406}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006407#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
6408 !MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
6409 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
6410 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
6411 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
6412 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
6413 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00006414
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006415int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00006416{
6417 int ret;
6418
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006419 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006420
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006421 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
Paul Bakker5121ce52009-01-03 21:22:43 +00006422 ssl->out_msglen = 1;
6423 ssl->out_msg[0] = 1;
6424
Paul Bakker5121ce52009-01-03 21:22:43 +00006425 ssl->state++;
6426
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02006427 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006428 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02006429 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00006430 return( ret );
6431 }
6432
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006433 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006434
6435 return( 0 );
6436}
6437
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006438int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00006439{
6440 int ret;
6441
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006442 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006443
Hanno Becker327c93b2018-08-15 13:56:18 +01006444 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006445 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006446 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00006447 return( ret );
6448 }
6449
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006450 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Paul Bakker5121ce52009-01-03 21:22:43 +00006451 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006452 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006453 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6454 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006455 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00006456 }
6457
Hanno Beckere678eaa2018-08-21 14:57:46 +01006458 /* CCS records are only accepted if they have length 1 and content '1',
6459 * so we don't need to check this here. */
Paul Bakker5121ce52009-01-03 21:22:43 +00006460
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006461 /*
6462 * Switch to our negotiated transform and session parameters for inbound
6463 * data.
6464 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006465 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006466 ssl->transform_in = ssl->transform_negotiate;
6467 ssl->session_in = ssl->session_negotiate;
6468
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006469#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006470 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006471 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006472#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006473 ssl_dtls_replay_reset( ssl );
6474#endif
6475
6476 /* Increment epoch */
6477 if( ++ssl->in_epoch == 0 )
6478 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006479 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006480 /* This is highly unlikely to happen for legitimate reasons, so
6481 treat it as an attack and don't send an alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006482 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006483 }
6484 }
6485 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006486#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006487 memset( ssl->in_ctr, 0, 8 );
6488
Hanno Beckerf5970a02019-05-08 09:38:41 +01006489 ssl_update_in_pointers( ssl );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006490
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006491#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
6492 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006493 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006494 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_INBOUND ) ) != 0 )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006495 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006496 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006497 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6498 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006499 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006500 }
6501 }
6502#endif
6503
Paul Bakker5121ce52009-01-03 21:22:43 +00006504 ssl->state++;
6505
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006506 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006507
6508 return( 0 );
6509}
6510
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006511void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
6512 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
Paul Bakker380da532012-04-18 16:10:25 +00006513{
Paul Bakkerfb08fd22013-08-27 15:06:26 +02006514 ((void) ciphersuite_info);
Paul Bakker769075d2012-11-24 11:26:46 +01006515
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006516#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6517 defined(MBEDTLS_SSL_PROTO_TLS1_1)
6518 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker48916f92012-09-16 19:57:18 +00006519 ssl->handshake->update_checksum = ssl_update_checksum_md5sha1;
Paul Bakker380da532012-04-18 16:10:25 +00006520 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006521#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006522#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6523#if defined(MBEDTLS_SHA512_C)
6524 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006525 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
6526 else
6527#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006528#if defined(MBEDTLS_SHA256_C)
6529 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
Paul Bakker48916f92012-09-16 19:57:18 +00006530 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006531 else
6532#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006533#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard61edffe2014-04-11 17:07:31 +02006534 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006535 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006536 return;
Manuel Pégourié-Gonnard61edffe2014-04-11 17:07:31 +02006537 }
Paul Bakker380da532012-04-18 16:10:25 +00006538}
Paul Bakkerf7abd422013-04-16 13:15:56 +02006539
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006540void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02006541{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006542#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6543 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006544 mbedtls_md5_starts_ret( &ssl->handshake->fin_md5 );
6545 mbedtls_sha1_starts_ret( &ssl->handshake->fin_sha1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02006546#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006547#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6548#if defined(MBEDTLS_SHA256_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006549 mbedtls_sha256_starts_ret( &ssl->handshake->fin_sha256, 0 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02006550#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006551#if defined(MBEDTLS_SHA512_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006552 mbedtls_sha512_starts_ret( &ssl->handshake->fin_sha512, 1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02006553#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006554#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02006555}
6556
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006557static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006558 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00006559{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006560#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6561 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006562 mbedtls_md5_update_ret( &ssl->handshake->fin_md5 , buf, len );
6563 mbedtls_sha1_update_ret( &ssl->handshake->fin_sha1, buf, len );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006564#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006565#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6566#if defined(MBEDTLS_SHA256_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006567 mbedtls_sha256_update_ret( &ssl->handshake->fin_sha256, buf, len );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006568#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006569#if defined(MBEDTLS_SHA512_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006570 mbedtls_sha512_update_ret( &ssl->handshake->fin_sha512, buf, len );
Paul Bakker769075d2012-11-24 11:26:46 +01006571#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006572#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker380da532012-04-18 16:10:25 +00006573}
6574
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006575#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6576 defined(MBEDTLS_SSL_PROTO_TLS1_1)
6577static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006578 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00006579{
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006580 mbedtls_md5_update_ret( &ssl->handshake->fin_md5 , buf, len );
6581 mbedtls_sha1_update_ret( &ssl->handshake->fin_sha1, buf, len );
Paul Bakker380da532012-04-18 16:10:25 +00006582}
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006583#endif
Paul Bakker380da532012-04-18 16:10:25 +00006584
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006585#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6586#if defined(MBEDTLS_SHA256_C)
6587static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006588 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00006589{
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006590 mbedtls_sha256_update_ret( &ssl->handshake->fin_sha256, buf, len );
Paul Bakker380da532012-04-18 16:10:25 +00006591}
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006592#endif
Paul Bakker380da532012-04-18 16:10:25 +00006593
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006594#if defined(MBEDTLS_SHA512_C)
6595static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006596 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00006597{
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006598 mbedtls_sha512_update_ret( &ssl->handshake->fin_sha512, buf, len );
Paul Bakker380da532012-04-18 16:10:25 +00006599}
Paul Bakker769075d2012-11-24 11:26:46 +01006600#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006601#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker380da532012-04-18 16:10:25 +00006602
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006603#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker1ef83d62012-04-11 12:09:53 +00006604static void ssl_calc_finished_ssl(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006605 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakker5121ce52009-01-03 21:22:43 +00006606{
Paul Bakker3c2122f2013-06-24 19:03:14 +02006607 const char *sender;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006608 mbedtls_md5_context md5;
6609 mbedtls_sha1_context sha1;
Paul Bakker1ef83d62012-04-11 12:09:53 +00006610
Paul Bakker5121ce52009-01-03 21:22:43 +00006611 unsigned char padbuf[48];
6612 unsigned char md5sum[16];
6613 unsigned char sha1sum[20];
6614
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006615 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00006616 if( !session )
6617 session = ssl->session;
6618
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006619 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006620
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02006621 mbedtls_md5_init( &md5 );
6622 mbedtls_sha1_init( &sha1 );
6623
6624 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
6625 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006626
6627 /*
6628 * SSLv3:
6629 * hash =
6630 * MD5( master + pad2 +
6631 * MD5( handshake + sender + master + pad1 ) )
6632 * + SHA1( master + pad2 +
6633 * SHA1( handshake + sender + master + pad1 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00006634 */
6635
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006636#if !defined(MBEDTLS_MD5_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006637 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
6638 md5.state, sizeof( md5.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02006639#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00006640
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006641#if !defined(MBEDTLS_SHA1_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006642 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
6643 sha1.state, sizeof( sha1.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02006644#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00006645
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006646 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT"
Paul Bakker3c2122f2013-06-24 19:03:14 +02006647 : "SRVR";
Paul Bakker5121ce52009-01-03 21:22:43 +00006648
Paul Bakker1ef83d62012-04-11 12:09:53 +00006649 memset( padbuf, 0x36, 48 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006650
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006651 mbedtls_md5_update_ret( &md5, (const unsigned char *) sender, 4 );
6652 mbedtls_md5_update_ret( &md5, session->master, 48 );
6653 mbedtls_md5_update_ret( &md5, padbuf, 48 );
6654 mbedtls_md5_finish_ret( &md5, md5sum );
Paul Bakker5121ce52009-01-03 21:22:43 +00006655
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006656 mbedtls_sha1_update_ret( &sha1, (const unsigned char *) sender, 4 );
6657 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
6658 mbedtls_sha1_update_ret( &sha1, padbuf, 40 );
6659 mbedtls_sha1_finish_ret( &sha1, sha1sum );
Paul Bakker5121ce52009-01-03 21:22:43 +00006660
Paul Bakker1ef83d62012-04-11 12:09:53 +00006661 memset( padbuf, 0x5C, 48 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006662
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006663 mbedtls_md5_starts_ret( &md5 );
6664 mbedtls_md5_update_ret( &md5, session->master, 48 );
6665 mbedtls_md5_update_ret( &md5, padbuf, 48 );
6666 mbedtls_md5_update_ret( &md5, md5sum, 16 );
6667 mbedtls_md5_finish_ret( &md5, buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00006668
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006669 mbedtls_sha1_starts_ret( &sha1 );
6670 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
6671 mbedtls_sha1_update_ret( &sha1, padbuf , 40 );
6672 mbedtls_sha1_update_ret( &sha1, sha1sum, 20 );
6673 mbedtls_sha1_finish_ret( &sha1, buf + 16 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006674
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006675 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006676
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006677 mbedtls_md5_free( &md5 );
6678 mbedtls_sha1_free( &sha1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006679
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006680 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
6681 mbedtls_platform_zeroize( md5sum, sizeof( md5sum ) );
6682 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006683
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006684 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006685}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006686#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00006687
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006688#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Paul Bakker1ef83d62012-04-11 12:09:53 +00006689static void ssl_calc_finished_tls(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006690 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakker5121ce52009-01-03 21:22:43 +00006691{
Paul Bakker1ef83d62012-04-11 12:09:53 +00006692 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02006693 const char *sender;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006694 mbedtls_md5_context md5;
6695 mbedtls_sha1_context sha1;
Paul Bakker1ef83d62012-04-11 12:09:53 +00006696 unsigned char padbuf[36];
Paul Bakker5121ce52009-01-03 21:22:43 +00006697
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006698 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00006699 if( !session )
6700 session = ssl->session;
6701
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006702 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006703
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02006704 mbedtls_md5_init( &md5 );
6705 mbedtls_sha1_init( &sha1 );
6706
6707 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
6708 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006709
Paul Bakker1ef83d62012-04-11 12:09:53 +00006710 /*
6711 * TLSv1:
6712 * hash = PRF( master, finished_label,
6713 * MD5( handshake ) + SHA1( handshake ) )[0..11]
6714 */
Paul Bakker5121ce52009-01-03 21:22:43 +00006715
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006716#if !defined(MBEDTLS_MD5_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006717 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
6718 md5.state, sizeof( md5.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02006719#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00006720
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006721#if !defined(MBEDTLS_SHA1_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006722 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
6723 sha1.state, sizeof( sha1.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02006724#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00006725
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006726 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker3c2122f2013-06-24 19:03:14 +02006727 ? "client finished"
6728 : "server finished";
Paul Bakker1ef83d62012-04-11 12:09:53 +00006729
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006730 mbedtls_md5_finish_ret( &md5, padbuf );
6731 mbedtls_sha1_finish_ret( &sha1, padbuf + 16 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006732
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006733 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00006734 padbuf, 36, buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006735
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006736 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006737
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006738 mbedtls_md5_free( &md5 );
6739 mbedtls_sha1_free( &sha1 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006740
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006741 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006742
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006743 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006744}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006745#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker1ef83d62012-04-11 12:09:53 +00006746
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006747#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6748#if defined(MBEDTLS_SHA256_C)
Paul Bakkerca4ab492012-04-18 14:23:57 +00006749static void ssl_calc_finished_tls_sha256(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006750 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakker1ef83d62012-04-11 12:09:53 +00006751{
6752 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02006753 const char *sender;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006754 mbedtls_sha256_context sha256;
Paul Bakker1ef83d62012-04-11 12:09:53 +00006755 unsigned char padbuf[32];
6756
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006757 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00006758 if( !session )
6759 session = ssl->session;
6760
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02006761 mbedtls_sha256_init( &sha256 );
6762
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006763 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006764
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02006765 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006766
6767 /*
6768 * TLSv1.2:
6769 * hash = PRF( master, finished_label,
6770 * Hash( handshake ) )[0.11]
6771 */
6772
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006773#if !defined(MBEDTLS_SHA256_ALT)
6774 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006775 sha256.state, sizeof( sha256.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02006776#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00006777
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006778 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker3c2122f2013-06-24 19:03:14 +02006779 ? "client finished"
6780 : "server finished";
Paul Bakker1ef83d62012-04-11 12:09:53 +00006781
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006782 mbedtls_sha256_finish_ret( &sha256, padbuf );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006783
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006784 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00006785 padbuf, 32, buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006786
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006787 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006788
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006789 mbedtls_sha256_free( &sha256 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006790
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006791 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006792
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006793 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006794}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006795#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +00006796
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006797#if defined(MBEDTLS_SHA512_C)
Paul Bakkerca4ab492012-04-18 14:23:57 +00006798static void ssl_calc_finished_tls_sha384(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006799 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakkerca4ab492012-04-18 14:23:57 +00006800{
6801 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02006802 const char *sender;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006803 mbedtls_sha512_context sha512;
Paul Bakkerca4ab492012-04-18 14:23:57 +00006804 unsigned char padbuf[48];
6805
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006806 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00006807 if( !session )
6808 session = ssl->session;
6809
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02006810 mbedtls_sha512_init( &sha512 );
6811
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006812 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006813
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02006814 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006815
6816 /*
6817 * TLSv1.2:
6818 * hash = PRF( master, finished_label,
6819 * Hash( handshake ) )[0.11]
6820 */
6821
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006822#if !defined(MBEDTLS_SHA512_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006823 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
6824 sha512.state, sizeof( sha512.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02006825#endif
Paul Bakkerca4ab492012-04-18 14:23:57 +00006826
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006827 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker3c2122f2013-06-24 19:03:14 +02006828 ? "client finished"
6829 : "server finished";
Paul Bakkerca4ab492012-04-18 14:23:57 +00006830
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006831 mbedtls_sha512_finish_ret( &sha512, padbuf );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006832
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006833 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00006834 padbuf, 48, buf, len );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006835
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006836 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006837
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006838 mbedtls_sha512_free( &sha512 );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006839
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006840 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006841
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006842 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006843}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006844#endif /* MBEDTLS_SHA512_C */
6845#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +00006846
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006847static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00006848{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006849 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00006850
6851 /*
6852 * Free our handshake params
6853 */
Gilles Peskine9b562d52018-04-25 20:32:43 +02006854 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006855 mbedtls_free( ssl->handshake );
Paul Bakker48916f92012-09-16 19:57:18 +00006856 ssl->handshake = NULL;
6857
6858 /*
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006859 * Free the previous transform and swith in the current one
Paul Bakker48916f92012-09-16 19:57:18 +00006860 */
6861 if( ssl->transform )
6862 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006863 mbedtls_ssl_transform_free( ssl->transform );
6864 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00006865 }
6866 ssl->transform = ssl->transform_negotiate;
6867 ssl->transform_negotiate = NULL;
6868
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006869 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006870}
6871
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006872void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006873{
6874 int resume = ssl->handshake->resume;
6875
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006876 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006877
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006878#if defined(MBEDTLS_SSL_RENEGOTIATION)
6879 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006880 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006881 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006882 ssl->renego_records_seen = 0;
6883 }
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01006884#endif
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006885
6886 /*
6887 * Free the previous session and switch in the current one
6888 */
Paul Bakker0a597072012-09-25 21:55:46 +00006889 if( ssl->session )
6890 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006891#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard1a034732014-11-04 17:36:18 +01006892 /* RFC 7366 3.1: keep the EtM state */
6893 ssl->session_negotiate->encrypt_then_mac =
6894 ssl->session->encrypt_then_mac;
6895#endif
6896
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006897 mbedtls_ssl_session_free( ssl->session );
6898 mbedtls_free( ssl->session );
Paul Bakker0a597072012-09-25 21:55:46 +00006899 }
6900 ssl->session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00006901 ssl->session_negotiate = NULL;
6902
Paul Bakker0a597072012-09-25 21:55:46 +00006903 /*
6904 * Add cache entry
6905 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006906 if( ssl->conf->f_set_cache != NULL &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02006907 ssl->session->id_len != 0 &&
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02006908 resume == 0 )
6909 {
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01006910 if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006911 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02006912 }
Paul Bakker0a597072012-09-25 21:55:46 +00006913
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006914#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006915 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006916 ssl->handshake->flight != NULL )
6917 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02006918 /* Cancel handshake timer */
6919 ssl_set_timer( ssl, 0 );
6920
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006921 /* Keep last flight around in case we need to resend it:
6922 * we need the handshake and transform structures for that */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006923 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006924 }
6925 else
6926#endif
6927 ssl_handshake_wrapup_free_hs_transform( ssl );
6928
Paul Bakker48916f92012-09-16 19:57:18 +00006929 ssl->state++;
6930
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006931 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00006932}
6933
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006934int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
Paul Bakker1ef83d62012-04-11 12:09:53 +00006935{
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02006936 int ret, hash_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00006937
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006938 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006939
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01006940 ssl_update_out_pointers( ssl, ssl->transform_negotiate );
Paul Bakker92be97b2013-01-02 17:30:03 +01006941
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006942 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006943
Manuel Pégourié-Gonnard214a8482016-02-22 11:27:26 +01006944 /*
6945 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
6946 * may define some other value. Currently (early 2016), no defined
6947 * ciphersuite does this (and this is unlikely to change as activity has
6948 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
6949 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006950 hash_len = ( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00006951
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006952#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00006953 ssl->verify_data_len = hash_len;
6954 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01006955#endif
Paul Bakker48916f92012-09-16 19:57:18 +00006956
Paul Bakker5121ce52009-01-03 21:22:43 +00006957 ssl->out_msglen = 4 + hash_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006958 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6959 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
Paul Bakker5121ce52009-01-03 21:22:43 +00006960
6961 /*
6962 * In case of session resuming, invert the client and server
6963 * ChangeCipherSpec messages order.
6964 */
Paul Bakker0a597072012-09-25 21:55:46 +00006965 if( ssl->handshake->resume != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006966 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006967#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006968 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006969 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01006970#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006971#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006972 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006973 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01006974#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00006975 }
6976 else
6977 ssl->state++;
6978
Paul Bakker48916f92012-09-16 19:57:18 +00006979 /*
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02006980 * Switch to our negotiated transform and session parameters for outbound
6981 * data.
Paul Bakker48916f92012-09-16 19:57:18 +00006982 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006983 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01006984
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006985#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006986 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02006987 {
6988 unsigned char i;
6989
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02006990 /* Remember current epoch settings for resending */
6991 ssl->handshake->alt_transform_out = ssl->transform_out;
Hanno Becker19859472018-08-06 09:40:20 +01006992 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02006993
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02006994 /* Set sequence_number to zero */
Hanno Becker19859472018-08-06 09:40:20 +01006995 memset( ssl->cur_out_ctr + 2, 0, 6 );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02006996
6997 /* Increment epoch */
6998 for( i = 2; i > 0; i-- )
Hanno Becker19859472018-08-06 09:40:20 +01006999 if( ++ssl->cur_out_ctr[i - 1] != 0 )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02007000 break;
7001
7002 /* The loop goes to its end iff the counter is wrapping */
7003 if( i == 0 )
7004 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007005 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
7006 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02007007 }
7008 }
7009 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007010#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Becker19859472018-08-06 09:40:20 +01007011 memset( ssl->cur_out_ctr, 0, 8 );
Paul Bakker5121ce52009-01-03 21:22:43 +00007012
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02007013 ssl->transform_out = ssl->transform_negotiate;
7014 ssl->session_out = ssl->session_negotiate;
7015
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007016#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
7017 if( mbedtls_ssl_hw_record_activate != NULL )
Paul Bakker07eb38b2012-12-19 14:42:06 +01007018 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007019 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Paul Bakker07eb38b2012-12-19 14:42:06 +01007020 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007021 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
7022 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker07eb38b2012-12-19 14:42:06 +01007023 }
7024 }
7025#endif
7026
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007027#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007028 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007029 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02007030#endif
7031
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007032 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007033 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02007034 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007035 return( ret );
7036 }
7037
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02007038#if defined(MBEDTLS_SSL_PROTO_DTLS)
7039 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
7040 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
7041 {
7042 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
7043 return( ret );
7044 }
7045#endif
7046
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007047 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007048
7049 return( 0 );
7050}
7051
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007052#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00007053#define SSL_MAX_HASH_LEN 36
7054#else
7055#define SSL_MAX_HASH_LEN 12
7056#endif
7057
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007058int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007059{
Paul Bakker23986e52011-04-24 08:57:21 +00007060 int ret;
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02007061 unsigned int hash_len;
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00007062 unsigned char buf[SSL_MAX_HASH_LEN];
Paul Bakker5121ce52009-01-03 21:22:43 +00007063
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007064 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007065
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007066 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00007067
Hanno Becker327c93b2018-08-15 13:56:18 +01007068 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007069 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007070 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007071 return( ret );
7072 }
7073
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007074 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00007075 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007076 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007077 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7078 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007079 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00007080 }
7081
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00007082 /* There is currently no ciphersuite using another length with TLS 1.2 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007083#if defined(MBEDTLS_SSL_PROTO_SSL3)
7084 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00007085 hash_len = 36;
7086 else
7087#endif
7088 hash_len = 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00007089
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007090 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED ||
7091 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
Paul Bakker5121ce52009-01-03 21:22:43 +00007092 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007093 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007094 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7095 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007096 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00007097 }
7098
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007099 if( mbedtls_ssl_safer_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
Manuel Pégourié-Gonnard4abc3272014-09-10 12:02:46 +00007100 buf, hash_len ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007101 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007102 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02007103 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
7104 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007105 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00007106 }
7107
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007108#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00007109 ssl->verify_data_len = hash_len;
7110 memcpy( ssl->peer_verify_data, buf, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01007111#endif
Paul Bakker48916f92012-09-16 19:57:18 +00007112
Paul Bakker0a597072012-09-25 21:55:46 +00007113 if( ssl->handshake->resume != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00007114 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007115#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007116 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007117 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01007118#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007119#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007120 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007121 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01007122#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00007123 }
7124 else
7125 ssl->state++;
7126
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007127#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007128 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007129 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02007130#endif
7131
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007132 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00007133
7134 return( 0 );
7135}
7136
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007137static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007138{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007139 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007140
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007141#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
7142 defined(MBEDTLS_SSL_PROTO_TLS1_1)
7143 mbedtls_md5_init( &handshake->fin_md5 );
7144 mbedtls_sha1_init( &handshake->fin_sha1 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01007145 mbedtls_md5_starts_ret( &handshake->fin_md5 );
7146 mbedtls_sha1_starts_ret( &handshake->fin_sha1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007147#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007148#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
7149#if defined(MBEDTLS_SHA256_C)
7150 mbedtls_sha256_init( &handshake->fin_sha256 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01007151 mbedtls_sha256_starts_ret( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007152#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007153#if defined(MBEDTLS_SHA512_C)
7154 mbedtls_sha512_init( &handshake->fin_sha512 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01007155 mbedtls_sha512_starts_ret( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007156#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007157#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007158
7159 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +01007160
7161#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
7162 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
7163 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
7164#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007165
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007166#if defined(MBEDTLS_DHM_C)
7167 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007168#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007169#if defined(MBEDTLS_ECDH_C)
7170 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007171#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02007172#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02007173 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02007174#if defined(MBEDTLS_SSL_CLI_C)
7175 handshake->ecjpake_cache = NULL;
7176 handshake->ecjpake_cache_len = 0;
7177#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02007178#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02007179
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02007180#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02007181 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02007182#endif
7183
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02007184#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7185 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
7186#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007187}
7188
Hanno Becker611a83b2018-01-03 14:27:32 +00007189void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007190{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007191 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Paul Bakker84bbeb52014-07-01 14:53:22 +02007192
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007193 mbedtls_cipher_init( &transform->cipher_ctx_enc );
7194 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Paul Bakker84bbeb52014-07-01 14:53:22 +02007195
Hanno Becker92231322018-01-03 15:32:51 +00007196#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007197 mbedtls_md_init( &transform->md_ctx_enc );
7198 mbedtls_md_init( &transform->md_ctx_dec );
Hanno Becker92231322018-01-03 15:32:51 +00007199#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007200}
7201
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007202void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007203{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007204 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007205}
7206
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007207static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00007208{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007209 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +00007210 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007211 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007212 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007213 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007214 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +02007215 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007216
7217 /*
7218 * Either the pointers are now NULL or cleared properly and can be freed.
7219 * Now allocate missing structures.
7220 */
7221 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02007222 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02007223 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02007224 }
Paul Bakker48916f92012-09-16 19:57:18 +00007225
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007226 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02007227 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02007228 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02007229 }
Paul Bakker48916f92012-09-16 19:57:18 +00007230
Paul Bakker82788fb2014-10-20 13:59:19 +02007231 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02007232 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02007233 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02007234 }
Paul Bakker48916f92012-09-16 19:57:18 +00007235
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007236 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +00007237 if( ssl->handshake == NULL ||
7238 ssl->transform_negotiate == NULL ||
7239 ssl->session_negotiate == NULL )
7240 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02007241 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007242
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007243 mbedtls_free( ssl->handshake );
7244 mbedtls_free( ssl->transform_negotiate );
7245 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007246
7247 ssl->handshake = NULL;
7248 ssl->transform_negotiate = NULL;
7249 ssl->session_negotiate = NULL;
7250
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02007251 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +00007252 }
7253
Paul Bakkeraccaffe2014-06-26 13:37:14 +02007254 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007255 mbedtls_ssl_session_init( ssl->session_negotiate );
Hanno Becker611a83b2018-01-03 14:27:32 +00007256 mbedtls_ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +02007257 ssl_handshake_params_init( ssl->handshake );
7258
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007259#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02007260 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7261 {
7262 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02007263
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02007264 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
7265 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
7266 else
7267 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02007268
7269 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02007270 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02007271#endif
7272
Paul Bakker48916f92012-09-16 19:57:18 +00007273 return( 0 );
7274}
7275
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02007276#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02007277/* Dummy cookie callbacks for defaults */
7278static int ssl_cookie_write_dummy( void *ctx,
7279 unsigned char **p, unsigned char *end,
7280 const unsigned char *cli_id, size_t cli_id_len )
7281{
7282 ((void) ctx);
7283 ((void) p);
7284 ((void) end);
7285 ((void) cli_id);
7286 ((void) cli_id_len);
7287
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007288 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02007289}
7290
7291static int ssl_cookie_check_dummy( void *ctx,
7292 const unsigned char *cookie, size_t cookie_len,
7293 const unsigned char *cli_id, size_t cli_id_len )
7294{
7295 ((void) ctx);
7296 ((void) cookie);
7297 ((void) cookie_len);
7298 ((void) cli_id);
7299 ((void) cli_id_len);
7300
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007301 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02007302}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02007303#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02007304
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01007305/* Once ssl->out_hdr as the address of the beginning of the
7306 * next outgoing record is set, deduce the other pointers.
7307 *
7308 * Note: For TLS, we save the implicit record sequence number
7309 * (entering MAC computation) in the 8 bytes before ssl->out_hdr,
7310 * and the caller has to make sure there's space for this.
7311 */
7312
7313static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
7314 mbedtls_ssl_transform *transform )
7315{
7316#if defined(MBEDTLS_SSL_PROTO_DTLS)
7317 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7318 {
7319 ssl->out_ctr = ssl->out_hdr + 3;
Hanno Becker70e79282019-05-03 14:34:53 +01007320#if defined(MBEDTLS_SSL_CID)
7321 ssl->out_cid = ssl->out_ctr + 8;
7322 ssl->out_len = ssl->out_cid;
7323 if( transform != NULL )
7324 ssl->out_len += transform->out_cid_len;
7325#else /* MBEDTLS_SSL_CID */
7326 ssl->out_len = ssl->out_ctr + 8;
7327#endif /* MBEDTLS_SSL_CID */
7328 ssl->out_iv = ssl->out_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01007329 }
7330 else
7331#endif
7332 {
7333 ssl->out_ctr = ssl->out_hdr - 8;
7334 ssl->out_len = ssl->out_hdr + 3;
Hanno Becker9bf10ea2019-05-08 16:43:21 +01007335#if defined(MBEDTLS_SSL_CID)
7336 ssl->out_cid = ssl->out_len;
7337#endif
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01007338 ssl->out_iv = ssl->out_hdr + 5;
7339 }
7340
7341 /* Adjust out_msg to make space for explicit IV, if used. */
7342 if( transform != NULL &&
7343 ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
7344 {
7345 ssl->out_msg = ssl->out_iv + transform->ivlen - transform->fixed_ivlen;
7346 }
7347 else
7348 ssl->out_msg = ssl->out_iv;
7349}
7350
7351/* Once ssl->in_hdr as the address of the beginning of the
7352 * next incoming record is set, deduce the other pointers.
7353 *
7354 * Note: For TLS, we save the implicit record sequence number
7355 * (entering MAC computation) in the 8 bytes before ssl->in_hdr,
7356 * and the caller has to make sure there's space for this.
7357 */
7358
Hanno Beckerf5970a02019-05-08 09:38:41 +01007359static void ssl_update_in_pointers( mbedtls_ssl_context *ssl )
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01007360{
Hanno Beckerf5970a02019-05-08 09:38:41 +01007361 /* This function sets the pointers to match the case
7362 * of unprotected TLS/DTLS records, with both ssl->in_iv
7363 * and ssl->in_msg pointing to the beginning of the record
7364 * content.
7365 *
7366 * When decrypting a protected record, ssl->in_msg
7367 * will be shifted to point to the beginning of the
7368 * record plaintext.
7369 */
7370
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01007371#if defined(MBEDTLS_SSL_PROTO_DTLS)
7372 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7373 {
Hanno Becker70e79282019-05-03 14:34:53 +01007374 /* This sets the header pointers to match records
7375 * without CID. When we receive a record containing
7376 * a CID, the fields are shifted accordingly in
7377 * ssl_parse_record_header(). */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01007378 ssl->in_ctr = ssl->in_hdr + 3;
Hanno Becker70e79282019-05-03 14:34:53 +01007379#if defined(MBEDTLS_SSL_CID)
7380 ssl->in_cid = ssl->in_ctr + 8;
7381 ssl->in_len = ssl->in_cid; /* Default: no CID */
7382#else /* MBEDTLS_SSL_CID */
7383 ssl->in_len = ssl->in_ctr + 8;
7384#endif /* MBEDTLS_SSL_CID */
7385 ssl->in_iv = ssl->in_len + 2;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01007386 }
7387 else
7388#endif
7389 {
7390 ssl->in_ctr = ssl->in_hdr - 8;
7391 ssl->in_len = ssl->in_hdr + 3;
Hanno Becker9bf10ea2019-05-08 16:43:21 +01007392#if defined(MBEDTLS_SSL_CID)
7393 ssl->in_cid = ssl->in_len;
7394#endif
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01007395 ssl->in_iv = ssl->in_hdr + 5;
7396 }
7397
Hanno Beckerf5970a02019-05-08 09:38:41 +01007398 /* This will be adjusted at record decryption time. */
7399 ssl->in_msg = ssl->in_iv;
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01007400}
7401
Paul Bakker5121ce52009-01-03 21:22:43 +00007402/*
7403 * Initialize an SSL context
7404 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02007405void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
7406{
7407 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
7408}
7409
7410/*
7411 * Setup an SSL context
7412 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01007413
7414static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl )
7415{
7416 /* Set the incoming and outgoing record pointers. */
7417#if defined(MBEDTLS_SSL_PROTO_DTLS)
7418 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
7419 {
7420 ssl->out_hdr = ssl->out_buf;
7421 ssl->in_hdr = ssl->in_buf;
7422 }
7423 else
7424#endif /* MBEDTLS_SSL_PROTO_DTLS */
7425 {
7426 ssl->out_hdr = ssl->out_buf + 8;
7427 ssl->in_hdr = ssl->in_buf + 8;
7428 }
7429
7430 /* Derive other internal pointers. */
7431 ssl_update_out_pointers( ssl, NULL /* no transform enabled */ );
Hanno Beckerf5970a02019-05-08 09:38:41 +01007432 ssl_update_in_pointers ( ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +01007433}
7434
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02007435int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02007436 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00007437{
Paul Bakker48916f92012-09-16 19:57:18 +00007438 int ret;
Paul Bakker5121ce52009-01-03 21:22:43 +00007439
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02007440 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00007441
7442 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01007443 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00007444 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02007445
7446 /* Set to NULL in case of an error condition */
7447 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02007448
Angus Grattond8213d02016-05-25 20:56:48 +10007449 ssl->in_buf = mbedtls_calloc( 1, MBEDTLS_SSL_IN_BUFFER_LEN );
7450 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00007451 {
Angus Grattond8213d02016-05-25 20:56:48 +10007452 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", MBEDTLS_SSL_IN_BUFFER_LEN) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02007453 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02007454 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10007455 }
7456
7457 ssl->out_buf = mbedtls_calloc( 1, MBEDTLS_SSL_OUT_BUFFER_LEN );
7458 if( ssl->out_buf == NULL )
7459 {
7460 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", MBEDTLS_SSL_OUT_BUFFER_LEN) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02007461 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02007462 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00007463 }
7464
Hanno Becker2a43f6f2018-08-10 11:12:52 +01007465 ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02007466
Paul Bakker48916f92012-09-16 19:57:18 +00007467 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02007468 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00007469
7470 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02007471
7472error:
7473 mbedtls_free( ssl->in_buf );
7474 mbedtls_free( ssl->out_buf );
7475
7476 ssl->conf = NULL;
7477
7478 ssl->in_buf = NULL;
7479 ssl->out_buf = NULL;
7480
7481 ssl->in_hdr = NULL;
7482 ssl->in_ctr = NULL;
7483 ssl->in_len = NULL;
7484 ssl->in_iv = NULL;
7485 ssl->in_msg = NULL;
7486
7487 ssl->out_hdr = NULL;
7488 ssl->out_ctr = NULL;
7489 ssl->out_len = NULL;
7490 ssl->out_iv = NULL;
7491 ssl->out_msg = NULL;
7492
k-stachowiak9f7798e2018-07-31 16:52:32 +02007493 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00007494}
7495
7496/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00007497 * Reset an initialized and used SSL context for re-use while retaining
7498 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02007499 *
7500 * If partial is non-zero, keep data in the input buffer and client ID.
7501 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00007502 */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02007503static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00007504{
Paul Bakker48916f92012-09-16 19:57:18 +00007505 int ret;
7506
Hanno Becker7e772132018-08-10 12:38:21 +01007507#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || \
7508 !defined(MBEDTLS_SSL_SRV_C)
7509 ((void) partial);
7510#endif
7511
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007512 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01007513
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02007514 /* Cancel any possibly running timer */
7515 ssl_set_timer( ssl, 0 );
7516
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007517#if defined(MBEDTLS_SSL_RENEGOTIATION)
7518 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01007519 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00007520
7521 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007522 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
7523 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01007524#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007525 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00007526
Paul Bakker7eb013f2011-10-06 12:37:39 +00007527 ssl->in_offt = NULL;
Hanno Beckerf29d4702018-08-10 11:31:15 +01007528 ssl_reset_in_out_pointers( ssl );
Paul Bakker7eb013f2011-10-06 12:37:39 +00007529
7530 ssl->in_msgtype = 0;
7531 ssl->in_msglen = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007532#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02007533 ssl->next_record_offset = 0;
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02007534 ssl->in_epoch = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02007535#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007536#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02007537 ssl_dtls_replay_reset( ssl );
7538#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00007539
7540 ssl->in_hslen = 0;
7541 ssl->nb_zero = 0;
Hanno Beckeraf0665d2017-05-24 09:16:26 +01007542
7543 ssl->keep_current_message = 0;
Paul Bakker7eb013f2011-10-06 12:37:39 +00007544
7545 ssl->out_msgtype = 0;
7546 ssl->out_msglen = 0;
7547 ssl->out_left = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007548#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
7549 if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01007550 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01007551#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00007552
Hanno Becker19859472018-08-06 09:40:20 +01007553 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
7554
Paul Bakker48916f92012-09-16 19:57:18 +00007555 ssl->transform_in = NULL;
7556 ssl->transform_out = NULL;
Paul Bakker7eb013f2011-10-06 12:37:39 +00007557
Hanno Becker78640902018-08-13 16:35:15 +01007558 ssl->session_in = NULL;
7559 ssl->session_out = NULL;
7560
Angus Grattond8213d02016-05-25 20:56:48 +10007561 memset( ssl->out_buf, 0, MBEDTLS_SSL_OUT_BUFFER_LEN );
Hanno Becker4ccbf062018-08-10 11:20:38 +01007562
7563#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02007564 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01007565#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
7566 {
7567 ssl->in_left = 0;
Angus Grattond8213d02016-05-25 20:56:48 +10007568 memset( ssl->in_buf, 0, MBEDTLS_SSL_IN_BUFFER_LEN );
Hanno Becker4ccbf062018-08-10 11:20:38 +01007569 }
Paul Bakker05ef8352012-05-08 09:17:57 +00007570
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007571#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
7572 if( mbedtls_ssl_hw_record_reset != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00007573 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007574 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) );
7575 if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 )
Paul Bakker2770fbd2012-07-03 13:30:23 +00007576 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007577 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret );
7578 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00007579 }
Paul Bakker05ef8352012-05-08 09:17:57 +00007580 }
7581#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00007582
Paul Bakker48916f92012-09-16 19:57:18 +00007583 if( ssl->transform )
Paul Bakker2770fbd2012-07-03 13:30:23 +00007584 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007585 mbedtls_ssl_transform_free( ssl->transform );
7586 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00007587 ssl->transform = NULL;
Paul Bakker2770fbd2012-07-03 13:30:23 +00007588 }
Paul Bakker48916f92012-09-16 19:57:18 +00007589
Paul Bakkerc0463502013-02-14 11:19:38 +01007590 if( ssl->session )
7591 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007592 mbedtls_ssl_session_free( ssl->session );
7593 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01007594 ssl->session = NULL;
7595 }
7596
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007597#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02007598 ssl->alpn_chosen = NULL;
7599#endif
7600
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02007601#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01007602#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02007603 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01007604#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02007605 {
7606 mbedtls_free( ssl->cli_id );
7607 ssl->cli_id = NULL;
7608 ssl->cli_id_len = 0;
7609 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02007610#endif
7611
Paul Bakker48916f92012-09-16 19:57:18 +00007612 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
7613 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00007614
7615 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00007616}
7617
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02007618/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02007619 * Reset an initialized and used SSL context for re-use while retaining
7620 * all application-set variables, function pointers and data.
7621 */
7622int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
7623{
7624 return( ssl_session_reset_int( ssl, 0 ) );
7625}
7626
7627/*
Paul Bakker5121ce52009-01-03 21:22:43 +00007628 * SSL set accessors
7629 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007630void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00007631{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007632 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00007633}
7634
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02007635void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01007636{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007637 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01007638}
7639
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007640#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007641void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02007642{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007643 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02007644}
7645#endif
7646
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007647#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007648void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02007649{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007650 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02007651}
7652#endif
7653
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007654#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01007655
Hanno Becker1841b0a2018-08-24 11:13:57 +01007656void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
7657 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01007658{
7659 ssl->disable_datagram_packing = !allow_packing;
7660}
7661
7662void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
7663 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02007664{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007665 conf->hs_timeout_min = min;
7666 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02007667}
7668#endif
7669
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007670void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00007671{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007672 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00007673}
7674
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007675#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007676void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02007677 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00007678 void *p_vrfy )
7679{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007680 conf->f_vrfy = f_vrfy;
7681 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00007682}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007683#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00007684
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007685void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00007686 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00007687 void *p_rng )
7688{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01007689 conf->f_rng = f_rng;
7690 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00007691}
7692
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007693void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02007694 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00007695 void *p_dbg )
7696{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007697 conf->f_dbg = f_dbg;
7698 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00007699}
7700
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007701void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02007702 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00007703 mbedtls_ssl_send_t *f_send,
7704 mbedtls_ssl_recv_t *f_recv,
7705 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02007706{
7707 ssl->p_bio = p_bio;
7708 ssl->f_send = f_send;
7709 ssl->f_recv = f_recv;
7710 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01007711}
7712
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02007713#if defined(MBEDTLS_SSL_PROTO_DTLS)
7714void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
7715{
7716 ssl->mtu = mtu;
7717}
7718#endif
7719
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007720void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01007721{
7722 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02007723}
7724
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02007725void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
7726 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00007727 mbedtls_ssl_set_timer_t *f_set_timer,
7728 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02007729{
7730 ssl->p_timer = p_timer;
7731 ssl->f_set_timer = f_set_timer;
7732 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02007733
7734 /* Make sure we start with no timer running */
7735 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02007736}
7737
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007738#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007739void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01007740 void *p_cache,
7741 int (*f_get_cache)(void *, mbedtls_ssl_session *),
7742 int (*f_set_cache)(void *, const mbedtls_ssl_session *) )
Paul Bakker5121ce52009-01-03 21:22:43 +00007743{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01007744 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007745 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007746 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00007747}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007748#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00007749
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007750#if defined(MBEDTLS_SSL_CLI_C)
7751int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00007752{
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02007753 int ret;
7754
7755 if( ssl == NULL ||
7756 session == NULL ||
7757 ssl->session_negotiate == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007758 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02007759 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007760 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02007761 }
7762
7763 if( ( ret = ssl_session_copy( ssl->session_negotiate, session ) ) != 0 )
7764 return( ret );
7765
Paul Bakker0a597072012-09-25 21:55:46 +00007766 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02007767
7768 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00007769}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007770#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00007771
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007772void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007773 const int *ciphersuites )
Paul Bakker5121ce52009-01-03 21:22:43 +00007774{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007775 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = ciphersuites;
7776 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = ciphersuites;
7777 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = ciphersuites;
7778 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = ciphersuites;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02007779}
7780
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007781void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02007782 const int *ciphersuites,
Paul Bakker8f4ddae2013-04-15 15:09:54 +02007783 int major, int minor )
7784{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007785 if( major != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker8f4ddae2013-04-15 15:09:54 +02007786 return;
7787
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007788 if( minor < MBEDTLS_SSL_MINOR_VERSION_0 || minor > MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker8f4ddae2013-04-15 15:09:54 +02007789 return;
7790
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007791 conf->ciphersuite_list[minor] = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00007792}
7793
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007794#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02007795void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01007796 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02007797{
7798 conf->cert_profile = profile;
7799}
7800
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02007801/* Append a new keycert entry to a (possibly empty) list */
7802static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
7803 mbedtls_x509_crt *cert,
7804 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007805{
niisato8ee24222018-06-25 19:05:48 +09007806 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007807
niisato8ee24222018-06-25 19:05:48 +09007808 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
7809 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02007810 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007811
niisato8ee24222018-06-25 19:05:48 +09007812 new_cert->cert = cert;
7813 new_cert->key = key;
7814 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007815
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02007816 /* Update head is the list was null, else add to the end */
7817 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01007818 {
niisato8ee24222018-06-25 19:05:48 +09007819 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01007820 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007821 else
7822 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02007823 mbedtls_ssl_key_cert *cur = *head;
7824 while( cur->next != NULL )
7825 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09007826 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007827 }
7828
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02007829 return( 0 );
7830}
7831
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007832int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02007833 mbedtls_x509_crt *own_cert,
7834 mbedtls_pk_context *pk_key )
7835{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02007836 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007837}
7838
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007839void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01007840 mbedtls_x509_crt *ca_chain,
7841 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007842{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01007843 conf->ca_chain = ca_chain;
7844 conf->ca_crl = ca_crl;
Paul Bakker5121ce52009-01-03 21:22:43 +00007845}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007846#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00007847
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02007848#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7849int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
7850 mbedtls_x509_crt *own_cert,
7851 mbedtls_pk_context *pk_key )
7852{
7853 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
7854 own_cert, pk_key ) );
7855}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02007856
7857void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
7858 mbedtls_x509_crt *ca_chain,
7859 mbedtls_x509_crl *ca_crl )
7860{
7861 ssl->handshake->sni_ca_chain = ca_chain;
7862 ssl->handshake->sni_ca_crl = ca_crl;
7863}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02007864
7865void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
7866 int authmode )
7867{
7868 ssl->handshake->sni_authmode = authmode;
7869}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02007870#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
7871
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02007872#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02007873/*
7874 * Set EC J-PAKE password for current handshake
7875 */
7876int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
7877 const unsigned char *pw,
7878 size_t pw_len )
7879{
7880 mbedtls_ecjpake_role role;
7881
Janos Follath8eb64132016-06-03 15:40:57 +01007882 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02007883 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7884
7885 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
7886 role = MBEDTLS_ECJPAKE_SERVER;
7887 else
7888 role = MBEDTLS_ECJPAKE_CLIENT;
7889
7890 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
7891 role,
7892 MBEDTLS_MD_SHA256,
7893 MBEDTLS_ECP_DP_SECP256R1,
7894 pw, pw_len ) );
7895}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02007896#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02007897
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007898#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007899int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01007900 const unsigned char *psk, size_t psk_len,
7901 const unsigned char *psk_identity, size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02007902{
Paul Bakker6db455e2013-09-18 17:29:31 +02007903 if( psk == NULL || psk_identity == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007904 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker6db455e2013-09-18 17:29:31 +02007905
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007906 if( psk_len > MBEDTLS_PSK_MAX_LEN )
7907 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01007908
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02007909 /* Identity len will be encoded on two bytes */
7910 if( ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10007911 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02007912 {
7913 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7914 }
7915
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01007916 if( conf->psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02007917 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05007918 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01007919
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01007920 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02007921 conf->psk = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01007922 conf->psk_len = 0;
7923 }
7924 if( conf->psk_identity != NULL )
7925 {
7926 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02007927 conf->psk_identity = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01007928 conf->psk_identity_len = 0;
Paul Bakker6db455e2013-09-18 17:29:31 +02007929 }
7930
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02007931 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
7932 ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
Mansour Moufidf81088b2015-02-17 13:10:21 -05007933 {
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01007934 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02007935 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01007936 conf->psk = NULL;
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02007937 conf->psk_identity = NULL;
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02007938 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Mansour Moufidf81088b2015-02-17 13:10:21 -05007939 }
Paul Bakker6db455e2013-09-18 17:29:31 +02007940
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01007941 conf->psk_len = psk_len;
7942 conf->psk_identity_len = psk_identity_len;
Paul Bakker6db455e2013-09-18 17:29:31 +02007943
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01007944 memcpy( conf->psk, psk, conf->psk_len );
7945 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker6db455e2013-09-18 17:29:31 +02007946
7947 return( 0 );
7948}
7949
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01007950int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
7951 const unsigned char *psk, size_t psk_len )
7952{
7953 if( psk == NULL || ssl->handshake == NULL )
7954 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7955
7956 if( psk_len > MBEDTLS_PSK_MAX_LEN )
7957 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7958
7959 if( ssl->handshake->psk != NULL )
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01007960 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05007961 mbedtls_platform_zeroize( ssl->handshake->psk,
7962 ssl->handshake->psk_len );
Simon Butcher5b8d1d62015-10-04 22:06:51 +01007963 mbedtls_free( ssl->handshake->psk );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01007964 ssl->handshake->psk_len = 0;
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01007965 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01007966
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02007967 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02007968 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01007969
7970 ssl->handshake->psk_len = psk_len;
7971 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
7972
7973 return( 0 );
7974}
7975
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007976void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007977 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
Paul Bakker6db455e2013-09-18 17:29:31 +02007978 size_t),
7979 void *p_psk )
7980{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007981 conf->f_psk = f_psk;
7982 conf->p_psk = p_psk;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02007983}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007984#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakker43b7e352011-01-18 15:27:19 +00007985
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02007986#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker470a8c42017-10-04 15:28:46 +01007987
7988#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007989int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G )
Paul Bakker5121ce52009-01-03 21:22:43 +00007990{
7991 int ret;
7992
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01007993 if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 ||
7994 ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
7995 {
7996 mbedtls_mpi_free( &conf->dhm_P );
7997 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker5121ce52009-01-03 21:22:43 +00007998 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01007999 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008000
8001 return( 0 );
8002}
Hanno Becker470a8c42017-10-04 15:28:46 +01008003#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker5121ce52009-01-03 21:22:43 +00008004
Hanno Beckera90658f2017-10-04 15:29:08 +01008005int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
8006 const unsigned char *dhm_P, size_t P_len,
8007 const unsigned char *dhm_G, size_t G_len )
8008{
8009 int ret;
8010
8011 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
8012 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
8013 {
8014 mbedtls_mpi_free( &conf->dhm_P );
8015 mbedtls_mpi_free( &conf->dhm_G );
8016 return( ret );
8017 }
8018
8019 return( 0 );
8020}
Paul Bakker5121ce52009-01-03 21:22:43 +00008021
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008022int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00008023{
8024 int ret;
8025
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01008026 if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 ||
8027 ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
8028 {
8029 mbedtls_mpi_free( &conf->dhm_P );
8030 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00008031 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01008032 }
Paul Bakker1b57b062011-01-06 15:48:19 +00008033
8034 return( 0 );
8035}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02008036#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00008037
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02008038#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
8039/*
8040 * Set the minimum length for Diffie-Hellman parameters
8041 */
8042void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
8043 unsigned int bitlen )
8044{
8045 conf->dhm_min_bitlen = bitlen;
8046}
8047#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
8048
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02008049#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02008050/*
8051 * Set allowed/preferred hashes for handshake signatures
8052 */
8053void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
8054 const int *hashes )
8055{
8056 conf->sig_hashes = hashes;
8057}
Hanno Becker947194e2017-04-07 13:25:49 +01008058#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02008059
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02008060#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01008061/*
8062 * Set the allowed elliptic curves
8063 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008064void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008065 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01008066{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008067 conf->curve_list = curve_list;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01008068}
Hanno Becker947194e2017-04-07 13:25:49 +01008069#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01008070
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01008071#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008072int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00008073{
Hanno Becker947194e2017-04-07 13:25:49 +01008074 /* Initialize to suppress unnecessary compiler warning */
8075 size_t hostname_len = 0;
8076
8077 /* Check if new hostname is valid before
8078 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01008079 if( hostname != NULL )
8080 {
8081 hostname_len = strlen( hostname );
8082
8083 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
8084 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8085 }
8086
8087 /* Now it's clear that we will overwrite the old hostname,
8088 * so we can free it safely */
8089
8090 if( ssl->hostname != NULL )
8091 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05008092 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01008093 mbedtls_free( ssl->hostname );
8094 }
8095
8096 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01008097
Paul Bakker5121ce52009-01-03 21:22:43 +00008098 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01008099 {
8100 ssl->hostname = NULL;
8101 }
8102 else
8103 {
8104 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01008105 if( ssl->hostname == NULL )
8106 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02008107
Hanno Becker947194e2017-04-07 13:25:49 +01008108 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02008109
Hanno Becker947194e2017-04-07 13:25:49 +01008110 ssl->hostname[hostname_len] = '\0';
8111 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008112
8113 return( 0 );
8114}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01008115#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00008116
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01008117#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008118void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008119 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00008120 const unsigned char *, size_t),
8121 void *p_sni )
8122{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008123 conf->f_sni = f_sni;
8124 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00008125}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008126#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00008127
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008128#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008129int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02008130{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02008131 size_t cur_len, tot_len;
8132 const char **p;
8133
8134 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08008135 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
8136 * MUST NOT be truncated."
8137 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02008138 */
8139 tot_len = 0;
8140 for( p = protos; *p != NULL; p++ )
8141 {
8142 cur_len = strlen( *p );
8143 tot_len += cur_len;
8144
8145 if( cur_len == 0 || cur_len > 255 || tot_len > 65535 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008146 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02008147 }
8148
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008149 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02008150
8151 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02008152}
8153
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008154const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02008155{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02008156 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02008157}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008158#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02008159
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02008160void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00008161{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008162 conf->max_major_ver = major;
8163 conf->max_minor_ver = minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00008164}
8165
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02008166void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00008167{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008168 conf->min_major_ver = major;
8169 conf->min_minor_ver = minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00008170}
8171
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008172#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008173void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback )
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02008174{
Manuel Pégourié-Gonnard684b0592015-05-06 09:27:31 +01008175 conf->fallback = fallback;
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02008176}
8177#endif
8178
Janos Follath088ce432017-04-10 12:42:31 +01008179#if defined(MBEDTLS_SSL_SRV_C)
8180void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
8181 char cert_req_ca_list )
8182{
8183 conf->cert_req_ca_list = cert_req_ca_list;
8184}
8185#endif
8186
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008187#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008188void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01008189{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008190 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01008191}
8192#endif
8193
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008194#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008195void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02008196{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008197 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02008198}
8199#endif
8200
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02008201#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008202void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 )
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01008203{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008204 conf->arc4_disabled = arc4;
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01008205}
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02008206#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01008207
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008208#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008209int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02008210{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008211 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10008212 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02008213 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008214 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02008215 }
8216
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01008217 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02008218
8219 return( 0 );
8220}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008221#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02008222
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008223#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02008224void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate )
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02008225{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008226 conf->trunc_hmac = truncate;
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02008227}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008228#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02008229
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008230#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008231void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01008232{
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01008233 conf->cbc_record_splitting = split;
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01008234}
8235#endif
8236
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008237void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00008238{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008239 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00008240}
8241
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008242#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008243void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008244{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008245 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01008246}
8247
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008248void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02008249{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008250 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02008251}
8252
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02008253void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01008254 const unsigned char period[8] )
8255{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02008256 memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01008257}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008258#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00008259
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008260#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02008261#if defined(MBEDTLS_SSL_CLI_C)
8262void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02008263{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01008264 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02008265}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02008266#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02008267
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02008268#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02008269void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
8270 mbedtls_ssl_ticket_write_t *f_ticket_write,
8271 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
8272 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +02008273{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02008274 conf->f_ticket_write = f_ticket_write;
8275 conf->f_ticket_parse = f_ticket_parse;
8276 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02008277}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02008278#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008279#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02008280
Robert Cragie4feb7ae2015-10-02 13:33:37 +01008281#if defined(MBEDTLS_SSL_EXPORT_KEYS)
8282void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
8283 mbedtls_ssl_export_keys_t *f_export_keys,
8284 void *p_export_keys )
8285{
8286 conf->f_export_keys = f_export_keys;
8287 conf->p_export_keys = p_export_keys;
8288}
8289#endif
8290
Gilles Peskineb74a1c72018-04-24 13:09:22 +02008291#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01008292void mbedtls_ssl_conf_async_private_cb(
8293 mbedtls_ssl_config *conf,
8294 mbedtls_ssl_async_sign_t *f_async_sign,
8295 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
8296 mbedtls_ssl_async_resume_t *f_async_resume,
8297 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02008298 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +01008299{
8300 conf->f_async_sign_start = f_async_sign;
8301 conf->f_async_decrypt_start = f_async_decrypt;
8302 conf->f_async_resume = f_async_resume;
8303 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02008304 conf->p_async_config_data = async_config_data;
8305}
8306
Gilles Peskine8f97af72018-04-26 11:46:10 +02008307void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
8308{
8309 return( conf->p_async_config_data );
8310}
8311
Gilles Peskine1febfef2018-04-30 11:54:39 +02008312void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02008313{
8314 if( ssl->handshake == NULL )
8315 return( NULL );
8316 else
8317 return( ssl->handshake->user_async_ctx );
8318}
8319
Gilles Peskine1febfef2018-04-30 11:54:39 +02008320void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02008321 void *ctx )
8322{
8323 if( ssl->handshake != NULL )
8324 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +01008325}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02008326#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01008327
Paul Bakker5121ce52009-01-03 21:22:43 +00008328/*
8329 * SSL get accessors
8330 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008331size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008332{
8333 return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
8334}
8335
Hanno Becker8b170a02017-10-10 11:51:19 +01008336int mbedtls_ssl_check_pending( const mbedtls_ssl_context *ssl )
8337{
8338 /*
8339 * Case A: We're currently holding back
8340 * a message for further processing.
8341 */
8342
8343 if( ssl->keep_current_message == 1 )
8344 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01008345 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: record held back for processing" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01008346 return( 1 );
8347 }
8348
8349 /*
8350 * Case B: Further records are pending in the current datagram.
8351 */
8352
8353#if defined(MBEDTLS_SSL_PROTO_DTLS)
8354 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
8355 ssl->in_left > ssl->next_record_offset )
8356 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01008357 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more records within current datagram" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01008358 return( 1 );
8359 }
8360#endif /* MBEDTLS_SSL_PROTO_DTLS */
8361
8362 /*
8363 * Case C: A handshake message is being processed.
8364 */
8365
Hanno Becker8b170a02017-10-10 11:51:19 +01008366 if( ssl->in_hslen > 0 && ssl->in_hslen < ssl->in_msglen )
8367 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01008368 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more handshake messages within current record" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01008369 return( 1 );
8370 }
8371
8372 /*
8373 * Case D: An application data message is being processed
8374 */
8375 if( ssl->in_offt != NULL )
8376 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01008377 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: application data record is being processed" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01008378 return( 1 );
8379 }
8380
8381 /*
8382 * In all other cases, the rest of the message can be dropped.
Hanno Beckerc573ac32018-08-28 17:15:25 +01008383 * As in ssl_get_next_record, this needs to be adapted if
Hanno Becker8b170a02017-10-10 11:51:19 +01008384 * we implement support for multiple alerts in single records.
8385 */
8386
8387 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: nothing pending" ) );
8388 return( 0 );
8389}
8390
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02008391uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008392{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00008393 if( ssl->session != NULL )
8394 return( ssl->session->verify_result );
8395
8396 if( ssl->session_negotiate != NULL )
8397 return( ssl->session_negotiate->verify_result );
8398
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +02008399 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +00008400}
8401
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008402const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +00008403{
Paul Bakker926c8e42013-03-06 10:23:34 +01008404 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02008405 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +01008406
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008407 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
Paul Bakker72f62662011-01-16 21:27:44 +00008408}
8409
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008410const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +00008411{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008412#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008413 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01008414 {
8415 switch( ssl->minor_ver )
8416 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008417 case MBEDTLS_SSL_MINOR_VERSION_2:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01008418 return( "DTLSv1.0" );
8419
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008420 case MBEDTLS_SSL_MINOR_VERSION_3:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01008421 return( "DTLSv1.2" );
8422
8423 default:
8424 return( "unknown (DTLS)" );
8425 }
8426 }
8427#endif
8428
Paul Bakker43ca69c2011-01-15 17:35:19 +00008429 switch( ssl->minor_ver )
8430 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008431 case MBEDTLS_SSL_MINOR_VERSION_0:
Paul Bakker43ca69c2011-01-15 17:35:19 +00008432 return( "SSLv3.0" );
8433
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008434 case MBEDTLS_SSL_MINOR_VERSION_1:
Paul Bakker43ca69c2011-01-15 17:35:19 +00008435 return( "TLSv1.0" );
8436
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008437 case MBEDTLS_SSL_MINOR_VERSION_2:
Paul Bakker43ca69c2011-01-15 17:35:19 +00008438 return( "TLSv1.1" );
8439
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008440 case MBEDTLS_SSL_MINOR_VERSION_3:
Paul Bakker1ef83d62012-04-11 12:09:53 +00008441 return( "TLSv1.2" );
8442
Paul Bakker43ca69c2011-01-15 17:35:19 +00008443 default:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01008444 return( "unknown" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00008445 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00008446}
8447
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008448int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02008449{
Hanno Becker3136ede2018-08-17 15:28:19 +01008450 size_t transform_expansion = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008451 const mbedtls_ssl_transform *transform = ssl->transform_out;
Hanno Becker5b559ac2018-08-03 09:40:07 +01008452 unsigned block_size;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02008453
Hanno Becker43395762019-05-03 14:46:38 +01008454 size_t out_hdr_len = mbedtls_ssl_out_hdr_len( ssl );
8455
Hanno Becker78640902018-08-13 16:35:15 +01008456 if( transform == NULL )
Hanno Becker43395762019-05-03 14:46:38 +01008457 return( (int) out_hdr_len );
Hanno Becker78640902018-08-13 16:35:15 +01008458
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008459#if defined(MBEDTLS_ZLIB_SUPPORT)
8460 if( ssl->session_out->compression != MBEDTLS_SSL_COMPRESS_NULL )
8461 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02008462#endif
8463
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008464 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02008465 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008466 case MBEDTLS_MODE_GCM:
8467 case MBEDTLS_MODE_CCM:
Hanno Becker5b559ac2018-08-03 09:40:07 +01008468 case MBEDTLS_MODE_CHACHAPOLY:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008469 case MBEDTLS_MODE_STREAM:
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02008470 transform_expansion = transform->minlen;
8471 break;
8472
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008473 case MBEDTLS_MODE_CBC:
Hanno Becker5b559ac2018-08-03 09:40:07 +01008474
8475 block_size = mbedtls_cipher_get_block_size(
8476 &transform->cipher_ctx_enc );
8477
Hanno Becker3136ede2018-08-17 15:28:19 +01008478 /* Expansion due to the addition of the MAC. */
8479 transform_expansion += transform->maclen;
8480
8481 /* Expansion due to the addition of CBC padding;
8482 * Theoretically up to 256 bytes, but we never use
8483 * more than the block size of the underlying cipher. */
8484 transform_expansion += block_size;
8485
8486 /* For TLS 1.1 or higher, an explicit IV is added
8487 * after the record header. */
Hanno Becker5b559ac2018-08-03 09:40:07 +01008488#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
8489 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Hanno Becker3136ede2018-08-17 15:28:19 +01008490 transform_expansion += block_size;
Hanno Becker5b559ac2018-08-03 09:40:07 +01008491#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker3136ede2018-08-17 15:28:19 +01008492
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02008493 break;
8494
8495 default:
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02008496 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008497 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02008498 }
8499
Hanno Beckeradd01902019-05-08 15:40:11 +01008500#if defined(MBEDTLS_SSL_CID)
8501 if( transform->out_cid_len != 0 )
8502 transform_expansion += MBEDTLS_SSL_MAX_CID_EXPANSION;
8503#endif /* MBEDTLS_SSL_CID */
8504
Hanno Becker43395762019-05-03 14:46:38 +01008505 return( (int)( out_hdr_len + transform_expansion ) );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02008506}
8507
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02008508#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8509size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
8510{
8511 size_t max_len;
8512
8513 /*
8514 * Assume mfl_code is correct since it was checked when set
8515 */
Angus Grattond8213d02016-05-25 20:56:48 +10008516 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02008517
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02008518 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02008519 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +10008520 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02008521 {
Angus Grattond8213d02016-05-25 20:56:48 +10008522 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02008523 }
8524
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02008525 /* During a handshake, use the value being negotiated */
8526 if( ssl->session_negotiate != NULL &&
8527 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
8528 {
8529 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
8530 }
8531
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008532 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02008533}
8534#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
8535
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02008536#if defined(MBEDTLS_SSL_PROTO_DTLS)
8537static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
8538{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04008539 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
8540 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
8541 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
8542 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
8543 return ( 0 );
8544
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02008545 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
8546 return( ssl->mtu );
8547
8548 if( ssl->mtu == 0 )
8549 return( ssl->handshake->mtu );
8550
8551 return( ssl->mtu < ssl->handshake->mtu ?
8552 ssl->mtu : ssl->handshake->mtu );
8553}
8554#endif /* MBEDTLS_SSL_PROTO_DTLS */
8555
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008556int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
8557{
8558 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
8559
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02008560#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
8561 !defined(MBEDTLS_SSL_PROTO_DTLS)
8562 (void) ssl;
8563#endif
8564
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008565#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8566 const size_t mfl = mbedtls_ssl_get_max_frag_len( ssl );
8567
8568 if( max_len > mfl )
8569 max_len = mfl;
8570#endif
8571
8572#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02008573 if( ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008574 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02008575 const size_t mtu = ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008576 const int ret = mbedtls_ssl_get_record_expansion( ssl );
8577 const size_t overhead = (size_t) ret;
8578
8579 if( ret < 0 )
8580 return( ret );
8581
8582 if( mtu <= overhead )
8583 {
8584 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
8585 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
8586 }
8587
8588 if( max_len > mtu - overhead )
8589 max_len = mtu - overhead;
8590 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02008591#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008592
Hanno Becker0defedb2018-08-10 12:35:02 +01008593#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
8594 !defined(MBEDTLS_SSL_PROTO_DTLS)
8595 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008596#endif
8597
8598 return( (int) max_len );
8599}
8600
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008601#if defined(MBEDTLS_X509_CRT_PARSE_C)
8602const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +00008603{
8604 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02008605 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +00008606
Paul Bakkerd8bb8262014-06-17 14:06:49 +02008607 return( ssl->session->peer_cert );
Paul Bakkerb0550d92012-10-30 07:51:03 +00008608}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008609#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00008610
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008611#if defined(MBEDTLS_SSL_CLI_C)
8612int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl, mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02008613{
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02008614 if( ssl == NULL ||
8615 dst == NULL ||
8616 ssl->session == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008617 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02008618 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008619 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02008620 }
8621
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02008622 return( ssl_session_copy( dst, ssl->session ) );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02008623}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008624#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02008625
Paul Bakker5121ce52009-01-03 21:22:43 +00008626/*
Paul Bakker1961b702013-01-25 14:49:24 +01008627 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00008628 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008629int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008630{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008631 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker5121ce52009-01-03 21:22:43 +00008632
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02008633 if( ssl == NULL || ssl->conf == NULL )
8634 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8635
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008636#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008637 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008638 ret = mbedtls_ssl_handshake_client_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00008639#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008640#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008641 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008642 ret = mbedtls_ssl_handshake_server_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00008643#endif
8644
Paul Bakker1961b702013-01-25 14:49:24 +01008645 return( ret );
8646}
8647
8648/*
8649 * Perform the SSL handshake
8650 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008651int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +01008652{
8653 int ret = 0;
8654
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02008655 if( ssl == NULL || ssl->conf == NULL )
8656 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8657
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008658 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +01008659
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008660 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker1961b702013-01-25 14:49:24 +01008661 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008662 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01008663
8664 if( ret != 0 )
8665 break;
8666 }
8667
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008668 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008669
8670 return( ret );
8671}
8672
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008673#if defined(MBEDTLS_SSL_RENEGOTIATION)
8674#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00008675/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008676 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00008677 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008678static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008679{
8680 int ret;
8681
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008682 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008683
8684 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008685 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
8686 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008687
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008688 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008689 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008690 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008691 return( ret );
8692 }
8693
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008694 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008695
8696 return( 0 );
8697}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008698#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008699
8700/*
8701 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008702 * - any side: calling mbedtls_ssl_renegotiate(),
8703 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
8704 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02008705 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008706 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008707 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008708 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008709static int ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00008710{
8711 int ret;
8712
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008713 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008714
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008715 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
8716 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00008717
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02008718 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
8719 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008720#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008721 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008722 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02008723 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008724 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02008725 ssl->handshake->out_msg_seq = 1;
8726 else
8727 ssl->handshake->in_msg_seq = 1;
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02008728 }
8729#endif
8730
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008731 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
8732 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00008733
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008734 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00008735 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008736 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +00008737 return( ret );
8738 }
8739
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008740 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008741
8742 return( 0 );
8743}
8744
8745/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008746 * Renegotiate current connection on client,
8747 * or request renegotiation on server
8748 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008749int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008750{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008751 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008752
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02008753 if( ssl == NULL || ssl->conf == NULL )
8754 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8755
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008756#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008757 /* On server, just send the request */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008758 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008759 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008760 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
8761 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008762
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008763 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02008764
8765 /* Did we already try/start sending HelloRequest? */
8766 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008767 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02008768
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008769 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008770 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008771#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008772
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008773#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008774 /*
8775 * On client, either start the renegotiation process or,
8776 * if already in progress, continue the handshake
8777 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008778 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008779 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008780 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
8781 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008782
8783 if( ( ret = ssl_start_renegotiation( ssl ) ) != 0 )
8784 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008785 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008786 return( ret );
8787 }
8788 }
8789 else
8790 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008791 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008792 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008793 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008794 return( ret );
8795 }
8796 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008797#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008798
Paul Bakker37ce0ff2013-10-31 14:32:04 +01008799 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008800}
8801
8802/*
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008803 * Check record counters and renegotiate if they're above the limit.
8804 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008805static int ssl_check_ctr_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008806{
Andres AG2196c7f2016-12-15 17:01:16 +00008807 size_t ep_len = ssl_ep_len( ssl );
8808 int in_ctr_cmp;
8809 int out_ctr_cmp;
8810
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008811 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ||
8812 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008813 ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008814 {
8815 return( 0 );
8816 }
8817
Andres AG2196c7f2016-12-15 17:01:16 +00008818 in_ctr_cmp = memcmp( ssl->in_ctr + ep_len,
8819 ssl->conf->renego_period + ep_len, 8 - ep_len );
Hanno Becker19859472018-08-06 09:40:20 +01008820 out_ctr_cmp = memcmp( ssl->cur_out_ctr + ep_len,
Andres AG2196c7f2016-12-15 17:01:16 +00008821 ssl->conf->renego_period + ep_len, 8 - ep_len );
8822
8823 if( in_ctr_cmp <= 0 && out_ctr_cmp <= 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008824 {
8825 return( 0 );
8826 }
8827
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02008828 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008829 return( mbedtls_ssl_renegotiate( ssl ) );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008830}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008831#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00008832
8833/*
8834 * Receive application data decrypted from the SSL layer
8835 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008836int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +00008837{
Hanno Becker4a810fb2017-05-24 16:27:30 +01008838 int ret;
Paul Bakker23986e52011-04-24 08:57:21 +00008839 size_t n;
Paul Bakker5121ce52009-01-03 21:22:43 +00008840
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02008841 if( ssl == NULL || ssl->conf == NULL )
8842 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8843
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008844 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008845
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008846#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008847 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008848 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008849 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008850 return( ret );
8851
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02008852 if( ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008853 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02008854 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02008855 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02008856 return( ret );
8857 }
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008858 }
8859#endif
8860
Hanno Becker4a810fb2017-05-24 16:27:30 +01008861 /*
8862 * Check if renegotiation is necessary and/or handshake is
8863 * in process. If yes, perform/continue, and fall through
8864 * if an unexpected packet is received while the client
8865 * is waiting for the ServerHello.
8866 *
8867 * (There is no equivalent to the last condition on
8868 * the server-side as it is not treated as within
8869 * a handshake while waiting for the ClientHello
8870 * after a renegotiation request.)
8871 */
8872
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008873#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +01008874 ret = ssl_check_ctr_renegotiate( ssl );
8875 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
8876 ret != 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008877 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008878 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008879 return( ret );
8880 }
8881#endif
8882
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008883 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00008884 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008885 ret = mbedtls_ssl_handshake( ssl );
Hanno Becker4a810fb2017-05-24 16:27:30 +01008886 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
8887 ret != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008888 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008889 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008890 return( ret );
8891 }
8892 }
8893
Hanno Beckere41158b2017-10-23 13:30:32 +01008894 /* Loop as long as no application data record is available */
Hanno Becker90333da2017-10-10 11:27:13 +01008895 while( ssl->in_offt == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00008896 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02008897 /* Start timer if not already running */
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +02008898 if( ssl->f_get_timer != NULL &&
8899 ssl->f_get_timer( ssl->p_timer ) == -1 )
8900 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008901 ssl_set_timer( ssl, ssl->conf->read_timeout );
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +02008902 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02008903
Hanno Becker327c93b2018-08-15 13:56:18 +01008904 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008905 {
Hanno Becker4a810fb2017-05-24 16:27:30 +01008906 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
8907 return( 0 );
Paul Bakker831a7552011-05-18 13:32:51 +00008908
Hanno Becker4a810fb2017-05-24 16:27:30 +01008909 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
8910 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008911 }
8912
8913 if( ssl->in_msglen == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008914 ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +00008915 {
8916 /*
8917 * OpenSSL sends empty messages to randomize the IV
8918 */
Hanno Becker327c93b2018-08-15 13:56:18 +01008919 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008920 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008921 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
Paul Bakker831a7552011-05-18 13:32:51 +00008922 return( 0 );
8923
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008924 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008925 return( ret );
8926 }
8927 }
8928
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008929 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker48916f92012-09-16 19:57:18 +00008930 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008931 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received handshake message" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008932
Hanno Becker4a810fb2017-05-24 16:27:30 +01008933 /*
8934 * - For client-side, expect SERVER_HELLO_REQUEST.
8935 * - For server-side, expect CLIENT_HELLO.
8936 * - Fail (TLS) or silently drop record (DTLS) in other cases.
8937 */
8938
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008939#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008940 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008941 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST ||
Hanno Becker4a810fb2017-05-24 16:27:30 +01008942 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ) )
Paul Bakker48916f92012-09-16 19:57:18 +00008943 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008944 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008945
8946 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008947#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008948 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Hanno Becker90333da2017-10-10 11:27:13 +01008949 {
8950 continue;
8951 }
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008952#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008953 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008954 }
Hanno Becker4a810fb2017-05-24 16:27:30 +01008955#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008956
Hanno Becker4a810fb2017-05-24 16:27:30 +01008957#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008958 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008959 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008960 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008961 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008962
8963 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008964#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008965 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Hanno Becker90333da2017-10-10 11:27:13 +01008966 {
8967 continue;
8968 }
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008969#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008970 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker48916f92012-09-16 19:57:18 +00008971 }
Hanno Becker4a810fb2017-05-24 16:27:30 +01008972#endif /* MBEDTLS_SSL_SRV_C */
8973
Hanno Becker21df7f92017-10-17 11:03:26 +01008974#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +01008975 /* Determine whether renegotiation attempt should be accepted */
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +01008976 if( ! ( ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
8977 ( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
8978 ssl->conf->allow_legacy_renegotiation ==
8979 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) ) )
8980 {
8981 /*
8982 * Accept renegotiation request
8983 */
Paul Bakker48916f92012-09-16 19:57:18 +00008984
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +01008985 /* DTLS clients need to know renego is server-initiated */
8986#if defined(MBEDTLS_SSL_PROTO_DTLS)
8987 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
8988 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
8989 {
8990 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
8991 }
8992#endif
8993 ret = ssl_start_renegotiation( ssl );
8994 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
8995 ret != 0 )
8996 {
8997 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
8998 return( ret );
8999 }
9000 }
9001 else
Hanno Becker21df7f92017-10-17 11:03:26 +01009002#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +00009003 {
Hanno Becker4a810fb2017-05-24 16:27:30 +01009004 /*
9005 * Refuse renegotiation
9006 */
9007
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009008 MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00009009
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009010#if defined(MBEDTLS_SSL_PROTO_SSL3)
9011 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker48916f92012-09-16 19:57:18 +00009012 {
Gilles Peskine92e44262017-05-10 17:27:49 +02009013 /* SSLv3 does not have a "no_renegotiation" warning, so
9014 we send a fatal alert and abort the connection. */
9015 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
9016 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
9017 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00009018 }
9019 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009020#endif /* MBEDTLS_SSL_PROTO_SSL3 */
9021#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
9022 defined(MBEDTLS_SSL_PROTO_TLS1_2)
9023 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00009024 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009025 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
9026 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
9027 MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00009028 {
9029 return( ret );
9030 }
Paul Bakker48916f92012-09-16 19:57:18 +00009031 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02009032 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009033#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 ||
9034 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02009035 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009036 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
9037 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02009038 }
Paul Bakker48916f92012-09-16 19:57:18 +00009039 }
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02009040
Hanno Becker90333da2017-10-10 11:27:13 +01009041 /* At this point, we don't know whether the renegotiation has been
9042 * completed or not. The cases to consider are the following:
9043 * 1) The renegotiation is complete. In this case, no new record
9044 * has been read yet.
9045 * 2) The renegotiation is incomplete because the client received
9046 * an application data record while awaiting the ServerHello.
9047 * 3) The renegotiation is incomplete because the client received
9048 * a non-handshake, non-application data message while awaiting
9049 * the ServerHello.
9050 * In each of these case, looping will be the proper action:
9051 * - For 1), the next iteration will read a new record and check
9052 * if it's application data.
9053 * - For 2), the loop condition isn't satisfied as application data
9054 * is present, hence continue is the same as break
9055 * - For 3), the loop condition is satisfied and read_record
9056 * will re-deliver the message that was held back by the client
9057 * when expecting the ServerHello.
9058 */
9059 continue;
Paul Bakker48916f92012-09-16 19:57:18 +00009060 }
Hanno Becker21df7f92017-10-17 11:03:26 +01009061#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009062 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +01009063 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02009064 if( ssl->conf->renego_max_records >= 0 )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02009065 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02009066 if( ++ssl->renego_records_seen > ssl->conf->renego_max_records )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02009067 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009068 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02009069 "but not honored by client" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009070 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02009071 }
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02009072 }
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +01009073 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009074#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02009075
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009076 /* Fatal and closure alerts handled by mbedtls_ssl_read_record() */
9077 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02009078 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009079 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01009080 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02009081 }
9082
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009083 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +00009084 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009085 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
9086 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00009087 }
9088
9089 ssl->in_offt = ssl->in_msg;
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02009090
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02009091 /* We're going to return something now, cancel timer,
9092 * except if handshake (renegotiation) is in progress */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009093 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02009094 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02009095
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02009096#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02009097 /* If we requested renego but received AppData, resend HelloRequest.
9098 * Do it now, after setting in_offt, to avoid taking this branch
9099 * again if ssl_write_hello_request() returns WANT_WRITE */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009100#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02009101 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009102 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02009103 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02009104 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02009105 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009106 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02009107 return( ret );
9108 }
9109 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009110#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker4a810fb2017-05-24 16:27:30 +01009111#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker5121ce52009-01-03 21:22:43 +00009112 }
9113
9114 n = ( len < ssl->in_msglen )
9115 ? len : ssl->in_msglen;
9116
9117 memcpy( buf, ssl->in_offt, n );
9118 ssl->in_msglen -= n;
9119
9120 if( ssl->in_msglen == 0 )
Hanno Becker4a810fb2017-05-24 16:27:30 +01009121 {
9122 /* all bytes consumed */
Paul Bakker5121ce52009-01-03 21:22:43 +00009123 ssl->in_offt = NULL;
Hanno Beckerbdf39052017-06-09 10:42:03 +01009124 ssl->keep_current_message = 0;
Hanno Becker4a810fb2017-05-24 16:27:30 +01009125 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009126 else
Hanno Becker4a810fb2017-05-24 16:27:30 +01009127 {
Paul Bakker5121ce52009-01-03 21:22:43 +00009128 /* more data available */
9129 ssl->in_offt += n;
Hanno Becker4a810fb2017-05-24 16:27:30 +01009130 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009131
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009132 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00009133
Paul Bakker23986e52011-04-24 08:57:21 +00009134 return( (int) n );
Paul Bakker5121ce52009-01-03 21:22:43 +00009135}
9136
9137/*
Andres Amaya Garcia5b923522017-09-28 14:41:17 +01009138 * Send application data to be encrypted by the SSL layer, taking care of max
9139 * fragment length and buffer size.
9140 *
9141 * According to RFC 5246 Section 6.2.1:
9142 *
9143 * Zero-length fragments of Application data MAY be sent as they are
9144 * potentially useful as a traffic analysis countermeasure.
9145 *
9146 * Therefore, it is possible that the input message length is 0 and the
9147 * corresponding return code is 0 on success.
Paul Bakker5121ce52009-01-03 21:22:43 +00009148 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02009149static int ssl_write_real( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02009150 const unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +00009151{
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02009152 int ret = mbedtls_ssl_get_max_out_record_payload( ssl );
9153 const size_t max_len = (size_t) ret;
9154
9155 if( ret < 0 )
9156 {
9157 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_max_out_record_payload", ret );
9158 return( ret );
9159 }
9160
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02009161 if( len > max_len )
9162 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009163#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02009164 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02009165 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009166 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02009167 "maximum fragment length: %d > %d",
9168 len, max_len ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009169 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02009170 }
9171 else
9172#endif
9173 len = max_len;
9174 }
Paul Bakker887bd502011-06-08 13:10:54 +00009175
Paul Bakker5121ce52009-01-03 21:22:43 +00009176 if( ssl->out_left != 0 )
9177 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +01009178 /*
9179 * The user has previously tried to send the data and
9180 * MBEDTLS_ERR_SSL_WANT_WRITE or the message was only partially
9181 * written. In this case, we expect the high-level write function
9182 * (e.g. mbedtls_ssl_write()) to be called with the same parameters
9183 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009184 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00009185 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009186 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00009187 return( ret );
9188 }
9189 }
Paul Bakker887bd502011-06-08 13:10:54 +00009190 else
Paul Bakker1fd00bf2011-03-14 20:50:15 +00009191 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +01009192 /*
9193 * The user is trying to send a message the first time, so we need to
9194 * copy the data into the internal buffers and setup the data structure
9195 * to keep track of partial writes
9196 */
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02009197 ssl->out_msglen = len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009198 ssl->out_msgtype = MBEDTLS_SSL_MSG_APPLICATION_DATA;
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02009199 memcpy( ssl->out_msg, buf, len );
Paul Bakker887bd502011-06-08 13:10:54 +00009200
Hanno Becker67bc7c32018-08-06 11:33:50 +01009201 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Paul Bakker887bd502011-06-08 13:10:54 +00009202 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009203 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker887bd502011-06-08 13:10:54 +00009204 return( ret );
9205 }
Paul Bakker5121ce52009-01-03 21:22:43 +00009206 }
9207
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02009208 return( (int) len );
Paul Bakker5121ce52009-01-03 21:22:43 +00009209}
9210
9211/*
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01009212 * Write application data, doing 1/n-1 splitting if necessary.
9213 *
9214 * With non-blocking I/O, ssl_write_real() may return WANT_WRITE,
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009215 * then the caller will call us again with the same arguments, so
Hanno Becker2b187c42017-09-18 14:58:11 +01009216 * remember whether we already did the split or not.
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01009217 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009218#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02009219static int ssl_write_split( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02009220 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01009221{
9222 int ret;
9223
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01009224 if( ssl->conf->cbc_record_splitting ==
9225 MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED ||
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01009226 len <= 1 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009227 ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_1 ||
9228 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc )
9229 != MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01009230 {
9231 return( ssl_write_real( ssl, buf, len ) );
9232 }
9233
9234 if( ssl->split_done == 0 )
9235 {
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +01009236 if( ( ret = ssl_write_real( ssl, buf, 1 ) ) <= 0 )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01009237 return( ret );
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +01009238 ssl->split_done = 1;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01009239 }
9240
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +01009241 if( ( ret = ssl_write_real( ssl, buf + 1, len - 1 ) ) <= 0 )
9242 return( ret );
9243 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01009244
9245 return( ret + 1 );
9246}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009247#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01009248
9249/*
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02009250 * Write application data (public-facing wrapper)
9251 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02009252int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02009253{
9254 int ret;
9255
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02009256 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02009257
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02009258 if( ssl == NULL || ssl->conf == NULL )
9259 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9260
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02009261#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02009262 if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
9263 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02009264 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02009265 return( ret );
9266 }
9267#endif
9268
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02009269 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02009270 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02009271 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02009272 {
Manuel Pégourié-Gonnard151dc772015-05-14 13:55:51 +02009273 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02009274 return( ret );
9275 }
9276 }
9277
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02009278#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02009279 ret = ssl_write_split( ssl, buf, len );
9280#else
9281 ret = ssl_write_real( ssl, buf, len );
9282#endif
9283
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02009284 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02009285
9286 return( ret );
9287}
9288
9289/*
Paul Bakker5121ce52009-01-03 21:22:43 +00009290 * Notify the peer that the connection is being closed
9291 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009292int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00009293{
9294 int ret;
9295
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02009296 if( ssl == NULL || ssl->conf == NULL )
9297 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
9298
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009299 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00009300
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +02009301 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009302 return( mbedtls_ssl_flush_output( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00009303
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009304 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00009305 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009306 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
9307 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
9308 MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00009309 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009310 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00009311 return( ret );
9312 }
9313 }
9314
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009315 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00009316
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +02009317 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00009318}
9319
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009320void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform )
Paul Bakker48916f92012-09-16 19:57:18 +00009321{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02009322 if( transform == NULL )
9323 return;
9324
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009325#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00009326 deflateEnd( &transform->ctx_deflate );
9327 inflateEnd( &transform->ctx_inflate );
9328#endif
9329
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009330 mbedtls_cipher_free( &transform->cipher_ctx_enc );
9331 mbedtls_cipher_free( &transform->cipher_ctx_dec );
Manuel Pégourié-Gonnardf71e5872013-09-23 17:12:43 +02009332
Hanno Becker92231322018-01-03 15:32:51 +00009333#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009334 mbedtls_md_free( &transform->md_ctx_enc );
9335 mbedtls_md_free( &transform->md_ctx_dec );
Hanno Becker92231322018-01-03 15:32:51 +00009336#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02009337
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009338 mbedtls_platform_zeroize( transform, sizeof( mbedtls_ssl_transform ) );
Paul Bakker48916f92012-09-16 19:57:18 +00009339}
9340
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009341#if defined(MBEDTLS_X509_CRT_PARSE_C)
9342static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02009343{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009344 mbedtls_ssl_key_cert *cur = key_cert, *next;
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02009345
9346 while( cur != NULL )
9347 {
9348 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009349 mbedtls_free( cur );
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02009350 cur = next;
9351 }
9352}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009353#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02009354
Hanno Becker0271f962018-08-16 13:23:47 +01009355#if defined(MBEDTLS_SSL_PROTO_DTLS)
9356
9357static void ssl_buffering_free( mbedtls_ssl_context *ssl )
9358{
9359 unsigned offset;
9360 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
9361
9362 if( hs == NULL )
9363 return;
9364
Hanno Becker283f5ef2018-08-24 09:34:47 +01009365 ssl_free_buffered_record( ssl );
9366
Hanno Becker0271f962018-08-16 13:23:47 +01009367 for( offset = 0; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
Hanno Beckere605b192018-08-21 15:59:07 +01009368 ssl_buffering_free_slot( ssl, offset );
9369}
9370
9371static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
9372 uint8_t slot )
9373{
9374 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
9375 mbedtls_ssl_hs_buffer * const hs_buf = &hs->buffering.hs[slot];
Hanno Beckerb309b922018-08-23 13:18:05 +01009376
9377 if( slot >= MBEDTLS_SSL_MAX_BUFFERED_HS )
9378 return;
9379
Hanno Beckere605b192018-08-21 15:59:07 +01009380 if( hs_buf->is_valid == 1 )
Hanno Becker0271f962018-08-16 13:23:47 +01009381 {
Hanno Beckere605b192018-08-21 15:59:07 +01009382 hs->buffering.total_bytes_buffered -= hs_buf->data_len;
Hanno Becker805f2e12018-10-12 16:31:41 +01009383 mbedtls_platform_zeroize( hs_buf->data, hs_buf->data_len );
Hanno Beckere605b192018-08-21 15:59:07 +01009384 mbedtls_free( hs_buf->data );
9385 memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Hanno Becker0271f962018-08-16 13:23:47 +01009386 }
9387}
9388
9389#endif /* MBEDTLS_SSL_PROTO_DTLS */
9390
Gilles Peskine9b562d52018-04-25 20:32:43 +02009391void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00009392{
Gilles Peskine9b562d52018-04-25 20:32:43 +02009393 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
9394
Paul Bakkeraccaffe2014-06-26 13:37:14 +02009395 if( handshake == NULL )
9396 return;
9397
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02009398#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
9399 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
9400 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02009401 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02009402 handshake->async_in_progress = 0;
9403 }
9404#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
9405
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02009406#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
9407 defined(MBEDTLS_SSL_PROTO_TLS1_1)
9408 mbedtls_md5_free( &handshake->fin_md5 );
9409 mbedtls_sha1_free( &handshake->fin_sha1 );
9410#endif
9411#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
9412#if defined(MBEDTLS_SHA256_C)
9413 mbedtls_sha256_free( &handshake->fin_sha256 );
9414#endif
9415#if defined(MBEDTLS_SHA512_C)
9416 mbedtls_sha512_free( &handshake->fin_sha512 );
9417#endif
9418#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
9419
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009420#if defined(MBEDTLS_DHM_C)
9421 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +00009422#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009423#if defined(MBEDTLS_ECDH_C)
9424 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +02009425#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02009426#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02009427 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02009428#if defined(MBEDTLS_SSL_CLI_C)
9429 mbedtls_free( handshake->ecjpake_cache );
9430 handshake->ecjpake_cache = NULL;
9431 handshake->ecjpake_cache_len = 0;
9432#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02009433#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02009434
Janos Follath4ae5c292016-02-10 11:27:43 +00009435#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
9436 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02009437 /* explicit void pointer cast for buggy MS compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009438 mbedtls_free( (void *) handshake->curves );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02009439#endif
9440
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009441#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
9442 if( handshake->psk != NULL )
9443 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009444 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01009445 mbedtls_free( handshake->psk );
9446 }
9447#endif
9448
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009449#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
9450 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02009451 /*
9452 * Free only the linked list wrapper, not the keys themselves
9453 * since the belong to the SNI callback
9454 */
9455 if( handshake->sni_key_cert != NULL )
9456 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009457 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02009458
9459 while( cur != NULL )
9460 {
9461 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009462 mbedtls_free( cur );
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02009463 cur = next;
9464 }
9465 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009466#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02009467
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02009468#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02009469 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02009470#endif
9471
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009472#if defined(MBEDTLS_SSL_PROTO_DTLS)
9473 mbedtls_free( handshake->verify_cookie );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02009474 ssl_flight_free( handshake->flight );
Hanno Becker0271f962018-08-16 13:23:47 +01009475 ssl_buffering_free( ssl );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02009476#endif
9477
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009478 mbedtls_platform_zeroize( handshake,
9479 sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakker48916f92012-09-16 19:57:18 +00009480}
9481
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009482void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +00009483{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02009484 if( session == NULL )
9485 return;
9486
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009487#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker0a597072012-09-25 21:55:46 +00009488 if( session->peer_cert != NULL )
Paul Bakker48916f92012-09-16 19:57:18 +00009489 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009490 mbedtls_x509_crt_free( session->peer_cert );
9491 mbedtls_free( session->peer_cert );
Paul Bakker48916f92012-09-16 19:57:18 +00009492 }
Paul Bakkered27a042013-04-18 22:46:23 +02009493#endif
Paul Bakker0a597072012-09-25 21:55:46 +00009494
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02009495#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009496 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +02009497#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02009498
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009499 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +00009500}
9501
Paul Bakker5121ce52009-01-03 21:22:43 +00009502/*
9503 * Free an SSL context
9504 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009505void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00009506{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02009507 if( ssl == NULL )
9508 return;
9509
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009510 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00009511
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01009512 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00009513 {
Angus Grattond8213d02016-05-25 20:56:48 +10009514 mbedtls_platform_zeroize( ssl->out_buf, MBEDTLS_SSL_OUT_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009515 mbedtls_free( ssl->out_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00009516 }
9517
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01009518 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00009519 {
Angus Grattond8213d02016-05-25 20:56:48 +10009520 mbedtls_platform_zeroize( ssl->in_buf, MBEDTLS_SSL_IN_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009521 mbedtls_free( ssl->in_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00009522 }
9523
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009524#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker16770332013-10-11 09:59:44 +02009525 if( ssl->compress_buf != NULL )
9526 {
Angus Grattond8213d02016-05-25 20:56:48 +10009527 mbedtls_platform_zeroize( ssl->compress_buf, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009528 mbedtls_free( ssl->compress_buf );
Paul Bakker16770332013-10-11 09:59:44 +02009529 }
9530#endif
9531
Paul Bakker48916f92012-09-16 19:57:18 +00009532 if( ssl->transform )
9533 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009534 mbedtls_ssl_transform_free( ssl->transform );
9535 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00009536 }
9537
9538 if( ssl->handshake )
9539 {
Gilles Peskine9b562d52018-04-25 20:32:43 +02009540 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009541 mbedtls_ssl_transform_free( ssl->transform_negotiate );
9542 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00009543
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009544 mbedtls_free( ssl->handshake );
9545 mbedtls_free( ssl->transform_negotiate );
9546 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00009547 }
9548
Paul Bakkerc0463502013-02-14 11:19:38 +01009549 if( ssl->session )
9550 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009551 mbedtls_ssl_session_free( ssl->session );
9552 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01009553 }
9554
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02009555#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker66d5d072014-06-17 16:39:18 +02009556 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00009557 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009558 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009559 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +00009560 }
Paul Bakker0be444a2013-08-27 21:55:01 +02009561#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00009562
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009563#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
9564 if( mbedtls_ssl_hw_record_finish != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00009565 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009566 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) );
9567 mbedtls_ssl_hw_record_finish( ssl );
Paul Bakker05ef8352012-05-08 09:17:57 +00009568 }
9569#endif
9570
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02009571#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009572 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02009573#endif
9574
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009575 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +00009576
Paul Bakker86f04f42013-02-14 11:20:09 +01009577 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009578 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00009579}
9580
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009581/*
9582 * Initialze mbedtls_ssl_config
9583 */
9584void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
9585{
9586 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
9587}
9588
Simon Butcherc97b6972015-12-27 23:48:17 +00009589#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01009590static int ssl_preset_default_hashes[] = {
9591#if defined(MBEDTLS_SHA512_C)
9592 MBEDTLS_MD_SHA512,
9593 MBEDTLS_MD_SHA384,
9594#endif
9595#if defined(MBEDTLS_SHA256_C)
9596 MBEDTLS_MD_SHA256,
9597 MBEDTLS_MD_SHA224,
9598#endif
Gilles Peskine5d2511c2017-05-12 13:16:40 +02009599#if defined(MBEDTLS_SHA1_C) && defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01009600 MBEDTLS_MD_SHA1,
9601#endif
9602 MBEDTLS_MD_NONE
9603};
Simon Butcherc97b6972015-12-27 23:48:17 +00009604#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01009605
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009606static int ssl_preset_suiteb_ciphersuites[] = {
9607 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
9608 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
9609 0
9610};
9611
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009612#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009613static int ssl_preset_suiteb_hashes[] = {
9614 MBEDTLS_MD_SHA256,
9615 MBEDTLS_MD_SHA384,
9616 MBEDTLS_MD_NONE
9617};
9618#endif
9619
9620#if defined(MBEDTLS_ECP_C)
9621static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = {
9622 MBEDTLS_ECP_DP_SECP256R1,
9623 MBEDTLS_ECP_DP_SECP384R1,
9624 MBEDTLS_ECP_DP_NONE
9625};
9626#endif
9627
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009628/*
Tillmann Karras588ad502015-09-25 04:27:22 +02009629 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009630 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02009631int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009632 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009633{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02009634#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009635 int ret;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02009636#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009637
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02009638 /* Use the functions here so that they are covered in tests,
9639 * but otherwise access member directly for efficiency */
9640 mbedtls_ssl_conf_endpoint( conf, endpoint );
9641 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009642
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009643 /*
9644 * Things that are common to all presets
9645 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02009646#if defined(MBEDTLS_SSL_CLI_C)
9647 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
9648 {
9649 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
9650#if defined(MBEDTLS_SSL_SESSION_TICKETS)
9651 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
9652#endif
9653 }
9654#endif
9655
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009656#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009657 conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED;
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009658#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009659
9660#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
9661 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
9662#endif
9663
9664#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
9665 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
9666#endif
9667
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01009668#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
9669 conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED;
9670#endif
9671
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02009672#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009673 conf->f_cookie_write = ssl_cookie_write_dummy;
9674 conf->f_cookie_check = ssl_cookie_check_dummy;
9675#endif
9676
9677#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
9678 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
9679#endif
9680
Janos Follath088ce432017-04-10 12:42:31 +01009681#if defined(MBEDTLS_SSL_SRV_C)
9682 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
9683#endif
9684
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009685#if defined(MBEDTLS_SSL_PROTO_DTLS)
9686 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
9687 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
9688#endif
9689
9690#if defined(MBEDTLS_SSL_RENEGOTIATION)
9691 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Andres AG2196c7f2016-12-15 17:01:16 +00009692 memset( conf->renego_period, 0x00, 2 );
9693 memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009694#endif
9695
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009696#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
9697 if( endpoint == MBEDTLS_SSL_IS_SERVER )
9698 {
Hanno Becker00d0a682017-10-04 13:14:29 +01009699 const unsigned char dhm_p[] =
9700 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
9701 const unsigned char dhm_g[] =
9702 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
9703
Hanno Beckera90658f2017-10-04 15:29:08 +01009704 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
9705 dhm_p, sizeof( dhm_p ),
9706 dhm_g, sizeof( dhm_g ) ) ) != 0 )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009707 {
9708 return( ret );
9709 }
9710 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02009711#endif
9712
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009713 /*
9714 * Preset-specific defaults
9715 */
9716 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009717 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009718 /*
9719 * NSA Suite B
9720 */
9721 case MBEDTLS_SSL_PRESET_SUITEB:
9722 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
9723 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
9724 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
9725 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
9726
9727 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
9728 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
9729 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
9730 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
9731 ssl_preset_suiteb_ciphersuites;
9732
9733#if defined(MBEDTLS_X509_CRT_PARSE_C)
9734 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009735#endif
9736
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009737#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009738 conf->sig_hashes = ssl_preset_suiteb_hashes;
9739#endif
9740
9741#if defined(MBEDTLS_ECP_C)
9742 conf->curve_list = ssl_preset_suiteb_curves;
9743#endif
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02009744 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009745
9746 /*
9747 * Default
9748 */
9749 default:
Ron Eldor5e9f14d2017-05-28 10:46:38 +03009750 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
9751 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
9752 MBEDTLS_SSL_MIN_MAJOR_VERSION :
9753 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
9754 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
9755 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
9756 MBEDTLS_SSL_MIN_MINOR_VERSION :
9757 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009758 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
9759 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
9760
9761#if defined(MBEDTLS_SSL_PROTO_DTLS)
9762 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
9763 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
9764#endif
9765
9766 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
9767 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
9768 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
9769 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
9770 mbedtls_ssl_list_ciphersuites();
9771
9772#if defined(MBEDTLS_X509_CRT_PARSE_C)
9773 conf->cert_profile = &mbedtls_x509_crt_profile_default;
9774#endif
9775
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009776#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01009777 conf->sig_hashes = ssl_preset_default_hashes;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009778#endif
9779
9780#if defined(MBEDTLS_ECP_C)
9781 conf->curve_list = mbedtls_ecp_grp_id_list();
9782#endif
9783
9784#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
9785 conf->dhm_min_bitlen = 1024;
9786#endif
9787 }
9788
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009789 return( 0 );
9790}
9791
9792/*
9793 * Free mbedtls_ssl_config
9794 */
9795void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
9796{
9797#if defined(MBEDTLS_DHM_C)
9798 mbedtls_mpi_free( &conf->dhm_P );
9799 mbedtls_mpi_free( &conf->dhm_G );
9800#endif
9801
9802#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
9803 if( conf->psk != NULL )
9804 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009805 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009806 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +00009807 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009808 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09009809 }
9810
9811 if( conf->psk_identity != NULL )
9812 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009813 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +09009814 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +00009815 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009816 conf->psk_identity_len = 0;
9817 }
9818#endif
9819
9820#if defined(MBEDTLS_X509_CRT_PARSE_C)
9821 ssl_key_cert_free( conf->key_cert );
9822#endif
9823
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009824 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009825}
9826
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02009827#if defined(MBEDTLS_PK_C) && \
9828 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02009829/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009830 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02009831 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009832unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02009833{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009834#if defined(MBEDTLS_RSA_C)
9835 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
9836 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02009837#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009838#if defined(MBEDTLS_ECDSA_C)
9839 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
9840 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02009841#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009842 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02009843}
9844
Hanno Becker7e5437a2017-04-28 17:15:26 +01009845unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
9846{
9847 switch( type ) {
9848 case MBEDTLS_PK_RSA:
9849 return( MBEDTLS_SSL_SIG_RSA );
9850 case MBEDTLS_PK_ECDSA:
9851 case MBEDTLS_PK_ECKEY:
9852 return( MBEDTLS_SSL_SIG_ECDSA );
9853 default:
9854 return( MBEDTLS_SSL_SIG_ANON );
9855 }
9856}
9857
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009858mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009859{
9860 switch( sig )
9861 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009862#if defined(MBEDTLS_RSA_C)
9863 case MBEDTLS_SSL_SIG_RSA:
9864 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009865#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009866#if defined(MBEDTLS_ECDSA_C)
9867 case MBEDTLS_SSL_SIG_ECDSA:
9868 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009869#endif
9870 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009871 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009872 }
9873}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02009874#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009875
Hanno Becker7e5437a2017-04-28 17:15:26 +01009876#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
9877 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
9878
9879/* Find an entry in a signature-hash set matching a given hash algorithm. */
9880mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
9881 mbedtls_pk_type_t sig_alg )
9882{
9883 switch( sig_alg )
9884 {
9885 case MBEDTLS_PK_RSA:
9886 return( set->rsa );
9887 case MBEDTLS_PK_ECDSA:
9888 return( set->ecdsa );
9889 default:
9890 return( MBEDTLS_MD_NONE );
9891 }
9892}
9893
9894/* Add a signature-hash-pair to a signature-hash set */
9895void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
9896 mbedtls_pk_type_t sig_alg,
9897 mbedtls_md_type_t md_alg )
9898{
9899 switch( sig_alg )
9900 {
9901 case MBEDTLS_PK_RSA:
9902 if( set->rsa == MBEDTLS_MD_NONE )
9903 set->rsa = md_alg;
9904 break;
9905
9906 case MBEDTLS_PK_ECDSA:
9907 if( set->ecdsa == MBEDTLS_MD_NONE )
9908 set->ecdsa = md_alg;
9909 break;
9910
9911 default:
9912 break;
9913 }
9914}
9915
9916/* Allow exactly one hash algorithm for each signature. */
9917void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
9918 mbedtls_md_type_t md_alg )
9919{
9920 set->rsa = md_alg;
9921 set->ecdsa = md_alg;
9922}
9923
9924#endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
9925 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
9926
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02009927/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02009928 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02009929 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009930mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009931{
9932 switch( hash )
9933 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009934#if defined(MBEDTLS_MD5_C)
9935 case MBEDTLS_SSL_HASH_MD5:
9936 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009937#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009938#if defined(MBEDTLS_SHA1_C)
9939 case MBEDTLS_SSL_HASH_SHA1:
9940 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009941#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009942#if defined(MBEDTLS_SHA256_C)
9943 case MBEDTLS_SSL_HASH_SHA224:
9944 return( MBEDTLS_MD_SHA224 );
9945 case MBEDTLS_SSL_HASH_SHA256:
9946 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009947#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009948#if defined(MBEDTLS_SHA512_C)
9949 case MBEDTLS_SSL_HASH_SHA384:
9950 return( MBEDTLS_MD_SHA384 );
9951 case MBEDTLS_SSL_HASH_SHA512:
9952 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009953#endif
9954 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009955 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009956 }
9957}
9958
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02009959/*
9960 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
9961 */
9962unsigned char mbedtls_ssl_hash_from_md_alg( int md )
9963{
9964 switch( md )
9965 {
9966#if defined(MBEDTLS_MD5_C)
9967 case MBEDTLS_MD_MD5:
9968 return( MBEDTLS_SSL_HASH_MD5 );
9969#endif
9970#if defined(MBEDTLS_SHA1_C)
9971 case MBEDTLS_MD_SHA1:
9972 return( MBEDTLS_SSL_HASH_SHA1 );
9973#endif
9974#if defined(MBEDTLS_SHA256_C)
9975 case MBEDTLS_MD_SHA224:
9976 return( MBEDTLS_SSL_HASH_SHA224 );
9977 case MBEDTLS_MD_SHA256:
9978 return( MBEDTLS_SSL_HASH_SHA256 );
9979#endif
9980#if defined(MBEDTLS_SHA512_C)
9981 case MBEDTLS_MD_SHA384:
9982 return( MBEDTLS_SSL_HASH_SHA384 );
9983 case MBEDTLS_MD_SHA512:
9984 return( MBEDTLS_SSL_HASH_SHA512 );
9985#endif
9986 default:
9987 return( MBEDTLS_SSL_HASH_NONE );
9988 }
9989}
9990
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02009991#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01009992/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02009993 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02009994 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01009995 */
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02009996int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01009997{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009998 const mbedtls_ecp_group_id *gid;
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01009999
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020010000 if( ssl->conf->curve_list == NULL )
10001 return( -1 );
10002
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020010003 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010010004 if( *gid == grp_id )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020010005 return( 0 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010010006
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +020010007 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +010010008}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +020010009#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020010010
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020010011#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020010012/*
10013 * Check if a hash proposed by the peer is in our list.
10014 * Return 0 if we're willing to use it, -1 otherwise.
10015 */
10016int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
10017 mbedtls_md_type_t md )
10018{
10019 const int *cur;
10020
10021 if( ssl->conf->sig_hashes == NULL )
10022 return( -1 );
10023
10024 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
10025 if( *cur == (int) md )
10026 return( 0 );
10027
10028 return( -1 );
10029}
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +020010030#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +020010031
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010032#if defined(MBEDTLS_X509_CRT_PARSE_C)
10033int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
10034 const mbedtls_ssl_ciphersuite_t *ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010010035 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +020010036 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020010037{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010010038 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010039#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020010040 int usage = 0;
10041#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010042#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020010043 const char *ext_oid;
10044 size_t ext_len;
10045#endif
10046
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010047#if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \
10048 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020010049 ((void) cert);
10050 ((void) cert_endpoint);
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010010051 ((void) flags);
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020010052#endif
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020010053
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010054#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
10055 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020010056 {
10057 /* Server part of the key exchange */
10058 switch( ciphersuite->key_exchange )
10059 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010060 case MBEDTLS_KEY_EXCHANGE_RSA:
10061 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010010062 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020010063 break;
10064
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010065 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
10066 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
10067 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
10068 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020010069 break;
10070
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010071 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
10072 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010010073 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020010074 break;
10075
10076 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010077 case MBEDTLS_KEY_EXCHANGE_NONE:
10078 case MBEDTLS_KEY_EXCHANGE_PSK:
10079 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
10080 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +020010081 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020010082 usage = 0;
10083 }
10084 }
10085 else
10086 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010087 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
10088 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020010089 }
10090
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010091 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010010092 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010010093 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010010094 ret = -1;
10095 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020010096#else
10097 ((void) ciphersuite);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010098#endif /* MBEDTLS_X509_CHECK_KEY_USAGE */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020010099
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010100#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
10101 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020010102 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010103 ext_oid = MBEDTLS_OID_SERVER_AUTH;
10104 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020010105 }
10106 else
10107 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010108 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
10109 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020010110 }
10111
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010112 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010010113 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +010010114 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010010115 ret = -1;
10116 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010117#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020010118
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +010010119 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +020010120}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010121#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +020010122
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +010010123/*
10124 * Convert version numbers to/from wire format
10125 * and, for DTLS, to/from TLS equivalent.
10126 *
10127 * For TLS this is the identity.
Brian J Murray1903fb32016-11-06 04:45:15 -080010128 * For DTLS, use 1's complement (v -> 255 - v, and then map as follows:
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +010010129 * 1.0 <-> 3.2 (DTLS 1.0 is based on TLS 1.1)
10130 * 1.x <-> 3.x+1 for x != 0 (DTLS 1.2 based on TLS 1.2)
10131 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010132void mbedtls_ssl_write_version( int major, int minor, int transport,
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +010010133 unsigned char ver[2] )
10134{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010135#if defined(MBEDTLS_SSL_PROTO_DTLS)
10136 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +010010137 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010138 if( minor == MBEDTLS_SSL_MINOR_VERSION_2 )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +010010139 --minor; /* DTLS 1.0 stored as TLS 1.1 internally */
10140
10141 ver[0] = (unsigned char)( 255 - ( major - 2 ) );
10142 ver[1] = (unsigned char)( 255 - ( minor - 1 ) );
10143 }
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +010010144 else
10145#else
10146 ((void) transport);
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +010010147#endif
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +010010148 {
10149 ver[0] = (unsigned char) major;
10150 ver[1] = (unsigned char) minor;
10151 }
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +010010152}
10153
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010154void mbedtls_ssl_read_version( int *major, int *minor, int transport,
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +010010155 const unsigned char ver[2] )
10156{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010157#if defined(MBEDTLS_SSL_PROTO_DTLS)
10158 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +010010159 {
10160 *major = 255 - ver[0] + 2;
10161 *minor = 255 - ver[1] + 1;
10162
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010163 if( *minor == MBEDTLS_SSL_MINOR_VERSION_1 )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +010010164 ++*minor; /* DTLS 1.0 stored as TLS 1.1 internally */
10165 }
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +010010166 else
10167#else
10168 ((void) transport);
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +010010169#endif
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +010010170 {
10171 *major = ver[0];
10172 *minor = ver[1];
10173 }
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +010010174}
10175
Simon Butcher99000142016-10-13 17:21:01 +010010176int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
10177{
10178#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
10179 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
10180 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
10181
10182 switch( md )
10183 {
10184#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
10185#if defined(MBEDTLS_MD5_C)
10186 case MBEDTLS_SSL_HASH_MD5:
Janos Follath182013f2016-10-25 10:50:22 +010010187 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
Simon Butcher99000142016-10-13 17:21:01 +010010188#endif
10189#if defined(MBEDTLS_SHA1_C)
10190 case MBEDTLS_SSL_HASH_SHA1:
10191 ssl->handshake->calc_verify = ssl_calc_verify_tls;
10192 break;
10193#endif
10194#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
10195#if defined(MBEDTLS_SHA512_C)
10196 case MBEDTLS_SSL_HASH_SHA384:
10197 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
10198 break;
10199#endif
10200#if defined(MBEDTLS_SHA256_C)
10201 case MBEDTLS_SSL_HASH_SHA256:
10202 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
10203 break;
10204#endif
10205 default:
10206 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
10207 }
10208
10209 return 0;
10210#else /* !MBEDTLS_SSL_PROTO_TLS1_2 */
10211 (void) ssl;
10212 (void) md;
10213
10214 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
10215#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
10216}
10217
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010218#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
10219 defined(MBEDTLS_SSL_PROTO_TLS1_1)
10220int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
10221 unsigned char *output,
10222 unsigned char *data, size_t data_len )
10223{
10224 int ret = 0;
10225 mbedtls_md5_context mbedtls_md5;
10226 mbedtls_sha1_context mbedtls_sha1;
10227
10228 mbedtls_md5_init( &mbedtls_md5 );
10229 mbedtls_sha1_init( &mbedtls_sha1 );
10230
10231 /*
10232 * digitally-signed struct {
10233 * opaque md5_hash[16];
10234 * opaque sha_hash[20];
10235 * };
10236 *
10237 * md5_hash
10238 * MD5(ClientHello.random + ServerHello.random
10239 * + ServerParams);
10240 * sha_hash
10241 * SHA(ClientHello.random + ServerHello.random
10242 * + ServerParams);
10243 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010244 if( ( ret = mbedtls_md5_starts_ret( &mbedtls_md5 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010245 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010246 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010247 goto exit;
10248 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010249 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010250 ssl->handshake->randbytes, 64 ) ) != 0 )
10251 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010252 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010253 goto exit;
10254 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010255 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5, data, data_len ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010256 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010257 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010258 goto exit;
10259 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010260 if( ( ret = mbedtls_md5_finish_ret( &mbedtls_md5, output ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010261 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010262 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010263 goto exit;
10264 }
10265
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010266 if( ( ret = mbedtls_sha1_starts_ret( &mbedtls_sha1 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010267 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010268 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010269 goto exit;
10270 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010271 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010272 ssl->handshake->randbytes, 64 ) ) != 0 )
10273 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010274 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010275 goto exit;
10276 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010277 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1, data,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010278 data_len ) ) != 0 )
10279 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010280 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010281 goto exit;
10282 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010283 if( ( ret = mbedtls_sha1_finish_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010284 output + 16 ) ) != 0 )
10285 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +010010286 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010287 goto exit;
10288 }
10289
10290exit:
10291 mbedtls_md5_free( &mbedtls_md5 );
10292 mbedtls_sha1_free( &mbedtls_sha1 );
10293
10294 if( ret != 0 )
10295 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
10296 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
10297
10298 return( ret );
10299
10300}
10301#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
10302 MBEDTLS_SSL_PROTO_TLS1_1 */
10303
10304#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
10305 defined(MBEDTLS_SSL_PROTO_TLS1_2)
10306int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
Gilles Peskineca1d7422018-04-24 11:53:22 +020010307 unsigned char *hash, size_t *hashlen,
10308 unsigned char *data, size_t data_len,
10309 mbedtls_md_type_t md_alg )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010310{
10311 int ret = 0;
10312 mbedtls_md_context_t ctx;
10313 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
Gilles Peskineca1d7422018-04-24 11:53:22 +020010314 *hashlen = mbedtls_md_get_size( md_info );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010315
10316 mbedtls_md_init( &ctx );
10317
10318 /*
10319 * digitally-signed struct {
10320 * opaque client_random[32];
10321 * opaque server_random[32];
10322 * ServerDHParams params;
10323 * };
10324 */
10325 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
10326 {
10327 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
10328 goto exit;
10329 }
10330 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
10331 {
10332 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
10333 goto exit;
10334 }
10335 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
10336 {
10337 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
10338 goto exit;
10339 }
10340 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
10341 {
10342 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
10343 goto exit;
10344 }
Gilles Peskineca1d7422018-04-24 11:53:22 +020010345 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +010010346 {
10347 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
10348 goto exit;
10349 }
10350
10351exit:
10352 mbedtls_md_free( &ctx );
10353
10354 if( ret != 0 )
10355 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
10356 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
10357
10358 return( ret );
10359}
10360#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
10361 MBEDTLS_SSL_PROTO_TLS1_2 */
10362
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020010363#endif /* MBEDTLS_SSL_TLS_C */