blob: 8bc79be05b956a06917f4cbe36e3ee399b14862f [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 shared functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Bence Szépkútif744bd72020-06-05 13:02:18 +02005 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 *
7 * This file is provided under the Apache License 2.0, or the
8 * GNU General Public License v2.0 or later.
9 *
10 * **********
11 * Apache License 2.0:
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +020012 *
13 * Licensed under the Apache License, Version 2.0 (the "License"); you may
14 * not use this file except in compliance with the License.
15 * You may obtain a copy of the License at
16 *
17 * http://www.apache.org/licenses/LICENSE-2.0
18 *
19 * Unless required by applicable law or agreed to in writing, software
20 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
21 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
22 * See the License for the specific language governing permissions and
23 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000024 *
Bence Szépkútif744bd72020-06-05 13:02:18 +020025 * **********
26 *
27 * **********
28 * GNU General Public License v2.0 or later:
29 *
30 * This program is free software; you can redistribute it and/or modify
31 * it under the terms of the GNU General Public License as published by
32 * the Free Software Foundation; either version 2 of the License, or
33 * (at your option) any later version.
34 *
35 * This program is distributed in the hope that it will be useful,
36 * but WITHOUT ANY WARRANTY; without even the implied warranty of
37 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
38 * GNU General Public License for more details.
39 *
40 * You should have received a copy of the GNU General Public License along
41 * with this program; if not, write to the Free Software Foundation, Inc.,
42 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
43 *
44 * **********
45 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000046 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000047 */
48/*
49 * The SSL 3.0 specification was drafted by Netscape in 1996,
50 * and became an IETF standard in 1999.
51 *
52 * http://wp.netscape.com/eng/ssl3/
53 * http://www.ietf.org/rfc/rfc2246.txt
54 * http://www.ietf.org/rfc/rfc4346.txt
55 */
56
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020057#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000058#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020059#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020060#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020061#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000062
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020063#if defined(MBEDTLS_SSL_TLS_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000064
SimonBd5800b72016-04-26 07:43:27 +010065#if defined(MBEDTLS_PLATFORM_C)
66#include "mbedtls/platform.h"
67#else
68#include <stdlib.h>
69#define mbedtls_calloc calloc
70#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010071#endif
72
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000073#include "mbedtls/debug.h"
74#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020075#include "mbedtls/ssl_internal.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050076#include "mbedtls/platform_util.h"
Paul Bakker0be444a2013-08-27 21:55:01 +020077
Rich Evans00ab4702015-02-06 13:43:58 +000078#include <string.h>
79
Janos Follath23bdca02016-10-07 14:47:14 +010080#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000081#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +020082#endif
83
Hanno Becker2a43f6f2018-08-10 11:12:52 +010084static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl );
Hanno Beckercd9dcda2018-08-28 17:18:56 +010085static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl );
Hanno Becker2a43f6f2018-08-10 11:12:52 +010086
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +010087/* Length of the "epoch" field in the record header */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020088static inline size_t ssl_ep_len( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +010089{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020090#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020091 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +010092 return( 2 );
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +010093#else
94 ((void) ssl);
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +010095#endif
96 return( 0 );
97}
98
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +020099/*
100 * Start a timer.
101 * Passing millisecs = 0 cancels a running timer.
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200102 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200103static void ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200104{
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200105 if( ssl->f_set_timer == NULL )
106 return;
107
108 MBEDTLS_SSL_DEBUG_MSG( 3, ( "set_timer to %d ms", (int) millisecs ) );
109 ssl->f_set_timer( ssl->p_timer, millisecs / 4, millisecs );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200110}
111
112/*
113 * Return -1 is timer is expired, 0 if it isn't.
114 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200115static int ssl_check_timer( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200116{
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200117 if( ssl->f_get_timer == NULL )
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +0200118 return( 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +0200119
120 if( ssl->f_get_timer( ssl->p_timer ) == 2 )
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200121 {
122 MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) );
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200123 return( -1 );
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200124 }
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200125
126 return( 0 );
127}
Manuel Pégourié-Gonnarddb2858c2014-09-29 14:04:42 +0200128
Hanno Becker5aa4e2c2018-08-06 09:26:08 +0100129static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
130 mbedtls_ssl_transform *transform );
131static void ssl_update_in_pointers( mbedtls_ssl_context *ssl,
132 mbedtls_ssl_transform *transform );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100133
134#define SSL_DONT_FORCE_FLUSH 0
135#define SSL_FORCE_FLUSH 1
136
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +0200137#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker2b1e3542018-08-06 11:19:13 +0100138
Hanno Beckerd5847772018-08-28 10:09:23 +0100139/* Forward declarations for functions related to message buffering. */
140static void ssl_buffering_free( mbedtls_ssl_context *ssl );
141static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
142 uint8_t slot );
143static void ssl_free_buffered_record( mbedtls_ssl_context *ssl );
144static int ssl_load_buffered_message( mbedtls_ssl_context *ssl );
145static int ssl_load_buffered_record( mbedtls_ssl_context *ssl );
146static int ssl_buffer_message( mbedtls_ssl_context *ssl );
147static int ssl_buffer_future_record( mbedtls_ssl_context *ssl );
Hanno Beckeref7afdf2018-08-28 17:16:31 +0100148static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl );
Hanno Beckerd5847772018-08-28 10:09:23 +0100149
Hanno Beckera67dee22018-08-22 10:05:20 +0100150static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl );
Hanno Becker11682cc2018-08-22 14:41:02 +0100151static size_t ssl_get_maximum_datagram_size( mbedtls_ssl_context const *ssl )
Hanno Becker2b1e3542018-08-06 11:19:13 +0100152{
Hanno Becker11682cc2018-08-22 14:41:02 +0100153 size_t mtu = ssl_get_current_mtu( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100154
155 if( mtu != 0 && mtu < MBEDTLS_SSL_OUT_BUFFER_LEN )
Hanno Becker11682cc2018-08-22 14:41:02 +0100156 return( mtu );
Hanno Becker2b1e3542018-08-06 11:19:13 +0100157
158 return( MBEDTLS_SSL_OUT_BUFFER_LEN );
159}
160
Hanno Becker67bc7c32018-08-06 11:33:50 +0100161static int ssl_get_remaining_space_in_datagram( mbedtls_ssl_context const *ssl )
162{
Hanno Becker11682cc2018-08-22 14:41:02 +0100163 size_t const bytes_written = ssl->out_left;
164 size_t const mtu = ssl_get_maximum_datagram_size( ssl );
Hanno Becker67bc7c32018-08-06 11:33:50 +0100165
166 /* Double-check that the write-index hasn't gone
167 * past what we can transmit in a single datagram. */
Hanno Becker11682cc2018-08-22 14:41:02 +0100168 if( bytes_written > mtu )
Hanno Becker67bc7c32018-08-06 11:33:50 +0100169 {
170 /* Should never happen... */
171 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
172 }
173
174 return( (int) ( mtu - bytes_written ) );
175}
176
177static int ssl_get_remaining_payload_in_datagram( mbedtls_ssl_context const *ssl )
178{
179 int ret;
180 size_t remaining, expansion;
Andrzej Kurek748face2018-10-11 07:20:19 -0400181 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100182
183#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
184 const size_t mfl = mbedtls_ssl_get_max_frag_len( ssl );
185
186 if( max_len > mfl )
187 max_len = mfl;
Hanno Beckerf4b010e2018-08-24 10:47:29 +0100188
189 /* By the standard (RFC 6066 Sect. 4), the MFL extension
190 * only limits the maximum record payload size, so in theory
191 * we would be allowed to pack multiple records of payload size
192 * MFL into a single datagram. However, this would mean that there's
193 * no way to explicitly communicate MTU restrictions to the peer.
194 *
195 * The following reduction of max_len makes sure that we never
196 * write datagrams larger than MFL + Record Expansion Overhead.
197 */
198 if( max_len <= ssl->out_left )
199 return( 0 );
200
201 max_len -= ssl->out_left;
Hanno Becker67bc7c32018-08-06 11:33:50 +0100202#endif
203
204 ret = ssl_get_remaining_space_in_datagram( ssl );
205 if( ret < 0 )
206 return( ret );
207 remaining = (size_t) ret;
208
209 ret = mbedtls_ssl_get_record_expansion( ssl );
210 if( ret < 0 )
211 return( ret );
212 expansion = (size_t) ret;
213
214 if( remaining <= expansion )
215 return( 0 );
216
217 remaining -= expansion;
218 if( remaining >= max_len )
219 remaining = max_len;
220
221 return( (int) remaining );
222}
223
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200224/*
225 * Double the retransmit timeout value, within the allowed range,
226 * returning -1 if the maximum value has already been reached.
227 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200228static int ssl_double_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200229{
230 uint32_t new_timeout;
231
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200232 if( ssl->handshake->retransmit_timeout >= ssl->conf->hs_timeout_max )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200233 return( -1 );
234
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200235 /* Implement the final paragraph of RFC 6347 section 4.1.1.1
236 * in the following way: after the initial transmission and a first
237 * retransmission, back off to a temporary estimated MTU of 508 bytes.
238 * This value is guaranteed to be deliverable (if not guaranteed to be
239 * delivered) of any compliant IPv4 (and IPv6) network, and should work
240 * on most non-IP stacks too. */
241 if( ssl->handshake->retransmit_timeout != ssl->conf->hs_timeout_min )
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400242 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200243 ssl->handshake->mtu = 508;
Andrzej Kurek6290dae2018-10-05 08:06:01 -0400244 MBEDTLS_SSL_DEBUG_MSG( 2, ( "mtu autoreduction to %d bytes", ssl->handshake->mtu ) );
245 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +0200246
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200247 new_timeout = 2 * ssl->handshake->retransmit_timeout;
248
249 /* Avoid arithmetic overflow and range overflow */
250 if( new_timeout < ssl->handshake->retransmit_timeout ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200251 new_timeout > ssl->conf->hs_timeout_max )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200252 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200253 new_timeout = ssl->conf->hs_timeout_max;
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200254 }
255
256 ssl->handshake->retransmit_timeout = new_timeout;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200257 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200258 ssl->handshake->retransmit_timeout ) );
259
260 return( 0 );
261}
262
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200263static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200264{
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200265 ssl->handshake->retransmit_timeout = ssl->conf->hs_timeout_min;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200266 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200267 ssl->handshake->retransmit_timeout ) );
268}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200269#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +0200270
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200271#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200272/*
273 * Convert max_fragment_length codes to length.
274 * RFC 6066 says:
275 * enum{
276 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
277 * } MaxFragmentLength;
278 * and we add 0 -> extension unused
279 */
Angus Grattond8213d02016-05-25 20:56:48 +1000280static unsigned int ssl_mfl_code_to_length( int mfl )
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200281{
Angus Grattond8213d02016-05-25 20:56:48 +1000282 switch( mfl )
283 {
284 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE:
285 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
286 case MBEDTLS_SSL_MAX_FRAG_LEN_512:
287 return 512;
288 case MBEDTLS_SSL_MAX_FRAG_LEN_1024:
289 return 1024;
290 case MBEDTLS_SSL_MAX_FRAG_LEN_2048:
291 return 2048;
292 case MBEDTLS_SSL_MAX_FRAG_LEN_4096:
293 return 4096;
294 default:
295 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN );
296 }
297}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200298#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard581e6b62013-07-18 12:32:27 +0200299
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +0200300#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200301static int ssl_session_copy( mbedtls_ssl_session *dst, const mbedtls_ssl_session *src )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200302{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200303 mbedtls_ssl_session_free( dst );
304 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200305
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200306#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200307 if( src->peer_cert != NULL )
308 {
Paul Bakker2292d1f2013-09-15 17:06:49 +0200309 int ret;
310
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200311 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200312 if( dst->peer_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200313 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200314
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200315 mbedtls_x509_crt_init( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200316
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200317 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
Manuel Pégourié-Gonnard4d2a8eb2014-06-13 20:33:27 +0200318 src->peer_cert->raw.len ) ) != 0 )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200319 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200320 mbedtls_free( dst->peer_cert );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200321 dst->peer_cert = NULL;
322 return( ret );
323 }
324 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200325#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200326
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200327#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200328 if( src->ticket != NULL )
329 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200330 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200331 if( dst->ticket == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200332 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200333
334 memcpy( dst->ticket, src->ticket, src->ticket_len );
335 }
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +0200336#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200337
338 return( 0 );
339}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +0200340#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +0200341
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200342#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
343int (*mbedtls_ssl_hw_record_init)( mbedtls_ssl_context *ssl,
Paul Bakker9af723c2014-05-01 13:03:14 +0200344 const unsigned char *key_enc, const unsigned char *key_dec,
345 size_t keylen,
346 const unsigned char *iv_enc, const unsigned char *iv_dec,
347 size_t ivlen,
348 const unsigned char *mac_enc, const unsigned char *mac_dec,
Paul Bakker66d5d072014-06-17 16:39:18 +0200349 size_t maclen ) = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200350int (*mbedtls_ssl_hw_record_activate)( mbedtls_ssl_context *ssl, int direction) = NULL;
351int (*mbedtls_ssl_hw_record_reset)( mbedtls_ssl_context *ssl ) = NULL;
352int (*mbedtls_ssl_hw_record_write)( mbedtls_ssl_context *ssl ) = NULL;
353int (*mbedtls_ssl_hw_record_read)( mbedtls_ssl_context *ssl ) = NULL;
354int (*mbedtls_ssl_hw_record_finish)( mbedtls_ssl_context *ssl ) = NULL;
355#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +0000356
Paul Bakker5121ce52009-01-03 21:22:43 +0000357/*
358 * Key material generation
359 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200360#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200361static int ssl3_prf( const unsigned char *secret, size_t slen,
362 const char *label,
363 const unsigned char *random, size_t rlen,
Paul Bakker5f70b252012-09-13 14:23:06 +0000364 unsigned char *dstbuf, size_t dlen )
365{
Andres Amaya Garcia33952502017-07-20 16:29:16 +0100366 int ret = 0;
Paul Bakker5f70b252012-09-13 14:23:06 +0000367 size_t i;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200368 mbedtls_md5_context md5;
369 mbedtls_sha1_context sha1;
Paul Bakker5f70b252012-09-13 14:23:06 +0000370 unsigned char padding[16];
371 unsigned char sha1sum[20];
372 ((void)label);
373
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200374 mbedtls_md5_init( &md5 );
375 mbedtls_sha1_init( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +0200376
Paul Bakker5f70b252012-09-13 14:23:06 +0000377 /*
378 * SSLv3:
379 * block =
380 * MD5( secret + SHA1( 'A' + secret + random ) ) +
381 * MD5( secret + SHA1( 'BB' + secret + random ) ) +
382 * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
383 * ...
384 */
385 for( i = 0; i < dlen / 16; i++ )
386 {
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200387 memset( padding, (unsigned char) ('A' + i), 1 + i );
Paul Bakker5f70b252012-09-13 14:23:06 +0000388
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100389 if( ( ret = mbedtls_sha1_starts_ret( &sha1 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100390 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100391 if( ( ret = mbedtls_sha1_update_ret( &sha1, padding, 1 + i ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100392 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100393 if( ( ret = mbedtls_sha1_update_ret( &sha1, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100394 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100395 if( ( ret = mbedtls_sha1_update_ret( &sha1, random, rlen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100396 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100397 if( ( ret = mbedtls_sha1_finish_ret( &sha1, sha1sum ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100398 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000399
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100400 if( ( ret = mbedtls_md5_starts_ret( &md5 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100401 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100402 if( ( ret = mbedtls_md5_update_ret( &md5, secret, slen ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100403 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100404 if( ( ret = mbedtls_md5_update_ret( &md5, sha1sum, 20 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100405 goto exit;
Gilles Peskine9e4f77c2018-01-22 11:48:08 +0100406 if( ( ret = mbedtls_md5_finish_ret( &md5, dstbuf + i * 16 ) ) != 0 )
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100407 goto exit;
Paul Bakker5f70b252012-09-13 14:23:06 +0000408 }
409
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100410exit:
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +0200411 mbedtls_md5_free( &md5 );
412 mbedtls_sha1_free( &sha1 );
Paul Bakker5f70b252012-09-13 14:23:06 +0000413
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500414 mbedtls_platform_zeroize( padding, sizeof( padding ) );
415 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
Paul Bakker5f70b252012-09-13 14:23:06 +0000416
Andres Amaya Garcia1a607a12017-06-29 17:09:42 +0100417 return( ret );
Paul Bakker5f70b252012-09-13 14:23:06 +0000418}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200419#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +0000420
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200421#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200422static int tls1_prf( const unsigned char *secret, size_t slen,
423 const char *label,
424 const unsigned char *random, size_t rlen,
Paul Bakker23986e52011-04-24 08:57:21 +0000425 unsigned char *dstbuf, size_t dlen )
Paul Bakker5121ce52009-01-03 21:22:43 +0000426{
Paul Bakker23986e52011-04-24 08:57:21 +0000427 size_t nb, hs;
428 size_t i, j, k;
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200429 const unsigned char *S1, *S2;
Paul Bakker5121ce52009-01-03 21:22:43 +0000430 unsigned char tmp[128];
431 unsigned char h_i[20];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200432 const mbedtls_md_info_t *md_info;
433 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100434 int ret;
435
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200436 mbedtls_md_init( &md_ctx );
Paul Bakker5121ce52009-01-03 21:22:43 +0000437
438 if( sizeof( tmp ) < 20 + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200439 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +0000440
441 hs = ( slen + 1 ) / 2;
442 S1 = secret;
443 S2 = secret + slen - hs;
444
445 nb = strlen( label );
446 memcpy( tmp + 20, label, nb );
447 memcpy( tmp + 20 + nb, random, rlen );
448 nb += rlen;
449
450 /*
451 * First compute P_md5(secret,label+random)[0..dlen]
452 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200453 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) == NULL )
454 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100455
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200456 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100457 return( ret );
458
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200459 mbedtls_md_hmac_starts( &md_ctx, S1, hs );
460 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
461 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000462
463 for( i = 0; i < dlen; i += 16 )
464 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200465 mbedtls_md_hmac_reset ( &md_ctx );
466 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb );
467 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100468
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200469 mbedtls_md_hmac_reset ( &md_ctx );
470 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 );
471 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000472
473 k = ( i + 16 > dlen ) ? dlen % 16 : 16;
474
475 for( j = 0; j < k; j++ )
476 dstbuf[i + j] = h_i[j];
477 }
478
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200479 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100480
Paul Bakker5121ce52009-01-03 21:22:43 +0000481 /*
482 * XOR out with P_sha1(secret,label+random)[0..dlen]
483 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200484 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) == NULL )
485 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100486
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200487 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100488 return( ret );
489
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200490 mbedtls_md_hmac_starts( &md_ctx, S2, hs );
491 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
492 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000493
494 for( i = 0; i < dlen; i += 20 )
495 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200496 mbedtls_md_hmac_reset ( &md_ctx );
497 mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb );
498 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100499
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200500 mbedtls_md_hmac_reset ( &md_ctx );
501 mbedtls_md_hmac_update( &md_ctx, tmp, 20 );
502 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker5121ce52009-01-03 21:22:43 +0000503
504 k = ( i + 20 > dlen ) ? dlen % 20 : 20;
505
506 for( j = 0; j < k; j++ )
507 dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
508 }
509
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200510 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100511
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500512 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
513 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000514
515 return( 0 );
516}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200517#endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker5121ce52009-01-03 21:22:43 +0000518
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200519#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
520static int tls_prf_generic( mbedtls_md_type_t md_type,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100521 const unsigned char *secret, size_t slen,
522 const char *label,
523 const unsigned char *random, size_t rlen,
524 unsigned char *dstbuf, size_t dlen )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000525{
526 size_t nb;
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100527 size_t i, j, k, md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000528 unsigned char tmp[128];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200529 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
530 const mbedtls_md_info_t *md_info;
531 mbedtls_md_context_t md_ctx;
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100532 int ret;
533
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200534 mbedtls_md_init( &md_ctx );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000535
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200536 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
537 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100538
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200539 md_len = mbedtls_md_get_size( md_info );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100540
541 if( sizeof( tmp ) < md_len + strlen( label ) + rlen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200542 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000543
544 nb = strlen( label );
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100545 memcpy( tmp + md_len, label, nb );
546 memcpy( tmp + md_len + nb, random, rlen );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000547 nb += rlen;
548
549 /*
550 * Compute P_<hash>(secret, label + random)[0..dlen]
551 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200552 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100553 return( ret );
554
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200555 mbedtls_md_hmac_starts( &md_ctx, secret, slen );
556 mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
557 mbedtls_md_hmac_finish( &md_ctx, tmp );
Manuel Pégourié-Gonnard7da726b2015-03-24 18:08:19 +0100558
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100559 for( i = 0; i < dlen; i += md_len )
Paul Bakker1ef83d62012-04-11 12:09:53 +0000560 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200561 mbedtls_md_hmac_reset ( &md_ctx );
562 mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
563 mbedtls_md_hmac_finish( &md_ctx, h_i );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100564
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200565 mbedtls_md_hmac_reset ( &md_ctx );
566 mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
567 mbedtls_md_hmac_finish( &md_ctx, tmp );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000568
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100569 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +0000570
571 for( j = 0; j < k; j++ )
572 dstbuf[i + j] = h_i[j];
573 }
574
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200575 mbedtls_md_free( &md_ctx );
Manuel Pégourié-Gonnardb7fcca32015-03-26 11:41:28 +0100576
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500577 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
578 mbedtls_platform_zeroize( h_i, sizeof( h_i ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +0000579
580 return( 0 );
581}
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100582
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200583#if defined(MBEDTLS_SHA256_C)
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100584static int tls_prf_sha256( const unsigned char *secret, size_t slen,
585 const char *label,
586 const unsigned char *random, size_t rlen,
587 unsigned char *dstbuf, size_t dlen )
588{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200589 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100590 label, random, rlen, dstbuf, dlen ) );
591}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200592#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000593
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200594#if defined(MBEDTLS_SHA512_C)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200595static int tls_prf_sha384( const unsigned char *secret, size_t slen,
596 const char *label,
597 const unsigned char *random, size_t rlen,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000598 unsigned char *dstbuf, size_t dlen )
599{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200600 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
Manuel Pégourié-Gonnard6890c6b2015-03-26 11:11:49 +0100601 label, random, rlen, dstbuf, dlen ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +0000602}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200603#endif /* MBEDTLS_SHA512_C */
604#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +0000605
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200606static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200607
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200608#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
609 defined(MBEDTLS_SSL_PROTO_TLS1_1)
610static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *, const unsigned char *, size_t );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200611#endif
Paul Bakker380da532012-04-18 16:10:25 +0000612
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200613#if defined(MBEDTLS_SSL_PROTO_SSL3)
614static void ssl_calc_verify_ssl( mbedtls_ssl_context *, unsigned char * );
615static void ssl_calc_finished_ssl( mbedtls_ssl_context *, unsigned char *, int );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200616#endif
617
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200618#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
619static void ssl_calc_verify_tls( mbedtls_ssl_context *, unsigned char * );
620static void ssl_calc_finished_tls( mbedtls_ssl_context *, unsigned char *, int );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200621#endif
622
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200623#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
624#if defined(MBEDTLS_SHA256_C)
625static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
626static void ssl_calc_verify_tls_sha256( mbedtls_ssl_context *,unsigned char * );
627static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200628#endif
Paul Bakker769075d2012-11-24 11:26:46 +0100629
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200630#if defined(MBEDTLS_SHA512_C)
631static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
632static void ssl_calc_verify_tls_sha384( mbedtls_ssl_context *, unsigned char * );
633static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
Paul Bakker769075d2012-11-24 11:26:46 +0100634#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200635#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker1ef83d62012-04-11 12:09:53 +0000636
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200637int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +0000638{
Paul Bakkerda02a7f2013-08-31 17:25:14 +0200639 int ret = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +0000640 unsigned char tmp[64];
Paul Bakker5121ce52009-01-03 21:22:43 +0000641 unsigned char keyblk[256];
642 unsigned char *key1;
643 unsigned char *key2;
Paul Bakker68884e32013-01-07 18:20:04 +0100644 unsigned char *mac_enc;
645 unsigned char *mac_dec;
Hanno Becker81c7b182017-11-09 18:39:33 +0000646 size_t mac_key_len;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200647 size_t iv_copy_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200648 const mbedtls_cipher_info_t *cipher_info;
649 const mbedtls_md_info_t *md_info;
Paul Bakker68884e32013-01-07 18:20:04 +0100650
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200651 mbedtls_ssl_session *session = ssl->session_negotiate;
652 mbedtls_ssl_transform *transform = ssl->transform_negotiate;
653 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Paul Bakker5121ce52009-01-03 21:22:43 +0000654
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200655 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000656
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200657 cipher_info = mbedtls_cipher_info_from_type( transform->ciphersuite_info->cipher );
Paul Bakker68884e32013-01-07 18:20:04 +0100658 if( cipher_info == NULL )
659 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200660 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %d not found",
Paul Bakker68884e32013-01-07 18:20:04 +0100661 transform->ciphersuite_info->cipher ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200662 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +0100663 }
664
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200665 md_info = mbedtls_md_info_from_type( transform->ciphersuite_info->mac );
Paul Bakker68884e32013-01-07 18:20:04 +0100666 if( md_info == NULL )
667 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200668 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %d not found",
Paul Bakker68884e32013-01-07 18:20:04 +0100669 transform->ciphersuite_info->mac ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200670 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +0100671 }
672
Paul Bakker5121ce52009-01-03 21:22:43 +0000673 /*
Paul Bakkerca4ab492012-04-18 14:23:57 +0000674 * Set appropriate PRF function and other SSL / TLS / TLS1.2 functions
Paul Bakker1ef83d62012-04-11 12:09:53 +0000675 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200676#if defined(MBEDTLS_SSL_PROTO_SSL3)
677 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakkerca4ab492012-04-18 14:23:57 +0000678 {
Paul Bakker48916f92012-09-16 19:57:18 +0000679 handshake->tls_prf = ssl3_prf;
680 handshake->calc_verify = ssl_calc_verify_ssl;
681 handshake->calc_finished = ssl_calc_finished_ssl;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000682 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200683 else
684#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200685#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
686 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakkerca4ab492012-04-18 14:23:57 +0000687 {
Paul Bakker48916f92012-09-16 19:57:18 +0000688 handshake->tls_prf = tls1_prf;
689 handshake->calc_verify = ssl_calc_verify_tls;
690 handshake->calc_finished = ssl_calc_finished_tls;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000691 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200692 else
693#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200694#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
695#if defined(MBEDTLS_SHA512_C)
696 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
697 transform->ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Paul Bakkerca4ab492012-04-18 14:23:57 +0000698 {
Paul Bakker48916f92012-09-16 19:57:18 +0000699 handshake->tls_prf = tls_prf_sha384;
700 handshake->calc_verify = ssl_calc_verify_tls_sha384;
701 handshake->calc_finished = ssl_calc_finished_tls_sha384;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000702 }
Paul Bakker1ef83d62012-04-11 12:09:53 +0000703 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200704#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200705#if defined(MBEDTLS_SHA256_C)
706 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakkerca4ab492012-04-18 14:23:57 +0000707 {
Paul Bakker48916f92012-09-16 19:57:18 +0000708 handshake->tls_prf = tls_prf_sha256;
709 handshake->calc_verify = ssl_calc_verify_tls_sha256;
710 handshake->calc_finished = ssl_calc_finished_tls_sha256;
Paul Bakkerca4ab492012-04-18 14:23:57 +0000711 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200712 else
713#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200714#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +0200715 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200716 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
717 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +0200718 }
Paul Bakker1ef83d62012-04-11 12:09:53 +0000719
720 /*
Paul Bakker5121ce52009-01-03 21:22:43 +0000721 * SSLv3:
722 * master =
723 * MD5( premaster + SHA1( 'A' + premaster + randbytes ) ) +
724 * MD5( premaster + SHA1( 'BB' + premaster + randbytes ) ) +
725 * MD5( premaster + SHA1( 'CCC' + premaster + randbytes ) )
Paul Bakkerf7abd422013-04-16 13:15:56 +0200726 *
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200727 * TLSv1+:
Paul Bakker5121ce52009-01-03 21:22:43 +0000728 * master = PRF( premaster, "master secret", randbytes )[0..47]
729 */
Paul Bakker0a597072012-09-25 21:55:46 +0000730 if( handshake->resume == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000731 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200732 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret", handshake->premaster,
Paul Bakker48916f92012-09-16 19:57:18 +0000733 handshake->pmslen );
Paul Bakker5121ce52009-01-03 21:22:43 +0000734
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200735#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
736 if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200737 {
738 unsigned char session_hash[48];
739 size_t hash_len;
740
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200741 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using extended master secret" ) );
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200742
743 ssl->handshake->calc_verify( ssl, session_hash );
744
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200745#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
746 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200747 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200748#if defined(MBEDTLS_SHA512_C)
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200749 if( ssl->transform_negotiate->ciphersuite_info->mac ==
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200750 MBEDTLS_MD_SHA384 )
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200751 {
752 hash_len = 48;
753 }
754 else
755#endif
756 hash_len = 32;
757 }
758 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200759#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200760 hash_len = 36;
761
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200762 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash", session_hash, hash_len );
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200763
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100764 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
765 "extended master secret",
766 session_hash, hash_len,
767 session->master, 48 );
768 if( ret != 0 )
769 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200770 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100771 return( ret );
772 }
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200773
774 }
775 else
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200776#endif
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100777 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
778 "master secret",
779 handshake->randbytes, 64,
780 session->master, 48 );
781 if( ret != 0 )
782 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200783 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100784 return( ret );
785 }
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +0200786
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500787 mbedtls_platform_zeroize( handshake->premaster,
788 sizeof(handshake->premaster) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000789 }
790 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200791 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000792
793 /*
794 * Swap the client and server random values.
795 */
Paul Bakker48916f92012-09-16 19:57:18 +0000796 memcpy( tmp, handshake->randbytes, 64 );
797 memcpy( handshake->randbytes, tmp + 32, 32 );
798 memcpy( handshake->randbytes + 32, tmp, 32 );
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500799 mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000800
801 /*
802 * SSLv3:
803 * key block =
804 * MD5( master + SHA1( 'A' + master + randbytes ) ) +
805 * MD5( master + SHA1( 'BB' + master + randbytes ) ) +
806 * MD5( master + SHA1( 'CCC' + master + randbytes ) ) +
807 * MD5( master + SHA1( 'DDDD' + master + randbytes ) ) +
808 * ...
809 *
810 * TLSv1:
811 * key block = PRF( master, "key expansion", randbytes )
812 */
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100813 ret = handshake->tls_prf( session->master, 48, "key expansion",
814 handshake->randbytes, 64, keyblk, 256 );
815 if( ret != 0 )
816 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200817 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
Manuel Pégourié-Gonnarde9608182015-03-26 11:47:47 +0100818 return( ret );
819 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000820
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200821 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
822 mbedtls_ssl_get_ciphersuite_name( session->ciphersuite ) ) );
823 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", session->master, 48 );
824 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", handshake->randbytes, 64 );
825 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
Paul Bakker5121ce52009-01-03 21:22:43 +0000826
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500827 mbedtls_platform_zeroize( handshake->randbytes,
828 sizeof( handshake->randbytes ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000829
830 /*
831 * Determine the appropriate key, IV and MAC length.
832 */
Paul Bakker68884e32013-01-07 18:20:04 +0100833
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +0200834 transform->keylen = cipher_info->key_bitlen / 8;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200835
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200836 if( cipher_info->mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200837 cipher_info->mode == MBEDTLS_MODE_CCM ||
838 cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakker5121ce52009-01-03 21:22:43 +0000839 {
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200840 size_t taglen, explicit_ivlen;
841
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200842 transform->maclen = 0;
Hanno Becker81c7b182017-11-09 18:39:33 +0000843 mac_key_len = 0;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200844
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200845 /* All modes haves 96-bit IVs;
846 * GCM and CCM has 4 implicit and 8 explicit bytes
847 * ChachaPoly has all 12 bytes implicit
848 */
Paul Bakker68884e32013-01-07 18:20:04 +0100849 transform->ivlen = 12;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200850 if( cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY )
851 transform->fixed_ivlen = 12;
852 else
853 transform->fixed_ivlen = 4;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200854
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +0200855 /* All modes have 128-bit tags, except CCM_8 (ciphersuite flag) */
856 taglen = transform->ciphersuite_info->flags &
857 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
858
859
860 /* Minimum length of encrypted record */
861 explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
862 transform->minlen = explicit_ivlen + taglen;
Paul Bakker68884e32013-01-07 18:20:04 +0100863 }
864 else
865 {
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200866 /* Initialize HMAC contexts */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200867 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
868 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
Paul Bakker68884e32013-01-07 18:20:04 +0100869 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200870 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200871 return( ret );
Paul Bakker68884e32013-01-07 18:20:04 +0100872 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000873
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200874 /* Get MAC length */
Hanno Becker81c7b182017-11-09 18:39:33 +0000875 mac_key_len = mbedtls_md_get_size( md_info );
876 transform->maclen = mac_key_len;
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200877
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200878#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200879 /*
880 * If HMAC is to be truncated, we shall keep the leftmost bytes,
881 * (rfc 6066 page 13 or rfc 2104 section 4),
882 * so we only need to adjust the length here.
883 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200884 if( session->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Hanno Beckere89353a2017-11-20 16:36:41 +0000885 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200886 transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN;
Hanno Beckere89353a2017-11-20 16:36:41 +0000887
888#if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT)
889 /* Fall back to old, non-compliant version of the truncated
Hanno Becker563423f2017-11-21 17:20:17 +0000890 * HMAC implementation which also truncates the key
891 * (Mbed TLS versions from 1.3 to 2.6.0) */
Hanno Beckere89353a2017-11-20 16:36:41 +0000892 mac_key_len = transform->maclen;
893#endif
894 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200895#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde800cd82014-06-18 15:34:40 +0200896
897 /* IV length */
Paul Bakker68884e32013-01-07 18:20:04 +0100898 transform->ivlen = cipher_info->iv_size;
Paul Bakker5121ce52009-01-03 21:22:43 +0000899
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200900 /* Minimum length */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200901 if( cipher_info->mode == MBEDTLS_MODE_STREAM )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200902 transform->minlen = transform->maclen;
903 else
Paul Bakker68884e32013-01-07 18:20:04 +0100904 {
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200905 /*
906 * GenericBlockCipher:
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +0100907 * 1. if EtM is in use: one block plus MAC
908 * otherwise: * first multiple of blocklen greater than maclen
909 * 2. IV except for SSL3 and TLS 1.0
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200910 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200911#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
912 if( session->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +0100913 {
914 transform->minlen = transform->maclen
915 + cipher_info->block_size;
916 }
917 else
918#endif
919 {
920 transform->minlen = transform->maclen
921 + cipher_info->block_size
922 - transform->maclen % cipher_info->block_size;
923 }
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200924
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200925#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
926 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
927 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_1 )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200928 ; /* No need to adjust minlen */
Paul Bakker68884e32013-01-07 18:20:04 +0100929 else
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200930#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200931#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
932 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_2 ||
933 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200934 {
935 transform->minlen += transform->ivlen;
936 }
937 else
938#endif
939 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200940 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
941 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardeaa76f72014-06-18 16:06:02 +0200942 }
Paul Bakker68884e32013-01-07 18:20:04 +0100943 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000944 }
945
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200946 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %d, minlen: %d, ivlen: %d, maclen: %d",
Paul Bakker48916f92012-09-16 19:57:18 +0000947 transform->keylen, transform->minlen, transform->ivlen,
948 transform->maclen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000949
950 /*
951 * Finally setup the cipher contexts, IVs and MAC secrets.
952 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200953#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200954 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +0000955 {
Hanno Becker81c7b182017-11-09 18:39:33 +0000956 key1 = keyblk + mac_key_len * 2;
957 key2 = keyblk + mac_key_len * 2 + transform->keylen;
Paul Bakker5121ce52009-01-03 21:22:43 +0000958
Paul Bakker68884e32013-01-07 18:20:04 +0100959 mac_enc = keyblk;
Hanno Becker81c7b182017-11-09 18:39:33 +0000960 mac_dec = keyblk + mac_key_len;
Paul Bakker5121ce52009-01-03 21:22:43 +0000961
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000962 /*
963 * This is not used in TLS v1.1.
964 */
Paul Bakker48916f92012-09-16 19:57:18 +0000965 iv_copy_len = ( transform->fixed_ivlen ) ?
966 transform->fixed_ivlen : transform->ivlen;
967 memcpy( transform->iv_enc, key2 + transform->keylen, iv_copy_len );
968 memcpy( transform->iv_dec, key2 + transform->keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000969 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +0000970 }
971 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200972#endif /* MBEDTLS_SSL_CLI_C */
973#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200974 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +0000975 {
Hanno Becker81c7b182017-11-09 18:39:33 +0000976 key1 = keyblk + mac_key_len * 2 + transform->keylen;
977 key2 = keyblk + mac_key_len * 2;
Paul Bakker5121ce52009-01-03 21:22:43 +0000978
Hanno Becker81c7b182017-11-09 18:39:33 +0000979 mac_enc = keyblk + mac_key_len;
Paul Bakker68884e32013-01-07 18:20:04 +0100980 mac_dec = keyblk;
Paul Bakker5121ce52009-01-03 21:22:43 +0000981
Paul Bakker2e11f7d2010-07-25 14:24:53 +0000982 /*
983 * This is not used in TLS v1.1.
984 */
Paul Bakker48916f92012-09-16 19:57:18 +0000985 iv_copy_len = ( transform->fixed_ivlen ) ?
986 transform->fixed_ivlen : transform->ivlen;
987 memcpy( transform->iv_dec, key1 + transform->keylen, iv_copy_len );
988 memcpy( transform->iv_enc, key1 + transform->keylen + iv_copy_len,
Paul Bakkerca4ab492012-04-18 14:23:57 +0000989 iv_copy_len );
Paul Bakker5121ce52009-01-03 21:22:43 +0000990 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +0100991 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200992#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +0100993 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200994 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
995 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +0100996 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000997
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200998#if defined(MBEDTLS_SSL_PROTO_SSL3)
999 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker68884e32013-01-07 18:20:04 +01001000 {
Hanno Becker81c7b182017-11-09 18:39:33 +00001001 if( mac_key_len > sizeof transform->mac_enc )
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001002 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001003 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1004 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7cfdcb82014-01-18 18:22:55 +01001005 }
1006
Hanno Becker81c7b182017-11-09 18:39:33 +00001007 memcpy( transform->mac_enc, mac_enc, mac_key_len );
1008 memcpy( transform->mac_dec, mac_dec, mac_key_len );
Paul Bakker68884e32013-01-07 18:20:04 +01001009 }
1010 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001011#endif /* MBEDTLS_SSL_PROTO_SSL3 */
1012#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1013 defined(MBEDTLS_SSL_PROTO_TLS1_2)
1014 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
Paul Bakker68884e32013-01-07 18:20:04 +01001015 {
Gilles Peskine039fd122018-03-19 19:06:08 +01001016 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
1017 For AEAD-based ciphersuites, there is nothing to do here. */
1018 if( mac_key_len != 0 )
1019 {
1020 mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len );
1021 mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len );
1022 }
Paul Bakker68884e32013-01-07 18:20:04 +01001023 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001024 else
1025#endif
Paul Bakker577e0062013-08-28 11:57:20 +02001026 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001027 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1028 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02001029 }
Paul Bakker68884e32013-01-07 18:20:04 +01001030
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001031#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1032 if( mbedtls_ssl_hw_record_init != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00001033 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001034 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00001035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001036 if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, transform->keylen,
Paul Bakker07eb38b2012-12-19 14:42:06 +01001037 transform->iv_enc, transform->iv_dec,
1038 iv_copy_len,
Paul Bakker68884e32013-01-07 18:20:04 +01001039 mac_enc, mac_dec,
Hanno Becker81c7b182017-11-09 18:39:33 +00001040 mac_key_len ) ) != 0 )
Paul Bakker05ef8352012-05-08 09:17:57 +00001041 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001042 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret );
1043 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00001044 }
1045 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001046#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00001047
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001048#if defined(MBEDTLS_SSL_EXPORT_KEYS)
1049 if( ssl->conf->f_export_keys != NULL )
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001050 {
Manuel Pégourié-Gonnard024b6df2015-10-19 13:52:53 +02001051 ssl->conf->f_export_keys( ssl->conf->p_export_keys,
1052 session->master, keyblk,
Hanno Becker81c7b182017-11-09 18:39:33 +00001053 mac_key_len, transform->keylen,
Robert Cragie4feb7ae2015-10-02 13:33:37 +01001054 iv_copy_len );
1055 }
1056#endif
1057
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001058 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001059 cipher_info ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001060 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001061 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001062 return( ret );
1063 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001064
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001065 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001066 cipher_info ) ) != 0 )
1067 {
Manuel Pégourié-Gonnard8473f872015-05-14 13:51:45 +02001068 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001069 return( ret );
1070 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001071
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001072 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001073 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001074 MBEDTLS_ENCRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001075 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001076 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001077 return( ret );
1078 }
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001079
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001080 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
Manuel Pégourié-Gonnard898e0aa2015-06-18 15:28:12 +02001081 cipher_info->key_bitlen,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001082 MBEDTLS_DECRYPT ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001083 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001084 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001085 return( ret );
1086 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001087
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001088#if defined(MBEDTLS_CIPHER_MODE_CBC)
1089 if( cipher_info->mode == MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001090 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001091 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
1092 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001093 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001094 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001095 return( ret );
Manuel Pégourié-Gonnard126a66f2013-10-25 18:33:32 +02001096 }
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001097
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001098 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
1099 MBEDTLS_PADDING_NONE ) ) != 0 )
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001100 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001101 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
Manuel Pégourié-Gonnard88665912013-10-25 18:42:44 +02001102 return( ret );
1103 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001104 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001105#endif /* MBEDTLS_CIPHER_MODE_CBC */
Paul Bakker5121ce52009-01-03 21:22:43 +00001106
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05001107 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001108
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001109#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker2770fbd2012-07-03 13:30:23 +00001110 // Initialize compression
1111 //
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001112 if( session->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001113 {
Paul Bakker16770332013-10-11 09:59:44 +02001114 if( ssl->compress_buf == NULL )
1115 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001116 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
Angus Grattond8213d02016-05-25 20:56:48 +10001117 ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
Paul Bakker16770332013-10-11 09:59:44 +02001118 if( ssl->compress_buf == NULL )
1119 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02001120 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
Angus Grattond8213d02016-05-25 20:56:48 +10001121 MBEDTLS_SSL_COMPRESS_BUFFER_LEN ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001122 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker16770332013-10-11 09:59:44 +02001123 }
1124 }
1125
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001126 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001127
Paul Bakker48916f92012-09-16 19:57:18 +00001128 memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) );
1129 memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001130
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001131 if( deflateInit( &transform->ctx_deflate,
1132 Z_DEFAULT_COMPRESSION ) != Z_OK ||
Paul Bakker48916f92012-09-16 19:57:18 +00001133 inflateInit( &transform->ctx_inflate ) != Z_OK )
Paul Bakker2770fbd2012-07-03 13:30:23 +00001134 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001135 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
1136 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00001137 }
1138 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001139#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00001140
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001141 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001142
1143 return( 0 );
1144}
1145
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001146#if defined(MBEDTLS_SSL_PROTO_SSL3)
1147void ssl_calc_verify_ssl( mbedtls_ssl_context *ssl, unsigned char hash[36] )
Paul Bakker5121ce52009-01-03 21:22:43 +00001148{
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001149 mbedtls_md5_context md5;
1150 mbedtls_sha1_context sha1;
Paul Bakker5121ce52009-01-03 21:22:43 +00001151 unsigned char pad_1[48];
1152 unsigned char pad_2[48];
1153
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001154 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001155
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001156 mbedtls_md5_init( &md5 );
1157 mbedtls_sha1_init( &sha1 );
1158
1159 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1160 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001161
Paul Bakker380da532012-04-18 16:10:25 +00001162 memset( pad_1, 0x36, 48 );
1163 memset( pad_2, 0x5C, 48 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001164
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001165 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1166 mbedtls_md5_update_ret( &md5, pad_1, 48 );
1167 mbedtls_md5_finish_ret( &md5, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00001168
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001169 mbedtls_md5_starts_ret( &md5 );
1170 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 );
1171 mbedtls_md5_update_ret( &md5, pad_2, 48 );
1172 mbedtls_md5_update_ret( &md5, hash, 16 );
1173 mbedtls_md5_finish_ret( &md5, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00001174
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001175 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1176 mbedtls_sha1_update_ret( &sha1, pad_1, 40 );
1177 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
Paul Bakker380da532012-04-18 16:10:25 +00001178
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001179 mbedtls_sha1_starts_ret( &sha1 );
1180 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 );
1181 mbedtls_sha1_update_ret( &sha1, pad_2, 40 );
1182 mbedtls_sha1_update_ret( &sha1, hash + 16, 20 );
1183 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
Paul Bakker380da532012-04-18 16:10:25 +00001184
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001185 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 );
1186 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001187
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001188 mbedtls_md5_free( &md5 );
1189 mbedtls_sha1_free( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +02001190
Paul Bakker380da532012-04-18 16:10:25 +00001191 return;
1192}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001193#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker380da532012-04-18 16:10:25 +00001194
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001195#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
1196void ssl_calc_verify_tls( mbedtls_ssl_context *ssl, unsigned char hash[36] )
Paul Bakker380da532012-04-18 16:10:25 +00001197{
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001198 mbedtls_md5_context md5;
1199 mbedtls_sha1_context sha1;
Paul Bakker380da532012-04-18 16:10:25 +00001200
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001201 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001202
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001203 mbedtls_md5_init( &md5 );
1204 mbedtls_sha1_init( &sha1 );
1205
1206 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
1207 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
Paul Bakker380da532012-04-18 16:10:25 +00001208
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001209 mbedtls_md5_finish_ret( &md5, hash );
1210 mbedtls_sha1_finish_ret( &sha1, hash + 16 );
Paul Bakker380da532012-04-18 16:10:25 +00001211
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001212 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 );
1213 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001214
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001215 mbedtls_md5_free( &md5 );
1216 mbedtls_sha1_free( &sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +02001217
Paul Bakker380da532012-04-18 16:10:25 +00001218 return;
1219}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001220#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker380da532012-04-18 16:10:25 +00001221
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001222#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1223#if defined(MBEDTLS_SHA256_C)
1224void ssl_calc_verify_tls_sha256( mbedtls_ssl_context *ssl, unsigned char hash[32] )
Paul Bakker380da532012-04-18 16:10:25 +00001225{
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001226 mbedtls_sha256_context sha256;
Paul Bakker380da532012-04-18 16:10:25 +00001227
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001228 mbedtls_sha256_init( &sha256 );
1229
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001230 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001231
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001232 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001233 mbedtls_sha256_finish_ret( &sha256, hash );
Paul Bakker380da532012-04-18 16:10:25 +00001234
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001235 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 32 );
1236 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001237
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001238 mbedtls_sha256_free( &sha256 );
Paul Bakker5b4af392014-06-26 12:09:34 +02001239
Paul Bakker380da532012-04-18 16:10:25 +00001240 return;
1241}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001242#endif /* MBEDTLS_SHA256_C */
Paul Bakker380da532012-04-18 16:10:25 +00001243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001244#if defined(MBEDTLS_SHA512_C)
1245void ssl_calc_verify_tls_sha384( mbedtls_ssl_context *ssl, unsigned char hash[48] )
Paul Bakker380da532012-04-18 16:10:25 +00001246{
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001247 mbedtls_sha512_context sha512;
Paul Bakker380da532012-04-18 16:10:25 +00001248
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02001249 mbedtls_sha512_init( &sha512 );
1250
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001251 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
Paul Bakker380da532012-04-18 16:10:25 +00001252
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001253 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01001254 mbedtls_sha512_finish_ret( &sha512, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00001255
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001256 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 48 );
1257 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001258
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02001259 mbedtls_sha512_free( &sha512 );
Paul Bakker5b4af392014-06-26 12:09:34 +02001260
Paul Bakker5121ce52009-01-03 21:22:43 +00001261 return;
1262}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001263#endif /* MBEDTLS_SHA512_C */
1264#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001265
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001266#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
1267int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001268{
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001269 unsigned char *p = ssl->handshake->premaster;
1270 unsigned char *end = p + sizeof( ssl->handshake->premaster );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001271 const unsigned char *psk = ssl->conf->psk;
1272 size_t psk_len = ssl->conf->psk_len;
1273
1274 /* If the psk callback was called, use its result */
1275 if( ssl->handshake->psk != NULL )
1276 {
1277 psk = ssl->handshake->psk;
1278 psk_len = ssl->handshake->psk_len;
1279 }
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001280
1281 /*
1282 * PMS = struct {
1283 * opaque other_secret<0..2^16-1>;
1284 * opaque psk<0..2^16-1>;
1285 * };
1286 * with "other_secret" depending on the particular key exchange
1287 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001288#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1289 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001290 {
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001291 if( end - p < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001292 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001293
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001294 *(p++) = (unsigned char)( psk_len >> 8 );
1295 *(p++) = (unsigned char)( psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001296
1297 if( end < p || (size_t)( end - p ) < psk_len )
1298 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1299
1300 memset( p, 0, psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001301 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001302 }
1303 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001304#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
1305#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
1306 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02001307 {
1308 /*
1309 * other_secret already set by the ClientKeyExchange message,
1310 * and is 48 bytes long
1311 */
Philippe Antoine747fd532018-05-30 09:13:21 +02001312 if( end - p < 2 )
1313 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1314
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02001315 *p++ = 0;
1316 *p++ = 48;
1317 p += 48;
1318 }
1319 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001320#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
1321#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
1322 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001323 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02001324 int ret;
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01001325 size_t len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001326
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02001327 /* Write length only when we know the actual value */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001328 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01001329 p + 2, end - ( p + 2 ), &len,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001330 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001331 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001332 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001333 return( ret );
1334 }
Manuel Pégourié-Gonnard8df68632014-06-23 17:56:08 +02001335 *(p++) = (unsigned char)( len >> 8 );
1336 *(p++) = (unsigned char)( len );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001337 p += len;
1338
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001339 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001340 }
1341 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001342#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
1343#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
1344 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001345 {
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02001346 int ret;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001347 size_t zlen;
1348
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001349 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
Paul Bakker66d5d072014-06-17 16:39:18 +02001350 p + 2, end - ( p + 2 ),
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01001351 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001352 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001353 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001354 return( ret );
1355 }
1356
1357 *(p++) = (unsigned char)( zlen >> 8 );
1358 *(p++) = (unsigned char)( zlen );
1359 p += zlen;
1360
Janos Follath3fbdada2018-08-15 10:26:53 +01001361 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
1362 MBEDTLS_DEBUG_ECDH_Z );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001363 }
1364 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001365#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001366 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001367 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1368 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001369 }
1370
1371 /* opaque psk<0..2^16-1>; */
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001372 if( end - p < 2 )
1373 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01001374
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001375 *(p++) = (unsigned char)( psk_len >> 8 );
1376 *(p++) = (unsigned char)( psk_len );
Manuel Pégourié-Gonnardbc5e5082015-10-21 12:35:29 +02001377
1378 if( end < p || (size_t)( end - p ) < psk_len )
1379 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1380
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01001381 memcpy( p, psk, psk_len );
1382 p += psk_len;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001383
1384 ssl->handshake->pmslen = p - ssl->handshake->premaster;
1385
1386 return( 0 );
1387}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001388#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02001389
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001390#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00001391/*
1392 * SSLv3.0 MAC functions
1393 */
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01001394#define SSL_MAC_MAX_BYTES 20 /* MD-5 or SHA-1 */
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001395static void ssl_mac( mbedtls_md_context_t *md_ctx,
1396 const unsigned char *secret,
1397 const unsigned char *buf, size_t len,
1398 const unsigned char *ctr, int type,
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01001399 unsigned char out[SSL_MAC_MAX_BYTES] )
Paul Bakker5121ce52009-01-03 21:22:43 +00001400{
1401 unsigned char header[11];
1402 unsigned char padding[48];
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02001403 int padlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001404 int md_size = mbedtls_md_get_size( md_ctx->md_info );
1405 int md_type = mbedtls_md_get_type( md_ctx->md_info );
Paul Bakker68884e32013-01-07 18:20:04 +01001406
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02001407 /* Only MD5 and SHA-1 supported */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001408 if( md_type == MBEDTLS_MD_MD5 )
Paul Bakker68884e32013-01-07 18:20:04 +01001409 padlen = 48;
Manuel Pégourié-Gonnard8d4ad072014-07-13 14:43:28 +02001410 else
Paul Bakker68884e32013-01-07 18:20:04 +01001411 padlen = 40;
Paul Bakker5121ce52009-01-03 21:22:43 +00001412
1413 memcpy( header, ctr, 8 );
1414 header[ 8] = (unsigned char) type;
1415 header[ 9] = (unsigned char)( len >> 8 );
1416 header[10] = (unsigned char)( len );
1417
Paul Bakker68884e32013-01-07 18:20:04 +01001418 memset( padding, 0x36, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001419 mbedtls_md_starts( md_ctx );
1420 mbedtls_md_update( md_ctx, secret, md_size );
1421 mbedtls_md_update( md_ctx, padding, padlen );
1422 mbedtls_md_update( md_ctx, header, 11 );
1423 mbedtls_md_update( md_ctx, buf, len );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001424 mbedtls_md_finish( md_ctx, out );
Paul Bakker5121ce52009-01-03 21:22:43 +00001425
Paul Bakker68884e32013-01-07 18:20:04 +01001426 memset( padding, 0x5C, padlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001427 mbedtls_md_starts( md_ctx );
1428 mbedtls_md_update( md_ctx, secret, md_size );
1429 mbedtls_md_update( md_ctx, padding, padlen );
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001430 mbedtls_md_update( md_ctx, out, md_size );
1431 mbedtls_md_finish( md_ctx, out );
Paul Bakker5f70b252012-09-13 14:23:06 +00001432}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001433#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5f70b252012-09-13 14:23:06 +00001434
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001435#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER) || \
Manuel Pégourié-Gonnarda60d0f22020-07-28 09:55:33 +02001436 defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC)
Manuel Pégourié-Gonnard8408a942015-04-09 12:14:31 +02001437#define SSL_SOME_MODES_USE_MAC
Manuel Pégourié-Gonnard8e4b3372014-11-17 15:06:13 +01001438#endif
1439
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02001440/* The function below is only used in the Lucky 13 counter-measure in
1441 * ssl_decrypt_buf(). These are the defines that guard the call site. */
1442#if defined(SSL_SOME_MODES_USE_MAC) && \
1443 ( defined(MBEDTLS_SSL_PROTO_TLS1) || \
1444 defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1445 defined(MBEDTLS_SSL_PROTO_TLS1_2) )
1446/* This function makes sure every byte in the memory region is accessed
1447 * (in ascending addresses order) */
1448static void ssl_read_memory( unsigned char *p, size_t len )
1449{
1450 unsigned char acc = 0;
1451 volatile unsigned char force;
1452
1453 for( ; len != 0; p++, len-- )
1454 acc ^= *p;
1455
1456 force = acc;
1457 (void) force;
1458}
1459#endif /* SSL_SOME_MODES_USE_MAC && ( TLS1 || TLS1_1 || TLS1_2 ) */
1460
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01001461/*
Paul Bakker5121ce52009-01-03 21:22:43 +00001462 * Encryption/decryption functions
Paul Bakkerf7abd422013-04-16 13:15:56 +02001463 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001464static int ssl_encrypt_buf( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001465{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001466 mbedtls_cipher_mode_t mode;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001467 int auth_done = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001468
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001469 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001470
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001471 if( ssl->session_out == NULL || ssl->transform_out == NULL )
1472 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001473 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1474 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001475 }
1476
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001477 mode = mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001478
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001479 MBEDTLS_SSL_DEBUG_BUF( 4, "before encrypt: output payload",
Manuel Pégourié-Gonnard60346be2014-11-21 11:38:37 +01001480 ssl->out_msg, ssl->out_msglen );
1481
Paul Bakker5121ce52009-01-03 21:22:43 +00001482 /*
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01001483 * Add MAC before if needed
Paul Bakker5121ce52009-01-03 21:22:43 +00001484 */
Manuel Pégourié-Gonnard8408a942015-04-09 12:14:31 +02001485#if defined(SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001486 if( mode == MBEDTLS_MODE_STREAM ||
1487 ( mode == MBEDTLS_MODE_CBC
1488#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1489 && ssl->session_out->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001490#endif
1491 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00001492 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001493#if defined(MBEDTLS_SSL_PROTO_SSL3)
1494 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001495 {
Manuel Pégourié-Gonnardb053efb2017-12-19 10:03:46 +01001496 unsigned char mac[SSL_MAC_MAX_BYTES];
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001497
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001498 ssl_mac( &ssl->transform_out->md_ctx_enc,
1499 ssl->transform_out->mac_enc,
1500 ssl->out_msg, ssl->out_msglen,
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01001501 ssl->out_ctr, ssl->out_msgtype,
1502 mac );
1503
1504 memcpy( ssl->out_msg + ssl->out_msglen, mac, ssl->transform_out->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001505 }
1506 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001507#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001508#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1509 defined(MBEDTLS_SSL_PROTO_TLS1_2)
1510 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001511 {
Hanno Becker992b6872017-11-09 18:57:39 +00001512 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
1513
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001514 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_ctr, 8 );
1515 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_hdr, 3 );
1516 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_len, 2 );
1517 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc,
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001518 ssl->out_msg, ssl->out_msglen );
Hanno Becker992b6872017-11-09 18:57:39 +00001519 mbedtls_md_hmac_finish( &ssl->transform_out->md_ctx_enc, mac );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001520 mbedtls_md_hmac_reset( &ssl->transform_out->md_ctx_enc );
Hanno Becker992b6872017-11-09 18:57:39 +00001521
1522 memcpy( ssl->out_msg + ssl->out_msglen, mac, ssl->transform_out->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001523 }
1524 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001525#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001526 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001527 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1528 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001529 }
1530
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001531 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac",
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001532 ssl->out_msg + ssl->out_msglen,
1533 ssl->transform_out->maclen );
1534
1535 ssl->out_msglen += ssl->transform_out->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001536 auth_done++;
Paul Bakker577e0062013-08-28 11:57:20 +02001537 }
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001538#endif /* AEAD not the only option */
Paul Bakker5121ce52009-01-03 21:22:43 +00001539
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02001540 /*
1541 * Encrypt
1542 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001543#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
1544 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00001545 {
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001546 int ret;
1547 size_t olen = 0;
1548
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001549 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Paul Bakker5121ce52009-01-03 21:22:43 +00001550 "including %d bytes of padding",
1551 ssl->out_msglen, 0 ) );
1552
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001553 if( ( ret = mbedtls_cipher_crypt( &ssl->transform_out->cipher_ctx_enc,
Paul Bakker45125bc2013-09-04 16:47:11 +02001554 ssl->transform_out->iv_enc,
Manuel Pégourié-Gonnard8764d272014-05-13 11:52:02 +02001555 ssl->transform_out->ivlen,
1556 ssl->out_msg, ssl->out_msglen,
1557 ssl->out_msg, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02001558 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001559 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001560 return( ret );
1561 }
1562
1563 if( ssl->out_msglen != olen )
1564 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001565 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1566 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001567 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001568 }
Paul Bakker68884e32013-01-07 18:20:04 +01001569 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001570#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001571#if defined(MBEDTLS_GCM_C) || \
1572 defined(MBEDTLS_CCM_C) || \
1573 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001574 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001575 mode == MBEDTLS_MODE_CCM ||
1576 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00001577 {
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001578 int ret;
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001579 size_t enc_msglen, olen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001580 unsigned char *enc_msg;
1581 unsigned char add_data[13];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001582 unsigned char iv[12];
1583 mbedtls_ssl_transform *transform = ssl->transform_out;
1584 unsigned char taglen = transform->ciphersuite_info->flags &
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001585 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001586 size_t explicit_ivlen = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001587
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001588 /*
1589 * Prepare additional authenticated data
1590 */
Paul Bakkerca4ab492012-04-18 14:23:57 +00001591 memcpy( add_data, ssl->out_ctr, 8 );
1592 add_data[8] = ssl->out_msgtype;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001593 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001594 ssl->conf->transport, add_data + 9 );
Paul Bakkerca4ab492012-04-18 14:23:57 +00001595 add_data[11] = ( ssl->out_msglen >> 8 ) & 0xFF;
1596 add_data[12] = ssl->out_msglen & 0xFF;
1597
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001598 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data for AEAD", add_data, 13 );
Paul Bakkerca4ab492012-04-18 14:23:57 +00001599
Paul Bakker68884e32013-01-07 18:20:04 +01001600 /*
1601 * Generate IV
1602 */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001603 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
1604 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02001605 /* GCM and CCM: fixed || explicit (=seqnum) */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001606 memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
1607 memcpy( iv + transform->fixed_ivlen, ssl->out_ctr, 8 );
1608 memcpy( ssl->out_iv, ssl->out_ctr, 8 );
1609
1610 }
1611 else if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
1612 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02001613 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001614 unsigned char i;
1615
1616 memcpy( iv, transform->iv_enc, transform->fixed_ivlen );
1617
1618 for( i = 0; i < 8; i++ )
1619 iv[i+4] ^= ssl->out_ctr[i];
1620 }
1621 else
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01001622 {
1623 /* Reminder if we ever add an AEAD mode with a different size */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001624 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1625 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd056ce02014-10-29 22:29:20 +01001626 }
1627
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001628 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (internal)",
1629 iv, transform->ivlen );
1630 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (transmitted)",
1631 ssl->out_iv, explicit_ivlen );
Manuel Pégourié-Gonnard226d5da2013-09-05 13:19:22 +02001632
Paul Bakker68884e32013-01-07 18:20:04 +01001633 /*
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001634 * Fix message length with added IV
Paul Bakker68884e32013-01-07 18:20:04 +01001635 */
1636 enc_msg = ssl->out_msg;
1637 enc_msglen = ssl->out_msglen;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001638 ssl->out_msglen += explicit_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001639
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001640 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001641 "including 0 bytes of padding",
1642 ssl->out_msglen ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00001643
Paul Bakker68884e32013-01-07 18:20:04 +01001644 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001645 * Encrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001646 */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001647 if( ( ret = mbedtls_cipher_auth_encrypt( &transform->cipher_ctx_enc,
1648 iv, transform->ivlen,
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001649 add_data, 13,
1650 enc_msg, enc_msglen,
1651 enc_msg, &olen,
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001652 enc_msg + enc_msglen, taglen ) ) != 0 )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001653 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001654 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001655 return( ret );
1656 }
1657
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001658 if( olen != enc_msglen )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001659 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001660 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1661 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001662 }
1663
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001664 ssl->out_msglen += taglen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001665 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001666
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001667 MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag", enc_msg + enc_msglen, taglen );
Paul Bakkerca4ab492012-04-18 14:23:57 +00001668 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001669 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001670#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
Manuel Pégourié-Gonnarda60d0f22020-07-28 09:55:33 +02001671#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001672 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00001673 {
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001674 int ret;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001675 unsigned char *enc_msg;
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01001676 size_t enc_msglen, padlen, olen = 0, i;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001677
Paul Bakker48916f92012-09-16 19:57:18 +00001678 padlen = ssl->transform_out->ivlen - ( ssl->out_msglen + 1 ) %
1679 ssl->transform_out->ivlen;
1680 if( padlen == ssl->transform_out->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00001681 padlen = 0;
1682
1683 for( i = 0; i <= padlen; i++ )
1684 ssl->out_msg[ssl->out_msglen + i] = (unsigned char) padlen;
1685
1686 ssl->out_msglen += padlen + 1;
1687
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001688 enc_msglen = ssl->out_msglen;
1689 enc_msg = ssl->out_msg;
1690
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001691#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001692 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00001693 * Prepend per-record IV for block cipher in TLS v1.1 and up as per
1694 * Method 1 (6.2.3.2. in RFC4346 and RFC5246)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001695 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001696 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001697 {
1698 /*
1699 * Generate IV
1700 */
Manuel Pégourié-Gonnardea356662015-08-27 12:02:40 +02001701 ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->transform_out->iv_enc,
Paul Bakker48916f92012-09-16 19:57:18 +00001702 ssl->transform_out->ivlen );
Paul Bakkera3d195c2011-11-27 21:07:34 +00001703 if( ret != 0 )
1704 return( ret );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001705
Paul Bakker92be97b2013-01-02 17:30:03 +01001706 memcpy( ssl->out_iv, ssl->transform_out->iv_enc,
Paul Bakker48916f92012-09-16 19:57:18 +00001707 ssl->transform_out->ivlen );
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001708
1709 /*
1710 * Fix pointer positions and message length with added IV
1711 */
Paul Bakker92be97b2013-01-02 17:30:03 +01001712 enc_msg = ssl->out_msg;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001713 enc_msglen = ssl->out_msglen;
Paul Bakker48916f92012-09-16 19:57:18 +00001714 ssl->out_msglen += ssl->transform_out->ivlen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001715 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001716#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001717
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001718 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001719 "including %d bytes of IV and %d bytes of padding",
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001720 ssl->out_msglen, ssl->transform_out->ivlen,
1721 padlen + 1 ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001722
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001723 if( ( ret = mbedtls_cipher_crypt( &ssl->transform_out->cipher_ctx_enc,
Paul Bakker45125bc2013-09-04 16:47:11 +02001724 ssl->transform_out->iv_enc,
Manuel Pégourié-Gonnard8764d272014-05-13 11:52:02 +02001725 ssl->transform_out->ivlen,
1726 enc_msg, enc_msglen,
1727 enc_msg, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02001728 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001729 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02001730 return( ret );
1731 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001732
Paul Bakkercca5b812013-08-31 17:40:26 +02001733 if( enc_msglen != olen )
1734 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001735 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1736 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02001737 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001738
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001739#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
1740 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakkercca5b812013-08-31 17:40:26 +02001741 {
1742 /*
1743 * Save IV in SSL3 and TLS1
1744 */
1745 memcpy( ssl->transform_out->iv_enc,
1746 ssl->transform_out->cipher_ctx_enc.iv,
1747 ssl->transform_out->ivlen );
Paul Bakker5121ce52009-01-03 21:22:43 +00001748 }
Paul Bakkercca5b812013-08-31 17:40:26 +02001749#endif
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001750
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001751#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001752 if( auth_done == 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001753 {
Hanno Becker3d8c9072018-01-05 16:24:22 +00001754 unsigned char mac[MBEDTLS_SSL_MAC_ADD];
1755
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001756 /*
1757 * MAC(MAC_write_key, seq_num +
1758 * TLSCipherText.type +
1759 * TLSCipherText.version +
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01001760 * length_of( (IV +) ENC(...) ) +
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001761 * IV + // except for TLS 1.0
1762 * ENC(content + padding + padding_length));
1763 */
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001764 unsigned char pseudo_hdr[13];
1765
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001766 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001767
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001768 memcpy( pseudo_hdr + 0, ssl->out_ctr, 8 );
1769 memcpy( pseudo_hdr + 8, ssl->out_hdr, 3 );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01001770 pseudo_hdr[11] = (unsigned char)( ( ssl->out_msglen >> 8 ) & 0xFF );
1771 pseudo_hdr[12] = (unsigned char)( ( ssl->out_msglen ) & 0xFF );
1772
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001773 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", pseudo_hdr, 13 );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001774
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001775 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, pseudo_hdr, 13 );
1776 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc,
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001777 ssl->out_iv, ssl->out_msglen );
Hanno Becker3d8c9072018-01-05 16:24:22 +00001778 mbedtls_md_hmac_finish( &ssl->transform_out->md_ctx_enc, mac );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001779 mbedtls_md_hmac_reset( &ssl->transform_out->md_ctx_enc );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001780
Hanno Becker3d8c9072018-01-05 16:24:22 +00001781 memcpy( ssl->out_iv + ssl->out_msglen, mac,
1782 ssl->transform_out->maclen );
1783
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001784 ssl->out_msglen += ssl->transform_out->maclen;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001785 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01001786 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001787#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Paul Bakker5121ce52009-01-03 21:22:43 +00001788 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02001789 else
Manuel Pégourié-Gonnarda60d0f22020-07-28 09:55:33 +02001790#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02001791 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001792 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1793 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02001794 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001795
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001796 /* Make extra sure authentication was performed, exactly once */
1797 if( auth_done != 1 )
1798 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001799 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1800 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001801 }
1802
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001803 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001804
1805 return( 0 );
1806}
1807
Manuel Pégourié-Gonnardfde75052020-07-28 10:19:45 +02001808#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) && \
1809 ( defined(MBEDTLS_SSL_PROTO_TLS1) || \
1810 defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1811 defined(MBEDTLS_SSL_PROTO_TLS1_2) )
1812/*
1813 * Compute HMAC of variable-length data with constant flow.
1814 */
1815int mbedtls_ssl_cf_hmac(
1816 mbedtls_md_context_t *ctx,
1817 const unsigned char *add_data, size_t add_data_len,
1818 const unsigned char *data, size_t data_len_secret,
1819 size_t min_data_len, size_t max_data_len,
1820 unsigned char *output )
1821{
1822 /* WORK IN PROGRESS - THIS IS NOT CONSTANT FLOW AT ALL */
1823 (void) min_data_len;
1824 (void) max_data_len;
1825 mbedtls_md_hmac_update( ctx, add_data, add_data_len );
1826 mbedtls_md_hmac_update( ctx, data, data_len_secret );
1827 mbedtls_md_hmac_finish( ctx, output );
1828 mbedtls_md_hmac_reset( ctx );
1829
1830 return( 0 );
1831}
1832#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC && TLS 1.0-1.2 */
1833
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001834static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001835{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001836 mbedtls_cipher_mode_t mode;
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001837 int auth_done = 0;
Manuel Pégourié-Gonnard8408a942015-04-09 12:14:31 +02001838#if defined(SSL_SOME_MODES_USE_MAC)
Paul Bakker1e5369c2013-12-19 16:40:57 +01001839 size_t padlen = 0, correct = 1;
1840#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001841
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001842 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001843
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001844 if( ssl->session_in == NULL || ssl->transform_in == NULL )
1845 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001846 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1847 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001848 }
1849
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001850 mode = mbedtls_cipher_get_cipher_mode( &ssl->transform_in->cipher_ctx_dec );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001851
Paul Bakker48916f92012-09-16 19:57:18 +00001852 if( ssl->in_msglen < ssl->transform_in->minlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00001853 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001854 MBEDTLS_SSL_DEBUG_MSG( 1, ( "in_msglen (%d) < minlen (%d)",
Paul Bakker48916f92012-09-16 19:57:18 +00001855 ssl->in_msglen, ssl->transform_in->minlen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001856 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker5121ce52009-01-03 21:22:43 +00001857 }
1858
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001859#if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
1860 if( mode == MBEDTLS_MODE_STREAM )
Paul Bakker68884e32013-01-07 18:20:04 +01001861 {
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001862 int ret;
1863 size_t olen = 0;
1864
Paul Bakker68884e32013-01-07 18:20:04 +01001865 padlen = 0;
1866
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001867 if( ( ret = mbedtls_cipher_crypt( &ssl->transform_in->cipher_ctx_dec,
Paul Bakker45125bc2013-09-04 16:47:11 +02001868 ssl->transform_in->iv_dec,
Manuel Pégourié-Gonnard8764d272014-05-13 11:52:02 +02001869 ssl->transform_in->ivlen,
1870 ssl->in_msg, ssl->in_msglen,
1871 ssl->in_msg, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02001872 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001873 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001874 return( ret );
1875 }
1876
1877 if( ssl->in_msglen != olen )
1878 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001879 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1880 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkerea6ad3f2013-09-02 14:57:01 +02001881 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001882 }
Paul Bakker68884e32013-01-07 18:20:04 +01001883 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001884#endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001885#if defined(MBEDTLS_GCM_C) || \
1886 defined(MBEDTLS_CCM_C) || \
1887 defined(MBEDTLS_CHACHAPOLY_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001888 if( mode == MBEDTLS_MODE_GCM ||
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001889 mode == MBEDTLS_MODE_CCM ||
1890 mode == MBEDTLS_MODE_CHACHAPOLY )
Paul Bakkerca4ab492012-04-18 14:23:57 +00001891 {
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001892 int ret;
1893 size_t dec_msglen, olen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001894 unsigned char *dec_msg;
1895 unsigned char *dec_msg_result;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001896 unsigned char add_data[13];
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001897 unsigned char iv[12];
1898 mbedtls_ssl_transform *transform = ssl->transform_in;
1899 unsigned char taglen = transform->ciphersuite_info->flags &
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001900 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001901 size_t explicit_iv_len = transform->ivlen - transform->fixed_ivlen;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001902
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001903 /*
1904 * Compute and update sizes
1905 */
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001906 if( ssl->in_msglen < explicit_iv_len + taglen )
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02001907 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001908 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < explicit_iv_len (%d) "
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02001909 "+ taglen (%d)", ssl->in_msglen,
1910 explicit_iv_len, taglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001911 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard0bcc4e12014-06-17 10:54:17 +02001912 }
1913 dec_msglen = ssl->in_msglen - explicit_iv_len - taglen;
1914
Paul Bakker68884e32013-01-07 18:20:04 +01001915 dec_msg = ssl->in_msg;
1916 dec_msg_result = ssl->in_msg;
1917 ssl->in_msglen = dec_msglen;
1918
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001919 /*
1920 * Prepare additional authenticated data
1921 */
Paul Bakker68884e32013-01-07 18:20:04 +01001922 memcpy( add_data, ssl->in_ctr, 8 );
1923 add_data[8] = ssl->in_msgtype;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001924 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001925 ssl->conf->transport, add_data + 9 );
Paul Bakker68884e32013-01-07 18:20:04 +01001926 add_data[11] = ( ssl->in_msglen >> 8 ) & 0xFF;
1927 add_data[12] = ssl->in_msglen & 0xFF;
1928
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001929 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data for AEAD", add_data, 13 );
Paul Bakker68884e32013-01-07 18:20:04 +01001930
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001931 /*
1932 * Prepare IV
1933 */
1934 if( transform->ivlen == 12 && transform->fixed_ivlen == 4 )
1935 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02001936 /* GCM and CCM: fixed || explicit (transmitted) */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001937 memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
1938 memcpy( iv + transform->fixed_ivlen, ssl->in_iv, 8 );
Paul Bakker68884e32013-01-07 18:20:04 +01001939
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001940 }
1941 else if( transform->ivlen == 12 && transform->fixed_ivlen == 12 )
1942 {
Manuel Pégourié-Gonnard8744a022018-07-11 12:30:40 +02001943 /* ChachaPoly: fixed XOR sequence number */
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001944 unsigned char i;
1945
1946 memcpy( iv, transform->iv_dec, transform->fixed_ivlen );
1947
1948 for( i = 0; i < 8; i++ )
1949 iv[i+4] ^= ssl->in_ctr[i];
1950 }
1951 else
1952 {
1953 /* Reminder if we ever add an AEAD mode with a different size */
1954 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1955 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1956 }
1957
1958 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", iv, transform->ivlen );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001959 MBEDTLS_SSL_DEBUG_BUF( 4, "TAG used", dec_msg + dec_msglen, taglen );
Paul Bakker68884e32013-01-07 18:20:04 +01001960
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001961 /*
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001962 * Decrypt and authenticate
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001963 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001964 if( ( ret = mbedtls_cipher_auth_decrypt( &ssl->transform_in->cipher_ctx_dec,
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02001965 iv, transform->ivlen,
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001966 add_data, 13,
1967 dec_msg, dec_msglen,
1968 dec_msg_result, &olen,
Manuel Pégourié-Gonnard2e5ee322014-05-14 13:09:22 +02001969 dec_msg + dec_msglen, taglen ) ) != 0 )
Paul Bakkerca4ab492012-04-18 14:23:57 +00001970 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001971 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001972
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001973 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
1974 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001975
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001976 return( ret );
1977 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01001978 auth_done++;
Paul Bakkerca4ab492012-04-18 14:23:57 +00001979
Manuel Pégourié-Gonnardde7bb442014-05-13 12:41:10 +02001980 if( olen != dec_msglen )
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001981 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001982 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1983 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardd13a4092013-09-05 16:10:41 +02001984 }
Paul Bakkerca4ab492012-04-18 14:23:57 +00001985 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001986 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001987#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
Manuel Pégourié-Gonnarda60d0f22020-07-28 09:55:33 +02001988#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001989 if( mode == MBEDTLS_MODE_CBC )
Paul Bakker5121ce52009-01-03 21:22:43 +00001990 {
Paul Bakker45829992013-01-03 14:52:21 +01001991 /*
1992 * Decrypt and check the padding
1993 */
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001994 int ret;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00001995 unsigned char *dec_msg;
1996 unsigned char *dec_msg_result;
Paul Bakker23986e52011-04-24 08:57:21 +00001997 size_t dec_msglen;
Paul Bakkere47b34b2013-02-27 14:48:00 +01001998 size_t minlen = 0;
Paul Bakkerda02a7f2013-08-31 17:25:14 +02001999 size_t olen = 0;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002000
Paul Bakker5121ce52009-01-03 21:22:43 +00002001 /*
Paul Bakker45829992013-01-03 14:52:21 +01002002 * Check immediate ciphertext sanity
Paul Bakker5121ce52009-01-03 21:22:43 +00002003 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002004#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
2005 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakker45829992013-01-03 14:52:21 +01002006 minlen += ssl->transform_in->ivlen;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002007#endif
Paul Bakker45829992013-01-03 14:52:21 +01002008
2009 if( ssl->in_msglen < minlen + ssl->transform_in->ivlen ||
2010 ssl->in_msglen < minlen + ssl->transform_in->maclen + 1 )
2011 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002012 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < max( ivlen(%d), maclen (%d) "
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02002013 "+ 1 ) ( + expl IV )", ssl->in_msglen,
2014 ssl->transform_in->ivlen,
2015 ssl->transform_in->maclen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002016 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker45829992013-01-03 14:52:21 +01002017 }
2018
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002019 dec_msglen = ssl->in_msglen;
2020 dec_msg = ssl->in_msg;
2021 dec_msg_result = ssl->in_msg;
2022
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002023 /*
2024 * Authenticate before decrypt if enabled
2025 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002026#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
2027 if( ssl->session_in->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002028 {
Hanno Becker992b6872017-11-09 18:57:39 +00002029 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01002030 unsigned char pseudo_hdr[13];
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002031
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002032 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002033
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002034 dec_msglen -= ssl->transform_in->maclen;
2035 ssl->in_msglen -= ssl->transform_in->maclen;
2036
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01002037 memcpy( pseudo_hdr + 0, ssl->in_ctr, 8 );
2038 memcpy( pseudo_hdr + 8, ssl->in_hdr, 3 );
2039 pseudo_hdr[11] = (unsigned char)( ( ssl->in_msglen >> 8 ) & 0xFF );
2040 pseudo_hdr[12] = (unsigned char)( ( ssl->in_msglen ) & 0xFF );
2041
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002042 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", pseudo_hdr, 13 );
Manuel Pégourié-Gonnard08558e52014-11-04 14:40:21 +01002043
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002044 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, pseudo_hdr, 13 );
2045 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec,
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002046 ssl->in_iv, ssl->in_msglen );
Hanno Becker992b6872017-11-09 18:57:39 +00002047 mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, mac_expect );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002048 mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002049
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002050 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", ssl->in_iv + ssl->in_msglen,
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002051 ssl->transform_in->maclen );
Hanno Becker992b6872017-11-09 18:57:39 +00002052 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect,
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002053 ssl->transform_in->maclen );
2054
Hanno Becker992b6872017-11-09 18:57:39 +00002055 if( mbedtls_ssl_safer_memcmp( ssl->in_iv + ssl->in_msglen, mac_expect,
2056 ssl->transform_in->maclen ) != 0 )
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002057 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002058 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002059
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002060 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002061 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002062 auth_done++;
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002063 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002064#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002065
2066 /*
2067 * Check length sanity
2068 */
2069 if( ssl->in_msglen % ssl->transform_in->ivlen != 0 )
2070 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002071 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0",
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002072 ssl->in_msglen, ssl->transform_in->ivlen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002073 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002074 }
2075
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002076#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002077 /*
Paul Bakker1ef83d62012-04-11 12:09:53 +00002078 * Initialize for prepended IV for block cipher in TLS v1.1 and up
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002079 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002080 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002081 {
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002082 unsigned char i;
Paul Bakker48916f92012-09-16 19:57:18 +00002083 dec_msglen -= ssl->transform_in->ivlen;
2084 ssl->in_msglen -= ssl->transform_in->ivlen;
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002085
Paul Bakker48916f92012-09-16 19:57:18 +00002086 for( i = 0; i < ssl->transform_in->ivlen; i++ )
Paul Bakker92be97b2013-01-02 17:30:03 +01002087 ssl->transform_in->iv_dec[i] = ssl->in_iv[i];
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002088 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002089#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker2e11f7d2010-07-25 14:24:53 +00002090
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002091 if( ( ret = mbedtls_cipher_crypt( &ssl->transform_in->cipher_ctx_dec,
Paul Bakker45125bc2013-09-04 16:47:11 +02002092 ssl->transform_in->iv_dec,
Manuel Pégourié-Gonnard8764d272014-05-13 11:52:02 +02002093 ssl->transform_in->ivlen,
2094 dec_msg, dec_msglen,
2095 dec_msg_result, &olen ) ) != 0 )
Paul Bakker45125bc2013-09-04 16:47:11 +02002096 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002097 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
Paul Bakkercca5b812013-08-31 17:40:26 +02002098 return( ret );
2099 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02002100
Paul Bakkercca5b812013-08-31 17:40:26 +02002101 if( dec_msglen != olen )
2102 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002103 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2104 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkercca5b812013-08-31 17:40:26 +02002105 }
Paul Bakkerda02a7f2013-08-31 17:25:14 +02002106
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002107#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
2108 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
Paul Bakkercca5b812013-08-31 17:40:26 +02002109 {
2110 /*
2111 * Save IV in SSL3 and TLS1
2112 */
2113 memcpy( ssl->transform_in->iv_dec,
2114 ssl->transform_in->cipher_ctx_dec.iv,
2115 ssl->transform_in->ivlen );
Paul Bakker5121ce52009-01-03 21:22:43 +00002116 }
Paul Bakkercca5b812013-08-31 17:40:26 +02002117#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002118
2119 padlen = 1 + ssl->in_msg[ssl->in_msglen - 1];
Paul Bakker45829992013-01-03 14:52:21 +01002120
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002121 if( ssl->in_msglen < ssl->transform_in->maclen + padlen &&
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002122 auth_done == 0 )
Paul Bakker45829992013-01-03 14:52:21 +01002123 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002124#if defined(MBEDTLS_SSL_DEBUG_ALL)
2125 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
Paul Bakker45829992013-01-03 14:52:21 +01002126 ssl->in_msglen, ssl->transform_in->maclen, padlen ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01002127#endif
Paul Bakker45829992013-01-03 14:52:21 +01002128 padlen = 0;
Paul Bakker45829992013-01-03 14:52:21 +01002129 correct = 0;
2130 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002131
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002132#if defined(MBEDTLS_SSL_PROTO_SSL3)
2133 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002134 {
Paul Bakker48916f92012-09-16 19:57:18 +00002135 if( padlen > ssl->transform_in->ivlen )
Paul Bakker5121ce52009-01-03 21:22:43 +00002136 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002137#if defined(MBEDTLS_SSL_DEBUG_ALL)
2138 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
Paul Bakker5121ce52009-01-03 21:22:43 +00002139 "should be no more than %d",
Paul Bakker48916f92012-09-16 19:57:18 +00002140 padlen, ssl->transform_in->ivlen ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01002141#endif
Paul Bakker45829992013-01-03 14:52:21 +01002142 correct = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00002143 }
2144 }
2145 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002146#endif /* MBEDTLS_SSL_PROTO_SSL3 */
2147#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2148 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2149 if( ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002150 {
2151 /*
Paul Bakker45829992013-01-03 14:52:21 +01002152 * TLSv1+: always check the padding up to the first failure
2153 * and fake check up to 256 bytes of padding
Paul Bakker5121ce52009-01-03 21:22:43 +00002154 */
Paul Bakkerca9c87e2013-09-25 18:52:37 +02002155 size_t pad_count = 0, real_count = 1;
Angus Grattonb512bc12018-06-19 15:57:50 +10002156 size_t padding_idx = ssl->in_msglen - padlen;
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002157 size_t i;
Paul Bakkere47b34b2013-02-27 14:48:00 +01002158
Paul Bakker956c9e02013-12-19 14:42:28 +01002159 /*
2160 * Padding is guaranteed to be incorrect if:
Angus Grattonb512bc12018-06-19 15:57:50 +10002161 * 1. padlen > ssl->in_msglen
Paul Bakker956c9e02013-12-19 14:42:28 +01002162 *
Angus Grattonb512bc12018-06-19 15:57:50 +10002163 * 2. padding_idx > MBEDTLS_SSL_IN_CONTENT_LEN +
Paul Bakker61885c72014-04-25 12:59:03 +02002164 * ssl->transform_in->maclen
Paul Bakker956c9e02013-12-19 14:42:28 +01002165 *
2166 * In both cases we reset padding_idx to a safe value (0) to
2167 * prevent out-of-buffer reads.
2168 */
Angus Grattonb512bc12018-06-19 15:57:50 +10002169 correct &= ( padlen <= ssl->in_msglen );
2170 correct &= ( padding_idx <= MBEDTLS_SSL_IN_CONTENT_LEN +
Paul Bakker61885c72014-04-25 12:59:03 +02002171 ssl->transform_in->maclen );
Paul Bakker956c9e02013-12-19 14:42:28 +01002172
2173 padding_idx *= correct;
2174
Angus Grattonb512bc12018-06-19 15:57:50 +10002175 for( i = 0; i < 256; i++ )
Paul Bakkerca9c87e2013-09-25 18:52:37 +02002176 {
Angus Grattonb512bc12018-06-19 15:57:50 +10002177 real_count &= ( i < padlen );
Paul Bakkerca9c87e2013-09-25 18:52:37 +02002178 pad_count += real_count *
2179 ( ssl->in_msg[padding_idx + i] == padlen - 1 );
2180 }
Paul Bakkere47b34b2013-02-27 14:48:00 +01002181
2182 correct &= ( pad_count == padlen ); /* Only 1 on correct padding */
Paul Bakkere47b34b2013-02-27 14:48:00 +01002183
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002184#if defined(MBEDTLS_SSL_DEBUG_ALL)
Paul Bakker66d5d072014-06-17 16:39:18 +02002185 if( padlen > 0 && correct == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002186 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
Paul Bakkerd66f0702013-01-31 16:57:45 +01002187#endif
Paul Bakkere47b34b2013-02-27 14:48:00 +01002188 padlen &= correct * 0x1FF;
Paul Bakker5121ce52009-01-03 21:22:43 +00002189 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002190 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002191#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
2192 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02002193 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002194 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2195 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02002196 }
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002197
2198 ssl->in_msglen -= padlen;
Paul Bakker5121ce52009-01-03 21:22:43 +00002199 }
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002200 else
Manuel Pégourié-Gonnarda60d0f22020-07-28 09:55:33 +02002201#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC) */
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002202 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002203 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2204 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardf7dc3782013-09-13 14:10:44 +02002205 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002206
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02002207#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002208 MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption",
Paul Bakker5121ce52009-01-03 21:22:43 +00002209 ssl->in_msg, ssl->in_msglen );
Manuel Pégourié-Gonnard6a25cfa2018-07-10 11:15:36 +02002210#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002211
2212 /*
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002213 * Authenticate if not done yet.
2214 * Compute the MAC regardless of the padding result (RFC4346, CBCTIME).
Paul Bakker5121ce52009-01-03 21:22:43 +00002215 */
Manuel Pégourié-Gonnard8408a942015-04-09 12:14:31 +02002216#if defined(SSL_SOME_MODES_USE_MAC)
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002217 if( auth_done == 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002218 {
Hanno Becker992b6872017-11-09 18:57:39 +00002219 unsigned char mac_expect[MBEDTLS_SSL_MAC_ADD];
Paul Bakker1e5369c2013-12-19 16:40:57 +01002220
Manuel Pégourié-Gonnard313d7962014-10-29 12:07:57 +01002221 ssl->in_msglen -= ssl->transform_in->maclen;
Paul Bakker5121ce52009-01-03 21:22:43 +00002222
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01002223 ssl->in_len[0] = (unsigned char)( ssl->in_msglen >> 8 );
2224 ssl->in_len[1] = (unsigned char)( ssl->in_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00002225
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002226#if defined(MBEDTLS_SSL_PROTO_SSL3)
2227 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002228 {
2229 ssl_mac( &ssl->transform_in->md_ctx_dec,
2230 ssl->transform_in->mac_dec,
2231 ssl->in_msg, ssl->in_msglen,
Manuel Pégourié-Gonnard464147c2017-12-18 18:04:59 +01002232 ssl->in_ctr, ssl->in_msgtype,
2233 mac_expect );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002234 }
2235 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002236#endif /* MBEDTLS_SSL_PROTO_SSL3 */
2237#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2238 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2239 if( ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002240 {
2241 /*
2242 * Process MAC and always update for padlen afterwards to make
Gilles Peskine20b44082018-05-29 14:06:49 +02002243 * total time independent of padlen.
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002244 *
2245 * Known timing attacks:
2246 * - Lucky Thirteen (http://www.isg.rhul.ac.uk/tls/TLStiming.pdf)
2247 *
Gilles Peskine20b44082018-05-29 14:06:49 +02002248 * To compensate for different timings for the MAC calculation
2249 * depending on how much padding was removed (which is determined
2250 * by padlen), process extra_run more blocks through the hash
2251 * function.
2252 *
2253 * The formula in the paper is
2254 * extra_run = ceil( (L1-55) / 64 ) - ceil( (L2-55) / 64 )
2255 * where L1 is the size of the header plus the decrypted message
2256 * plus CBC padding and L2 is the size of the header plus the
2257 * decrypted message. This is for an underlying hash function
2258 * with 64-byte blocks.
2259 * We use ( (Lx+8) / 64 ) to handle 'negative Lx' values
2260 * correctly. We round down instead of up, so -56 is the correct
2261 * value for our calculations instead of -55.
2262 *
Gilles Peskine1bd9d582018-06-04 11:58:44 +02002263 * Repeat the formula rather than defining a block_size variable.
2264 * This avoids requiring division by a variable at runtime
2265 * (which would be marginally less efficient and would require
2266 * linking an extra division function in some builds).
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002267 */
2268 size_t j, extra_run = 0;
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002269
2270 /*
2271 * The next two sizes are the minimum and maximum values of
2272 * in_msglen over all padlen values.
2273 *
2274 * They're independent of padlen, since we previously did
2275 * in_msglen -= padlen.
2276 *
2277 * Note that max_len + maclen is never more than the buffer
2278 * length, as we previously did in_msglen -= maclen too.
2279 */
2280 const size_t max_len = ssl->in_msglen + padlen;
2281 const size_t min_len = ( max_len > 256 ) ? max_len - 256 : 0;
2282
Gilles Peskine20b44082018-05-29 14:06:49 +02002283 switch( ssl->transform_in->ciphersuite_info->mac )
2284 {
Gilles Peskined0e55a42018-06-04 12:03:30 +02002285#if defined(MBEDTLS_MD5_C) || defined(MBEDTLS_SHA1_C) || \
2286 defined(MBEDTLS_SHA256_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02002287 case MBEDTLS_MD_MD5:
2288 case MBEDTLS_MD_SHA1:
Gilles Peskine20b44082018-05-29 14:06:49 +02002289 case MBEDTLS_MD_SHA256:
Gilles Peskine20b44082018-05-29 14:06:49 +02002290 /* 8 bytes of message size, 64-byte compression blocks */
2291 extra_run = ( 13 + ssl->in_msglen + padlen + 8 ) / 64 -
2292 ( 13 + ssl->in_msglen + 8 ) / 64;
2293 break;
2294#endif
Gilles Peskinea7fe25d2018-06-04 12:01:18 +02002295#if defined(MBEDTLS_SHA512_C)
Gilles Peskine20b44082018-05-29 14:06:49 +02002296 case MBEDTLS_MD_SHA384:
Gilles Peskine20b44082018-05-29 14:06:49 +02002297 /* 16 bytes of message size, 128-byte compression blocks */
2298 extra_run = ( 13 + ssl->in_msglen + padlen + 16 ) / 128 -
2299 ( 13 + ssl->in_msglen + 16 ) / 128;
2300 break;
2301#endif
2302 default:
Gilles Peskine5c389842018-06-04 12:02:43 +02002303 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Gilles Peskine20b44082018-05-29 14:06:49 +02002304 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2305 }
Paul Bakkere47b34b2013-02-27 14:48:00 +01002306
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002307 extra_run &= correct * 0xFF;
Paul Bakkere47b34b2013-02-27 14:48:00 +01002308
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002309 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_ctr, 8 );
2310 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_hdr, 3 );
2311 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_len, 2 );
2312 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_msg,
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002313 ssl->in_msglen );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002314 /* Make sure we access everything even when padlen > 0. This
2315 * makes the synchronisation requirements for just-in-time
2316 * Prime+Probe attacks much tighter and hopefully impractical. */
2317 ssl_read_memory( ssl->in_msg + ssl->in_msglen, padlen );
Hanno Becker992b6872017-11-09 18:57:39 +00002318 mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, mac_expect );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002319
Manuel Pégourié-Gonnard20cd85c2020-06-18 11:30:40 +02002320 /* Dummy calls to compression function.
2321 * Call mbedtls_md_process at least once due to cache attacks
2322 * that observe whether md_process() was called of not.
2323 * Respect the usual start-(process|update)-finish sequence for
2324 * the sake of hardware accelerators that might require it. */
2325 mbedtls_md_starts( &ssl->transform_in->md_ctx_dec );
Manuel Pégourié-Gonnard47fede02015-04-29 01:35:48 +02002326 for( j = 0; j < extra_run + 1; j++ )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002327 mbedtls_md_process( &ssl->transform_in->md_ctx_dec, ssl->in_msg );
Manuel Pégourié-Gonnard20cd85c2020-06-18 11:30:40 +02002328 {
2329 /* The switch statement above already checks that we're using
2330 * one of MD-5, SHA-1, SHA-256 or SHA-384. */
2331 unsigned char tmp[384 / 8];
2332 mbedtls_md_finish( &ssl->transform_in->md_ctx_dec, tmp );
2333 }
Paul Bakkere47b34b2013-02-27 14:48:00 +01002334
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002335 mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002336
2337 /* Make sure we access all the memory that could contain the MAC,
2338 * before we check it in the next code block. This makes the
2339 * synchronisation requirements for just-in-time Prime+Probe
2340 * attacks much tighter and hopefully impractical. */
2341 ssl_read_memory( ssl->in_msg + min_len,
2342 max_len - min_len + ssl->transform_in->maclen );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002343 }
2344 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002345#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
2346 MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002347 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002348 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2349 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002350 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002351
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002352#if defined(MBEDTLS_SSL_DEBUG_ALL)
Hanno Becker992b6872017-11-09 18:57:39 +00002353 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect, ssl->transform_in->maclen );
2354 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", ssl->in_msg + ssl->in_msglen,
2355 ssl->transform_in->maclen );
Manuel Pégourié-Gonnard7b420302018-06-28 10:38:35 +02002356#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002357
Hanno Becker992b6872017-11-09 18:57:39 +00002358 if( mbedtls_ssl_safer_memcmp( ssl->in_msg + ssl->in_msglen, mac_expect,
2359 ssl->transform_in->maclen ) != 0 )
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002360 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002361#if defined(MBEDTLS_SSL_DEBUG_ALL)
2362 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
Paul Bakkere47b34b2013-02-27 14:48:00 +01002363#endif
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002364 correct = 0;
2365 }
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002366 auth_done++;
Manuel Pégourié-Gonnard71096242013-10-25 19:31:25 +02002367 }
Hanno Beckerdd3ab132018-10-17 14:43:14 +01002368
2369 /*
2370 * Finally check the correct flag
2371 */
2372 if( correct == 0 )
2373 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard8408a942015-04-09 12:14:31 +02002374#endif /* SSL_SOME_MODES_USE_MAC */
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002375
2376 /* Make extra sure authentication was performed, exactly once */
2377 if( auth_done != 1 )
2378 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002379 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2380 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard352143f2015-01-13 10:59:51 +01002381 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002382
2383 if( ssl->in_msglen == 0 )
2384 {
Angus Gratton34817922018-06-19 15:58:22 +10002385#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2386 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3
2387 && ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
2388 {
2389 /* TLS v1.2 explicitly disallows zero-length messages which are not application data */
2390 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid zero-length message type: %d", ssl->in_msgtype ) );
2391 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
2392 }
2393#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2394
Paul Bakker5121ce52009-01-03 21:22:43 +00002395 ssl->nb_zero++;
2396
2397 /*
2398 * Three or more empty messages may be a DoS attack
2399 * (excessive CPU consumption).
2400 */
2401 if( ssl->nb_zero > 3 )
2402 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002403 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
Paul Bakker5121ce52009-01-03 21:22:43 +00002404 "messages, possible DoS attack" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002405 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Paul Bakker5121ce52009-01-03 21:22:43 +00002406 }
2407 }
2408 else
2409 ssl->nb_zero = 0;
Paul Bakkerf7abd422013-04-16 13:15:56 +02002410
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002411#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002412 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01002413 {
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02002414 ; /* in_ctr read from peer, not maintained internally */
Manuel Pégourié-Gonnardea22ce52014-09-24 09:46:10 +02002415 }
2416 else
2417#endif
2418 {
Manuel Pégourié-Gonnard2e58e8e2018-06-18 11:16:43 +02002419 unsigned char i;
Manuel Pégourié-Gonnardea22ce52014-09-24 09:46:10 +02002420 for( i = 8; i > ssl_ep_len( ssl ); i-- )
2421 if( ++ssl->in_ctr[i - 1] != 0 )
2422 break;
2423
2424 /* The loop goes to its end iff the counter is wrapping */
2425 if( i == ssl_ep_len( ssl ) )
2426 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002427 MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
2428 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnardea22ce52014-09-24 09:46:10 +02002429 }
Manuel Pégourié-Gonnard83cdffc2014-03-10 21:20:29 +01002430 }
2431
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002432 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002433
2434 return( 0 );
2435}
2436
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +01002437#undef MAC_NONE
2438#undef MAC_PLAINTEXT
2439#undef MAC_CIPHERTEXT
2440
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002441#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker2770fbd2012-07-03 13:30:23 +00002442/*
2443 * Compression/decompression functions
2444 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002445static int ssl_compress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00002446{
2447 int ret;
2448 unsigned char *msg_post = ssl->out_msg;
Andrzej Kurek5462e022018-04-20 07:58:53 -04002449 ptrdiff_t bytes_written = ssl->out_msg - ssl->out_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002450 size_t len_pre = ssl->out_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02002451 unsigned char *msg_pre = ssl->compress_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002452
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002453 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002454
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02002455 if( len_pre == 0 )
2456 return( 0 );
2457
Paul Bakker2770fbd2012-07-03 13:30:23 +00002458 memcpy( msg_pre, ssl->out_msg, len_pre );
2459
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002460 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002461 ssl->out_msglen ) );
2462
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002463 MBEDTLS_SSL_DEBUG_BUF( 4, "before compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002464 ssl->out_msg, ssl->out_msglen );
2465
Paul Bakker48916f92012-09-16 19:57:18 +00002466 ssl->transform_out->ctx_deflate.next_in = msg_pre;
2467 ssl->transform_out->ctx_deflate.avail_in = len_pre;
2468 ssl->transform_out->ctx_deflate.next_out = msg_post;
Angus Grattond8213d02016-05-25 20:56:48 +10002469 ssl->transform_out->ctx_deflate.avail_out = MBEDTLS_SSL_OUT_BUFFER_LEN - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002470
Paul Bakker48916f92012-09-16 19:57:18 +00002471 ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002472 if( ret != Z_OK )
2473 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002474 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform compression (%d)", ret ) );
2475 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002476 }
2477
Angus Grattond8213d02016-05-25 20:56:48 +10002478 ssl->out_msglen = MBEDTLS_SSL_OUT_BUFFER_LEN -
Andrzej Kurek5462e022018-04-20 07:58:53 -04002479 ssl->transform_out->ctx_deflate.avail_out - bytes_written;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002480
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002481 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002482 ssl->out_msglen ) );
2483
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002484 MBEDTLS_SSL_DEBUG_BUF( 4, "after compression: output payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002485 ssl->out_msg, ssl->out_msglen );
2486
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002487 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= compress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002488
2489 return( 0 );
2490}
2491
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002492static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
Paul Bakker2770fbd2012-07-03 13:30:23 +00002493{
2494 int ret;
2495 unsigned char *msg_post = ssl->in_msg;
Andrzej Kureka9ceef82018-04-24 06:32:44 -04002496 ptrdiff_t header_bytes = ssl->in_msg - ssl->in_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002497 size_t len_pre = ssl->in_msglen;
Paul Bakker16770332013-10-11 09:59:44 +02002498 unsigned char *msg_pre = ssl->compress_buf;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002499
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002500 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002501
Paul Bakkerabf2f8f2013-06-30 14:57:46 +02002502 if( len_pre == 0 )
2503 return( 0 );
2504
Paul Bakker2770fbd2012-07-03 13:30:23 +00002505 memcpy( msg_pre, ssl->in_msg, len_pre );
2506
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002507 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002508 ssl->in_msglen ) );
2509
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002510 MBEDTLS_SSL_DEBUG_BUF( 4, "before decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002511 ssl->in_msg, ssl->in_msglen );
2512
Paul Bakker48916f92012-09-16 19:57:18 +00002513 ssl->transform_in->ctx_inflate.next_in = msg_pre;
2514 ssl->transform_in->ctx_inflate.avail_in = len_pre;
2515 ssl->transform_in->ctx_inflate.next_out = msg_post;
Angus Grattond8213d02016-05-25 20:56:48 +10002516 ssl->transform_in->ctx_inflate.avail_out = MBEDTLS_SSL_IN_BUFFER_LEN -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04002517 header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002518
Paul Bakker48916f92012-09-16 19:57:18 +00002519 ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002520 if( ret != Z_OK )
2521 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002522 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform decompression (%d)", ret ) );
2523 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002524 }
2525
Angus Grattond8213d02016-05-25 20:56:48 +10002526 ssl->in_msglen = MBEDTLS_SSL_IN_BUFFER_LEN -
Andrzej Kureka9ceef82018-04-24 06:32:44 -04002527 ssl->transform_in->ctx_inflate.avail_out - header_bytes;
Paul Bakker2770fbd2012-07-03 13:30:23 +00002528
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002529 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002530 ssl->in_msglen ) );
2531
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002532 MBEDTLS_SSL_DEBUG_BUF( 4, "after decompression: input payload",
Paul Bakker2770fbd2012-07-03 13:30:23 +00002533 ssl->in_msg, ssl->in_msglen );
2534
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002535 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decompress buf" ) );
Paul Bakker2770fbd2012-07-03 13:30:23 +00002536
2537 return( 0 );
2538}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002539#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00002540
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002541#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
2542static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002543
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002544#if defined(MBEDTLS_SSL_PROTO_DTLS)
2545static int ssl_resend_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002546{
2547 /* If renegotiation is not enforced, retransmit until we would reach max
2548 * timeout if we were using the usual handshake doubling scheme */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002549 if( ssl->conf->renego_max_records < 0 )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002550 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002551 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002552 unsigned char doublings = 1;
2553
2554 while( ratio != 0 )
2555 {
2556 ++doublings;
2557 ratio >>= 1;
2558 }
2559
2560 if( ++ssl->renego_records_seen > doublings )
2561 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02002562 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002563 return( 0 );
2564 }
2565 }
2566
2567 return( ssl_write_hello_request( ssl ) );
2568}
2569#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002570#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02002571
Paul Bakker5121ce52009-01-03 21:22:43 +00002572/*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002573 * Fill the input message buffer by appending data to it.
2574 * The amount of data already fetched is in ssl->in_left.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002575 *
2576 * If we return 0, is it guaranteed that (at least) nb_want bytes are
2577 * available (from this read and/or a previous one). Otherwise, an error code
2578 * is returned (possibly EOF or WANT_READ).
2579 *
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002580 * With stream transport (TLS) on success ssl->in_left == nb_want, but
2581 * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
2582 * since we always read a whole datagram at once.
2583 *
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02002584 * For DTLS, it is up to the caller to set ssl->next_record_offset when
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002585 * they're done reading a record.
Paul Bakker5121ce52009-01-03 21:22:43 +00002586 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002587int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want )
Paul Bakker5121ce52009-01-03 21:22:43 +00002588{
Paul Bakker23986e52011-04-24 08:57:21 +00002589 int ret;
2590 size_t len;
Paul Bakker5121ce52009-01-03 21:22:43 +00002591
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002592 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002593
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002594 if( ssl->f_recv == NULL && ssl->f_recv_timeout == NULL )
2595 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002596 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01002597 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002598 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002599 }
2600
Angus Grattond8213d02016-05-25 20:56:48 +10002601 if( nb_want > MBEDTLS_SSL_IN_BUFFER_LEN - (size_t)( ssl->in_hdr - ssl->in_buf ) )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02002602 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002603 MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
2604 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02002605 }
2606
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002607#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002608 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00002609 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002610 uint32_t timeout;
2611
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02002612 /* Just to be sure */
2613 if( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL )
2614 {
2615 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
2616 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
2617 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2618 }
2619
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002620 /*
2621 * The point is, we need to always read a full datagram at once, so we
2622 * sometimes read more then requested, and handle the additional data.
2623 * It could be the rest of the current record (while fetching the
2624 * header) and/or some other records in the same datagram.
2625 */
2626
2627 /*
2628 * Move to the next record in the already read datagram if applicable
2629 */
2630 if( ssl->next_record_offset != 0 )
2631 {
2632 if( ssl->in_left < ssl->next_record_offset )
2633 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002634 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2635 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002636 }
2637
2638 ssl->in_left -= ssl->next_record_offset;
2639
2640 if( ssl->in_left != 0 )
2641 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002642 MBEDTLS_SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002643 ssl->next_record_offset ) );
2644 memmove( ssl->in_hdr,
2645 ssl->in_hdr + ssl->next_record_offset,
2646 ssl->in_left );
2647 }
2648
2649 ssl->next_record_offset = 0;
2650 }
2651
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002652 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Paul Bakker5121ce52009-01-03 21:22:43 +00002653 ssl->in_left, nb_want ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002654
2655 /*
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002656 * Done if we already have enough data.
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002657 */
2658 if( nb_want <= ssl->in_left)
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02002659 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002660 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002661 return( 0 );
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02002662 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002663
2664 /*
Antonin Décimod5f47592019-01-23 15:24:37 +01002665 * A record can't be split across datagrams. If we need to read but
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002666 * are not at the beginning of a new record, the caller did something
2667 * wrong.
2668 */
2669 if( ssl->in_left != 0 )
2670 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002671 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2672 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002673 }
2674
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002675 /*
2676 * Don't even try to read if time's out already.
2677 * This avoids by-passing the timer when repeatedly receiving messages
2678 * that will end up being dropped.
2679 */
2680 if( ssl_check_timer( ssl ) != 0 )
Hanno Beckere65ce782017-05-22 14:47:48 +01002681 {
2682 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timer has expired" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002683 ret = MBEDTLS_ERR_SSL_TIMEOUT;
Hanno Beckere65ce782017-05-22 14:47:48 +01002684 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002685 else
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002686 {
Angus Grattond8213d02016-05-25 20:56:48 +10002687 len = MBEDTLS_SSL_IN_BUFFER_LEN - ( ssl->in_hdr - ssl->in_buf );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002688
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002689 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002690 timeout = ssl->handshake->retransmit_timeout;
2691 else
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002692 timeout = ssl->conf->read_timeout;
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002693
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002694 MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002695
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02002696 if( ssl->f_recv_timeout != NULL )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002697 ret = ssl->f_recv_timeout( ssl->p_bio, ssl->in_hdr, len,
2698 timeout );
2699 else
2700 ret = ssl->f_recv( ssl->p_bio, ssl->in_hdr, len );
2701
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002702 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002703
2704 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002705 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002706 }
2707
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002708 if( ret == MBEDTLS_ERR_SSL_TIMEOUT )
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002709 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002710 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) );
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02002711 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002712
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002713 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02002714 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002715 if( ssl_double_retransmit_timeout( ssl ) != 0 )
2716 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002717 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002718 return( MBEDTLS_ERR_SSL_TIMEOUT );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002719 }
2720
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002721 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002722 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002723 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02002724 return( ret );
2725 }
2726
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002727 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02002728 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002729#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002730 else if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002731 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02002732 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02002733 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02002734 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002735 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02002736 return( ret );
2737 }
2738
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01002739 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02002740 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002741#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02002742 }
2743
Paul Bakker5121ce52009-01-03 21:22:43 +00002744 if( ret < 0 )
2745 return( ret );
2746
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002747 ssl->in_left = ret;
2748 }
2749 else
2750#endif
2751 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002752 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02002753 ssl->in_left, nb_want ) );
2754
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002755 while( ssl->in_left < nb_want )
2756 {
2757 len = nb_want - ssl->in_left;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02002758
2759 if( ssl_check_timer( ssl ) != 0 )
2760 ret = MBEDTLS_ERR_SSL_TIMEOUT;
2761 else
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02002762 {
2763 if( ssl->f_recv_timeout != NULL )
2764 {
2765 ret = ssl->f_recv_timeout( ssl->p_bio,
2766 ssl->in_hdr + ssl->in_left, len,
2767 ssl->conf->read_timeout );
2768 }
2769 else
2770 {
2771 ret = ssl->f_recv( ssl->p_bio,
2772 ssl->in_hdr + ssl->in_left, len );
2773 }
2774 }
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002775
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002776 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
Manuel Pégourié-Gonnard07617332015-06-24 23:00:03 +02002777 ssl->in_left, nb_want ) );
2778 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002779
2780 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002781 return( MBEDTLS_ERR_SSL_CONN_EOF );
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002782
2783 if( ret < 0 )
2784 return( ret );
2785
mohammad160352aecb92018-03-28 23:41:40 -07002786 if ( (size_t)ret > len || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16035bd15cb2018-02-28 04:30:59 -08002787 {
Darryl Green11999bb2018-03-13 15:22:58 +00002788 MBEDTLS_SSL_DEBUG_MSG( 1,
2789 ( "f_recv returned %d bytes but only %lu were requested",
mohammad160319d392b2018-04-02 07:25:26 -07002790 ret, (unsigned long)len ) );
mohammad16035bd15cb2018-02-28 04:30:59 -08002791 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2792 }
2793
Manuel Pégourié-Gonnardfe98ace2014-03-24 13:13:01 +01002794 ssl->in_left += ret;
2795 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002796 }
2797
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002798 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002799
2800 return( 0 );
2801}
2802
2803/*
2804 * Flush any data not yet written
2805 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002806int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002807{
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01002808 int ret;
Hanno Becker04484622018-08-06 09:49:38 +01002809 unsigned char *buf;
Paul Bakker5121ce52009-01-03 21:22:43 +00002810
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002811 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002812
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002813 if( ssl->f_send == NULL )
2814 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002815 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
Manuel Pégourié-Gonnard1b511f92015-05-06 15:54:23 +01002816 "or mbedtls_ssl_set_bio()" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002817 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002818 }
2819
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002820 /* Avoid incrementing counter if data is flushed */
2821 if( ssl->out_left == 0 )
2822 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002823 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002824 return( 0 );
2825 }
2826
Paul Bakker5121ce52009-01-03 21:22:43 +00002827 while( ssl->out_left > 0 )
2828 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002829 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
2830 mbedtls_ssl_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002831
Hanno Becker2b1e3542018-08-06 11:19:13 +01002832 buf = ssl->out_hdr - ssl->out_left;
Manuel Pégourié-Gonnarde6bdc442014-09-17 11:34:57 +02002833 ret = ssl->f_send( ssl->p_bio, buf, ssl->out_left );
Paul Bakker186751d2012-05-08 13:16:14 +00002834
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002835 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002836
2837 if( ret <= 0 )
2838 return( ret );
2839
mohammad160352aecb92018-03-28 23:41:40 -07002840 if( (size_t)ret > ssl->out_left || ( INT_MAX > SIZE_MAX && ret > SIZE_MAX ) )
mohammad16034bbaeb42018-02-22 04:29:04 -08002841 {
Darryl Green11999bb2018-03-13 15:22:58 +00002842 MBEDTLS_SSL_DEBUG_MSG( 1,
2843 ( "f_send returned %d bytes but only %lu bytes were sent",
mohammad160319d392b2018-04-02 07:25:26 -07002844 ret, (unsigned long)ssl->out_left ) );
mohammad16034bbaeb42018-02-22 04:29:04 -08002845 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2846 }
2847
Paul Bakker5121ce52009-01-03 21:22:43 +00002848 ssl->out_left -= ret;
2849 }
2850
Hanno Becker2b1e3542018-08-06 11:19:13 +01002851#if defined(MBEDTLS_SSL_PROTO_DTLS)
2852 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002853 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01002854 ssl->out_hdr = ssl->out_buf;
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002855 }
Hanno Becker2b1e3542018-08-06 11:19:13 +01002856 else
2857#endif
2858 {
2859 ssl->out_hdr = ssl->out_buf + 8;
2860 }
2861 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01002862
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002863 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002864
2865 return( 0 );
2866}
2867
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002868/*
2869 * Functions to handle the DTLS retransmission state machine
2870 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002871#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002872/*
2873 * Append current handshake message to current outgoing flight
2874 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002875static int ssl_flight_append( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002876{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002877 mbedtls_ssl_flight_item *msg;
Hanno Becker3b235902018-08-06 09:54:53 +01002878 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_flight_append" ) );
2879 MBEDTLS_SSL_DEBUG_BUF( 4, "message appended to flight",
2880 ssl->out_msg, ssl->out_msglen );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002881
2882 /* Allocate space for current message */
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02002883 if( ( msg = mbedtls_calloc( 1, sizeof( mbedtls_ssl_flight_item ) ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002884 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02002885 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002886 sizeof( mbedtls_ssl_flight_item ) ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02002887 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002888 }
2889
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02002890 if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002891 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02002892 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl->out_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002893 mbedtls_free( msg );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02002894 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002895 }
2896
2897 /* Copy current handshake message with headers */
2898 memcpy( msg->p, ssl->out_msg, ssl->out_msglen );
2899 msg->len = ssl->out_msglen;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002900 msg->type = ssl->out_msgtype;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002901 msg->next = NULL;
2902
2903 /* Append to the current flight */
2904 if( ssl->handshake->flight == NULL )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002905 ssl->handshake->flight = msg;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002906 else
2907 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002908 mbedtls_ssl_flight_item *cur = ssl->handshake->flight;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002909 while( cur->next != NULL )
2910 cur = cur->next;
2911 cur->next = msg;
2912 }
2913
Hanno Becker3b235902018-08-06 09:54:53 +01002914 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_flight_append" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002915 return( 0 );
2916}
2917
2918/*
2919 * Free the current flight of handshake messages
2920 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002921static void ssl_flight_free( mbedtls_ssl_flight_item *flight )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002922{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002923 mbedtls_ssl_flight_item *cur = flight;
2924 mbedtls_ssl_flight_item *next;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002925
2926 while( cur != NULL )
2927 {
2928 next = cur->next;
2929
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002930 mbedtls_free( cur->p );
2931 mbedtls_free( cur );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002932
2933 cur = next;
2934 }
2935}
2936
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002937#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
2938static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02002939#endif
2940
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02002941/*
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002942 * Swap transform_out and out_ctr with the alternative ones
2943 */
Andres Amaya Garcia52dbda62018-12-05 21:57:57 +00002944static int ssl_swap_epochs( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002945{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002946 mbedtls_ssl_transform *tmp_transform;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002947 unsigned char tmp_out_ctr[8];
Andres Amaya Garcia52dbda62018-12-05 21:57:57 +00002948#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
2949 int ret;
2950#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002951
2952 if( ssl->transform_out == ssl->handshake->alt_transform_out )
2953 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002954 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
Andres Amaya Garcia52dbda62018-12-05 21:57:57 +00002955 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002956 }
2957
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002958 MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002959
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002960 /* Swap transforms */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002961 tmp_transform = ssl->transform_out;
2962 ssl->transform_out = ssl->handshake->alt_transform_out;
2963 ssl->handshake->alt_transform_out = tmp_transform;
2964
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002965 /* Swap epoch + sequence_number */
Hanno Becker19859472018-08-06 09:40:20 +01002966 memcpy( tmp_out_ctr, ssl->cur_out_ctr, 8 );
2967 memcpy( ssl->cur_out_ctr, ssl->handshake->alt_out_ctr, 8 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002968 memcpy( ssl->handshake->alt_out_ctr, tmp_out_ctr, 8 );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002969
2970 /* Adjust to the newly activated transform */
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01002971 ssl_update_out_pointers( ssl, ssl->transform_out );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002972
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002973#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
2974 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002975 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002976 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002977 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002978 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
2979 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02002980 }
2981 }
Andres Amaya Garcia52dbda62018-12-05 21:57:57 +00002982#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
2983
2984 return( 0 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002985}
2986
2987/*
2988 * Retransmit the current flight of messages.
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002989 */
2990int mbedtls_ssl_resend( mbedtls_ssl_context *ssl )
2991{
2992 int ret = 0;
2993
2994 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_resend" ) );
2995
2996 ret = mbedtls_ssl_flight_transmit( ssl );
2997
2998 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) );
2999
3000 return( ret );
3001}
3002
3003/*
3004 * Transmit or retransmit the current flight of messages.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003005 *
3006 * Need to remember the current message in case flush_output returns
3007 * WANT_WRITE, causing us to exit this function and come back later.
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003008 * This function must be called until state is no longer SENDING.
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003009 */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003010int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003011{
Hanno Becker67bc7c32018-08-06 11:33:50 +01003012 int ret;
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003013 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003014
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003015 if( ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003016 {
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02003017 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialise flight transmission" ) );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003018
3019 ssl->handshake->cur_msg = ssl->handshake->flight;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003020 ssl->handshake->cur_msg_p = ssl->handshake->flight->p + 12;
Andres Amaya Garcia52dbda62018-12-05 21:57:57 +00003021 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
3022 return( ret );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003023
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003024 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003025 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003026
3027 while( ssl->handshake->cur_msg != NULL )
3028 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01003029 size_t max_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003030 const mbedtls_ssl_flight_item * const cur = ssl->handshake->cur_msg;
Hanno Becker67bc7c32018-08-06 11:33:50 +01003031
Hanno Beckere1dcb032018-08-17 16:47:58 +01003032 int const is_finished =
3033 ( cur->type == MBEDTLS_SSL_MSG_HANDSHAKE &&
3034 cur->p[0] == MBEDTLS_SSL_HS_FINISHED );
3035
Hanno Becker04da1892018-08-14 13:22:10 +01003036 uint8_t const force_flush = ssl->disable_datagram_packing == 1 ?
3037 SSL_FORCE_FLUSH : SSL_DONT_FORCE_FLUSH;
3038
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003039 /* Swap epochs before sending Finished: we can't do it after
3040 * sending ChangeCipherSpec, in case write returns WANT_READ.
3041 * Must be done before copying, may change out_msg pointer */
Hanno Beckere1dcb032018-08-17 16:47:58 +01003042 if( is_finished && ssl->handshake->cur_msg_p == ( cur->p + 12 ) )
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003043 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01003044 MBEDTLS_SSL_DEBUG_MSG( 2, ( "swap epochs to send finished message" ) );
Andres Amaya Garcia52dbda62018-12-05 21:57:57 +00003045 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
3046 return( ret );
Manuel Pégourié-Gonnardc715aed2014-09-19 21:39:13 +02003047 }
3048
Hanno Becker67bc7c32018-08-06 11:33:50 +01003049 ret = ssl_get_remaining_payload_in_datagram( ssl );
3050 if( ret < 0 )
3051 return( ret );
3052 max_frag_len = (size_t) ret;
3053
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003054 /* CCS is copied as is, while HS messages may need fragmentation */
3055 if( cur->type == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
3056 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01003057 if( max_frag_len == 0 )
3058 {
3059 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
3060 return( ret );
3061
3062 continue;
3063 }
3064
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003065 memcpy( ssl->out_msg, cur->p, cur->len );
Hanno Becker67bc7c32018-08-06 11:33:50 +01003066 ssl->out_msglen = cur->len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003067 ssl->out_msgtype = cur->type;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003068
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003069 /* Update position inside current message */
3070 ssl->handshake->cur_msg_p += cur->len;
3071 }
3072 else
3073 {
3074 const unsigned char * const p = ssl->handshake->cur_msg_p;
3075 const size_t hs_len = cur->len - 12;
3076 const size_t frag_off = p - ( cur->p + 12 );
3077 const size_t rem_len = hs_len - frag_off;
Hanno Becker67bc7c32018-08-06 11:33:50 +01003078 size_t cur_hs_frag_len, max_hs_frag_len;
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003079
Hanno Beckere1dcb032018-08-17 16:47:58 +01003080 if( ( max_frag_len < 12 ) || ( max_frag_len == 12 && hs_len != 0 ) )
Manuel Pégourié-Gonnarda1071a52018-08-20 11:56:14 +02003081 {
Hanno Beckere1dcb032018-08-17 16:47:58 +01003082 if( is_finished )
Andres Amaya Garcia52dbda62018-12-05 21:57:57 +00003083 {
3084 if( ( ret = ssl_swap_epochs( ssl ) ) != 0 )
3085 return( ret );
3086 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003087
Hanno Becker67bc7c32018-08-06 11:33:50 +01003088 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
3089 return( ret );
3090
3091 continue;
3092 }
3093 max_hs_frag_len = max_frag_len - 12;
3094
3095 cur_hs_frag_len = rem_len > max_hs_frag_len ?
3096 max_hs_frag_len : rem_len;
3097
3098 if( frag_off == 0 && cur_hs_frag_len != hs_len )
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02003099 {
3100 MBEDTLS_SSL_DEBUG_MSG( 2, ( "fragmenting handshake message (%u > %u)",
Hanno Becker67bc7c32018-08-06 11:33:50 +01003101 (unsigned) cur_hs_frag_len,
3102 (unsigned) max_hs_frag_len ) );
Manuel Pégourié-Gonnard19c62f92018-08-16 10:50:39 +02003103 }
Manuel Pégourié-Gonnardb747c6c2018-08-12 13:28:53 +02003104
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003105 /* Messages are stored with handshake headers as if not fragmented,
3106 * copy beginning of headers then fill fragmentation fields.
3107 * Handshake headers: type(1) len(3) seq(2) f_off(3) f_len(3) */
3108 memcpy( ssl->out_msg, cur->p, 6 );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003109
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003110 ssl->out_msg[6] = ( ( frag_off >> 16 ) & 0xff );
3111 ssl->out_msg[7] = ( ( frag_off >> 8 ) & 0xff );
3112 ssl->out_msg[8] = ( ( frag_off ) & 0xff );
3113
Hanno Becker67bc7c32018-08-06 11:33:50 +01003114 ssl->out_msg[ 9] = ( ( cur_hs_frag_len >> 16 ) & 0xff );
3115 ssl->out_msg[10] = ( ( cur_hs_frag_len >> 8 ) & 0xff );
3116 ssl->out_msg[11] = ( ( cur_hs_frag_len ) & 0xff );
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003117
3118 MBEDTLS_SSL_DEBUG_BUF( 3, "handshake header", ssl->out_msg, 12 );
3119
Hanno Becker3f7b9732018-08-28 09:53:25 +01003120 /* Copy the handshake message content and set records fields */
Hanno Becker67bc7c32018-08-06 11:33:50 +01003121 memcpy( ssl->out_msg + 12, p, cur_hs_frag_len );
3122 ssl->out_msglen = cur_hs_frag_len + 12;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003123 ssl->out_msgtype = cur->type;
3124
3125 /* Update position inside current message */
Hanno Becker67bc7c32018-08-06 11:33:50 +01003126 ssl->handshake->cur_msg_p += cur_hs_frag_len;
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003127 }
3128
3129 /* If done with the current message move to the next one if any */
3130 if( ssl->handshake->cur_msg_p >= cur->p + cur->len )
3131 {
3132 if( cur->next != NULL )
3133 {
3134 ssl->handshake->cur_msg = cur->next;
3135 ssl->handshake->cur_msg_p = cur->next->p + 12;
3136 }
3137 else
3138 {
3139 ssl->handshake->cur_msg = NULL;
3140 ssl->handshake->cur_msg_p = NULL;
3141 }
3142 }
3143
3144 /* Actually send the message out */
Hanno Becker04da1892018-08-14 13:22:10 +01003145 if( ( ret = mbedtls_ssl_write_record( ssl, force_flush ) ) != 0 )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003146 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003147 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003148 return( ret );
3149 }
3150 }
3151
Hanno Becker67bc7c32018-08-06 11:33:50 +01003152 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
3153 return( ret );
3154
Manuel Pégourié-Gonnard28f4bea2017-09-13 14:00:05 +02003155 /* Update state and set timer */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003156 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
3157 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard23b7b702014-09-25 13:50:12 +02003158 else
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003159 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003160 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard4e2f2452014-10-02 16:51:56 +02003161 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
3162 }
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003163
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003164 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_flight_transmit" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003165
3166 return( 0 );
3167}
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003168
3169/*
3170 * To be called when the last message of an incoming flight is received.
3171 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003172void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003173{
3174 /* We won't need to resend that one any more */
3175 ssl_flight_free( ssl->handshake->flight );
3176 ssl->handshake->flight = NULL;
3177 ssl->handshake->cur_msg = NULL;
3178
3179 /* The next incoming flight will start with this msg_seq */
3180 ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq;
3181
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003182 /* We don't want to remember CCS's across flight boundaries. */
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01003183 ssl->handshake->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01003184
Hanno Becker0271f962018-08-16 13:23:47 +01003185 /* Clear future message buffering structure. */
3186 ssl_buffering_free( ssl );
3187
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02003188 /* Cancel timer */
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003189 ssl_set_timer( ssl, 0 );
3190
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003191 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
3192 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003193 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003194 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003195 }
3196 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003197 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003198}
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003199
3200/*
3201 * To be called when the last message of an outgoing flight is send.
3202 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003203void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003204{
Manuel Pégourié-Gonnard6c1fa3a2014-10-01 16:58:16 +02003205 ssl_reset_retransmit_timeout( ssl );
Manuel Pégourié-Gonnard0ac247f2014-09-30 22:21:31 +02003206 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003207
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003208 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
3209 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003210 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003211 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003212 }
3213 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003214 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003215}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003216#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003217
Paul Bakker5121ce52009-01-03 21:22:43 +00003218/*
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003219 * Handshake layer functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003220 */
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003221
3222/*
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003223 * Write (DTLS: or queue) current handshake (including CCS) message.
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003224 *
3225 * - fill in handshake headers
3226 * - update handshake checksum
3227 * - DTLS: save message for resending
3228 * - then pass to the record layer
3229 *
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003230 * DTLS: except for HelloRequest, messages are only queued, and will only be
3231 * actually sent when calling flight_transmit() or resend().
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003232 *
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003233 * Inputs:
3234 * - ssl->out_msglen: 4 + actual handshake message len
3235 * (4 is the size of handshake headers for TLS)
3236 * - ssl->out_msg[0]: the handshake type (ClientHello, ServerHello, etc)
3237 * - ssl->out_msg + 4: the handshake message body
3238 *
Manuel Pégourié-Gonnard065a2a32018-08-20 11:09:26 +02003239 * Outputs, ie state before passing to flight_append() or write_record():
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003240 * - ssl->out_msglen: the length of the record contents
3241 * (including handshake headers but excluding record headers)
3242 * - ssl->out_msg: the record contents (handshake headers + content)
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003243 */
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003244int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003245{
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003246 int ret;
3247 const size_t hs_len = ssl->out_msglen - 4;
3248 const unsigned char hs_type = ssl->out_msg[0];
Paul Bakker5121ce52009-01-03 21:22:43 +00003249
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003250 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write handshake message" ) );
3251
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003252 /*
3253 * Sanity checks
3254 */
Hanno Beckerc83d2b32018-08-22 16:05:47 +01003255 if( ssl->out_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE &&
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003256 ssl->out_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
3257 {
Hanno Beckerc83d2b32018-08-22 16:05:47 +01003258 /* In SSLv3, the client might send a NoCertificate alert. */
3259#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
3260 if( ! ( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
3261 ssl->out_msgtype == MBEDTLS_SSL_MSG_ALERT &&
3262 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) )
3263#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
3264 {
3265 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3266 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3267 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003268 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003269
Hanno Beckerf6d6e302018-11-07 11:57:51 +00003270 /* Whenever we send anything different from a
3271 * HelloRequest we should be in a handshake - double check. */
3272 if( ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
3273 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) &&
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003274 ssl->handshake == NULL )
3275 {
3276 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3277 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3278 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003279
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003280#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003281 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003282 ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003283 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003284 {
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003285 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3286 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003287 }
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003288#endif
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003289
Hanno Beckerb50a2532018-08-06 11:52:54 +01003290 /* Double-check that we did not exceed the bounds
3291 * of the outgoing record buffer.
3292 * This should never fail as the various message
3293 * writing functions must obey the bounds of the
3294 * outgoing record buffer, but better be safe.
3295 *
3296 * Note: We deliberately do not check for the MTU or MFL here.
3297 */
3298 if( ssl->out_msglen > MBEDTLS_SSL_OUT_CONTENT_LEN )
3299 {
3300 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record too large: "
3301 "size %u, maximum %u",
3302 (unsigned) ssl->out_msglen,
3303 (unsigned) MBEDTLS_SSL_OUT_CONTENT_LEN ) );
3304 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3305 }
3306
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003307 /*
3308 * Fill handshake headers
3309 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003310 if( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003311 {
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003312 ssl->out_msg[1] = (unsigned char)( hs_len >> 16 );
3313 ssl->out_msg[2] = (unsigned char)( hs_len >> 8 );
3314 ssl->out_msg[3] = (unsigned char)( hs_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00003315
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003316 /*
3317 * DTLS has additional fields in the Handshake layer,
3318 * between the length field and the actual payload:
3319 * uint16 message_seq;
3320 * uint24 fragment_offset;
3321 * uint24 fragment_length;
3322 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003323#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003324 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003325 {
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01003326 /* Make room for the additional DTLS fields */
Angus Grattond8213d02016-05-25 20:56:48 +10003327 if( MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen < 8 )
Hanno Becker9648f8b2017-09-18 10:55:54 +01003328 {
3329 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS handshake message too large: "
3330 "size %u, maximum %u",
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003331 (unsigned) ( hs_len ),
Angus Grattond8213d02016-05-25 20:56:48 +10003332 (unsigned) ( MBEDTLS_SSL_OUT_CONTENT_LEN - 12 ) ) );
Hanno Becker9648f8b2017-09-18 10:55:54 +01003333 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3334 }
3335
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003336 memmove( ssl->out_msg + 12, ssl->out_msg + 4, hs_len );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003337 ssl->out_msglen += 8;
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003338
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02003339 /* Write message_seq and update it, except for HelloRequest */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003340 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02003341 {
Manuel Pégourié-Gonnardd9ba0d92014-09-02 18:30:26 +02003342 ssl->out_msg[4] = ( ssl->handshake->out_msg_seq >> 8 ) & 0xFF;
3343 ssl->out_msg[5] = ( ssl->handshake->out_msg_seq ) & 0xFF;
3344 ++( ssl->handshake->out_msg_seq );
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02003345 }
3346 else
3347 {
3348 ssl->out_msg[4] = 0;
3349 ssl->out_msg[5] = 0;
3350 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01003351
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003352 /* Handshake hashes are computed without fragmentation,
3353 * so set frag_offset = 0 and frag_len = hs_len for now */
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01003354 memset( ssl->out_msg + 6, 0x00, 3 );
3355 memcpy( ssl->out_msg + 9, ssl->out_msg + 1, 3 );
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003356 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003357#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003358
Hanno Becker0207e532018-08-28 10:28:28 +01003359 /* Update running hashes of handshake messages seen */
Manuel Pégourié-Gonnard9c3a8ca2017-09-13 09:54:27 +02003360 if( hs_type != MBEDTLS_SSL_HS_HELLO_REQUEST )
3361 ssl->handshake->update_checksum( ssl, ssl->out_msg, ssl->out_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00003362 }
3363
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003364 /* Either send now, or just save to be sent (and resent) later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003365#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003366 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Hanno Beckerf6d6e302018-11-07 11:57:51 +00003367 ! ( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
3368 hs_type == MBEDTLS_SSL_HS_HELLO_REQUEST ) )
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003369 {
3370 if( ( ret = ssl_flight_append( ssl ) ) != 0 )
3371 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003372 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003373 return( ret );
3374 }
3375 }
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003376 else
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003377#endif
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003378 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01003379 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003380 {
3381 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_record", ret );
3382 return( ret );
3383 }
3384 }
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003385
3386 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write handshake message" ) );
3387
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003388 return( 0 );
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003389}
3390
3391/*
3392 * Record layer functions
3393 */
3394
3395/*
3396 * Write current record.
3397 *
3398 * Uses:
3399 * - ssl->out_msgtype: type of the message (AppData, Handshake, Alert, CCS)
3400 * - ssl->out_msglen: length of the record content (excl headers)
3401 * - ssl->out_msg: record content
3402 */
Hanno Becker67bc7c32018-08-06 11:33:50 +01003403int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush )
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003404{
3405 int ret, done = 0;
3406 size_t len = ssl->out_msglen;
Hanno Becker67bc7c32018-08-06 11:33:50 +01003407 uint8_t flush = force_flush;
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003408
3409 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02003410
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003411#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00003412 if( ssl->transform_out != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003413 ssl->session_out->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00003414 {
3415 if( ( ret = ssl_compress_buf( ssl ) ) != 0 )
3416 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003417 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compress_buf", ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00003418 return( ret );
3419 }
3420
3421 len = ssl->out_msglen;
3422 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003423#endif /*MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00003424
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003425#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
3426 if( mbedtls_ssl_hw_record_write != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00003427 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003428 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_write()" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003429
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003430 ret = mbedtls_ssl_hw_record_write( ssl );
3431 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00003432 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003433 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_write", ret );
3434 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00003435 }
Paul Bakkerc7878112012-12-19 14:41:14 +01003436
3437 if( ret == 0 )
3438 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00003439 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003440#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker05ef8352012-05-08 09:17:57 +00003441 if( !done )
3442 {
Hanno Becker2b1e3542018-08-06 11:19:13 +01003443 unsigned i;
3444 size_t protected_record_size;
3445
Paul Bakker05ef8352012-05-08 09:17:57 +00003446 ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003447 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003448 ssl->conf->transport, ssl->out_hdr + 1 );
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01003449
Hanno Becker19859472018-08-06 09:40:20 +01003450 memcpy( ssl->out_ctr, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01003451 ssl->out_len[0] = (unsigned char)( len >> 8 );
3452 ssl->out_len[1] = (unsigned char)( len );
Paul Bakker05ef8352012-05-08 09:17:57 +00003453
Paul Bakker48916f92012-09-16 19:57:18 +00003454 if( ssl->transform_out != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00003455 {
3456 if( ( ret = ssl_encrypt_buf( ssl ) ) != 0 )
3457 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003458 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
Paul Bakker05ef8352012-05-08 09:17:57 +00003459 return( ret );
3460 }
3461
3462 len = ssl->out_msglen;
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01003463 ssl->out_len[0] = (unsigned char)( len >> 8 );
3464 ssl->out_len[1] = (unsigned char)( len );
Paul Bakker05ef8352012-05-08 09:17:57 +00003465 }
3466
Hanno Becker2b1e3542018-08-06 11:19:13 +01003467 protected_record_size = len + mbedtls_ssl_hdr_len( ssl );
3468
3469#if defined(MBEDTLS_SSL_PROTO_DTLS)
3470 /* In case of DTLS, double-check that we don't exceed
3471 * the remaining space in the datagram. */
3472 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3473 {
Hanno Becker554b0af2018-08-22 20:33:41 +01003474 ret = ssl_get_remaining_space_in_datagram( ssl );
Hanno Becker2b1e3542018-08-06 11:19:13 +01003475 if( ret < 0 )
3476 return( ret );
3477
3478 if( protected_record_size > (size_t) ret )
3479 {
3480 /* Should never happen */
3481 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3482 }
3483 }
3484#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker05ef8352012-05-08 09:17:57 +00003485
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003486 MBEDTLS_SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01003487 "version = [%d:%d], msglen = %d",
3488 ssl->out_hdr[0], ssl->out_hdr[1],
3489 ssl->out_hdr[2], len ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00003490
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003491 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
Hanno Beckerecbdf1c2018-08-28 09:53:54 +01003492 ssl->out_hdr, protected_record_size );
Hanno Becker2b1e3542018-08-06 11:19:13 +01003493
3494 ssl->out_left += protected_record_size;
3495 ssl->out_hdr += protected_record_size;
3496 ssl_update_out_pointers( ssl, ssl->transform_out );
3497
Hanno Becker04484622018-08-06 09:49:38 +01003498 for( i = 8; i > ssl_ep_len( ssl ); i-- )
3499 if( ++ssl->cur_out_ctr[i - 1] != 0 )
3500 break;
3501
3502 /* The loop goes to its end iff the counter is wrapping */
3503 if( i == ssl_ep_len( ssl ) )
3504 {
3505 MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
3506 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
3507 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003508 }
3509
Hanno Becker67bc7c32018-08-06 11:33:50 +01003510#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker47db8772018-08-21 13:32:13 +01003511 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3512 flush == SSL_DONT_FORCE_FLUSH )
Hanno Becker67bc7c32018-08-06 11:33:50 +01003513 {
Hanno Becker1f5a15d2018-08-21 13:31:31 +01003514 size_t remaining;
3515 ret = ssl_get_remaining_payload_in_datagram( ssl );
3516 if( ret < 0 )
3517 {
3518 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_remaining_payload_in_datagram",
3519 ret );
3520 return( ret );
3521 }
3522
3523 remaining = (size_t) ret;
Hanno Becker67bc7c32018-08-06 11:33:50 +01003524 if( remaining == 0 )
Hanno Beckerf0da6672018-08-28 09:55:10 +01003525 {
Hanno Becker67bc7c32018-08-06 11:33:50 +01003526 flush = SSL_FORCE_FLUSH;
Hanno Beckerf0da6672018-08-28 09:55:10 +01003527 }
Hanno Becker67bc7c32018-08-06 11:33:50 +01003528 else
3529 {
Hanno Becker513815a2018-08-20 11:56:09 +01003530 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Still %u bytes available in current datagram", (unsigned) remaining ) );
Hanno Becker67bc7c32018-08-06 11:33:50 +01003531 }
3532 }
3533#endif /* MBEDTLS_SSL_PROTO_DTLS */
3534
3535 if( ( flush == SSL_FORCE_FLUSH ) &&
3536 ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003537 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003538 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003539 return( ret );
3540 }
3541
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003542 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003543
3544 return( 0 );
3545}
3546
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003547#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckere25e3b72018-08-16 09:30:53 +01003548
3549static int ssl_hs_is_proper_fragment( mbedtls_ssl_context *ssl )
3550{
3551 if( ssl->in_msglen < ssl->in_hslen ||
3552 memcmp( ssl->in_msg + 6, "\0\0\0", 3 ) != 0 ||
3553 memcmp( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 )
3554 {
3555 return( 1 );
3556 }
3557 return( 0 );
3558}
Hanno Becker44650b72018-08-16 12:51:11 +01003559
Hanno Beckercd9dcda2018-08-28 17:18:56 +01003560static uint32_t ssl_get_hs_frag_len( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01003561{
3562 return( ( ssl->in_msg[9] << 16 ) |
3563 ( ssl->in_msg[10] << 8 ) |
3564 ssl->in_msg[11] );
3565}
3566
Hanno Beckercd9dcda2018-08-28 17:18:56 +01003567static uint32_t ssl_get_hs_frag_off( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01003568{
3569 return( ( ssl->in_msg[6] << 16 ) |
3570 ( ssl->in_msg[7] << 8 ) |
3571 ssl->in_msg[8] );
3572}
3573
Hanno Beckercd9dcda2018-08-28 17:18:56 +01003574static int ssl_check_hs_header( mbedtls_ssl_context const *ssl )
Hanno Becker44650b72018-08-16 12:51:11 +01003575{
3576 uint32_t msg_len, frag_off, frag_len;
3577
3578 msg_len = ssl_get_hs_total_len( ssl );
3579 frag_off = ssl_get_hs_frag_off( ssl );
3580 frag_len = ssl_get_hs_frag_len( ssl );
3581
3582 if( frag_off > msg_len )
3583 return( -1 );
3584
3585 if( frag_len > msg_len - frag_off )
3586 return( -1 );
3587
3588 if( frag_len + 12 > ssl->in_msglen )
3589 return( -1 );
3590
3591 return( 0 );
3592}
3593
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003594/*
3595 * Mark bits in bitmask (used for DTLS HS reassembly)
3596 */
3597static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len )
3598{
3599 unsigned int start_bits, end_bits;
3600
3601 start_bits = 8 - ( offset % 8 );
3602 if( start_bits != 8 )
3603 {
3604 size_t first_byte_idx = offset / 8;
3605
Manuel Pégourié-Gonnardac030522014-09-02 14:23:40 +02003606 /* Special case */
3607 if( len <= start_bits )
3608 {
3609 for( ; len != 0; len-- )
3610 mask[first_byte_idx] |= 1 << ( start_bits - len );
3611
3612 /* Avoid potential issues with offset or len becoming invalid */
3613 return;
3614 }
3615
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003616 offset += start_bits; /* Now offset % 8 == 0 */
3617 len -= start_bits;
3618
3619 for( ; start_bits != 0; start_bits-- )
3620 mask[first_byte_idx] |= 1 << ( start_bits - 1 );
3621 }
3622
3623 end_bits = len % 8;
3624 if( end_bits != 0 )
3625 {
3626 size_t last_byte_idx = ( offset + len ) / 8;
3627
3628 len -= end_bits; /* Now len % 8 == 0 */
3629
3630 for( ; end_bits != 0; end_bits-- )
3631 mask[last_byte_idx] |= 1 << ( 8 - end_bits );
3632 }
3633
3634 memset( mask + offset / 8, 0xFF, len / 8 );
3635}
3636
3637/*
3638 * Check that bitmask is full
3639 */
3640static int ssl_bitmask_check( unsigned char *mask, size_t len )
3641{
3642 size_t i;
3643
3644 for( i = 0; i < len / 8; i++ )
3645 if( mask[i] != 0xFF )
3646 return( -1 );
3647
3648 for( i = 0; i < len % 8; i++ )
3649 if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 )
3650 return( -1 );
3651
3652 return( 0 );
3653}
3654
Hanno Becker56e205e2018-08-16 09:06:12 +01003655/* msg_len does not include the handshake header */
Hanno Becker65dc8852018-08-23 09:40:49 +01003656static size_t ssl_get_reassembly_buffer_size( size_t msg_len,
Hanno Becker2a97b0e2018-08-21 15:47:49 +01003657 unsigned add_bitmap )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003658{
Hanno Becker56e205e2018-08-16 09:06:12 +01003659 size_t alloc_len;
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003660
Hanno Becker56e205e2018-08-16 09:06:12 +01003661 alloc_len = 12; /* Handshake header */
3662 alloc_len += msg_len; /* Content buffer */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003663
Hanno Beckerd07df862018-08-16 09:14:58 +01003664 if( add_bitmap )
3665 alloc_len += msg_len / 8 + ( msg_len % 8 != 0 ); /* Bitmap */
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003666
Hanno Becker2a97b0e2018-08-21 15:47:49 +01003667 return( alloc_len );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003668}
Hanno Becker56e205e2018-08-16 09:06:12 +01003669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003670#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003671
Hanno Beckercd9dcda2018-08-28 17:18:56 +01003672static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context const *ssl )
Hanno Becker12555c62018-08-16 12:47:53 +01003673{
3674 return( ( ssl->in_msg[1] << 16 ) |
3675 ( ssl->in_msg[2] << 8 ) |
3676 ssl->in_msg[3] );
3677}
Hanno Beckere25e3b72018-08-16 09:30:53 +01003678
Simon Butcher99000142016-10-13 17:21:01 +01003679int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003680{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003681 if( ssl->in_msglen < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02003682 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003683 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %d",
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02003684 ssl->in_msglen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003685 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnard9d1d7192014-09-03 11:01:14 +02003686 }
3687
Hanno Becker12555c62018-08-16 12:47:53 +01003688 ssl->in_hslen = mbedtls_ssl_hs_hdr_len( ssl ) + ssl_get_hs_total_len( ssl );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003689
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003690 MBEDTLS_SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003691 " %d, type = %d, hslen = %d",
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01003692 ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003693
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003694#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003695 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003696 {
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003697 int ret;
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003698 unsigned int recv_msg_seq = ( ssl->in_msg[4] << 8 ) | ssl->in_msg[5];
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003699
Hanno Becker44650b72018-08-16 12:51:11 +01003700 if( ssl_check_hs_header( ssl ) != 0 )
3701 {
3702 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid handshake header" ) );
3703 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
3704 }
3705
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003706 if( ssl->handshake != NULL &&
Hanno Beckerc76c6192017-06-06 10:03:17 +01003707 ( ( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER &&
3708 recv_msg_seq != ssl->handshake->in_msg_seq ) ||
3709 ( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
3710 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO ) ) )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003711 {
Hanno Becker9e1ec222018-08-15 15:54:43 +01003712 if( recv_msg_seq > ssl->handshake->in_msg_seq )
3713 {
3714 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received future handshake message of sequence number %u (next %u)",
3715 recv_msg_seq,
3716 ssl->handshake->in_msg_seq ) );
3717 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
3718 }
3719
Manuel Pégourié-Gonnardfc572dd2014-10-09 17:56:57 +02003720 /* Retransmit only on last message from previous flight, to avoid
3721 * too many retransmissions.
3722 * Besides, No sane server ever retransmits HelloVerifyRequest */
3723 if( recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003724 ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003725 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003726 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received message from last flight, "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003727 "message_seq = %d, start_of_flight = %d",
3728 recv_msg_seq,
3729 ssl->handshake->in_flight_start_seq ) );
3730
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003731 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003732 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003733 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003734 return( ret );
3735 }
3736 }
3737 else
3738 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003739 MBEDTLS_SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: "
Manuel Pégourié-Gonnard6a2bdfa2014-09-19 21:18:23 +02003740 "message_seq = %d, expected = %d",
3741 recv_msg_seq,
3742 ssl->handshake->in_msg_seq ) );
3743 }
3744
Hanno Becker90333da2017-10-10 11:27:13 +01003745 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003746 }
3747 /* Wait until message completion to increment in_msg_seq */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003748
Hanno Becker6d97ef52018-08-16 13:09:04 +01003749 /* Message reassembly is handled alongside buffering of future
3750 * messages; the commonality is that both handshake fragments and
Hanno Becker83ab41c2018-08-28 17:19:38 +01003751 * future messages cannot be forwarded immediately to the
Hanno Becker6d97ef52018-08-16 13:09:04 +01003752 * handshake logic layer. */
Hanno Beckere25e3b72018-08-16 09:30:53 +01003753 if( ssl_hs_is_proper_fragment( ssl ) == 1 )
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003754 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003755 MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
Hanno Becker6d97ef52018-08-16 13:09:04 +01003756 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003757 }
3758 }
3759 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003760#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnarded79a4b2014-08-20 10:43:01 +02003761 /* With TLS we don't handle fragmentation (for now) */
3762 if( ssl->in_msglen < ssl->in_hslen )
3763 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003764 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
3765 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003766 }
3767
Simon Butcher99000142016-10-13 17:21:01 +01003768 return( 0 );
3769}
3770
3771void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl )
3772{
Hanno Becker0271f962018-08-16 13:23:47 +01003773 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Simon Butcher99000142016-10-13 17:21:01 +01003774
Hanno Becker0271f962018-08-16 13:23:47 +01003775 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER && hs != NULL )
Manuel Pégourié-Gonnard14bf7062015-06-23 14:07:13 +02003776 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003777 ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
Manuel Pégourié-Gonnard14bf7062015-06-23 14:07:13 +02003778 }
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003779
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003780 /* Handshake message is complete, increment counter */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003781#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003782 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003783 ssl->handshake != NULL )
3784 {
Hanno Becker0271f962018-08-16 13:23:47 +01003785 unsigned offset;
3786 mbedtls_ssl_hs_buffer *hs_buf;
Hanno Beckere25e3b72018-08-16 09:30:53 +01003787
Hanno Becker0271f962018-08-16 13:23:47 +01003788 /* Increment handshake sequence number */
3789 hs->in_msg_seq++;
3790
3791 /*
3792 * Clear up handshake buffering and reassembly structure.
3793 */
3794
3795 /* Free first entry */
Hanno Beckere605b192018-08-21 15:59:07 +01003796 ssl_buffering_free_slot( ssl, 0 );
Hanno Becker0271f962018-08-16 13:23:47 +01003797
3798 /* Shift all other entries */
Hanno Beckere605b192018-08-21 15:59:07 +01003799 for( offset = 0, hs_buf = &hs->buffering.hs[0];
3800 offset + 1 < MBEDTLS_SSL_MAX_BUFFERED_HS;
Hanno Becker0271f962018-08-16 13:23:47 +01003801 offset++, hs_buf++ )
3802 {
3803 *hs_buf = *(hs_buf + 1);
3804 }
3805
3806 /* Create a fresh last entry */
3807 memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02003808 }
3809#endif
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01003810}
3811
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02003812/*
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003813 * DTLS anti-replay: RFC 6347 4.1.2.6
3814 *
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003815 * in_window is a field of bits numbered from 0 (lsb) to 63 (msb).
3816 * Bit n is set iff record number in_window_top - n has been seen.
3817 *
3818 * Usually, in_window_top is the last record number seen and the lsb of
3819 * in_window is set. The only exception is the initial state (record number 0
3820 * not seen yet).
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003821 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003822#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3823static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003824{
3825 ssl->in_window_top = 0;
3826 ssl->in_window = 0;
3827}
3828
3829static inline uint64_t ssl_load_six_bytes( unsigned char *buf )
3830{
3831 return( ( (uint64_t) buf[0] << 40 ) |
3832 ( (uint64_t) buf[1] << 32 ) |
3833 ( (uint64_t) buf[2] << 24 ) |
3834 ( (uint64_t) buf[3] << 16 ) |
3835 ( (uint64_t) buf[4] << 8 ) |
3836 ( (uint64_t) buf[5] ) );
3837}
3838
3839/*
3840 * Return 0 if sequence number is acceptable, -1 otherwise
3841 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003842int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003843{
3844 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
3845 uint64_t bit;
3846
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003847 if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003848 return( 0 );
3849
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003850 if( rec_seqnum > ssl->in_window_top )
3851 return( 0 );
3852
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003853 bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003854
3855 if( bit >= 64 )
3856 return( -1 );
3857
3858 if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 )
3859 return( -1 );
3860
3861 return( 0 );
3862}
3863
3864/*
3865 * Update replay window on new validated record
3866 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003867void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003868{
3869 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
3870
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003871 if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003872 return;
3873
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003874 if( rec_seqnum > ssl->in_window_top )
3875 {
3876 /* Update window_top and the contents of the window */
3877 uint64_t shift = rec_seqnum - ssl->in_window_top;
3878
3879 if( shift >= 64 )
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003880 ssl->in_window = 1;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003881 else
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003882 {
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003883 ssl->in_window <<= shift;
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003884 ssl->in_window |= 1;
3885 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003886
3887 ssl->in_window_top = rec_seqnum;
3888 }
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003889 else
3890 {
3891 /* Mark that number as seen in the current window */
Manuel Pégourié-Gonnard4956fd72014-09-24 11:13:44 +02003892 uint64_t bit = ssl->in_window_top - rec_seqnum;
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003893
3894 if( bit < 64 ) /* Always true, but be extra sure */
3895 ssl->in_window |= (uint64_t) 1 << bit;
3896 }
3897}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003898#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02003899
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02003900#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003901/* Forward declaration */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02003902static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial );
3903
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02003904/*
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003905 * Without any SSL context, check if a datagram looks like a ClientHello with
3906 * a valid cookie, and if it doesn't, generate a HelloVerifyRequest message.
Simon Butcher0789aed2015-09-11 17:15:17 +01003907 * Both input and output include full DTLS headers.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02003908 *
3909 * - if cookie is valid, return 0
3910 * - if ClientHello looks superficially valid but cookie is not,
3911 * fill obuf and set olen, then
3912 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
3913 * - otherwise return a specific error code
3914 */
3915static int ssl_check_dtls_clihlo_cookie(
3916 mbedtls_ssl_cookie_write_t *f_cookie_write,
3917 mbedtls_ssl_cookie_check_t *f_cookie_check,
3918 void *p_cookie,
3919 const unsigned char *cli_id, size_t cli_id_len,
3920 const unsigned char *in, size_t in_len,
3921 unsigned char *obuf, size_t buf_len, size_t *olen )
3922{
3923 size_t sid_len, cookie_len;
3924 unsigned char *p;
3925
3926 if( f_cookie_write == NULL || f_cookie_check == NULL )
3927 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3928
3929 /*
3930 * Structure of ClientHello with record and handshake headers,
3931 * and expected values. We don't need to check a lot, more checks will be
3932 * done when actually parsing the ClientHello - skipping those checks
3933 * avoids code duplication and does not make cookie forging any easier.
3934 *
3935 * 0-0 ContentType type; copied, must be handshake
3936 * 1-2 ProtocolVersion version; copied
3937 * 3-4 uint16 epoch; copied, must be 0
3938 * 5-10 uint48 sequence_number; copied
3939 * 11-12 uint16 length; (ignored)
3940 *
3941 * 13-13 HandshakeType msg_type; (ignored)
3942 * 14-16 uint24 length; (ignored)
3943 * 17-18 uint16 message_seq; copied
3944 * 19-21 uint24 fragment_offset; copied, must be 0
3945 * 22-24 uint24 fragment_length; (ignored)
3946 *
3947 * 25-26 ProtocolVersion client_version; (ignored)
3948 * 27-58 Random random; (ignored)
3949 * 59-xx SessionID session_id; 1 byte len + sid_len content
3950 * 60+ opaque cookie<0..2^8-1>; 1 byte len + content
3951 * ...
3952 *
3953 * Minimum length is 61 bytes.
3954 */
3955 if( in_len < 61 ||
3956 in[0] != MBEDTLS_SSL_MSG_HANDSHAKE ||
3957 in[3] != 0 || in[4] != 0 ||
3958 in[19] != 0 || in[20] != 0 || in[21] != 0 )
3959 {
3960 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
3961 }
3962
3963 sid_len = in[59];
3964 if( sid_len > in_len - 61 )
3965 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
3966
3967 cookie_len = in[60 + sid_len];
3968 if( cookie_len > in_len - 60 )
3969 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
3970
3971 if( f_cookie_check( p_cookie, in + sid_len + 61, cookie_len,
3972 cli_id, cli_id_len ) == 0 )
3973 {
3974 /* Valid cookie */
3975 return( 0 );
3976 }
3977
3978 /*
3979 * If we get here, we've got an invalid cookie, let's prepare HVR.
3980 *
3981 * 0-0 ContentType type; copied
3982 * 1-2 ProtocolVersion version; copied
3983 * 3-4 uint16 epoch; copied
3984 * 5-10 uint48 sequence_number; copied
3985 * 11-12 uint16 length; olen - 13
3986 *
3987 * 13-13 HandshakeType msg_type; hello_verify_request
3988 * 14-16 uint24 length; olen - 25
3989 * 17-18 uint16 message_seq; copied
3990 * 19-21 uint24 fragment_offset; copied
3991 * 22-24 uint24 fragment_length; olen - 25
3992 *
3993 * 25-26 ProtocolVersion server_version; 0xfe 0xff
3994 * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie
3995 *
3996 * Minimum length is 28.
3997 */
3998 if( buf_len < 28 )
3999 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
4000
4001 /* Copy most fields and adapt others */
4002 memcpy( obuf, in, 25 );
4003 obuf[13] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
4004 obuf[25] = 0xfe;
4005 obuf[26] = 0xff;
4006
4007 /* Generate and write actual cookie */
4008 p = obuf + 28;
4009 if( f_cookie_write( p_cookie,
4010 &p, obuf + buf_len, cli_id, cli_id_len ) != 0 )
4011 {
4012 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4013 }
4014
4015 *olen = p - obuf;
4016
4017 /* Go back and fill length fields */
4018 obuf[27] = (unsigned char)( *olen - 28 );
4019
4020 obuf[14] = obuf[22] = (unsigned char)( ( *olen - 25 ) >> 16 );
4021 obuf[15] = obuf[23] = (unsigned char)( ( *olen - 25 ) >> 8 );
4022 obuf[16] = obuf[24] = (unsigned char)( ( *olen - 25 ) );
4023
4024 obuf[11] = (unsigned char)( ( *olen - 13 ) >> 8 );
4025 obuf[12] = (unsigned char)( ( *olen - 13 ) );
4026
4027 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
4028}
4029
4030/*
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004031 * Handle possible client reconnect with the same UDP quadruplet
4032 * (RFC 6347 Section 4.2.8).
4033 *
4034 * Called by ssl_parse_record_header() in case we receive an epoch 0 record
4035 * that looks like a ClientHello.
4036 *
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004037 * - if the input looks like a ClientHello without cookies,
4038 * send back HelloVerifyRequest, then
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004039 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004040 * - if the input looks like a ClientHello with a valid cookie,
4041 * reset the session of the current context, and
Manuel Pégourié-Gonnardbe619c12015-09-08 11:21:21 +02004042 * return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004043 * - if anything goes wrong, return a specific error code
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004044 *
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004045 * mbedtls_ssl_read_record() will ignore the record if anything else than
Simon Butcherd0bf6a32015-09-11 17:34:49 +01004046 * MBEDTLS_ERR_SSL_CLIENT_RECONNECT or 0 is returned, although this function
4047 * cannot not return 0.
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004048 */
4049static int ssl_handle_possible_reconnect( mbedtls_ssl_context *ssl )
4050{
4051 int ret;
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004052 size_t len;
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004053
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004054 ret = ssl_check_dtls_clihlo_cookie(
4055 ssl->conf->f_cookie_write,
4056 ssl->conf->f_cookie_check,
4057 ssl->conf->p_cookie,
4058 ssl->cli_id, ssl->cli_id_len,
4059 ssl->in_buf, ssl->in_left,
Angus Grattond8213d02016-05-25 20:56:48 +10004060 ssl->out_buf, MBEDTLS_SSL_OUT_CONTENT_LEN, &len );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004061
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004062 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_dtls_clihlo_cookie", ret );
4063
4064 if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004065 {
Manuel Pégourié-Gonnardb08a3342020-03-31 12:31:24 +02004066 int send_ret;
4067 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sending HelloVerifyRequest" ) );
4068 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
4069 ssl->out_buf, len );
Brian J Murray1903fb32016-11-06 04:45:15 -08004070 /* Don't check write errors as we can't do anything here.
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004071 * If the error is permanent we'll catch it later,
4072 * if it's not, then hopefully it'll work next time. */
Manuel Pégourié-Gonnardb08a3342020-03-31 12:31:24 +02004073 send_ret = ssl->f_send( ssl->p_bio, ssl->out_buf, len );
4074 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", send_ret );
4075 (void) send_ret;
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004076
4077 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004078 }
4079
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004080 if( ret == 0 )
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004081 {
Manuel Pégourié-Gonnardb08a3342020-03-31 12:31:24 +02004082 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cookie is valid, resetting context" ) );
Manuel Pégourié-Gonnard62c74bb2015-09-08 17:50:29 +02004083 if( ( ret = ssl_session_reset_int( ssl, 1 ) ) != 0 )
4084 {
4085 MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret );
4086 return( ret );
4087 }
4088
4089 return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT );
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004090 }
4091
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004092 return( ret );
4093}
Manuel Pégourié-Gonnardddfe5d22015-09-09 12:46:16 +02004094#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard11331fc2015-09-08 10:30:55 +02004095
Manuel Pégourié-Gonnard7a7e1402014-09-24 10:52:58 +02004096/*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004097 * ContentType type;
4098 * ProtocolVersion version;
4099 * uint16 epoch; // DTLS only
4100 * uint48 sequence_number; // DTLS only
4101 * uint16 length;
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004102 *
4103 * Return 0 if header looks sane (and, for DTLS, the record is expected)
Simon Butcher207990d2015-12-16 01:51:30 +00004104 * MBEDTLS_ERR_SSL_INVALID_RECORD if the header looks bad,
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004105 * MBEDTLS_ERR_SSL_UNEXPECTED_RECORD (DTLS only) if sane but unexpected.
4106 *
4107 * With DTLS, mbedtls_ssl_read_record() will:
Simon Butcher207990d2015-12-16 01:51:30 +00004108 * 1. proceed with the record if this function returns 0
4109 * 2. drop only the current record if this function returns UNEXPECTED_RECORD
4110 * 3. return CLIENT_RECONNECT if this function return that value
4111 * 4. drop the whole datagram if this function returns anything else.
4112 * Point 2 is needed when the peer is resending, and we have already received
4113 * the first record from a datagram but are still waiting for the others.
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004114 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004115static int ssl_parse_record_header( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004116{
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01004117 int major_ver, minor_ver;
Paul Bakker5121ce52009-01-03 21:22:43 +00004118
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004119 MBEDTLS_SSL_DEBUG_BUF( 4, "input record header", ssl->in_hdr, mbedtls_ssl_hdr_len( ssl ) );
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02004120
Paul Bakker5121ce52009-01-03 21:22:43 +00004121 ssl->in_msgtype = ssl->in_hdr[0];
Manuel Pégourié-Gonnard507e1e42014-02-13 11:17:34 +01004122 ssl->in_msglen = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004123 mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, ssl->in_hdr + 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00004124
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004125 MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
Paul Bakker5121ce52009-01-03 21:22:43 +00004126 "version = [%d:%d], msglen = %d",
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02004127 ssl->in_msgtype,
4128 major_ver, minor_ver, ssl->in_msglen ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004129
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02004130 /* Check record type */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004131 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE &&
4132 ssl->in_msgtype != MBEDTLS_SSL_MSG_ALERT &&
4133 ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
4134 ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02004135 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004136 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
Andres Amaya Garcia2fad94b2017-06-26 15:11:59 +01004137
4138#if defined(MBEDTLS_SSL_PROTO_DTLS)
Andres Amaya Garcia01692532017-06-28 09:26:46 +01004139 /* Silently ignore invalid DTLS records as recommended by RFC 6347
4140 * Section 4.1.2.7 */
Andres Amaya Garcia2fad94b2017-06-26 15:11:59 +01004141 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4142#endif /* MBEDTLS_SSL_PROTO_DTLS */
4143 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4144 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
4145
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004146 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02004147 }
4148
4149 /* Check version */
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01004150 if( major_ver != ssl->major_ver )
Paul Bakker5121ce52009-01-03 21:22:43 +00004151 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004152 MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
4153 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00004154 }
4155
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004156 if( minor_ver > ssl->conf->max_minor_ver )
Paul Bakker5121ce52009-01-03 21:22:43 +00004157 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004158 MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
4159 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00004160 }
4161
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02004162 /* Check length against the size of our buffer */
Angus Grattond8213d02016-05-25 20:56:48 +10004163 if( ssl->in_msglen > MBEDTLS_SSL_IN_BUFFER_LEN
Manuel Pégourié-Gonnardedcbe542014-08-11 19:27:24 +02004164 - (size_t)( ssl->in_msg - ssl->in_buf ) )
Paul Bakker1a1fbba2014-04-30 14:38:05 +02004165 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004166 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4167 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker1a1fbba2014-04-30 14:38:05 +02004168 }
4169
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004170 /*
Hanno Becker52c6dc62017-05-26 16:07:36 +01004171 * DTLS-related tests.
4172 * Check epoch before checking length constraint because
4173 * the latter varies with the epoch. E.g., if a ChangeCipherSpec
4174 * message gets duplicated before the corresponding Finished message,
4175 * the second ChangeCipherSpec should be discarded because it belongs
4176 * to an old epoch, but not because its length is shorter than
4177 * the minimum record length for packets using the new record transform.
4178 * Note that these two kinds of failures are handled differently,
4179 * as an unexpected record is silently skipped but an invalid
4180 * record leads to the entire datagram being dropped.
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004181 */
4182#if defined(MBEDTLS_SSL_PROTO_DTLS)
4183 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4184 {
4185 unsigned int rec_epoch = ( ssl->in_ctr[0] << 8 ) | ssl->in_ctr[1];
4186
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004187 /* Check epoch (and sequence number) with DTLS */
4188 if( rec_epoch != ssl->in_epoch )
4189 {
4190 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: "
4191 "expected %d, received %d",
4192 ssl->in_epoch, rec_epoch ) );
4193
4194#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
4195 /*
4196 * Check for an epoch 0 ClientHello. We can't use in_msg here to
4197 * access the first byte of record content (handshake type), as we
4198 * have an active transform (possibly iv_len != 0), so use the
4199 * fact that the record header len is 13 instead.
4200 */
4201 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
4202 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
4203 rec_epoch == 0 &&
4204 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
4205 ssl->in_left > 13 &&
4206 ssl->in_buf[13] == MBEDTLS_SSL_HS_CLIENT_HELLO )
4207 {
4208 MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect "
4209 "from the same port" ) );
4210 return( ssl_handle_possible_reconnect( ssl ) );
4211 }
4212 else
4213#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
Hanno Becker5f066e72018-08-16 14:56:31 +01004214 {
4215 /* Consider buffering the record. */
4216 if( rec_epoch == (unsigned int) ssl->in_epoch + 1 )
4217 {
4218 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Consider record for buffering" ) );
4219 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
4220 }
4221
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004222 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
Hanno Becker5f066e72018-08-16 14:56:31 +01004223 }
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004224 }
4225
4226#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4227 /* Replay detection only works for the current epoch */
4228 if( rec_epoch == ssl->in_epoch &&
4229 mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
4230 {
4231 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
4232 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
4233 }
4234#endif
Hanno Becker52c6dc62017-05-26 16:07:36 +01004235
Hanno Becker52c6dc62017-05-26 16:07:36 +01004236 /* Drop unexpected ApplicationData records,
4237 * except at the beginning of renegotiations */
4238 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA &&
4239 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER
4240#if defined(MBEDTLS_SSL_RENEGOTIATION)
4241 && ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
4242 ssl->state == MBEDTLS_SSL_SERVER_HELLO )
4243#endif
4244 )
4245 {
4246 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
4247 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
4248 }
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01004249 }
4250#endif /* MBEDTLS_SSL_PROTO_DTLS */
4251
Hanno Becker52c6dc62017-05-26 16:07:36 +01004252
4253 /* Check length against bounds of the current transform and version */
4254 if( ssl->transform_in == NULL )
4255 {
4256 if( ssl->in_msglen < 1 ||
Angus Grattond8213d02016-05-25 20:56:48 +10004257 ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
Hanno Becker52c6dc62017-05-26 16:07:36 +01004258 {
4259 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4260 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4261 }
4262 }
4263 else
4264 {
4265 if( ssl->in_msglen < ssl->transform_in->minlen )
4266 {
4267 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4268 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4269 }
4270
4271#if defined(MBEDTLS_SSL_PROTO_SSL3)
4272 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
Angus Grattond8213d02016-05-25 20:56:48 +10004273 ssl->in_msglen > ssl->transform_in->minlen + MBEDTLS_SSL_IN_CONTENT_LEN )
Hanno Becker52c6dc62017-05-26 16:07:36 +01004274 {
4275 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4276 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4277 }
4278#endif
4279#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
4280 defined(MBEDTLS_SSL_PROTO_TLS1_2)
4281 /*
4282 * TLS encrypted messages can have up to 256 bytes of padding
4283 */
4284 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 &&
4285 ssl->in_msglen > ssl->transform_in->minlen +
Angus Grattond8213d02016-05-25 20:56:48 +10004286 MBEDTLS_SSL_IN_CONTENT_LEN + 256 )
Hanno Becker52c6dc62017-05-26 16:07:36 +01004287 {
4288 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4289 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
4290 }
4291#endif
4292 }
4293
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004294 return( 0 );
4295}
Paul Bakker5121ce52009-01-03 21:22:43 +00004296
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004297/*
4298 * If applicable, decrypt (and decompress) record content
4299 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004300static int ssl_prepare_record_content( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004301{
4302 int ret, done = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02004303
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004304 MBEDTLS_SSL_DEBUG_BUF( 4, "input record from network",
4305 ssl->in_hdr, mbedtls_ssl_hdr_len( ssl ) + ssl->in_msglen );
Paul Bakker5121ce52009-01-03 21:22:43 +00004306
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004307#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4308 if( mbedtls_ssl_hw_record_read != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00004309 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004310 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_read()" ) );
Paul Bakker05ef8352012-05-08 09:17:57 +00004311
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004312 ret = mbedtls_ssl_hw_record_read( ssl );
4313 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
Paul Bakker05ef8352012-05-08 09:17:57 +00004314 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004315 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_read", ret );
4316 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker05ef8352012-05-08 09:17:57 +00004317 }
Paul Bakkerc7878112012-12-19 14:41:14 +01004318
4319 if( ret == 0 )
4320 done = 1;
Paul Bakker05ef8352012-05-08 09:17:57 +00004321 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004322#endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
Paul Bakker48916f92012-09-16 19:57:18 +00004323 if( !done && ssl->transform_in != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004324 {
4325 if( ( ret = ssl_decrypt_buf( ssl ) ) != 0 )
4326 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004327 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004328 return( ret );
4329 }
4330
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004331 MBEDTLS_SSL_DEBUG_BUF( 4, "input payload after decrypt",
Paul Bakker5121ce52009-01-03 21:22:43 +00004332 ssl->in_msg, ssl->in_msglen );
4333
Angus Grattond8213d02016-05-25 20:56:48 +10004334 if( ssl->in_msglen > MBEDTLS_SSL_IN_CONTENT_LEN )
Paul Bakker5121ce52009-01-03 21:22:43 +00004335 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004336 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4337 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Paul Bakker5121ce52009-01-03 21:22:43 +00004338 }
4339 }
4340
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004341#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00004342 if( ssl->transform_in != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004343 ssl->session_in->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker2770fbd2012-07-03 13:30:23 +00004344 {
4345 if( ( ret = ssl_decompress_buf( ssl ) ) != 0 )
4346 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004347 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00004348 return( ret );
4349 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00004350 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004351#endif /* MBEDTLS_ZLIB_SUPPORT */
Paul Bakker2770fbd2012-07-03 13:30:23 +00004352
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004353#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004354 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02004355 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004356 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02004357 }
4358#endif
4359
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004360 return( 0 );
4361}
4362
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004363static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02004364
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004365/*
4366 * Read a record.
4367 *
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02004368 * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
4369 * RFC 6347 4.1.2.7) and continue reading until a valid record is found.
4370 *
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02004371 */
Hanno Becker1097b342018-08-15 14:09:41 +01004372
4373/* Helper functions for mbedtls_ssl_read_record(). */
4374static int ssl_consume_current_message( mbedtls_ssl_context *ssl );
Hanno Beckere74d5562018-08-15 14:26:08 +01004375static int ssl_get_next_record( mbedtls_ssl_context *ssl );
4376static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl );
Hanno Becker4162b112018-08-15 14:05:04 +01004377
Hanno Becker327c93b2018-08-15 13:56:18 +01004378int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl,
Hanno Becker3a0aad12018-08-20 09:44:02 +01004379 unsigned update_hs_digest )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004380{
4381 int ret;
4382
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004383 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read record" ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004384
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004385 if( ssl->keep_current_message == 0 )
4386 {
4387 do {
Simon Butcher99000142016-10-13 17:21:01 +01004388
Hanno Becker26994592018-08-15 14:14:59 +01004389 ret = ssl_consume_current_message( ssl );
Hanno Becker90333da2017-10-10 11:27:13 +01004390 if( ret != 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004391 return( ret );
Hanno Becker26994592018-08-15 14:14:59 +01004392
Hanno Beckere74d5562018-08-15 14:26:08 +01004393 if( ssl_record_is_in_progress( ssl ) == 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004394 {
Hanno Becker40f50842018-08-15 14:48:01 +01004395#if defined(MBEDTLS_SSL_PROTO_DTLS)
4396 int have_buffered = 0;
Hanno Beckere74d5562018-08-15 14:26:08 +01004397
Hanno Becker40f50842018-08-15 14:48:01 +01004398 /* We only check for buffered messages if the
4399 * current datagram is fully consumed. */
4400 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Hanno Beckeref7afdf2018-08-28 17:16:31 +01004401 ssl_next_record_is_in_datagram( ssl ) == 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01004402 {
Hanno Becker40f50842018-08-15 14:48:01 +01004403 if( ssl_load_buffered_message( ssl ) == 0 )
4404 have_buffered = 1;
4405 }
4406
4407 if( have_buffered == 0 )
4408#endif /* MBEDTLS_SSL_PROTO_DTLS */
4409 {
4410 ret = ssl_get_next_record( ssl );
4411 if( ret == MBEDTLS_ERR_SSL_CONTINUE_PROCESSING )
4412 continue;
4413
4414 if( ret != 0 )
4415 {
Hanno Beckerc573ac32018-08-28 17:15:25 +01004416 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_get_next_record" ), ret );
Hanno Becker40f50842018-08-15 14:48:01 +01004417 return( ret );
4418 }
Hanno Beckere74d5562018-08-15 14:26:08 +01004419 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004420 }
4421
4422 ret = mbedtls_ssl_handle_message_type( ssl );
4423
Hanno Becker40f50842018-08-15 14:48:01 +01004424#if defined(MBEDTLS_SSL_PROTO_DTLS)
4425 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
4426 {
4427 /* Buffer future message */
4428 ret = ssl_buffer_message( ssl );
4429 if( ret != 0 )
4430 return( ret );
4431
4432 ret = MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
4433 }
4434#endif /* MBEDTLS_SSL_PROTO_DTLS */
4435
Hanno Becker90333da2017-10-10 11:27:13 +01004436 } while( MBEDTLS_ERR_SSL_NON_FATAL == ret ||
4437 MBEDTLS_ERR_SSL_CONTINUE_PROCESSING == ret );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004438
4439 if( 0 != ret )
Simon Butcher99000142016-10-13 17:21:01 +01004440 {
Hanno Becker05c4fc82017-11-09 14:34:06 +00004441 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_handle_message_type" ), ret );
Simon Butcher99000142016-10-13 17:21:01 +01004442 return( ret );
4443 }
4444
Hanno Becker327c93b2018-08-15 13:56:18 +01004445 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
Hanno Becker3a0aad12018-08-20 09:44:02 +01004446 update_hs_digest == 1 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004447 {
4448 mbedtls_ssl_update_handshake_status( ssl );
4449 }
Simon Butcher99000142016-10-13 17:21:01 +01004450 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004451 else
Simon Butcher99000142016-10-13 17:21:01 +01004452 {
Hanno Becker02f59072018-08-15 14:00:24 +01004453 MBEDTLS_SSL_DEBUG_MSG( 2, ( "reuse previously read message" ) );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01004454 ssl->keep_current_message = 0;
Simon Butcher99000142016-10-13 17:21:01 +01004455 }
4456
4457 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );
4458
4459 return( 0 );
4460}
4461
Hanno Becker40f50842018-08-15 14:48:01 +01004462#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Beckeref7afdf2018-08-28 17:16:31 +01004463static int ssl_next_record_is_in_datagram( mbedtls_ssl_context *ssl )
Simon Butcher99000142016-10-13 17:21:01 +01004464{
Hanno Becker40f50842018-08-15 14:48:01 +01004465 if( ssl->in_left > ssl->next_record_offset )
4466 return( 1 );
Simon Butcher99000142016-10-13 17:21:01 +01004467
Hanno Becker40f50842018-08-15 14:48:01 +01004468 return( 0 );
4469}
4470
4471static int ssl_load_buffered_message( mbedtls_ssl_context *ssl )
4472{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004473 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker37f95322018-08-16 13:55:32 +01004474 mbedtls_ssl_hs_buffer * hs_buf;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004475 int ret = 0;
4476
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004477 if( hs == NULL )
4478 return( -1 );
4479
Hanno Beckere00ae372018-08-20 09:39:42 +01004480 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_messsage" ) );
4481
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004482 if( ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC ||
4483 ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
4484 {
4485 /* Check if we have seen a ChangeCipherSpec before.
4486 * If yes, synthesize a CCS record. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01004487 if( !hs->buffering.seen_ccs )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004488 {
4489 MBEDTLS_SSL_DEBUG_MSG( 2, ( "CCS not seen in the current flight" ) );
4490 ret = -1;
Hanno Becker0d4b3762018-08-20 09:36:59 +01004491 goto exit;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004492 }
4493
Hanno Becker39b8bc92018-08-28 17:17:13 +01004494 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Injecting buffered CCS message" ) );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004495 ssl->in_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
4496 ssl->in_msglen = 1;
4497 ssl->in_msg[0] = 1;
4498
4499 /* As long as they are equal, the exact value doesn't matter. */
4500 ssl->in_left = 0;
4501 ssl->next_record_offset = 0;
4502
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01004503 hs->buffering.seen_ccs = 0;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004504 goto exit;
4505 }
Hanno Becker37f95322018-08-16 13:55:32 +01004506
Hanno Beckerb8f50142018-08-28 10:01:34 +01004507#if defined(MBEDTLS_DEBUG_C)
Hanno Becker37f95322018-08-16 13:55:32 +01004508 /* Debug only */
4509 {
4510 unsigned offset;
4511 for( offset = 1; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
4512 {
4513 hs_buf = &hs->buffering.hs[offset];
4514 if( hs_buf->is_valid == 1 )
4515 {
4516 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Future message with sequence number %u %s buffered.",
4517 hs->in_msg_seq + offset,
Hanno Beckera591c482018-08-28 17:20:00 +01004518 hs_buf->is_complete ? "fully" : "partially" ) );
Hanno Becker37f95322018-08-16 13:55:32 +01004519 }
4520 }
4521 }
Hanno Beckerb8f50142018-08-28 10:01:34 +01004522#endif /* MBEDTLS_DEBUG_C */
Hanno Becker37f95322018-08-16 13:55:32 +01004523
4524 /* Check if we have buffered and/or fully reassembled the
4525 * next handshake message. */
4526 hs_buf = &hs->buffering.hs[0];
4527 if( ( hs_buf->is_valid == 1 ) && ( hs_buf->is_complete == 1 ) )
4528 {
4529 /* Synthesize a record containing the buffered HS message. */
4530 size_t msg_len = ( hs_buf->data[1] << 16 ) |
4531 ( hs_buf->data[2] << 8 ) |
4532 hs_buf->data[3];
4533
4534 /* Double-check that we haven't accidentally buffered
4535 * a message that doesn't fit into the input buffer. */
4536 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
4537 {
4538 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4539 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4540 }
4541
4542 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message has been buffered - load" ) );
4543 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered handshake message (incl. header)",
4544 hs_buf->data, msg_len + 12 );
4545
4546 ssl->in_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4547 ssl->in_hslen = msg_len + 12;
4548 ssl->in_msglen = msg_len + 12;
4549 memcpy( ssl->in_msg, hs_buf->data, ssl->in_hslen );
4550
4551 ret = 0;
4552 goto exit;
4553 }
4554 else
4555 {
4556 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message %u not or only partially bufffered",
4557 hs->in_msg_seq ) );
4558 }
4559
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004560 ret = -1;
4561
4562exit:
4563
4564 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_message" ) );
4565 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01004566}
4567
Hanno Beckera02b0b42018-08-21 17:20:27 +01004568static int ssl_buffer_make_space( mbedtls_ssl_context *ssl,
4569 size_t desired )
4570{
4571 int offset;
4572 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
Hanno Becker6e12c1e2018-08-24 14:39:15 +01004573 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Attempt to free buffered messages to have %u bytes available",
4574 (unsigned) desired ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01004575
Hanno Becker01315ea2018-08-21 17:22:17 +01004576 /* Get rid of future records epoch first, if such exist. */
4577 ssl_free_buffered_record( ssl );
4578
4579 /* Check if we have enough space available now. */
4580 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
4581 hs->buffering.total_bytes_buffered ) )
4582 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01004583 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing future epoch record" ) );
Hanno Becker01315ea2018-08-21 17:22:17 +01004584 return( 0 );
4585 }
Hanno Beckera02b0b42018-08-21 17:20:27 +01004586
Hanno Becker4f432ad2018-08-28 10:02:32 +01004587 /* We don't have enough space to buffer the next expected handshake
4588 * message. Remove buffers used for future messages to gain space,
4589 * starting with the most distant one. */
Hanno Beckera02b0b42018-08-21 17:20:27 +01004590 for( offset = MBEDTLS_SSL_MAX_BUFFERED_HS - 1;
4591 offset >= 0; offset-- )
4592 {
4593 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Free buffering slot %d to make space for reassembly of next handshake message",
4594 offset ) );
4595
Hanno Beckerb309b922018-08-23 13:18:05 +01004596 ssl_buffering_free_slot( ssl, (uint8_t) offset );
Hanno Beckera02b0b42018-08-21 17:20:27 +01004597
4598 /* Check if we have enough space available now. */
4599 if( desired <= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
4600 hs->buffering.total_bytes_buffered ) )
4601 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01004602 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing buffered HS messages" ) );
Hanno Beckera02b0b42018-08-21 17:20:27 +01004603 return( 0 );
4604 }
4605 }
4606
4607 return( -1 );
4608}
4609
Hanno Becker40f50842018-08-15 14:48:01 +01004610static int ssl_buffer_message( mbedtls_ssl_context *ssl )
4611{
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004612 int ret = 0;
4613 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
4614
4615 if( hs == NULL )
4616 return( 0 );
4617
4618 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_buffer_message" ) );
4619
4620 switch( ssl->in_msgtype )
4621 {
4622 case MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC:
4623 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Remember CCS message" ) );
Hanno Beckere678eaa2018-08-21 14:57:46 +01004624
Hanno Beckerd7f8ae22018-08-16 09:45:56 +01004625 hs->buffering.seen_ccs = 1;
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004626 break;
4627
4628 case MBEDTLS_SSL_MSG_HANDSHAKE:
Hanno Becker37f95322018-08-16 13:55:32 +01004629 {
4630 unsigned recv_msg_seq_offset;
4631 unsigned recv_msg_seq = ( ssl->in_msg[4] << 8 ) | ssl->in_msg[5];
4632 mbedtls_ssl_hs_buffer *hs_buf;
4633 size_t msg_len = ssl->in_hslen - 12;
4634
4635 /* We should never receive an old handshake
4636 * message - double-check nonetheless. */
4637 if( recv_msg_seq < ssl->handshake->in_msg_seq )
4638 {
4639 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4640 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4641 }
4642
4643 recv_msg_seq_offset = recv_msg_seq - ssl->handshake->in_msg_seq;
4644 if( recv_msg_seq_offset >= MBEDTLS_SSL_MAX_BUFFERED_HS )
4645 {
4646 /* Silently ignore -- message too far in the future */
4647 MBEDTLS_SSL_DEBUG_MSG( 2,
4648 ( "Ignore future HS message with sequence number %u, "
4649 "buffering window %u - %u",
4650 recv_msg_seq, ssl->handshake->in_msg_seq,
4651 ssl->handshake->in_msg_seq + MBEDTLS_SSL_MAX_BUFFERED_HS - 1 ) );
4652
4653 goto exit;
4654 }
4655
4656 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering HS message with sequence number %u, offset %u ",
4657 recv_msg_seq, recv_msg_seq_offset ) );
4658
4659 hs_buf = &hs->buffering.hs[ recv_msg_seq_offset ];
4660
4661 /* Check if the buffering for this seq nr has already commenced. */
Hanno Becker4422bbb2018-08-20 09:40:19 +01004662 if( !hs_buf->is_valid )
Hanno Becker37f95322018-08-16 13:55:32 +01004663 {
Hanno Becker2a97b0e2018-08-21 15:47:49 +01004664 size_t reassembly_buf_sz;
4665
Hanno Becker37f95322018-08-16 13:55:32 +01004666 hs_buf->is_fragmented =
4667 ( ssl_hs_is_proper_fragment( ssl ) == 1 );
4668
4669 /* We copy the message back into the input buffer
4670 * after reassembly, so check that it's not too large.
4671 * This is an implementation-specific limitation
4672 * and not one from the standard, hence it is not
4673 * checked in ssl_check_hs_header(). */
Hanno Becker96a6c692018-08-21 15:56:03 +01004674 if( msg_len + 12 > MBEDTLS_SSL_IN_CONTENT_LEN )
Hanno Becker37f95322018-08-16 13:55:32 +01004675 {
4676 /* Ignore message */
4677 goto exit;
4678 }
4679
Hanno Beckere0b150f2018-08-21 15:51:03 +01004680 /* Check if we have enough space to buffer the message. */
4681 if( hs->buffering.total_bytes_buffered >
4682 MBEDTLS_SSL_DTLS_MAX_BUFFERING )
4683 {
4684 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4685 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4686 }
4687
Hanno Becker2a97b0e2018-08-21 15:47:49 +01004688 reassembly_buf_sz = ssl_get_reassembly_buffer_size( msg_len,
4689 hs_buf->is_fragmented );
Hanno Beckere0b150f2018-08-21 15:51:03 +01004690
4691 if( reassembly_buf_sz > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
4692 hs->buffering.total_bytes_buffered ) )
4693 {
4694 if( recv_msg_seq_offset > 0 )
4695 {
4696 /* If we can't buffer a future message because
4697 * of space limitations -- ignore. */
4698 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
4699 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
4700 (unsigned) hs->buffering.total_bytes_buffered ) );
4701 goto exit;
4702 }
Hanno Beckere1801392018-08-21 16:51:05 +01004703 else
4704 {
4705 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- attempt to make space by freeing buffered future messages\n",
4706 (unsigned) msg_len, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
4707 (unsigned) hs->buffering.total_bytes_buffered ) );
4708 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01004709
Hanno Beckera02b0b42018-08-21 17:20:27 +01004710 if( ssl_buffer_make_space( ssl, reassembly_buf_sz ) != 0 )
Hanno Becker55e9e2a2018-08-21 16:07:55 +01004711 {
Hanno Becker6e12c1e2018-08-24 14:39:15 +01004712 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reassembly of next message of size %u (%u with bitmap) would exceed the compile-time limit %u (already %u bytes buffered) -- fail\n",
4713 (unsigned) msg_len,
4714 (unsigned) reassembly_buf_sz,
4715 MBEDTLS_SSL_DTLS_MAX_BUFFERING,
Hanno Beckere0b150f2018-08-21 15:51:03 +01004716 (unsigned) hs->buffering.total_bytes_buffered ) );
Hanno Becker55e9e2a2018-08-21 16:07:55 +01004717 ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
4718 goto exit;
4719 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01004720 }
4721
4722 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %d",
4723 msg_len ) );
4724
Hanno Becker2a97b0e2018-08-21 15:47:49 +01004725 hs_buf->data = mbedtls_calloc( 1, reassembly_buf_sz );
4726 if( hs_buf->data == NULL )
Hanno Becker37f95322018-08-16 13:55:32 +01004727 {
Hanno Beckere0b150f2018-08-21 15:51:03 +01004728 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
Hanno Becker37f95322018-08-16 13:55:32 +01004729 goto exit;
4730 }
Hanno Beckere0b150f2018-08-21 15:51:03 +01004731 hs_buf->data_len = reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01004732
4733 /* Prepare final header: copy msg_type, length and message_seq,
4734 * then add standardised fragment_offset and fragment_length */
4735 memcpy( hs_buf->data, ssl->in_msg, 6 );
4736 memset( hs_buf->data + 6, 0, 3 );
4737 memcpy( hs_buf->data + 9, hs_buf->data + 1, 3 );
4738
4739 hs_buf->is_valid = 1;
Hanno Beckere0b150f2018-08-21 15:51:03 +01004740
4741 hs->buffering.total_bytes_buffered += reassembly_buf_sz;
Hanno Becker37f95322018-08-16 13:55:32 +01004742 }
4743 else
4744 {
4745 /* Make sure msg_type and length are consistent */
4746 if( memcmp( hs_buf->data, ssl->in_msg, 4 ) != 0 )
4747 {
4748 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Fragment header mismatch - ignore" ) );
4749 /* Ignore */
4750 goto exit;
4751 }
4752 }
4753
Hanno Becker4422bbb2018-08-20 09:40:19 +01004754 if( !hs_buf->is_complete )
Hanno Becker37f95322018-08-16 13:55:32 +01004755 {
4756 size_t frag_len, frag_off;
4757 unsigned char * const msg = hs_buf->data + 12;
4758
4759 /*
4760 * Check and copy current fragment
4761 */
4762
4763 /* Validation of header fields already done in
4764 * mbedtls_ssl_prepare_handshake_record(). */
4765 frag_off = ssl_get_hs_frag_off( ssl );
4766 frag_len = ssl_get_hs_frag_len( ssl );
4767
4768 MBEDTLS_SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %d, length = %d",
4769 frag_off, frag_len ) );
4770 memcpy( msg + frag_off, ssl->in_msg + 12, frag_len );
4771
4772 if( hs_buf->is_fragmented )
4773 {
4774 unsigned char * const bitmask = msg + msg_len;
4775 ssl_bitmask_set( bitmask, frag_off, frag_len );
4776 hs_buf->is_complete = ( ssl_bitmask_check( bitmask,
4777 msg_len ) == 0 );
4778 }
4779 else
4780 {
4781 hs_buf->is_complete = 1;
4782 }
4783
4784 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message %scomplete",
4785 hs_buf->is_complete ? "" : "not yet " ) );
4786 }
4787
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004788 break;
Hanno Becker37f95322018-08-16 13:55:32 +01004789 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004790
4791 default:
Hanno Becker360bef32018-08-28 10:04:33 +01004792 /* We don't buffer other types of messages. */
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01004793 break;
4794 }
4795
4796exit:
4797
4798 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_buffer_message" ) );
4799 return( ret );
Hanno Becker40f50842018-08-15 14:48:01 +01004800}
4801#endif /* MBEDTLS_SSL_PROTO_DTLS */
4802
Hanno Becker1097b342018-08-15 14:09:41 +01004803static int ssl_consume_current_message( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004804{
Hanno Becker4a810fb2017-05-24 16:27:30 +01004805 /*
Hanno Becker4a810fb2017-05-24 16:27:30 +01004806 * Consume last content-layer message and potentially
4807 * update in_msglen which keeps track of the contents'
4808 * consumption state.
4809 *
4810 * (1) Handshake messages:
4811 * Remove last handshake message, move content
4812 * and adapt in_msglen.
4813 *
4814 * (2) Alert messages:
4815 * Consume whole record content, in_msglen = 0.
4816 *
Hanno Becker4a810fb2017-05-24 16:27:30 +01004817 * (3) Change cipher spec:
4818 * Consume whole record content, in_msglen = 0.
4819 *
4820 * (4) Application data:
4821 * Don't do anything - the record layer provides
4822 * the application data as a stream transport
4823 * and consumes through mbedtls_ssl_read only.
4824 *
4825 */
4826
4827 /* Case (1): Handshake messages */
4828 if( ssl->in_hslen != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004829 {
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01004830 /* Hard assertion to be sure that no application data
4831 * is in flight, as corrupting ssl->in_msglen during
4832 * ssl->in_offt != NULL is fatal. */
4833 if( ssl->in_offt != NULL )
4834 {
4835 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4836 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4837 }
4838
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004839 /*
4840 * Get next Handshake message in the current record
4841 */
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004842
Hanno Becker4a810fb2017-05-24 16:27:30 +01004843 /* Notes:
Hanno Beckere72489d2017-10-23 13:23:50 +01004844 * (1) in_hslen is not necessarily the size of the
Hanno Becker4a810fb2017-05-24 16:27:30 +01004845 * current handshake content: If DTLS handshake
4846 * fragmentation is used, that's the fragment
4847 * size instead. Using the total handshake message
Hanno Beckere72489d2017-10-23 13:23:50 +01004848 * size here is faulty and should be changed at
4849 * some point.
Hanno Becker4a810fb2017-05-24 16:27:30 +01004850 * (2) While it doesn't seem to cause problems, one
4851 * has to be very careful not to assume that in_hslen
4852 * is always <= in_msglen in a sensible communication.
4853 * Again, it's wrong for DTLS handshake fragmentation.
4854 * The following check is therefore mandatory, and
4855 * should not be treated as a silently corrected assertion.
Hanno Beckerbb9dd0c2017-06-08 11:55:34 +01004856 * Additionally, ssl->in_hslen might be arbitrarily out of
4857 * bounds after handling a DTLS message with an unexpected
4858 * sequence number, see mbedtls_ssl_prepare_handshake_record.
Hanno Becker4a810fb2017-05-24 16:27:30 +01004859 */
4860 if( ssl->in_hslen < ssl->in_msglen )
4861 {
4862 ssl->in_msglen -= ssl->in_hslen;
4863 memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
4864 ssl->in_msglen );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004865
Hanno Becker4a810fb2017-05-24 16:27:30 +01004866 MBEDTLS_SSL_DEBUG_BUF( 4, "remaining content in record",
4867 ssl->in_msg, ssl->in_msglen );
4868 }
4869 else
4870 {
4871 ssl->in_msglen = 0;
4872 }
Manuel Pégourié-Gonnard4a175362014-09-09 17:45:31 +02004873
Hanno Becker4a810fb2017-05-24 16:27:30 +01004874 ssl->in_hslen = 0;
4875 }
4876 /* Case (4): Application data */
4877 else if( ssl->in_offt != NULL )
4878 {
4879 return( 0 );
4880 }
4881 /* Everything else (CCS & Alerts) */
4882 else
4883 {
4884 ssl->in_msglen = 0;
4885 }
4886
Hanno Becker1097b342018-08-15 14:09:41 +01004887 return( 0 );
4888}
Hanno Becker4a810fb2017-05-24 16:27:30 +01004889
Hanno Beckere74d5562018-08-15 14:26:08 +01004890static int ssl_record_is_in_progress( mbedtls_ssl_context *ssl )
4891{
Hanno Becker4a810fb2017-05-24 16:27:30 +01004892 if( ssl->in_msglen > 0 )
Hanno Beckere74d5562018-08-15 14:26:08 +01004893 return( 1 );
4894
4895 return( 0 );
4896}
4897
Hanno Becker5f066e72018-08-16 14:56:31 +01004898#if defined(MBEDTLS_SSL_PROTO_DTLS)
4899
4900static void ssl_free_buffered_record( mbedtls_ssl_context *ssl )
4901{
4902 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
4903 if( hs == NULL )
4904 return;
4905
Hanno Becker01315ea2018-08-21 17:22:17 +01004906 if( hs->buffering.future_record.data != NULL )
Hanno Becker4a810fb2017-05-24 16:27:30 +01004907 {
Hanno Becker01315ea2018-08-21 17:22:17 +01004908 hs->buffering.total_bytes_buffered -=
4909 hs->buffering.future_record.len;
4910
4911 mbedtls_free( hs->buffering.future_record.data );
4912 hs->buffering.future_record.data = NULL;
4913 }
Hanno Becker5f066e72018-08-16 14:56:31 +01004914}
4915
4916static int ssl_load_buffered_record( mbedtls_ssl_context *ssl )
4917{
4918 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
4919 unsigned char * rec;
4920 size_t rec_len;
4921 unsigned rec_epoch;
4922
4923 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
4924 return( 0 );
4925
4926 if( hs == NULL )
4927 return( 0 );
4928
Hanno Becker5f066e72018-08-16 14:56:31 +01004929 rec = hs->buffering.future_record.data;
4930 rec_len = hs->buffering.future_record.len;
4931 rec_epoch = hs->buffering.future_record.epoch;
4932
4933 if( rec == NULL )
4934 return( 0 );
4935
Hanno Becker4cb782d2018-08-20 11:19:05 +01004936 /* Only consider loading future records if the
4937 * input buffer is empty. */
Hanno Beckeref7afdf2018-08-28 17:16:31 +01004938 if( ssl_next_record_is_in_datagram( ssl ) == 1 )
Hanno Becker4cb782d2018-08-20 11:19:05 +01004939 return( 0 );
4940
Hanno Becker5f066e72018-08-16 14:56:31 +01004941 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_record" ) );
4942
4943 if( rec_epoch != ssl->in_epoch )
4944 {
4945 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffered record not from current epoch." ) );
4946 goto exit;
4947 }
4948
4949 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Found buffered record from current epoch - load" ) );
4950
4951 /* Double-check that the record is not too large */
4952 if( rec_len > MBEDTLS_SSL_IN_BUFFER_LEN -
4953 (size_t)( ssl->in_hdr - ssl->in_buf ) )
4954 {
4955 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4956 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4957 }
4958
4959 memcpy( ssl->in_hdr, rec, rec_len );
4960 ssl->in_left = rec_len;
4961 ssl->next_record_offset = 0;
4962
4963 ssl_free_buffered_record( ssl );
4964
4965exit:
4966 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_record" ) );
4967 return( 0 );
4968}
4969
4970static int ssl_buffer_future_record( mbedtls_ssl_context *ssl )
4971{
4972 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
4973 size_t const rec_hdr_len = 13;
Hanno Becker01315ea2018-08-21 17:22:17 +01004974 size_t const total_buf_sz = rec_hdr_len + ssl->in_msglen;
Hanno Becker5f066e72018-08-16 14:56:31 +01004975
4976 /* Don't buffer future records outside handshakes. */
4977 if( hs == NULL )
4978 return( 0 );
4979
4980 /* Only buffer handshake records (we are only interested
4981 * in Finished messages). */
4982 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
4983 return( 0 );
4984
4985 /* Don't buffer more than one future epoch record. */
4986 if( hs->buffering.future_record.data != NULL )
4987 return( 0 );
4988
Hanno Becker01315ea2018-08-21 17:22:17 +01004989 /* Don't buffer record if there's not enough buffering space remaining. */
4990 if( total_buf_sz > ( MBEDTLS_SSL_DTLS_MAX_BUFFERING -
4991 hs->buffering.total_bytes_buffered ) )
4992 {
4993 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future epoch record of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
4994 (unsigned) total_buf_sz, MBEDTLS_SSL_DTLS_MAX_BUFFERING,
4995 (unsigned) hs->buffering.total_bytes_buffered ) );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02004996 return( 0 );
4997 }
4998
Hanno Becker5f066e72018-08-16 14:56:31 +01004999 /* Buffer record */
5000 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffer record from epoch %u",
5001 ssl->in_epoch + 1 ) );
5002 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered record", ssl->in_hdr,
5003 rec_hdr_len + ssl->in_msglen );
5004
5005 /* ssl_parse_record_header() only considers records
5006 * of the next epoch as candidates for buffering. */
5007 hs->buffering.future_record.epoch = ssl->in_epoch + 1;
Hanno Becker01315ea2018-08-21 17:22:17 +01005008 hs->buffering.future_record.len = total_buf_sz;
Hanno Becker5f066e72018-08-16 14:56:31 +01005009
5010 hs->buffering.future_record.data =
5011 mbedtls_calloc( 1, hs->buffering.future_record.len );
5012 if( hs->buffering.future_record.data == NULL )
5013 {
5014 /* If we run out of RAM trying to buffer a
5015 * record from the next epoch, just ignore. */
5016 return( 0 );
5017 }
5018
Hanno Becker01315ea2018-08-21 17:22:17 +01005019 memcpy( hs->buffering.future_record.data, ssl->in_hdr, total_buf_sz );
Hanno Becker5f066e72018-08-16 14:56:31 +01005020
Hanno Becker01315ea2018-08-21 17:22:17 +01005021 hs->buffering.total_bytes_buffered += total_buf_sz;
Hanno Becker5f066e72018-08-16 14:56:31 +01005022 return( 0 );
5023}
5024
5025#endif /* MBEDTLS_SSL_PROTO_DTLS */
5026
Hanno Beckere74d5562018-08-15 14:26:08 +01005027static int ssl_get_next_record( mbedtls_ssl_context *ssl )
Hanno Becker1097b342018-08-15 14:09:41 +01005028{
5029 int ret;
5030
Hanno Becker5f066e72018-08-16 14:56:31 +01005031#if defined(MBEDTLS_SSL_PROTO_DTLS)
5032 /* We might have buffered a future record; if so,
5033 * and if the epoch matches now, load it.
5034 * On success, this call will set ssl->in_left to
5035 * the length of the buffered record, so that
5036 * the calls to ssl_fetch_input() below will
5037 * essentially be no-ops. */
5038 ret = ssl_load_buffered_record( ssl );
5039 if( ret != 0 )
5040 return( ret );
5041#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Becker4a810fb2017-05-24 16:27:30 +01005042
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005043 if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) ) ) != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005044 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005045 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005046 return( ret );
5047 }
5048
5049 if( ( ret = ssl_parse_record_header( ssl ) ) != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005050 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005051#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardbe619c12015-09-08 11:21:21 +02005052 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5053 ret != MBEDTLS_ERR_SSL_CLIENT_RECONNECT )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005054 {
Hanno Becker5f066e72018-08-16 14:56:31 +01005055 if( ret == MBEDTLS_ERR_SSL_EARLY_MESSAGE )
5056 {
5057 ret = ssl_buffer_future_record( ssl );
5058 if( ret != 0 )
5059 return( ret );
5060
5061 /* Fall through to handling of unexpected records */
5062 ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
5063 }
5064
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005065 if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD )
5066 {
5067 /* Skip unexpected record (but not whole datagram) */
5068 ssl->next_record_offset = ssl->in_msglen
5069 + mbedtls_ssl_hdr_len( ssl );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005070
Manuel Pégourié-Gonnarde2e25e72015-12-03 16:13:17 +01005071 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding unexpected record "
5072 "(header)" ) );
5073 }
5074 else
5075 {
5076 /* Skip invalid record and the rest of the datagram */
5077 ssl->next_record_offset = 0;
5078 ssl->in_left = 0;
5079
5080 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record "
5081 "(header)" ) );
5082 }
5083
5084 /* Get next record */
Hanno Becker90333da2017-10-10 11:27:13 +01005085 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005086 }
5087#endif
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005088 return( ret );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005089 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005090
5091 /*
5092 * Read and optionally decrypt the message contents
5093 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005094 if( ( ret = mbedtls_ssl_fetch_input( ssl,
5095 mbedtls_ssl_hdr_len( ssl ) + ssl->in_msglen ) ) != 0 )
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005096 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005097 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005098 return( ret );
5099 }
5100
5101 /* Done reading this record, get ready for the next one */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005102#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005103 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Hanno Beckere65ce782017-05-22 14:47:48 +01005104 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005105 ssl->next_record_offset = ssl->in_msglen + mbedtls_ssl_hdr_len( ssl );
Hanno Beckere65ce782017-05-22 14:47:48 +01005106 if( ssl->next_record_offset < ssl->in_left )
5107 {
5108 MBEDTLS_SSL_DEBUG_MSG( 3, ( "more than one record within datagram" ) );
5109 }
5110 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005111 else
5112#endif
5113 ssl->in_left = 0;
5114
5115 if( ( ret = ssl_prepare_record_content( ssl ) ) != 0 )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005116 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005117#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005118 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005119 {
5120 /* Silently discard invalid records */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005121 if( ret == MBEDTLS_ERR_SSL_INVALID_RECORD ||
5122 ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005123 {
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02005124 /* Except when waiting for Finished as a bad mac here
5125 * probably means something went wrong in the handshake
5126 * (eg wrong psk used, mitm downgrade attempt, etc.) */
5127 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED ||
5128 ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
5129 {
5130#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
5131 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
5132 {
5133 mbedtls_ssl_send_alert_message( ssl,
5134 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5135 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
5136 }
5137#endif
5138 return( ret );
5139 }
5140
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005141#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005142 if( ssl->conf->badmac_limit != 0 &&
5143 ++ssl->badmac_seen >= ssl->conf->badmac_limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02005144 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005145 MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
5146 return( MBEDTLS_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02005147 }
5148#endif
5149
Hanno Becker4a810fb2017-05-24 16:27:30 +01005150 /* As above, invalid records cause
5151 * dismissal of the whole datagram. */
5152
5153 ssl->next_record_offset = 0;
5154 ssl->in_left = 0;
5155
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005156 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
Hanno Becker90333da2017-10-10 11:27:13 +01005157 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005158 }
5159
5160 return( ret );
5161 }
5162 else
5163#endif
5164 {
5165 /* Error out (and send alert) on invalid records */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005166#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
5167 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005168 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005169 mbedtls_ssl_send_alert_message( ssl,
5170 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5171 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02005172 }
5173#endif
5174 return( ret );
5175 }
5176 }
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005177
Simon Butcher99000142016-10-13 17:21:01 +01005178 return( 0 );
5179}
5180
5181int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl )
5182{
5183 int ret;
5184
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02005185 /*
Manuel Pégourié-Gonnard167a3762014-09-08 16:14:10 +02005186 * Handle particular types of records
5187 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005188 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00005189 {
Simon Butcher99000142016-10-13 17:21:01 +01005190 if( ( ret = mbedtls_ssl_prepare_handshake_record( ssl ) ) != 0 )
5191 {
Manuel Pégourié-Gonnarda59543a2014-02-18 11:33:49 +01005192 return( ret );
Simon Butcher99000142016-10-13 17:21:01 +01005193 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005194 }
5195
Hanno Beckere678eaa2018-08-21 14:57:46 +01005196 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005197 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01005198 if( ssl->in_msglen != 1 )
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005199 {
Hanno Beckere678eaa2018-08-21 14:57:46 +01005200 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, len: %d",
5201 ssl->in_msglen ) );
5202 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005203 }
5204
Hanno Beckere678eaa2018-08-21 14:57:46 +01005205 if( ssl->in_msg[0] != 1 )
5206 {
5207 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, content: %02x",
5208 ssl->in_msg[0] ) );
5209 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5210 }
5211
5212#if defined(MBEDTLS_SSL_PROTO_DTLS)
5213 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5214 ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
5215 ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
5216 {
5217 if( ssl->handshake == NULL )
5218 {
5219 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping ChangeCipherSpec outside handshake" ) );
5220 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
5221 }
5222
5223 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received out-of-order ChangeCipherSpec - remember" ) );
5224 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE );
5225 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005226#endif
Hanno Beckere678eaa2018-08-21 14:57:46 +01005227 }
Hanno Becker2ed6bcc2018-08-15 15:11:57 +01005228
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005229 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Paul Bakker5121ce52009-01-03 21:22:43 +00005230 {
Angus Gratton1a7a17e2018-06-20 15:43:50 +10005231 if( ssl->in_msglen != 2 )
5232 {
5233 /* Note: Standard allows for more than one 2 byte alert
5234 to be packed in a single message, but Mbed TLS doesn't
5235 currently support this. */
5236 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid alert message, len: %d",
5237 ssl->in_msglen ) );
5238 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
5239 }
5240
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005241 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]",
Paul Bakker5121ce52009-01-03 21:22:43 +00005242 ssl->in_msg[0], ssl->in_msg[1] ) );
5243
5244 /*
Simon Butcher459a9502015-10-27 16:09:03 +00005245 * Ignore non-fatal alerts, except close_notify and no_renegotiation
Paul Bakker5121ce52009-01-03 21:22:43 +00005246 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005247 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005248 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005249 MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
Paul Bakker2770fbd2012-07-03 13:30:23 +00005250 ssl->in_msg[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005251 return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005252 }
5253
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005254 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
5255 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00005256 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005257 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
5258 return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00005259 }
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02005260
5261#if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
5262 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
5263 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION )
5264 {
Hanno Becker90333da2017-10-10 11:27:13 +01005265 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no renegotiation alert" ) );
Manuel Pégourié-Gonnardfbdf06c2015-10-23 11:13:28 +02005266 /* Will be handled when trying to parse ServerHello */
5267 return( 0 );
5268 }
5269#endif
5270
5271#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_SRV_C)
5272 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
5273 ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
5274 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
5275 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
5276 {
5277 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
5278 /* Will be handled in mbedtls_ssl_parse_certificate() */
5279 return( 0 );
5280 }
5281#endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
5282
5283 /* Silently ignore: fetch new message */
Simon Butcher99000142016-10-13 17:21:01 +01005284 return MBEDTLS_ERR_SSL_NON_FATAL;
Paul Bakker5121ce52009-01-03 21:22:43 +00005285 }
5286
Hanno Beckerc76c6192017-06-06 10:03:17 +01005287#if defined(MBEDTLS_SSL_PROTO_DTLS)
5288 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
5289 ssl->handshake != NULL &&
5290 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
5291 {
5292 ssl_handshake_wrapup_free_hs_transform( ssl );
5293 }
5294#endif
5295
Paul Bakker5121ce52009-01-03 21:22:43 +00005296 return( 0 );
5297}
5298
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005299int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00005300{
5301 int ret;
5302
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005303 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
5304 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5305 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00005306 {
5307 return( ret );
5308 }
5309
5310 return( 0 );
5311}
5312
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005313int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
Paul Bakker0a925182012-04-16 06:46:41 +00005314 unsigned char level,
5315 unsigned char message )
5316{
5317 int ret;
5318
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02005319 if( ssl == NULL || ssl->conf == NULL )
5320 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
5321
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005322 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005323 MBEDTLS_SSL_DEBUG_MSG( 3, ( "send alert level=%u message=%u", level, message ));
Paul Bakker0a925182012-04-16 06:46:41 +00005324
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005325 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
Paul Bakker0a925182012-04-16 06:46:41 +00005326 ssl->out_msglen = 2;
5327 ssl->out_msg[0] = level;
5328 ssl->out_msg[1] = message;
5329
Hanno Becker67bc7c32018-08-06 11:33:50 +01005330 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Paul Bakker0a925182012-04-16 06:46:41 +00005331 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005332 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker0a925182012-04-16 06:46:41 +00005333 return( ret );
5334 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005335 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
Paul Bakker0a925182012-04-16 06:46:41 +00005336
5337 return( 0 );
5338}
5339
Paul Bakker5121ce52009-01-03 21:22:43 +00005340/*
5341 * Handshake functions
5342 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005343#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
5344 !defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) && \
5345 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
5346 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
5347 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \
5348 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
5349 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
Gilles Peskinef9828522017-05-03 12:28:43 +02005350/* No certificate support -> dummy functions */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005351int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00005352{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005353 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00005354
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005355 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005356
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005357 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
5358 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02005359 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
5360 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02005361 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005362 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02005363 ssl->state++;
5364 return( 0 );
5365 }
5366
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005367 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5368 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005369}
5370
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005371int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005372{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005373 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005374
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005375 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005376
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005377 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
5378 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02005379 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
5380 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005381 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005382 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005383 ssl->state++;
5384 return( 0 );
5385 }
5386
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005387 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5388 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005389}
Gilles Peskinef9828522017-05-03 12:28:43 +02005390
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005391#else
Gilles Peskinef9828522017-05-03 12:28:43 +02005392/* Some certificate support -> implement write and parse */
5393
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005394int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005395{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005396 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005397 size_t i, n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005398 const mbedtls_x509_crt *crt;
5399 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005400
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005401 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005402
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005403 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
5404 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02005405 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
5406 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005407 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005408 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02005409 ssl->state++;
5410 return( 0 );
5411 }
5412
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005413#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005414 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker5121ce52009-01-03 21:22:43 +00005415 {
5416 if( ssl->client_auth == 0 )
5417 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005418 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005419 ssl->state++;
5420 return( 0 );
5421 }
5422
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005423#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00005424 /*
5425 * If using SSLv3 and got no cert, send an Alert message
5426 * (otherwise an empty Certificate message will be sent).
5427 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005428 if( mbedtls_ssl_own_cert( ssl ) == NULL &&
5429 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005430 {
5431 ssl->out_msglen = 2;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005432 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
5433 ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING;
5434 ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT;
Paul Bakker5121ce52009-01-03 21:22:43 +00005435
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005436 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005437 goto write_msg;
5438 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005439#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00005440 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005441#endif /* MBEDTLS_SSL_CLI_C */
5442#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005443 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00005444 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005445 if( mbedtls_ssl_own_cert( ssl ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005446 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005447 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
5448 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED );
Paul Bakker5121ce52009-01-03 21:22:43 +00005449 }
5450 }
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01005451#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00005452
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005453 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005454
5455 /*
5456 * 0 . 0 handshake type
5457 * 1 . 3 handshake length
5458 * 4 . 6 length of all certs
5459 * 7 . 9 length of cert. 1
5460 * 10 . n-1 peer certificate
5461 * n . n+2 length of cert. 2
5462 * n+3 . ... upper level cert, etc.
5463 */
5464 i = 7;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005465 crt = mbedtls_ssl_own_cert( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00005466
Paul Bakker29087132010-03-21 21:03:34 +00005467 while( crt != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005468 {
5469 n = crt->raw.len;
Angus Grattond8213d02016-05-25 20:56:48 +10005470 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i )
Paul Bakker5121ce52009-01-03 21:22:43 +00005471 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005472 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
Angus Grattond8213d02016-05-25 20:56:48 +10005473 i + 3 + n, MBEDTLS_SSL_OUT_CONTENT_LEN ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005474 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005475 }
5476
5477 ssl->out_msg[i ] = (unsigned char)( n >> 16 );
5478 ssl->out_msg[i + 1] = (unsigned char)( n >> 8 );
5479 ssl->out_msg[i + 2] = (unsigned char)( n );
5480
5481 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
5482 i += n; crt = crt->next;
5483 }
5484
5485 ssl->out_msg[4] = (unsigned char)( ( i - 7 ) >> 16 );
5486 ssl->out_msg[5] = (unsigned char)( ( i - 7 ) >> 8 );
5487 ssl->out_msg[6] = (unsigned char)( ( i - 7 ) );
5488
5489 ssl->out_msglen = i;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005490 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
5491 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
Paul Bakker5121ce52009-01-03 21:22:43 +00005492
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02005493#if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00005494write_msg:
Paul Bakkerd2f068e2013-08-27 21:19:20 +02005495#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00005496
5497 ssl->state++;
5498
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02005499 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005500 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02005501 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005502 return( ret );
5503 }
5504
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005505 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005506
Paul Bakkered27a042013-04-18 22:46:23 +02005507 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005508}
5509
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02005510/*
5511 * Once the certificate message is read, parse it into a cert chain and
5512 * perform basic checks, but leave actual verification to the caller
5513 */
5514static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00005515{
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02005516 int ret;
Paul Bakker23986e52011-04-24 08:57:21 +00005517 size_t i, n;
Gilles Peskine064a85c2017-05-10 10:46:40 +02005518 uint8_t alert;
Paul Bakker5121ce52009-01-03 21:22:43 +00005519
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005520#if defined(MBEDTLS_SSL_SRV_C)
5521#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker5121ce52009-01-03 21:22:43 +00005522 /*
5523 * Check if the client sent an empty certificate
5524 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005525 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005526 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005527 {
Paul Bakker2e11f7d2010-07-25 14:24:53 +00005528 if( ssl->in_msglen == 2 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005529 ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT &&
5530 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
5531 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
Paul Bakker5121ce52009-01-03 21:22:43 +00005532 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005533 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005534
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005535 /* The client was asked for a certificate but didn't send
5536 one. The client should know what's going on, so we
5537 don't send an alert. */
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005538 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02005539 return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005540 }
5541 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005542#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00005543
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005544#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
5545 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005546 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005547 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005548 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005549 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
5550 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
5551 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
5552 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005553 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005554 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005555
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005556 /* The client was asked for a certificate but didn't send
5557 one. The client should know what's going on, so we
5558 don't send an alert. */
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01005559 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02005560 return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005561 }
5562 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005563#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
5564 MBEDTLS_SSL_PROTO_TLS1_2 */
5565#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00005566
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005567 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00005568 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005569 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005570 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5571 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005572 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005573 }
5574
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005575 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE ||
5576 ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005577 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005578 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005579 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5580 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005581 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005582 }
5583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005584 i = mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00005585
Paul Bakker5121ce52009-01-03 21:22:43 +00005586 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005587 * Same message structure as in mbedtls_ssl_write_certificate()
Paul Bakker5121ce52009-01-03 21:22:43 +00005588 */
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00005589 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
Paul Bakker5121ce52009-01-03 21:22:43 +00005590
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00005591 if( ssl->in_msg[i] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005592 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00005593 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005594 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005595 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5596 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005597 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005598 }
5599
Manuel Pégourié-Gonnardbfb355c2013-09-07 17:27:43 +02005600 /* In case we tried to reuse a session but it failed */
5601 if( ssl->session_negotiate->peer_cert != NULL )
5602 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005603 mbedtls_x509_crt_free( ssl->session_negotiate->peer_cert );
5604 mbedtls_free( ssl->session_negotiate->peer_cert );
Manuel Pégourié-Gonnardbfb355c2013-09-07 17:27:43 +02005605 }
5606
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02005607 if( ( ssl->session_negotiate->peer_cert = mbedtls_calloc( 1,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005608 sizeof( mbedtls_x509_crt ) ) ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00005609 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02005610 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005611 sizeof( mbedtls_x509_crt ) ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005612 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5613 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02005614 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker5121ce52009-01-03 21:22:43 +00005615 }
5616
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005617 mbedtls_x509_crt_init( ssl->session_negotiate->peer_cert );
Paul Bakker5121ce52009-01-03 21:22:43 +00005618
Manuel Pégourié-Gonnardf49a7da2014-09-10 13:30:43 +00005619 i += 3;
Paul Bakker5121ce52009-01-03 21:22:43 +00005620
5621 while( i < ssl->in_hslen )
5622 {
Philippe Antoine747fd532018-05-30 09:13:21 +02005623 if ( i + 3 > ssl->in_hslen ) {
5624 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5625 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5626 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
5627 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
5628 }
Paul Bakker5121ce52009-01-03 21:22:43 +00005629 if( ssl->in_msg[i] != 0 )
5630 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005631 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005632 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5633 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005634 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005635 }
5636
5637 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
5638 | (unsigned int) ssl->in_msg[i + 2];
5639 i += 3;
5640
5641 if( n < 128 || i + n > ssl->in_hslen )
5642 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005643 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005644 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5645 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005646 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005647 }
5648
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005649 ret = mbedtls_x509_crt_parse_der( ssl->session_negotiate->peer_cert,
Paul Bakkerddf26b42013-09-18 13:46:23 +02005650 ssl->in_msg + i, n );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005651 switch( ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00005652 {
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005653 case 0: /*ok*/
5654 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
5655 /* Ignore certificate with an unknown algorithm: maybe a
5656 prior certificate was already trusted. */
5657 break;
5658
5659 case MBEDTLS_ERR_X509_ALLOC_FAILED:
5660 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR;
5661 goto crt_parse_der_failed;
5662
5663 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
5664 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
5665 goto crt_parse_der_failed;
5666
5667 default:
5668 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
5669 crt_parse_der_failed:
5670 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005671 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005672 return( ret );
5673 }
5674
5675 i += n;
5676 }
5677
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005678 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", ssl->session_negotiate->peer_cert );
Paul Bakker5121ce52009-01-03 21:22:43 +00005679
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01005680 /*
5681 * On client, make sure the server cert doesn't change during renego to
5682 * avoid "triple handshake" attack: https://secure-resumption.com/
5683 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005684#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02005685 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005686 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01005687 {
5688 if( ssl->session->peer_cert == NULL )
5689 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005690 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005691 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5692 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005693 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01005694 }
5695
5696 if( ssl->session->peer_cert->raw.len !=
5697 ssl->session_negotiate->peer_cert->raw.len ||
5698 memcmp( ssl->session->peer_cert->raw.p,
5699 ssl->session_negotiate->peer_cert->raw.p,
5700 ssl->session->peer_cert->raw.len ) != 0 )
5701 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005702 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server cert changed during renegotiation" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005703 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5704 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005705 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01005706 }
5707 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005708#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard796c6f32014-03-10 09:34:49 +01005709
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02005710 return( 0 );
5711}
5712
5713int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
5714{
5715 int ret;
5716 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
5717 ssl->transform_negotiate->ciphersuite_info;
5718#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
5719 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
5720 ? ssl->handshake->sni_authmode
5721 : ssl->conf->authmode;
5722#else
5723 const int authmode = ssl->conf->authmode;
5724#endif
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02005725 void *rs_ctx = NULL;
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02005726
5727 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
5728
5729 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
5730 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
5731 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
5732 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
5733 {
5734 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
5735 ssl->state++;
5736 return( 0 );
5737 }
5738
5739#if defined(MBEDTLS_SSL_SRV_C)
5740 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
5741 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
5742 {
5743 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
5744 ssl->state++;
5745 return( 0 );
5746 }
5747
5748 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
5749 authmode == MBEDTLS_SSL_VERIFY_NONE )
5750 {
5751 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
5752 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02005753
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02005754 ssl->state++;
5755 return( 0 );
5756 }
5757#endif
5758
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02005759#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
5760 if( ssl->handshake->ecrs_enabled &&
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02005761 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify )
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02005762 {
5763 goto crt_verify;
5764 }
5765#endif
5766
Manuel Pégourié-Gonnard125af942018-09-11 11:08:12 +02005767 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02005768 {
5769 /* mbedtls_ssl_read_record may have sent an alert already. We
5770 let it decide whether to alert. */
5771 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
5772 return( ret );
5773 }
5774
5775 if( ( ret = ssl_parse_certificate_chain( ssl ) ) != 0 )
5776 {
5777#if defined(MBEDTLS_SSL_SRV_C)
5778 if( ret == MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE &&
5779 authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
5780 {
5781 ret = 0;
5782 }
5783#endif
5784
5785 ssl->state++;
5786 return( ret );
5787 }
5788
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02005789#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
5790 if( ssl->handshake->ecrs_enabled)
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02005791 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02005792
5793crt_verify:
5794 if( ssl->handshake->ecrs_enabled)
5795 rs_ctx = &ssl->handshake->ecrs_ctx;
5796#endif
5797
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02005798 if( authmode != MBEDTLS_SSL_VERIFY_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00005799 {
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02005800 mbedtls_x509_crt *ca_chain;
5801 mbedtls_x509_crl *ca_crl;
5802
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02005803#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02005804 if( ssl->handshake->sni_ca_chain != NULL )
5805 {
5806 ca_chain = ssl->handshake->sni_ca_chain;
5807 ca_crl = ssl->handshake->sni_ca_crl;
5808 }
5809 else
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02005810#endif
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02005811 {
5812 ca_chain = ssl->conf->ca_chain;
5813 ca_crl = ssl->conf->ca_crl;
5814 }
5815
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005816 /*
5817 * Main check: verify certificate
5818 */
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02005819 ret = mbedtls_x509_crt_verify_restartable(
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02005820 ssl->session_negotiate->peer_cert,
5821 ca_chain, ca_crl,
5822 ssl->conf->cert_profile,
5823 ssl->hostname,
5824 &ssl->session_negotiate->verify_result,
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02005825 ssl->conf->f_vrfy, ssl->conf->p_vrfy, rs_ctx );
Paul Bakker5121ce52009-01-03 21:22:43 +00005826
5827 if( ret != 0 )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005828 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005829 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005830 }
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005831
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02005832#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
5833 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
Manuel Pégourié-Gonnard558da9c2018-06-13 12:02:12 +02005834 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS );
Manuel Pégourié-Gonnard3bf49c42017-08-15 13:47:06 +02005835#endif
5836
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005837 /*
5838 * Secondary checks: always done, but change 'ret' only if it was 0
5839 */
5840
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02005841#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005842 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005843 const mbedtls_pk_context *pk = &ssl->session_negotiate->peer_cert->pk;
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005844
5845 /* If certificate uses an EC key, make sure the curve is OK */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005846 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02005847 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005848 {
Hanno Becker39ae8cd2017-05-08 16:31:14 +01005849 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
5850
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005851 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005852 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005853 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01005854 }
5855 }
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02005856#endif /* MBEDTLS_ECP_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00005857
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005858 if( mbedtls_ssl_check_cert_usage( ssl->session_negotiate->peer_cert,
Hanno Becker39ae8cd2017-05-08 16:31:14 +01005859 ciphersuite_info,
5860 ! ssl->conf->endpoint,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01005861 &ssl->session_negotiate->verify_result ) != 0 )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005862 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005863 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005864 if( ret == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005865 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02005866 }
5867
Hanno Becker39ae8cd2017-05-08 16:31:14 +01005868 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
5869 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
5870 * with details encoded in the verification flags. All other kinds
5871 * of error codes, including those from the user provided f_vrfy
5872 * functions, are treated as fatal and lead to a failure of
5873 * ssl_parse_certificate even if verification was optional. */
5874 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
5875 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
5876 ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) )
5877 {
Paul Bakker5121ce52009-01-03 21:22:43 +00005878 ret = 0;
Hanno Becker39ae8cd2017-05-08 16:31:14 +01005879 }
5880
5881 if( ca_chain == NULL && authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
5882 {
5883 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
5884 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
5885 }
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005886
5887 if( ret != 0 )
5888 {
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02005889 uint8_t alert;
5890
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005891 /* The certificate may have been rejected for several reasons.
5892 Pick one and send the corresponding alert. Which alert to send
5893 may be a subject of debate in some cases. */
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005894 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER )
5895 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED;
5896 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH )
5897 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT;
5898 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE )
5899 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
5900 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE )
5901 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
5902 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE )
5903 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
5904 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK )
5905 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
5906 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY )
5907 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT;
5908 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED )
5909 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED;
5910 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED )
5911 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED;
5912 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED )
5913 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA;
Gilles Peskine8498cb32017-05-10 15:39:40 +02005914 else
5915 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN;
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005916 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5917 alert );
5918 }
Hanno Becker39ae8cd2017-05-08 16:31:14 +01005919
Hanno Beckere6706e62017-05-15 16:05:15 +01005920#if defined(MBEDTLS_DEBUG_C)
5921 if( ssl->session_negotiate->verify_result != 0 )
5922 {
5923 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %x",
5924 ssl->session_negotiate->verify_result ) );
5925 }
5926 else
5927 {
5928 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
5929 }
5930#endif /* MBEDTLS_DEBUG_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00005931 }
5932
Manuel Pégourié-Gonnardfed37ed2017-08-15 13:27:41 +02005933 ssl->state++;
5934
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005935 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005936
5937 return( ret );
5938}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005939#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
5940 !MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
5941 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
5942 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
5943 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
5944 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
5945 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00005946
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005947int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00005948{
5949 int ret;
5950
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005951 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005952
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005953 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
Paul Bakker5121ce52009-01-03 21:22:43 +00005954 ssl->out_msglen = 1;
5955 ssl->out_msg[0] = 1;
5956
Paul Bakker5121ce52009-01-03 21:22:43 +00005957 ssl->state++;
5958
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02005959 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005960 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02005961 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005962 return( ret );
5963 }
5964
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005965 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005966
5967 return( 0 );
5968}
5969
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005970int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00005971{
5972 int ret;
5973
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005974 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00005975
Hanno Becker327c93b2018-08-15 13:56:18 +01005976 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00005977 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005978 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00005979 return( ret );
5980 }
5981
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005982 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
Paul Bakker5121ce52009-01-03 21:22:43 +00005983 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005984 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02005985 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
5986 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005987 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00005988 }
5989
Hanno Beckere678eaa2018-08-21 14:57:46 +01005990 /* CCS records are only accepted if they have length 1 and content '1',
5991 * so we don't need to check this here. */
Paul Bakker5121ce52009-01-03 21:22:43 +00005992
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02005993 /*
5994 * Switch to our negotiated transform and session parameters for inbound
5995 * data.
5996 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02005997 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02005998 ssl->transform_in = ssl->transform_negotiate;
5999 ssl->session_in = ssl->session_negotiate;
6000
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006001#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006002 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006003 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006004#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006005 ssl_dtls_replay_reset( ssl );
6006#endif
6007
6008 /* Increment epoch */
6009 if( ++ssl->in_epoch == 0 )
6010 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006011 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006012 /* This is highly unlikely to happen for legitimate reasons, so
6013 treat it as an attack and don't send an alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006014 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006015 }
6016 }
6017 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006018#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006019 memset( ssl->in_ctr, 0, 8 );
6020
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01006021 ssl_update_in_pointers( ssl, ssl->transform_negotiate );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006022
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006023#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
6024 if( mbedtls_ssl_hw_record_activate != NULL )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006025 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006026 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_INBOUND ) ) != 0 )
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006027 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006028 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006029 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6030 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006031 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02006032 }
6033 }
6034#endif
6035
Paul Bakker5121ce52009-01-03 21:22:43 +00006036 ssl->state++;
6037
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006038 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006039
6040 return( 0 );
6041}
6042
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006043void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
6044 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
Paul Bakker380da532012-04-18 16:10:25 +00006045{
Paul Bakkerfb08fd22013-08-27 15:06:26 +02006046 ((void) ciphersuite_info);
Paul Bakker769075d2012-11-24 11:26:46 +01006047
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006048#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6049 defined(MBEDTLS_SSL_PROTO_TLS1_1)
6050 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker48916f92012-09-16 19:57:18 +00006051 ssl->handshake->update_checksum = ssl_update_checksum_md5sha1;
Paul Bakker380da532012-04-18 16:10:25 +00006052 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006053#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006054#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6055#if defined(MBEDTLS_SHA512_C)
6056 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006057 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
6058 else
6059#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006060#if defined(MBEDTLS_SHA256_C)
6061 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
Paul Bakker48916f92012-09-16 19:57:18 +00006062 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006063 else
6064#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006065#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard61edffe2014-04-11 17:07:31 +02006066 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006067 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006068 return;
Manuel Pégourié-Gonnard61edffe2014-04-11 17:07:31 +02006069 }
Paul Bakker380da532012-04-18 16:10:25 +00006070}
Paul Bakkerf7abd422013-04-16 13:15:56 +02006071
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006072void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02006073{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006074#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6075 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006076 mbedtls_md5_starts_ret( &ssl->handshake->fin_md5 );
6077 mbedtls_sha1_starts_ret( &ssl->handshake->fin_sha1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02006078#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006079#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6080#if defined(MBEDTLS_SHA256_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006081 mbedtls_sha256_starts_ret( &ssl->handshake->fin_sha256, 0 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02006082#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006083#if defined(MBEDTLS_SHA512_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006084 mbedtls_sha512_starts_ret( &ssl->handshake->fin_sha512, 1 );
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02006085#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006086#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02006087}
6088
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006089static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006090 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00006091{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006092#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6093 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006094 mbedtls_md5_update_ret( &ssl->handshake->fin_md5 , buf, len );
6095 mbedtls_sha1_update_ret( &ssl->handshake->fin_sha1, buf, len );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006096#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006097#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6098#if defined(MBEDTLS_SHA256_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006099 mbedtls_sha256_update_ret( &ssl->handshake->fin_sha256, buf, len );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006100#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006101#if defined(MBEDTLS_SHA512_C)
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006102 mbedtls_sha512_update_ret( &ssl->handshake->fin_sha512, buf, len );
Paul Bakker769075d2012-11-24 11:26:46 +01006103#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006104#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker380da532012-04-18 16:10:25 +00006105}
6106
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006107#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6108 defined(MBEDTLS_SSL_PROTO_TLS1_1)
6109static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006110 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00006111{
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006112 mbedtls_md5_update_ret( &ssl->handshake->fin_md5 , buf, len );
6113 mbedtls_sha1_update_ret( &ssl->handshake->fin_sha1, buf, len );
Paul Bakker380da532012-04-18 16:10:25 +00006114}
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006115#endif
Paul Bakker380da532012-04-18 16:10:25 +00006116
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006117#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6118#if defined(MBEDTLS_SHA256_C)
6119static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006120 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00006121{
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006122 mbedtls_sha256_update_ret( &ssl->handshake->fin_sha256, buf, len );
Paul Bakker380da532012-04-18 16:10:25 +00006123}
Paul Bakkerd2f068e2013-08-27 21:19:20 +02006124#endif
Paul Bakker380da532012-04-18 16:10:25 +00006125
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006126#if defined(MBEDTLS_SHA512_C)
6127static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006128 const unsigned char *buf, size_t len )
Paul Bakker380da532012-04-18 16:10:25 +00006129{
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006130 mbedtls_sha512_update_ret( &ssl->handshake->fin_sha512, buf, len );
Paul Bakker380da532012-04-18 16:10:25 +00006131}
Paul Bakker769075d2012-11-24 11:26:46 +01006132#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006133#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker380da532012-04-18 16:10:25 +00006134
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006135#if defined(MBEDTLS_SSL_PROTO_SSL3)
Paul Bakker1ef83d62012-04-11 12:09:53 +00006136static void ssl_calc_finished_ssl(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006137 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakker5121ce52009-01-03 21:22:43 +00006138{
Paul Bakker3c2122f2013-06-24 19:03:14 +02006139 const char *sender;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006140 mbedtls_md5_context md5;
6141 mbedtls_sha1_context sha1;
Paul Bakker1ef83d62012-04-11 12:09:53 +00006142
Paul Bakker5121ce52009-01-03 21:22:43 +00006143 unsigned char padbuf[48];
6144 unsigned char md5sum[16];
6145 unsigned char sha1sum[20];
6146
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006147 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00006148 if( !session )
6149 session = ssl->session;
6150
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006151 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006152
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02006153 mbedtls_md5_init( &md5 );
6154 mbedtls_sha1_init( &sha1 );
6155
6156 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
6157 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006158
6159 /*
6160 * SSLv3:
6161 * hash =
6162 * MD5( master + pad2 +
6163 * MD5( handshake + sender + master + pad1 ) )
6164 * + SHA1( master + pad2 +
6165 * SHA1( handshake + sender + master + pad1 ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00006166 */
6167
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006168#if !defined(MBEDTLS_MD5_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006169 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
6170 md5.state, sizeof( md5.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02006171#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00006172
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006173#if !defined(MBEDTLS_SHA1_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006174 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
6175 sha1.state, sizeof( sha1.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02006176#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00006177
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006178 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT"
Paul Bakker3c2122f2013-06-24 19:03:14 +02006179 : "SRVR";
Paul Bakker5121ce52009-01-03 21:22:43 +00006180
Paul Bakker1ef83d62012-04-11 12:09:53 +00006181 memset( padbuf, 0x36, 48 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006182
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006183 mbedtls_md5_update_ret( &md5, (const unsigned char *) sender, 4 );
6184 mbedtls_md5_update_ret( &md5, session->master, 48 );
6185 mbedtls_md5_update_ret( &md5, padbuf, 48 );
6186 mbedtls_md5_finish_ret( &md5, md5sum );
Paul Bakker5121ce52009-01-03 21:22:43 +00006187
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006188 mbedtls_sha1_update_ret( &sha1, (const unsigned char *) sender, 4 );
6189 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
6190 mbedtls_sha1_update_ret( &sha1, padbuf, 40 );
6191 mbedtls_sha1_finish_ret( &sha1, sha1sum );
Paul Bakker5121ce52009-01-03 21:22:43 +00006192
Paul Bakker1ef83d62012-04-11 12:09:53 +00006193 memset( padbuf, 0x5C, 48 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006194
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006195 mbedtls_md5_starts_ret( &md5 );
6196 mbedtls_md5_update_ret( &md5, session->master, 48 );
6197 mbedtls_md5_update_ret( &md5, padbuf, 48 );
6198 mbedtls_md5_update_ret( &md5, md5sum, 16 );
6199 mbedtls_md5_finish_ret( &md5, buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00006200
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006201 mbedtls_sha1_starts_ret( &sha1 );
6202 mbedtls_sha1_update_ret( &sha1, session->master, 48 );
6203 mbedtls_sha1_update_ret( &sha1, padbuf , 40 );
6204 mbedtls_sha1_update_ret( &sha1, sha1sum, 20 );
6205 mbedtls_sha1_finish_ret( &sha1, buf + 16 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006206
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006207 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006208
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006209 mbedtls_md5_free( &md5 );
6210 mbedtls_sha1_free( &sha1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006211
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006212 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
6213 mbedtls_platform_zeroize( md5sum, sizeof( md5sum ) );
6214 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006215
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006216 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006217}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006218#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker5121ce52009-01-03 21:22:43 +00006219
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006220#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
Paul Bakker1ef83d62012-04-11 12:09:53 +00006221static void ssl_calc_finished_tls(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006222 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakker5121ce52009-01-03 21:22:43 +00006223{
Paul Bakker1ef83d62012-04-11 12:09:53 +00006224 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02006225 const char *sender;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006226 mbedtls_md5_context md5;
6227 mbedtls_sha1_context sha1;
Paul Bakker1ef83d62012-04-11 12:09:53 +00006228 unsigned char padbuf[36];
Paul Bakker5121ce52009-01-03 21:22:43 +00006229
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006230 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00006231 if( !session )
6232 session = ssl->session;
6233
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006234 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006235
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02006236 mbedtls_md5_init( &md5 );
6237 mbedtls_sha1_init( &sha1 );
6238
6239 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
6240 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006241
Paul Bakker1ef83d62012-04-11 12:09:53 +00006242 /*
6243 * TLSv1:
6244 * hash = PRF( master, finished_label,
6245 * MD5( handshake ) + SHA1( handshake ) )[0..11]
6246 */
Paul Bakker5121ce52009-01-03 21:22:43 +00006247
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006248#if !defined(MBEDTLS_MD5_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006249 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
6250 md5.state, sizeof( md5.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02006251#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00006252
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006253#if !defined(MBEDTLS_SHA1_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006254 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
6255 sha1.state, sizeof( sha1.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02006256#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00006257
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006258 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker3c2122f2013-06-24 19:03:14 +02006259 ? "client finished"
6260 : "server finished";
Paul Bakker1ef83d62012-04-11 12:09:53 +00006261
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006262 mbedtls_md5_finish_ret( &md5, padbuf );
6263 mbedtls_sha1_finish_ret( &sha1, padbuf + 16 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006264
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006265 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00006266 padbuf, 36, buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006267
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006268 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006269
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006270 mbedtls_md5_free( &md5 );
6271 mbedtls_sha1_free( &sha1 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006272
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006273 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006274
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006275 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006276}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006277#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
Paul Bakker1ef83d62012-04-11 12:09:53 +00006278
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006279#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6280#if defined(MBEDTLS_SHA256_C)
Paul Bakkerca4ab492012-04-18 14:23:57 +00006281static void ssl_calc_finished_tls_sha256(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006282 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakker1ef83d62012-04-11 12:09:53 +00006283{
6284 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02006285 const char *sender;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006286 mbedtls_sha256_context sha256;
Paul Bakker1ef83d62012-04-11 12:09:53 +00006287 unsigned char padbuf[32];
6288
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006289 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00006290 if( !session )
6291 session = ssl->session;
6292
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02006293 mbedtls_sha256_init( &sha256 );
6294
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006295 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006296
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02006297 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006298
6299 /*
6300 * TLSv1.2:
6301 * hash = PRF( master, finished_label,
6302 * Hash( handshake ) )[0.11]
6303 */
6304
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006305#if !defined(MBEDTLS_SHA256_ALT)
6306 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006307 sha256.state, sizeof( sha256.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02006308#endif
Paul Bakker1ef83d62012-04-11 12:09:53 +00006309
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006310 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker3c2122f2013-06-24 19:03:14 +02006311 ? "client finished"
6312 : "server finished";
Paul Bakker1ef83d62012-04-11 12:09:53 +00006313
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006314 mbedtls_sha256_finish_ret( &sha256, padbuf );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006315
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006316 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00006317 padbuf, 32, buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006318
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006319 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006320
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006321 mbedtls_sha256_free( &sha256 );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006322
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006323 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006324
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006325 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006326}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006327#endif /* MBEDTLS_SHA256_C */
Paul Bakker1ef83d62012-04-11 12:09:53 +00006328
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006329#if defined(MBEDTLS_SHA512_C)
Paul Bakkerca4ab492012-04-18 14:23:57 +00006330static void ssl_calc_finished_tls_sha384(
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006331 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
Paul Bakkerca4ab492012-04-18 14:23:57 +00006332{
6333 int len = 12;
Paul Bakker3c2122f2013-06-24 19:03:14 +02006334 const char *sender;
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006335 mbedtls_sha512_context sha512;
Paul Bakkerca4ab492012-04-18 14:23:57 +00006336 unsigned char padbuf[48];
6337
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006338 mbedtls_ssl_session *session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00006339 if( !session )
6340 session = ssl->session;
6341
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02006342 mbedtls_sha512_init( &sha512 );
6343
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006344 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006345
Manuel Pégourié-Gonnard001f2b62015-07-06 16:21:13 +02006346 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006347
6348 /*
6349 * TLSv1.2:
6350 * hash = PRF( master, finished_label,
6351 * Hash( handshake ) )[0.11]
6352 */
6353
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006354#if !defined(MBEDTLS_SHA512_ALT)
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006355 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
6356 sha512.state, sizeof( sha512.state ) );
Paul Bakker90995b52013-06-24 19:20:35 +02006357#endif
Paul Bakkerca4ab492012-04-18 14:23:57 +00006358
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006359 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
Paul Bakker3c2122f2013-06-24 19:03:14 +02006360 ? "client finished"
6361 : "server finished";
Paul Bakkerca4ab492012-04-18 14:23:57 +00006362
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006363 mbedtls_sha512_finish_ret( &sha512, padbuf );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006364
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +02006365 ssl->handshake->tls_prf( session->master, 48, sender,
Paul Bakker48916f92012-09-16 19:57:18 +00006366 padbuf, 48, buf, len );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006367
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006368 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006369
Manuel Pégourié-Gonnardc0bf01e2015-07-06 16:11:18 +02006370 mbedtls_sha512_free( &sha512 );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006371
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05006372 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006373
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006374 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
Paul Bakkerca4ab492012-04-18 14:23:57 +00006375}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006376#endif /* MBEDTLS_SHA512_C */
6377#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkerca4ab492012-04-18 14:23:57 +00006378
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006379static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00006380{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006381 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00006382
6383 /*
6384 * Free our handshake params
6385 */
Gilles Peskine9b562d52018-04-25 20:32:43 +02006386 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006387 mbedtls_free( ssl->handshake );
Paul Bakker48916f92012-09-16 19:57:18 +00006388 ssl->handshake = NULL;
6389
6390 /*
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006391 * Free the previous transform and swith in the current one
Paul Bakker48916f92012-09-16 19:57:18 +00006392 */
6393 if( ssl->transform )
6394 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006395 mbedtls_ssl_transform_free( ssl->transform );
6396 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00006397 }
6398 ssl->transform = ssl->transform_negotiate;
6399 ssl->transform_negotiate = NULL;
6400
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006401 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006402}
6403
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006404void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006405{
6406 int resume = ssl->handshake->resume;
6407
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006408 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006409
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006410#if defined(MBEDTLS_SSL_RENEGOTIATION)
6411 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006412 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006413 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006414 ssl->renego_records_seen = 0;
6415 }
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01006416#endif
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006417
6418 /*
6419 * Free the previous session and switch in the current one
6420 */
Paul Bakker0a597072012-09-25 21:55:46 +00006421 if( ssl->session )
6422 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006423#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard1a034732014-11-04 17:36:18 +01006424 /* RFC 7366 3.1: keep the EtM state */
6425 ssl->session_negotiate->encrypt_then_mac =
6426 ssl->session->encrypt_then_mac;
6427#endif
6428
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006429 mbedtls_ssl_session_free( ssl->session );
6430 mbedtls_free( ssl->session );
Paul Bakker0a597072012-09-25 21:55:46 +00006431 }
6432 ssl->session = ssl->session_negotiate;
Paul Bakker48916f92012-09-16 19:57:18 +00006433 ssl->session_negotiate = NULL;
6434
Paul Bakker0a597072012-09-25 21:55:46 +00006435 /*
6436 * Add cache entry
6437 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006438 if( ssl->conf->f_set_cache != NULL &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02006439 ssl->session->id_len != 0 &&
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02006440 resume == 0 )
6441 {
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01006442 if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006443 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02006444 }
Paul Bakker0a597072012-09-25 21:55:46 +00006445
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006446#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006447 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006448 ssl->handshake->flight != NULL )
6449 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02006450 /* Cancel handshake timer */
6451 ssl_set_timer( ssl, 0 );
6452
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006453 /* Keep last flight around in case we need to resend it:
6454 * we need the handshake and transform structures for that */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006455 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02006456 }
6457 else
6458#endif
6459 ssl_handshake_wrapup_free_hs_transform( ssl );
6460
Paul Bakker48916f92012-09-16 19:57:18 +00006461 ssl->state++;
6462
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006463 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00006464}
6465
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006466int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
Paul Bakker1ef83d62012-04-11 12:09:53 +00006467{
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02006468 int ret, hash_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00006469
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006470 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006471
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01006472 ssl_update_out_pointers( ssl, ssl->transform_negotiate );
Paul Bakker92be97b2013-01-02 17:30:03 +01006473
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006474 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
Paul Bakker1ef83d62012-04-11 12:09:53 +00006475
Manuel Pégourié-Gonnard214a8482016-02-22 11:27:26 +01006476 /*
6477 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
6478 * may define some other value. Currently (early 2016), no defined
6479 * ciphersuite does this (and this is unlikely to change as activity has
6480 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
6481 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006482 hash_len = ( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00006483
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006484#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00006485 ssl->verify_data_len = hash_len;
6486 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01006487#endif
Paul Bakker48916f92012-09-16 19:57:18 +00006488
Paul Bakker5121ce52009-01-03 21:22:43 +00006489 ssl->out_msglen = 4 + hash_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006490 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
6491 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
Paul Bakker5121ce52009-01-03 21:22:43 +00006492
6493 /*
6494 * In case of session resuming, invert the client and server
6495 * ChangeCipherSpec messages order.
6496 */
Paul Bakker0a597072012-09-25 21:55:46 +00006497 if( ssl->handshake->resume != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006498 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006499#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006500 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006501 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01006502#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006503#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006504 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006505 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01006506#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00006507 }
6508 else
6509 ssl->state++;
6510
Paul Bakker48916f92012-09-16 19:57:18 +00006511 /*
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02006512 * Switch to our negotiated transform and session parameters for outbound
6513 * data.
Paul Bakker48916f92012-09-16 19:57:18 +00006514 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006515 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
Manuel Pégourié-Gonnard5afb1672014-02-16 18:33:22 +01006516
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006517#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006518 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02006519 {
6520 unsigned char i;
6521
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02006522 /* Remember current epoch settings for resending */
6523 ssl->handshake->alt_transform_out = ssl->transform_out;
Hanno Becker19859472018-08-06 09:40:20 +01006524 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr, 8 );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02006525
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02006526 /* Set sequence_number to zero */
Hanno Becker19859472018-08-06 09:40:20 +01006527 memset( ssl->cur_out_ctr + 2, 0, 6 );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02006528
6529 /* Increment epoch */
6530 for( i = 2; i > 0; i-- )
Hanno Becker19859472018-08-06 09:40:20 +01006531 if( ++ssl->cur_out_ctr[i - 1] != 0 )
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02006532 break;
6533
6534 /* The loop goes to its end iff the counter is wrapping */
6535 if( i == 0 )
6536 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006537 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
6538 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02006539 }
6540 }
6541 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006542#endif /* MBEDTLS_SSL_PROTO_DTLS */
Hanno Becker19859472018-08-06 09:40:20 +01006543 memset( ssl->cur_out_ctr, 0, 8 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006544
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02006545 ssl->transform_out = ssl->transform_negotiate;
6546 ssl->session_out = ssl->session_negotiate;
6547
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006548#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
6549 if( mbedtls_ssl_hw_record_activate != NULL )
Paul Bakker07eb38b2012-12-19 14:42:06 +01006550 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006551 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
Paul Bakker07eb38b2012-12-19 14:42:06 +01006552 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006553 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
6554 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker07eb38b2012-12-19 14:42:06 +01006555 }
6556 }
6557#endif
6558
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006559#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006560 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006561 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02006562#endif
6563
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02006564 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006565 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02006566 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00006567 return( ret );
6568 }
6569
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02006570#if defined(MBEDTLS_SSL_PROTO_DTLS)
6571 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
6572 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
6573 {
6574 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
6575 return( ret );
6576 }
6577#endif
6578
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006579 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006580
6581 return( 0 );
6582}
6583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006584#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00006585#define SSL_MAX_HASH_LEN 36
6586#else
6587#define SSL_MAX_HASH_LEN 12
6588#endif
6589
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006590int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00006591{
Paul Bakker23986e52011-04-24 08:57:21 +00006592 int ret;
Manuel Pégourié-Gonnard879a4f92014-07-11 22:31:12 +02006593 unsigned int hash_len;
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00006594 unsigned char buf[SSL_MAX_HASH_LEN];
Paul Bakker5121ce52009-01-03 21:22:43 +00006595
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006596 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006597
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006598 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
Paul Bakker5121ce52009-01-03 21:22:43 +00006599
Hanno Becker327c93b2018-08-15 13:56:18 +01006600 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006601 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006602 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00006603 return( ret );
6604 }
6605
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006606 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00006607 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006608 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006609 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6610 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006611 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00006612 }
6613
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00006614 /* There is currently no ciphersuite using another length with TLS 1.2 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006615#if defined(MBEDTLS_SSL_PROTO_SSL3)
6616 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnardca6440b2014-09-10 12:39:54 +00006617 hash_len = 36;
6618 else
6619#endif
6620 hash_len = 12;
Paul Bakker5121ce52009-01-03 21:22:43 +00006621
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006622 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED ||
6623 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
Paul Bakker5121ce52009-01-03 21:22:43 +00006624 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006625 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006626 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6627 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006628 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00006629 }
6630
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006631 if( mbedtls_ssl_safer_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
Manuel Pégourié-Gonnard4abc3272014-09-10 12:02:46 +00006632 buf, hash_len ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006633 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006634 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02006635 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
6636 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006637 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
Paul Bakker5121ce52009-01-03 21:22:43 +00006638 }
6639
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006640#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00006641 ssl->verify_data_len = hash_len;
6642 memcpy( ssl->peer_verify_data, buf, hash_len );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01006643#endif
Paul Bakker48916f92012-09-16 19:57:18 +00006644
Paul Bakker0a597072012-09-25 21:55:46 +00006645 if( ssl->handshake->resume != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00006646 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006647#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006648 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006649 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01006650#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006651#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006652 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006653 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Manuel Pégourié-Gonnardd16d1cb2014-11-20 18:15:05 +01006654#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00006655 }
6656 else
6657 ssl->state++;
6658
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006659#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02006660 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006661 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02006662#endif
6663
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006664 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00006665
6666 return( 0 );
6667}
6668
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006669static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006670{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006671 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006672
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006673#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6674 defined(MBEDTLS_SSL_PROTO_TLS1_1)
6675 mbedtls_md5_init( &handshake->fin_md5 );
6676 mbedtls_sha1_init( &handshake->fin_sha1 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006677 mbedtls_md5_starts_ret( &handshake->fin_md5 );
6678 mbedtls_sha1_starts_ret( &handshake->fin_sha1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006679#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006680#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6681#if defined(MBEDTLS_SHA256_C)
6682 mbedtls_sha256_init( &handshake->fin_sha256 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006683 mbedtls_sha256_starts_ret( &handshake->fin_sha256, 0 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006684#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006685#if defined(MBEDTLS_SHA512_C)
6686 mbedtls_sha512_init( &handshake->fin_sha512 );
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01006687 mbedtls_sha512_starts_ret( &handshake->fin_sha512, 1 );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006688#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006689#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006690
6691 handshake->update_checksum = ssl_update_checksum_start;
Hanno Becker7e5437a2017-04-28 17:15:26 +01006692
6693#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
6694 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
6695 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
6696#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006697
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006698#if defined(MBEDTLS_DHM_C)
6699 mbedtls_dhm_init( &handshake->dhm_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006700#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006701#if defined(MBEDTLS_ECDH_C)
6702 mbedtls_ecdh_init( &handshake->ecdh_ctx );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006703#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02006704#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02006705 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02006706#if defined(MBEDTLS_SSL_CLI_C)
6707 handshake->ecjpake_cache = NULL;
6708 handshake->ecjpake_cache_len = 0;
6709#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02006710#endif
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02006711
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02006712#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02006713 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02006714#endif
6715
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02006716#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6717 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
6718#endif
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006719}
6720
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006721static void ssl_transform_init( mbedtls_ssl_transform *transform )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006722{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006723 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
Paul Bakker84bbeb52014-07-01 14:53:22 +02006724
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006725 mbedtls_cipher_init( &transform->cipher_ctx_enc );
6726 mbedtls_cipher_init( &transform->cipher_ctx_dec );
Paul Bakker84bbeb52014-07-01 14:53:22 +02006727
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006728 mbedtls_md_init( &transform->md_ctx_enc );
6729 mbedtls_md_init( &transform->md_ctx_dec );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006730}
6731
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006732void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006733{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006734 memset( session, 0, sizeof(mbedtls_ssl_session) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006735}
6736
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006737static int ssl_handshake_init( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00006738{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006739 /* Clear old handshake information if present */
Paul Bakker48916f92012-09-16 19:57:18 +00006740 if( ssl->transform_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006741 mbedtls_ssl_transform_free( ssl->transform_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006742 if( ssl->session_negotiate )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006743 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006744 if( ssl->handshake )
Gilles Peskine9b562d52018-04-25 20:32:43 +02006745 mbedtls_ssl_handshake_free( ssl );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006746
6747 /*
6748 * Either the pointers are now NULL or cleared properly and can be freed.
6749 * Now allocate missing structures.
6750 */
6751 if( ssl->transform_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02006752 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02006753 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02006754 }
Paul Bakker48916f92012-09-16 19:57:18 +00006755
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006756 if( ssl->session_negotiate == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02006757 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02006758 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02006759 }
Paul Bakker48916f92012-09-16 19:57:18 +00006760
Paul Bakker82788fb2014-10-20 13:59:19 +02006761 if( ssl->handshake == NULL )
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02006762 {
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02006763 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02006764 }
Paul Bakker48916f92012-09-16 19:57:18 +00006765
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006766 /* All pointers should exist and can be directly freed without issue */
Paul Bakker48916f92012-09-16 19:57:18 +00006767 if( ssl->handshake == NULL ||
6768 ssl->transform_negotiate == NULL ||
6769 ssl->session_negotiate == NULL )
6770 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02006771 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006772
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006773 mbedtls_free( ssl->handshake );
6774 mbedtls_free( ssl->transform_negotiate );
6775 mbedtls_free( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006776
6777 ssl->handshake = NULL;
6778 ssl->transform_negotiate = NULL;
6779 ssl->session_negotiate = NULL;
6780
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02006781 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker48916f92012-09-16 19:57:18 +00006782 }
6783
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006784 /* Initialize structures */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006785 mbedtls_ssl_session_init( ssl->session_negotiate );
Paul Bakkeraccaffe2014-06-26 13:37:14 +02006786 ssl_transform_init( ssl->transform_negotiate );
Paul Bakker968afaa2014-07-09 11:09:24 +02006787 ssl_handshake_params_init( ssl->handshake );
6788
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006789#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02006790 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6791 {
6792 ssl->handshake->alt_transform_out = ssl->transform_out;
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02006793
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02006794 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
6795 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
6796 else
6797 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02006798
6799 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02006800 }
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02006801#endif
6802
Paul Bakker48916f92012-09-16 19:57:18 +00006803 return( 0 );
6804}
6805
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02006806#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02006807/* Dummy cookie callbacks for defaults */
6808static int ssl_cookie_write_dummy( void *ctx,
6809 unsigned char **p, unsigned char *end,
6810 const unsigned char *cli_id, size_t cli_id_len )
6811{
6812 ((void) ctx);
6813 ((void) p);
6814 ((void) end);
6815 ((void) cli_id);
6816 ((void) cli_id_len);
6817
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006818 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02006819}
6820
6821static int ssl_cookie_check_dummy( void *ctx,
6822 const unsigned char *cookie, size_t cookie_len,
6823 const unsigned char *cli_id, size_t cli_id_len )
6824{
6825 ((void) ctx);
6826 ((void) cookie);
6827 ((void) cookie_len);
6828 ((void) cli_id);
6829 ((void) cli_id_len);
6830
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02006831 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02006832}
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02006833#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02006834
Hanno Becker5aa4e2c2018-08-06 09:26:08 +01006835/* Once ssl->out_hdr as the address of the beginning of the
6836 * next outgoing record is set, deduce the other pointers.
6837 *
6838 * Note: For TLS, we save the implicit record sequence number
6839 * (entering MAC computation) in the 8 bytes before ssl->out_hdr,
6840 * and the caller has to make sure there's space for this.
6841 */
6842
6843static void ssl_update_out_pointers( mbedtls_ssl_context *ssl,
6844 mbedtls_ssl_transform *transform )
6845{
6846#if defined(MBEDTLS_SSL_PROTO_DTLS)
6847 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6848 {
6849 ssl->out_ctr = ssl->out_hdr + 3;
6850 ssl->out_len = ssl->out_hdr + 11;
6851 ssl->out_iv = ssl->out_hdr + 13;
6852 }
6853 else
6854#endif
6855 {
6856 ssl->out_ctr = ssl->out_hdr - 8;
6857 ssl->out_len = ssl->out_hdr + 3;
6858 ssl->out_iv = ssl->out_hdr + 5;
6859 }
6860
6861 /* Adjust out_msg to make space for explicit IV, if used. */
6862 if( transform != NULL &&
6863 ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
6864 {
6865 ssl->out_msg = ssl->out_iv + transform->ivlen - transform->fixed_ivlen;
6866 }
6867 else
6868 ssl->out_msg = ssl->out_iv;
6869}
6870
6871/* Once ssl->in_hdr as the address of the beginning of the
6872 * next incoming record is set, deduce the other pointers.
6873 *
6874 * Note: For TLS, we save the implicit record sequence number
6875 * (entering MAC computation) in the 8 bytes before ssl->in_hdr,
6876 * and the caller has to make sure there's space for this.
6877 */
6878
6879static void ssl_update_in_pointers( mbedtls_ssl_context *ssl,
6880 mbedtls_ssl_transform *transform )
6881{
6882#if defined(MBEDTLS_SSL_PROTO_DTLS)
6883 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6884 {
6885 ssl->in_ctr = ssl->in_hdr + 3;
6886 ssl->in_len = ssl->in_hdr + 11;
6887 ssl->in_iv = ssl->in_hdr + 13;
6888 }
6889 else
6890#endif
6891 {
6892 ssl->in_ctr = ssl->in_hdr - 8;
6893 ssl->in_len = ssl->in_hdr + 3;
6894 ssl->in_iv = ssl->in_hdr + 5;
6895 }
6896
6897 /* Offset in_msg from in_iv to allow space for explicit IV, if used. */
6898 if( transform != NULL &&
6899 ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
6900 {
6901 ssl->in_msg = ssl->in_iv + transform->ivlen - transform->fixed_ivlen;
6902 }
6903 else
6904 ssl->in_msg = ssl->in_iv;
6905}
6906
Paul Bakker5121ce52009-01-03 21:22:43 +00006907/*
6908 * Initialize an SSL context
6909 */
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +02006910void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
6911{
6912 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
6913}
6914
6915/*
6916 * Setup an SSL context
6917 */
Hanno Becker2a43f6f2018-08-10 11:12:52 +01006918
6919static void ssl_reset_in_out_pointers( mbedtls_ssl_context *ssl )
6920{
6921 /* Set the incoming and outgoing record pointers. */
6922#if defined(MBEDTLS_SSL_PROTO_DTLS)
6923 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
6924 {
6925 ssl->out_hdr = ssl->out_buf;
6926 ssl->in_hdr = ssl->in_buf;
6927 }
6928 else
6929#endif /* MBEDTLS_SSL_PROTO_DTLS */
6930 {
6931 ssl->out_hdr = ssl->out_buf + 8;
6932 ssl->in_hdr = ssl->in_buf + 8;
6933 }
6934
6935 /* Derive other internal pointers. */
6936 ssl_update_out_pointers( ssl, NULL /* no transform enabled */ );
6937 ssl_update_in_pointers ( ssl, NULL /* no transform enabled */ );
6938}
6939
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02006940int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02006941 const mbedtls_ssl_config *conf )
Paul Bakker5121ce52009-01-03 21:22:43 +00006942{
Paul Bakker48916f92012-09-16 19:57:18 +00006943 int ret;
Paul Bakker5121ce52009-01-03 21:22:43 +00006944
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02006945 ssl->conf = conf;
Paul Bakker62f2dee2012-09-28 07:31:51 +00006946
6947 /*
Manuel Pégourié-Gonnard06193482014-02-14 08:39:32 +01006948 * Prepare base structures
Paul Bakker62f2dee2012-09-28 07:31:51 +00006949 */
k-stachowiakc9a5f022018-07-24 13:53:31 +02006950
6951 /* Set to NULL in case of an error condition */
6952 ssl->out_buf = NULL;
k-stachowiaka47911c2018-07-04 17:41:58 +02006953
Angus Grattond8213d02016-05-25 20:56:48 +10006954 ssl->in_buf = mbedtls_calloc( 1, MBEDTLS_SSL_IN_BUFFER_LEN );
6955 if( ssl->in_buf == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00006956 {
Angus Grattond8213d02016-05-25 20:56:48 +10006957 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", MBEDTLS_SSL_IN_BUFFER_LEN) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02006958 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02006959 goto error;
Angus Grattond8213d02016-05-25 20:56:48 +10006960 }
6961
6962 ssl->out_buf = mbedtls_calloc( 1, MBEDTLS_SSL_OUT_BUFFER_LEN );
6963 if( ssl->out_buf == NULL )
6964 {
6965 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", MBEDTLS_SSL_OUT_BUFFER_LEN) );
k-stachowiak9f7798e2018-07-31 16:52:32 +02006966 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
k-stachowiaka47911c2018-07-04 17:41:58 +02006967 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00006968 }
6969
Hanno Becker2a43f6f2018-08-10 11:12:52 +01006970 ssl_reset_in_out_pointers( ssl );
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02006971
Paul Bakker48916f92012-09-16 19:57:18 +00006972 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
k-stachowiaka47911c2018-07-04 17:41:58 +02006973 goto error;
Paul Bakker5121ce52009-01-03 21:22:43 +00006974
6975 return( 0 );
k-stachowiaka47911c2018-07-04 17:41:58 +02006976
6977error:
6978 mbedtls_free( ssl->in_buf );
6979 mbedtls_free( ssl->out_buf );
6980
6981 ssl->conf = NULL;
6982
6983 ssl->in_buf = NULL;
6984 ssl->out_buf = NULL;
6985
6986 ssl->in_hdr = NULL;
6987 ssl->in_ctr = NULL;
6988 ssl->in_len = NULL;
6989 ssl->in_iv = NULL;
6990 ssl->in_msg = NULL;
6991
6992 ssl->out_hdr = NULL;
6993 ssl->out_ctr = NULL;
6994 ssl->out_len = NULL;
6995 ssl->out_iv = NULL;
6996 ssl->out_msg = NULL;
6997
k-stachowiak9f7798e2018-07-31 16:52:32 +02006998 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00006999}
7000
7001/*
Paul Bakker7eb013f2011-10-06 12:37:39 +00007002 * Reset an initialized and used SSL context for re-use while retaining
7003 * all application-set variables, function pointers and data.
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02007004 *
7005 * If partial is non-zero, keep data in the input buffer and client ID.
7006 * (Use when a DTLS client reconnects from the same port.)
Paul Bakker7eb013f2011-10-06 12:37:39 +00007007 */
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02007008static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
Paul Bakker7eb013f2011-10-06 12:37:39 +00007009{
Paul Bakker48916f92012-09-16 19:57:18 +00007010 int ret;
7011
Hanno Becker7e772132018-08-10 12:38:21 +01007012#if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || \
7013 !defined(MBEDTLS_SSL_SRV_C)
7014 ((void) partial);
7015#endif
7016
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007017 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01007018
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02007019 /* Cancel any possibly running timer */
7020 ssl_set_timer( ssl, 0 );
7021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007022#if defined(MBEDTLS_SSL_RENEGOTIATION)
7023 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01007024 ssl->renego_records_seen = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00007025
7026 ssl->verify_data_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007027 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
7028 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01007029#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007030 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +00007031
Paul Bakker7eb013f2011-10-06 12:37:39 +00007032 ssl->in_offt = NULL;
Hanno Beckerf29d4702018-08-10 11:31:15 +01007033 ssl_reset_in_out_pointers( ssl );
Paul Bakker7eb013f2011-10-06 12:37:39 +00007034
7035 ssl->in_msgtype = 0;
7036 ssl->in_msglen = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007037#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02007038 ssl->next_record_offset = 0;
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02007039 ssl->in_epoch = 0;
Manuel Pégourié-Gonnardb2f3be82014-07-10 17:54:52 +02007040#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007041#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02007042 ssl_dtls_replay_reset( ssl );
7043#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00007044
7045 ssl->in_hslen = 0;
7046 ssl->nb_zero = 0;
Hanno Beckeraf0665d2017-05-24 09:16:26 +01007047
7048 ssl->keep_current_message = 0;
Paul Bakker7eb013f2011-10-06 12:37:39 +00007049
7050 ssl->out_msgtype = 0;
7051 ssl->out_msglen = 0;
7052 ssl->out_left = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007053#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
7054 if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01007055 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01007056#endif
Paul Bakker7eb013f2011-10-06 12:37:39 +00007057
Hanno Becker19859472018-08-06 09:40:20 +01007058 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) );
7059
Paul Bakker48916f92012-09-16 19:57:18 +00007060 ssl->transform_in = NULL;
7061 ssl->transform_out = NULL;
Paul Bakker7eb013f2011-10-06 12:37:39 +00007062
Hanno Becker78640902018-08-13 16:35:15 +01007063 ssl->session_in = NULL;
7064 ssl->session_out = NULL;
7065
Angus Grattond8213d02016-05-25 20:56:48 +10007066 memset( ssl->out_buf, 0, MBEDTLS_SSL_OUT_BUFFER_LEN );
Hanno Becker4ccbf062018-08-10 11:20:38 +01007067
7068#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02007069 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01007070#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
7071 {
7072 ssl->in_left = 0;
Angus Grattond8213d02016-05-25 20:56:48 +10007073 memset( ssl->in_buf, 0, MBEDTLS_SSL_IN_BUFFER_LEN );
Hanno Becker4ccbf062018-08-10 11:20:38 +01007074 }
Paul Bakker05ef8352012-05-08 09:17:57 +00007075
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007076#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
7077 if( mbedtls_ssl_hw_record_reset != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00007078 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007079 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) );
7080 if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 )
Paul Bakker2770fbd2012-07-03 13:30:23 +00007081 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007082 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret );
7083 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
Paul Bakker2770fbd2012-07-03 13:30:23 +00007084 }
Paul Bakker05ef8352012-05-08 09:17:57 +00007085 }
7086#endif
Paul Bakker2770fbd2012-07-03 13:30:23 +00007087
Paul Bakker48916f92012-09-16 19:57:18 +00007088 if( ssl->transform )
Paul Bakker2770fbd2012-07-03 13:30:23 +00007089 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007090 mbedtls_ssl_transform_free( ssl->transform );
7091 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00007092 ssl->transform = NULL;
Paul Bakker2770fbd2012-07-03 13:30:23 +00007093 }
Paul Bakker48916f92012-09-16 19:57:18 +00007094
Paul Bakkerc0463502013-02-14 11:19:38 +01007095 if( ssl->session )
7096 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007097 mbedtls_ssl_session_free( ssl->session );
7098 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01007099 ssl->session = NULL;
7100 }
7101
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007102#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02007103 ssl->alpn_chosen = NULL;
7104#endif
7105
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02007106#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker4ccbf062018-08-10 11:20:38 +01007107#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02007108 if( partial == 0 )
Hanno Becker4ccbf062018-08-10 11:20:38 +01007109#endif
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02007110 {
7111 mbedtls_free( ssl->cli_id );
7112 ssl->cli_id = NULL;
7113 ssl->cli_id_len = 0;
7114 }
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02007115#endif
7116
Paul Bakker48916f92012-09-16 19:57:18 +00007117 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
7118 return( ret );
Paul Bakker2770fbd2012-07-03 13:30:23 +00007119
7120 return( 0 );
Paul Bakker7eb013f2011-10-06 12:37:39 +00007121}
7122
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +02007123/*
Manuel Pégourié-Gonnard3f09b6d2015-09-08 11:58:14 +02007124 * Reset an initialized and used SSL context for re-use while retaining
7125 * all application-set variables, function pointers and data.
7126 */
7127int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
7128{
7129 return( ssl_session_reset_int( ssl, 0 ) );
7130}
7131
7132/*
Paul Bakker5121ce52009-01-03 21:22:43 +00007133 * SSL set accessors
7134 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007135void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
Paul Bakker5121ce52009-01-03 21:22:43 +00007136{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007137 conf->endpoint = endpoint;
Paul Bakker5121ce52009-01-03 21:22:43 +00007138}
7139
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02007140void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01007141{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007142 conf->transport = transport;
Manuel Pégourié-Gonnard0b1ff292014-02-06 13:04:16 +01007143}
7144
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007145#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007146void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02007147{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007148 conf->anti_replay = mode;
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02007149}
7150#endif
7151
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007152#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007153void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02007154{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007155 conf->badmac_limit = limit;
Manuel Pégourié-Gonnardb0643d12014-10-14 18:30:36 +02007156}
7157#endif
7158
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007159#if defined(MBEDTLS_SSL_PROTO_DTLS)
Hanno Becker04da1892018-08-14 13:22:10 +01007160
Hanno Becker1841b0a2018-08-24 11:13:57 +01007161void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl,
7162 unsigned allow_packing )
Hanno Becker04da1892018-08-14 13:22:10 +01007163{
7164 ssl->disable_datagram_packing = !allow_packing;
7165}
7166
7167void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf,
7168 uint32_t min, uint32_t max )
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02007169{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007170 conf->hs_timeout_min = min;
7171 conf->hs_timeout_max = max;
Manuel Pégourié-Gonnard905dd242014-10-01 12:03:55 +02007172}
7173#endif
7174
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007175void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
Paul Bakker5121ce52009-01-03 21:22:43 +00007176{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007177 conf->authmode = authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00007178}
7179
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007180#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007181void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02007182 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
Paul Bakkerb63b0af2011-01-13 17:54:59 +00007183 void *p_vrfy )
7184{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007185 conf->f_vrfy = f_vrfy;
7186 conf->p_vrfy = p_vrfy;
Paul Bakkerb63b0af2011-01-13 17:54:59 +00007187}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007188#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb63b0af2011-01-13 17:54:59 +00007189
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007190void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
Paul Bakkera3d195c2011-11-27 21:07:34 +00007191 int (*f_rng)(void *, unsigned char *, size_t),
Paul Bakker5121ce52009-01-03 21:22:43 +00007192 void *p_rng )
7193{
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01007194 conf->f_rng = f_rng;
7195 conf->p_rng = p_rng;
Paul Bakker5121ce52009-01-03 21:22:43 +00007196}
7197
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007198void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardfd474232015-06-23 16:34:24 +02007199 void (*f_dbg)(void *, int, const char *, int, const char *),
Paul Bakker5121ce52009-01-03 21:22:43 +00007200 void *p_dbg )
7201{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007202 conf->f_dbg = f_dbg;
7203 conf->p_dbg = p_dbg;
Paul Bakker5121ce52009-01-03 21:22:43 +00007204}
7205
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007206void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02007207 void *p_bio,
Simon Butchere846b512016-03-01 17:31:49 +00007208 mbedtls_ssl_send_t *f_send,
7209 mbedtls_ssl_recv_t *f_recv,
7210 mbedtls_ssl_recv_timeout_t *f_recv_timeout )
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02007211{
7212 ssl->p_bio = p_bio;
7213 ssl->f_send = f_send;
7214 ssl->f_recv = f_recv;
7215 ssl->f_recv_timeout = f_recv_timeout;
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01007216}
7217
Manuel Pégourié-Gonnard6e7aaca2018-08-20 10:37:23 +02007218#if defined(MBEDTLS_SSL_PROTO_DTLS)
7219void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu )
7220{
7221 ssl->mtu = mtu;
7222}
7223#endif
7224
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007225void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
Manuel Pégourié-Gonnard97fd52c2015-05-06 15:38:52 +01007226{
7227 conf->read_timeout = timeout;
Manuel Pégourié-Gonnard8fa6dfd2014-09-17 10:47:43 +02007228}
7229
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02007230void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
7231 void *p_timer,
Simon Butchere846b512016-03-01 17:31:49 +00007232 mbedtls_ssl_set_timer_t *f_set_timer,
7233 mbedtls_ssl_get_timer_t *f_get_timer )
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02007234{
7235 ssl->p_timer = p_timer;
7236 ssl->f_set_timer = f_set_timer;
7237 ssl->f_get_timer = f_get_timer;
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02007238
7239 /* Make sure we start with no timer running */
7240 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard2e012912015-05-12 20:55:41 +02007241}
7242
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007243#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007244void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01007245 void *p_cache,
7246 int (*f_get_cache)(void *, mbedtls_ssl_session *),
7247 int (*f_set_cache)(void *, const mbedtls_ssl_session *) )
Paul Bakker5121ce52009-01-03 21:22:43 +00007248{
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01007249 conf->p_cache = p_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007250 conf->f_get_cache = f_get_cache;
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007251 conf->f_set_cache = f_set_cache;
Paul Bakker5121ce52009-01-03 21:22:43 +00007252}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007253#endif /* MBEDTLS_SSL_SRV_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00007254
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007255#if defined(MBEDTLS_SSL_CLI_C)
7256int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
Paul Bakker5121ce52009-01-03 21:22:43 +00007257{
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02007258 int ret;
7259
7260 if( ssl == NULL ||
7261 session == NULL ||
7262 ssl->session_negotiate == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007263 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02007264 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007265 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02007266 }
7267
7268 if( ( ret = ssl_session_copy( ssl->session_negotiate, session ) ) != 0 )
7269 return( ret );
7270
Paul Bakker0a597072012-09-25 21:55:46 +00007271 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02007272
7273 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00007274}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007275#endif /* MBEDTLS_SSL_CLI_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00007276
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007277void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007278 const int *ciphersuites )
Paul Bakker5121ce52009-01-03 21:22:43 +00007279{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007280 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = ciphersuites;
7281 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = ciphersuites;
7282 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = ciphersuites;
7283 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = ciphersuites;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02007284}
7285
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007286void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02007287 const int *ciphersuites,
Paul Bakker8f4ddae2013-04-15 15:09:54 +02007288 int major, int minor )
7289{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007290 if( major != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker8f4ddae2013-04-15 15:09:54 +02007291 return;
7292
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007293 if( minor < MBEDTLS_SSL_MINOR_VERSION_0 || minor > MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker8f4ddae2013-04-15 15:09:54 +02007294 return;
7295
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007296 conf->ciphersuite_list[minor] = ciphersuites;
Paul Bakker5121ce52009-01-03 21:22:43 +00007297}
7298
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007299#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02007300void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
Nicholas Wilson2088e2e2015-09-08 16:53:18 +01007301 const mbedtls_x509_crt_profile *profile )
Manuel Pégourié-Gonnard6e3ee3a2015-06-17 10:58:20 +02007302{
7303 conf->cert_profile = profile;
7304}
7305
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02007306/* Append a new keycert entry to a (possibly empty) list */
7307static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
7308 mbedtls_x509_crt *cert,
7309 mbedtls_pk_context *key )
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007310{
niisato8ee24222018-06-25 19:05:48 +09007311 mbedtls_ssl_key_cert *new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007312
niisato8ee24222018-06-25 19:05:48 +09007313 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
7314 if( new_cert == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02007315 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007316
niisato8ee24222018-06-25 19:05:48 +09007317 new_cert->cert = cert;
7318 new_cert->key = key;
7319 new_cert->next = NULL;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007320
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02007321 /* Update head is the list was null, else add to the end */
7322 if( *head == NULL )
Paul Bakker0333b972013-11-04 17:08:28 +01007323 {
niisato8ee24222018-06-25 19:05:48 +09007324 *head = new_cert;
Paul Bakker0333b972013-11-04 17:08:28 +01007325 }
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007326 else
7327 {
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02007328 mbedtls_ssl_key_cert *cur = *head;
7329 while( cur->next != NULL )
7330 cur = cur->next;
niisato8ee24222018-06-25 19:05:48 +09007331 cur->next = new_cert;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007332 }
7333
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02007334 return( 0 );
7335}
7336
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007337int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +02007338 mbedtls_x509_crt *own_cert,
7339 mbedtls_pk_context *pk_key )
7340{
Manuel Pégourié-Gonnard17a40cd2015-05-10 23:17:17 +02007341 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02007342}
7343
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007344void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01007345 mbedtls_x509_crt *ca_chain,
7346 mbedtls_x509_crl *ca_crl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007347{
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01007348 conf->ca_chain = ca_chain;
7349 conf->ca_crl = ca_crl;
Paul Bakker5121ce52009-01-03 21:22:43 +00007350}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007351#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkereb2c6582012-09-27 19:15:01 +00007352
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02007353#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7354int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
7355 mbedtls_x509_crt *own_cert,
7356 mbedtls_pk_context *pk_key )
7357{
7358 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
7359 own_cert, pk_key ) );
7360}
Manuel Pégourié-Gonnard22bfa4b2015-05-11 08:46:37 +02007361
7362void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
7363 mbedtls_x509_crt *ca_chain,
7364 mbedtls_x509_crl *ca_crl )
7365{
7366 ssl->handshake->sni_ca_chain = ca_chain;
7367 ssl->handshake->sni_ca_crl = ca_crl;
7368}
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02007369
7370void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
7371 int authmode )
7372{
7373 ssl->handshake->sni_authmode = authmode;
7374}
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +02007375#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
7376
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02007377#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02007378/*
7379 * Set EC J-PAKE password for current handshake
7380 */
7381int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
7382 const unsigned char *pw,
7383 size_t pw_len )
7384{
7385 mbedtls_ecjpake_role role;
7386
Janos Follath8eb64132016-06-03 15:40:57 +01007387 if( ssl->handshake == NULL || ssl->conf == NULL )
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02007388 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7389
7390 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
7391 role = MBEDTLS_ECJPAKE_SERVER;
7392 else
7393 role = MBEDTLS_ECJPAKE_CLIENT;
7394
7395 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
7396 role,
7397 MBEDTLS_MD_SHA256,
7398 MBEDTLS_ECP_DP_SECP256R1,
7399 pw, pw_len ) );
7400}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02007401#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7002f4a2015-09-15 12:43:43 +02007402
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007403#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007404int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01007405 const unsigned char *psk, size_t psk_len,
7406 const unsigned char *psk_identity, size_t psk_identity_len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02007407{
Paul Bakker6db455e2013-09-18 17:29:31 +02007408 if( psk == NULL || psk_identity == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007409 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker6db455e2013-09-18 17:29:31 +02007410
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007411 if( psk_len > MBEDTLS_PSK_MAX_LEN )
7412 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardb2bf5a12014-03-25 16:28:12 +01007413
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02007414 /* Identity len will be encoded on two bytes */
7415 if( ( psk_identity_len >> 16 ) != 0 ||
Angus Grattond8213d02016-05-25 20:56:48 +10007416 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02007417 {
7418 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7419 }
7420
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01007421 if( conf->psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02007422 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05007423 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01007424
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01007425 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02007426 conf->psk = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01007427 conf->psk_len = 0;
7428 }
7429 if( conf->psk_identity != NULL )
7430 {
7431 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard173c7902015-10-20 19:56:45 +02007432 conf->psk_identity = NULL;
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01007433 conf->psk_identity_len = 0;
Paul Bakker6db455e2013-09-18 17:29:31 +02007434 }
7435
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02007436 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
7437 ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
Mansour Moufidf81088b2015-02-17 13:10:21 -05007438 {
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01007439 mbedtls_free( conf->psk );
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02007440 mbedtls_free( conf->psk_identity );
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01007441 conf->psk = NULL;
Manuel Pégourié-Gonnard24417f02015-09-28 18:09:45 +02007442 conf->psk_identity = NULL;
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02007443 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Mansour Moufidf81088b2015-02-17 13:10:21 -05007444 }
Paul Bakker6db455e2013-09-18 17:29:31 +02007445
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01007446 conf->psk_len = psk_len;
7447 conf->psk_identity_len = psk_identity_len;
Paul Bakker6db455e2013-09-18 17:29:31 +02007448
Manuel Pégourié-Gonnard120fdbd2015-05-07 17:07:50 +01007449 memcpy( conf->psk, psk, conf->psk_len );
7450 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
Paul Bakker6db455e2013-09-18 17:29:31 +02007451
7452 return( 0 );
7453}
7454
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01007455int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
7456 const unsigned char *psk, size_t psk_len )
7457{
7458 if( psk == NULL || ssl->handshake == NULL )
7459 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7460
7461 if( psk_len > MBEDTLS_PSK_MAX_LEN )
7462 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7463
7464 if( ssl->handshake->psk != NULL )
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01007465 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05007466 mbedtls_platform_zeroize( ssl->handshake->psk,
7467 ssl->handshake->psk_len );
Simon Butcher5b8d1d62015-10-04 22:06:51 +01007468 mbedtls_free( ssl->handshake->psk );
Andres Amaya Garciabbafd342017-07-05 14:25:21 +01007469 ssl->handshake->psk_len = 0;
Andres Amaya Garciaa0049882017-06-26 11:35:17 +01007470 }
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01007471
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02007472 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02007473 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01007474
7475 ssl->handshake->psk_len = psk_len;
7476 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
7477
7478 return( 0 );
7479}
7480
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007481void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007482 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
Paul Bakker6db455e2013-09-18 17:29:31 +02007483 size_t),
7484 void *p_psk )
7485{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007486 conf->f_psk = f_psk;
7487 conf->p_psk = p_psk;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02007488}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007489#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakker43b7e352011-01-18 15:27:19 +00007490
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02007491#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Hanno Becker470a8c42017-10-04 15:28:46 +01007492
7493#if !defined(MBEDTLS_DEPRECATED_REMOVED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007494int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G )
Paul Bakker5121ce52009-01-03 21:22:43 +00007495{
7496 int ret;
7497
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01007498 if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 ||
7499 ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
7500 {
7501 mbedtls_mpi_free( &conf->dhm_P );
7502 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker5121ce52009-01-03 21:22:43 +00007503 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01007504 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007505
7506 return( 0 );
7507}
Hanno Becker470a8c42017-10-04 15:28:46 +01007508#endif /* MBEDTLS_DEPRECATED_REMOVED */
Paul Bakker5121ce52009-01-03 21:22:43 +00007509
Hanno Beckera90658f2017-10-04 15:29:08 +01007510int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf,
7511 const unsigned char *dhm_P, size_t P_len,
7512 const unsigned char *dhm_G, size_t G_len )
7513{
7514 int ret;
7515
7516 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 ||
7517 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 )
7518 {
7519 mbedtls_mpi_free( &conf->dhm_P );
7520 mbedtls_mpi_free( &conf->dhm_G );
7521 return( ret );
7522 }
7523
7524 return( 0 );
7525}
Paul Bakker5121ce52009-01-03 21:22:43 +00007526
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007527int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
Paul Bakker1b57b062011-01-06 15:48:19 +00007528{
7529 int ret;
7530
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01007531 if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 ||
7532 ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
7533 {
7534 mbedtls_mpi_free( &conf->dhm_P );
7535 mbedtls_mpi_free( &conf->dhm_G );
Paul Bakker1b57b062011-01-06 15:48:19 +00007536 return( ret );
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01007537 }
Paul Bakker1b57b062011-01-06 15:48:19 +00007538
7539 return( 0 );
7540}
Manuel Pégourié-Gonnardcf141ca2015-05-20 10:35:51 +02007541#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
Paul Bakker1b57b062011-01-06 15:48:19 +00007542
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02007543#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
7544/*
7545 * Set the minimum length for Diffie-Hellman parameters
7546 */
7547void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
7548 unsigned int bitlen )
7549{
7550 conf->dhm_min_bitlen = bitlen;
7551}
7552#endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
7553
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02007554#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02007555/*
7556 * Set allowed/preferred hashes for handshake signatures
7557 */
7558void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
7559 const int *hashes )
7560{
7561 conf->sig_hashes = hashes;
7562}
Hanno Becker947194e2017-04-07 13:25:49 +01007563#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard36a8b572015-06-17 12:43:26 +02007564
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02007565#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01007566/*
7567 * Set the allowed elliptic curves
7568 */
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007569void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007570 const mbedtls_ecp_group_id *curve_list )
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01007571{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007572 conf->curve_list = curve_list;
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01007573}
Hanno Becker947194e2017-04-07 13:25:49 +01007574#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f38ed02014-02-04 15:52:33 +01007575
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01007576#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007577int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
Paul Bakker5121ce52009-01-03 21:22:43 +00007578{
Hanno Becker947194e2017-04-07 13:25:49 +01007579 /* Initialize to suppress unnecessary compiler warning */
7580 size_t hostname_len = 0;
7581
7582 /* Check if new hostname is valid before
7583 * making any change to current one */
Hanno Becker947194e2017-04-07 13:25:49 +01007584 if( hostname != NULL )
7585 {
7586 hostname_len = strlen( hostname );
7587
7588 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
7589 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
7590 }
7591
7592 /* Now it's clear that we will overwrite the old hostname,
7593 * so we can free it safely */
7594
7595 if( ssl->hostname != NULL )
7596 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05007597 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Hanno Becker947194e2017-04-07 13:25:49 +01007598 mbedtls_free( ssl->hostname );
7599 }
7600
7601 /* Passing NULL as hostname shall clear the old one */
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +01007602
Paul Bakker5121ce52009-01-03 21:22:43 +00007603 if( hostname == NULL )
Hanno Becker947194e2017-04-07 13:25:49 +01007604 {
7605 ssl->hostname = NULL;
7606 }
7607 else
7608 {
7609 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
Hanno Becker947194e2017-04-07 13:25:49 +01007610 if( ssl->hostname == NULL )
7611 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02007612
Hanno Becker947194e2017-04-07 13:25:49 +01007613 memcpy( ssl->hostname, hostname, hostname_len );
Paul Bakker75c1a6f2013-08-19 14:25:29 +02007614
Hanno Becker947194e2017-04-07 13:25:49 +01007615 ssl->hostname[hostname_len] = '\0';
7616 }
Paul Bakker5121ce52009-01-03 21:22:43 +00007617
7618 return( 0 );
7619}
Hanno Becker1a9a51c2017-04-07 13:02:16 +01007620#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00007621
Manuel Pégourié-Gonnardbc2b7712015-05-06 11:14:19 +01007622#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007623void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007624 int (*f_sni)(void *, mbedtls_ssl_context *,
Paul Bakker5701cdc2012-09-27 21:49:42 +00007625 const unsigned char *, size_t),
7626 void *p_sni )
7627{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007628 conf->f_sni = f_sni;
7629 conf->p_sni = p_sni;
Paul Bakker5701cdc2012-09-27 21:49:42 +00007630}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007631#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00007632
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007633#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007634int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02007635{
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02007636 size_t cur_len, tot_len;
7637 const char **p;
7638
7639 /*
Brian J Murray1903fb32016-11-06 04:45:15 -08007640 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
7641 * MUST NOT be truncated."
7642 * We check lengths now rather than later.
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02007643 */
7644 tot_len = 0;
7645 for( p = protos; *p != NULL; p++ )
7646 {
7647 cur_len = strlen( *p );
7648 tot_len += cur_len;
7649
Ronald Cron157cffe2020-04-23 16:41:44 +02007650 if( ( cur_len == 0 ) ||
7651 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) ||
7652 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007653 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02007654 }
7655
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007656 conf->alpn_list = protos;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02007657
7658 return( 0 );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02007659}
7660
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007661const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02007662{
Paul Bakkerd8bb8262014-06-17 14:06:49 +02007663 return( ssl->alpn_chosen );
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02007664}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007665#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard7e250d42014-04-04 16:08:41 +02007666
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02007667void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker490ecc82011-10-06 13:04:09 +00007668{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007669 conf->max_major_ver = major;
7670 conf->max_minor_ver = minor;
Paul Bakker490ecc82011-10-06 13:04:09 +00007671}
7672
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02007673void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
Paul Bakker1d29fb52012-09-28 13:28:45 +00007674{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007675 conf->min_major_ver = major;
7676 conf->min_minor_ver = minor;
Paul Bakker1d29fb52012-09-28 13:28:45 +00007677}
7678
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007679#if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007680void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback )
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02007681{
Manuel Pégourié-Gonnard684b0592015-05-06 09:27:31 +01007682 conf->fallback = fallback;
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02007683}
7684#endif
7685
Janos Follath088ce432017-04-10 12:42:31 +01007686#if defined(MBEDTLS_SSL_SRV_C)
7687void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
7688 char cert_req_ca_list )
7689{
7690 conf->cert_req_ca_list = cert_req_ca_list;
7691}
7692#endif
7693
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007694#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007695void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01007696{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007697 conf->encrypt_then_mac = etm;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01007698}
7699#endif
7700
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007701#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007702void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02007703{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007704 conf->extended_ms = ems;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02007705}
7706#endif
7707
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02007708#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007709void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 )
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01007710{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007711 conf->arc4_disabled = arc4;
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01007712}
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02007713#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01007714
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007715#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007716int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02007717{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007718 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
Angus Grattond8213d02016-05-25 20:56:48 +10007719 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN )
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02007720 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007721 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02007722 }
7723
Manuel Pégourié-Gonnard6bf89d62015-05-05 17:01:57 +01007724 conf->mfl_code = mfl_code;
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02007725
7726 return( 0 );
7727}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007728#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard8b464592013-07-16 12:45:26 +02007729
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007730#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02007731void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate )
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02007732{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007733 conf->trunc_hmac = truncate;
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02007734}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007735#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02007736
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007737#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007738void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split )
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01007739{
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01007740 conf->cbc_record_splitting = split;
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01007741}
7742#endif
7743
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007744void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
Paul Bakker48916f92012-09-16 19:57:18 +00007745{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007746 conf->allow_legacy_renegotiation = allow_legacy;
Paul Bakker48916f92012-09-16 19:57:18 +00007747}
7748
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007749#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007750void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01007751{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007752 conf->disable_renegotiation = renegotiation;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01007753}
7754
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007755void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02007756{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007757 conf->renego_max_records = max_records;
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02007758}
7759
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02007760void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01007761 const unsigned char period[8] )
7762{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +02007763 memcpy( conf->renego_period, period, 8 );
Manuel Pégourié-Gonnard837f0fe2014-11-05 13:58:53 +01007764}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007765#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00007766
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007767#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02007768#if defined(MBEDTLS_SSL_CLI_C)
7769void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02007770{
Manuel Pégourié-Gonnard2b494452015-05-06 10:05:11 +01007771 conf->session_tickets = use_tickets;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02007772}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02007773#endif
Paul Bakker606b4ba2013-08-14 16:52:14 +02007774
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02007775#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02007776void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
7777 mbedtls_ssl_ticket_write_t *f_ticket_write,
7778 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
7779 void *p_ticket )
Paul Bakker606b4ba2013-08-14 16:52:14 +02007780{
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02007781 conf->f_ticket_write = f_ticket_write;
7782 conf->f_ticket_parse = f_ticket_parse;
7783 conf->p_ticket = p_ticket;
Paul Bakker606b4ba2013-08-14 16:52:14 +02007784}
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02007785#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007786#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02007787
Robert Cragie4feb7ae2015-10-02 13:33:37 +01007788#if defined(MBEDTLS_SSL_EXPORT_KEYS)
7789void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
7790 mbedtls_ssl_export_keys_t *f_export_keys,
7791 void *p_export_keys )
7792{
7793 conf->f_export_keys = f_export_keys;
7794 conf->p_export_keys = p_export_keys;
7795}
7796#endif
7797
Gilles Peskineb74a1c72018-04-24 13:09:22 +02007798#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine8bf79f62018-01-05 21:11:53 +01007799void mbedtls_ssl_conf_async_private_cb(
7800 mbedtls_ssl_config *conf,
7801 mbedtls_ssl_async_sign_t *f_async_sign,
7802 mbedtls_ssl_async_decrypt_t *f_async_decrypt,
7803 mbedtls_ssl_async_resume_t *f_async_resume,
7804 mbedtls_ssl_async_cancel_t *f_async_cancel,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02007805 void *async_config_data )
Gilles Peskine8bf79f62018-01-05 21:11:53 +01007806{
7807 conf->f_async_sign_start = f_async_sign;
7808 conf->f_async_decrypt_start = f_async_decrypt;
7809 conf->f_async_resume = f_async_resume;
7810 conf->f_async_cancel = f_async_cancel;
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02007811 conf->p_async_config_data = async_config_data;
7812}
7813
Gilles Peskine8f97af72018-04-26 11:46:10 +02007814void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf )
7815{
7816 return( conf->p_async_config_data );
7817}
7818
Gilles Peskine1febfef2018-04-30 11:54:39 +02007819void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl )
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02007820{
7821 if( ssl->handshake == NULL )
7822 return( NULL );
7823 else
7824 return( ssl->handshake->user_async_ctx );
7825}
7826
Gilles Peskine1febfef2018-04-30 11:54:39 +02007827void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02007828 void *ctx )
7829{
7830 if( ssl->handshake != NULL )
7831 ssl->handshake->user_async_ctx = ctx;
Gilles Peskine8bf79f62018-01-05 21:11:53 +01007832}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02007833#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine8bf79f62018-01-05 21:11:53 +01007834
Paul Bakker5121ce52009-01-03 21:22:43 +00007835/*
7836 * SSL get accessors
7837 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007838size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007839{
7840 return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
7841}
7842
Hanno Becker8b170a02017-10-10 11:51:19 +01007843int mbedtls_ssl_check_pending( const mbedtls_ssl_context *ssl )
7844{
7845 /*
7846 * Case A: We're currently holding back
7847 * a message for further processing.
7848 */
7849
7850 if( ssl->keep_current_message == 1 )
7851 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01007852 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: record held back for processing" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01007853 return( 1 );
7854 }
7855
7856 /*
7857 * Case B: Further records are pending in the current datagram.
7858 */
7859
7860#if defined(MBEDTLS_SSL_PROTO_DTLS)
7861 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
7862 ssl->in_left > ssl->next_record_offset )
7863 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01007864 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more records within current datagram" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01007865 return( 1 );
7866 }
7867#endif /* MBEDTLS_SSL_PROTO_DTLS */
7868
7869 /*
7870 * Case C: A handshake message is being processed.
7871 */
7872
Hanno Becker8b170a02017-10-10 11:51:19 +01007873 if( ssl->in_hslen > 0 && ssl->in_hslen < ssl->in_msglen )
7874 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01007875 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more handshake messages within current record" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01007876 return( 1 );
7877 }
7878
7879 /*
7880 * Case D: An application data message is being processed
7881 */
7882 if( ssl->in_offt != NULL )
7883 {
Hanno Beckera6fb0892017-10-23 13:17:48 +01007884 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: application data record is being processed" ) );
Hanno Becker8b170a02017-10-10 11:51:19 +01007885 return( 1 );
7886 }
7887
7888 /*
7889 * In all other cases, the rest of the message can be dropped.
Hanno Beckerc573ac32018-08-28 17:15:25 +01007890 * As in ssl_get_next_record, this needs to be adapted if
Hanno Becker8b170a02017-10-10 11:51:19 +01007891 * we implement support for multiple alerts in single records.
7892 */
7893
7894 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: nothing pending" ) );
7895 return( 0 );
7896}
7897
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02007898uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00007899{
Manuel Pégourié-Gonnarde89163c2015-01-23 14:30:57 +00007900 if( ssl->session != NULL )
7901 return( ssl->session->verify_result );
7902
7903 if( ssl->session_negotiate != NULL )
7904 return( ssl->session_negotiate->verify_result );
7905
Manuel Pégourié-Gonnard6ab9b002015-05-14 11:25:04 +02007906 return( 0xFFFFFFFF );
Paul Bakker5121ce52009-01-03 21:22:43 +00007907}
7908
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007909const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
Paul Bakker72f62662011-01-16 21:27:44 +00007910{
Paul Bakker926c8e42013-03-06 10:23:34 +01007911 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02007912 return( NULL );
Paul Bakker926c8e42013-03-06 10:23:34 +01007913
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007914 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
Paul Bakker72f62662011-01-16 21:27:44 +00007915}
7916
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007917const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
Paul Bakker43ca69c2011-01-15 17:35:19 +00007918{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007919#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02007920 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01007921 {
7922 switch( ssl->minor_ver )
7923 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007924 case MBEDTLS_SSL_MINOR_VERSION_2:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01007925 return( "DTLSv1.0" );
7926
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007927 case MBEDTLS_SSL_MINOR_VERSION_3:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01007928 return( "DTLSv1.2" );
7929
7930 default:
7931 return( "unknown (DTLS)" );
7932 }
7933 }
7934#endif
7935
Paul Bakker43ca69c2011-01-15 17:35:19 +00007936 switch( ssl->minor_ver )
7937 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007938 case MBEDTLS_SSL_MINOR_VERSION_0:
Paul Bakker43ca69c2011-01-15 17:35:19 +00007939 return( "SSLv3.0" );
7940
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007941 case MBEDTLS_SSL_MINOR_VERSION_1:
Paul Bakker43ca69c2011-01-15 17:35:19 +00007942 return( "TLSv1.0" );
7943
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007944 case MBEDTLS_SSL_MINOR_VERSION_2:
Paul Bakker43ca69c2011-01-15 17:35:19 +00007945 return( "TLSv1.1" );
7946
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007947 case MBEDTLS_SSL_MINOR_VERSION_3:
Paul Bakker1ef83d62012-04-11 12:09:53 +00007948 return( "TLSv1.2" );
7949
Paul Bakker43ca69c2011-01-15 17:35:19 +00007950 default:
Manuel Pégourié-Gonnardb21ca2a2014-02-10 13:43:33 +01007951 return( "unknown" );
Paul Bakker43ca69c2011-01-15 17:35:19 +00007952 }
Paul Bakker43ca69c2011-01-15 17:35:19 +00007953}
7954
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007955int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02007956{
Hanno Becker3136ede2018-08-17 15:28:19 +01007957 size_t transform_expansion = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007958 const mbedtls_ssl_transform *transform = ssl->transform_out;
Hanno Becker5b559ac2018-08-03 09:40:07 +01007959 unsigned block_size;
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02007960
Hanno Becker78640902018-08-13 16:35:15 +01007961 if( transform == NULL )
7962 return( (int) mbedtls_ssl_hdr_len( ssl ) );
7963
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007964#if defined(MBEDTLS_ZLIB_SUPPORT)
7965 if( ssl->session_out->compression != MBEDTLS_SSL_COMPRESS_NULL )
7966 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02007967#endif
7968
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007969 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) )
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02007970 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007971 case MBEDTLS_MODE_GCM:
7972 case MBEDTLS_MODE_CCM:
Hanno Becker5b559ac2018-08-03 09:40:07 +01007973 case MBEDTLS_MODE_CHACHAPOLY:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007974 case MBEDTLS_MODE_STREAM:
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02007975 transform_expansion = transform->minlen;
7976 break;
7977
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02007978 case MBEDTLS_MODE_CBC:
Hanno Becker5b559ac2018-08-03 09:40:07 +01007979
7980 block_size = mbedtls_cipher_get_block_size(
7981 &transform->cipher_ctx_enc );
7982
Hanno Becker3136ede2018-08-17 15:28:19 +01007983 /* Expansion due to the addition of the MAC. */
7984 transform_expansion += transform->maclen;
7985
7986 /* Expansion due to the addition of CBC padding;
7987 * Theoretically up to 256 bytes, but we never use
7988 * more than the block size of the underlying cipher. */
7989 transform_expansion += block_size;
7990
7991 /* For TLS 1.1 or higher, an explicit IV is added
7992 * after the record header. */
Hanno Becker5b559ac2018-08-03 09:40:07 +01007993#if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
7994 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
Hanno Becker3136ede2018-08-17 15:28:19 +01007995 transform_expansion += block_size;
Hanno Becker5b559ac2018-08-03 09:40:07 +01007996#endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
Hanno Becker3136ede2018-08-17 15:28:19 +01007997
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02007998 break;
7999
8000 default:
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02008001 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008002 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02008003 }
8004
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02008005 return( (int)( mbedtls_ssl_hdr_len( ssl ) + transform_expansion ) );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02008006}
8007
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02008008#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8009size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
8010{
8011 size_t max_len;
8012
8013 /*
8014 * Assume mfl_code is correct since it was checked when set
8015 */
Angus Grattond8213d02016-05-25 20:56:48 +10008016 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02008017
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02008018 /* Check if a smaller max length was negotiated */
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02008019 if( ssl->session_out != NULL &&
Angus Grattond8213d02016-05-25 20:56:48 +10008020 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len )
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02008021 {
Angus Grattond8213d02016-05-25 20:56:48 +10008022 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02008023 }
8024
Manuel Pégourié-Gonnard2cb17e22017-09-19 13:00:47 +02008025 /* During a handshake, use the value being negotiated */
8026 if( ssl->session_negotiate != NULL &&
8027 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len )
8028 {
8029 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
8030 }
8031
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008032 return( max_len );
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02008033}
8034#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
8035
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02008036#if defined(MBEDTLS_SSL_PROTO_DTLS)
8037static size_t ssl_get_current_mtu( const mbedtls_ssl_context *ssl )
8038{
Andrzej Kurekef43ce62018-10-09 08:24:12 -04008039 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
8040 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
8041 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO ||
8042 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) )
8043 return ( 0 );
8044
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02008045 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 )
8046 return( ssl->mtu );
8047
8048 if( ssl->mtu == 0 )
8049 return( ssl->handshake->mtu );
8050
8051 return( ssl->mtu < ssl->handshake->mtu ?
8052 ssl->mtu : ssl->handshake->mtu );
8053}
8054#endif /* MBEDTLS_SSL_PROTO_DTLS */
8055
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008056int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
8057{
8058 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
8059
Manuel Pégourié-Gonnard000281e2018-08-21 11:20:58 +02008060#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
8061 !defined(MBEDTLS_SSL_PROTO_DTLS)
8062 (void) ssl;
8063#endif
8064
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008065#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8066 const size_t mfl = mbedtls_ssl_get_max_frag_len( ssl );
8067
8068 if( max_len > mfl )
8069 max_len = mfl;
8070#endif
8071
8072#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02008073 if( ssl_get_current_mtu( ssl ) != 0 )
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008074 {
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02008075 const size_t mtu = ssl_get_current_mtu( ssl );
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008076 const int ret = mbedtls_ssl_get_record_expansion( ssl );
8077 const size_t overhead = (size_t) ret;
8078
8079 if( ret < 0 )
8080 return( ret );
8081
8082 if( mtu <= overhead )
8083 {
8084 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
8085 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
8086 }
8087
8088 if( max_len > mtu - overhead )
8089 max_len = mtu - overhead;
8090 }
Manuel Pégourié-Gonnardb8eec192018-08-20 09:34:02 +02008091#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008092
Hanno Becker0defedb2018-08-10 12:35:02 +01008093#if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
8094 !defined(MBEDTLS_SSL_PROTO_DTLS)
8095 ((void) ssl);
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008096#endif
8097
8098 return( (int) max_len );
8099}
8100
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008101#if defined(MBEDTLS_X509_CRT_PARSE_C)
8102const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
Paul Bakkerb0550d92012-10-30 07:51:03 +00008103{
8104 if( ssl == NULL || ssl->session == NULL )
Paul Bakkerd8bb8262014-06-17 14:06:49 +02008105 return( NULL );
Paul Bakkerb0550d92012-10-30 07:51:03 +00008106
Paul Bakkerd8bb8262014-06-17 14:06:49 +02008107 return( ssl->session->peer_cert );
Paul Bakkerb0550d92012-10-30 07:51:03 +00008108}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008109#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkerb0550d92012-10-30 07:51:03 +00008110
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008111#if defined(MBEDTLS_SSL_CLI_C)
8112int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl, mbedtls_ssl_session *dst )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02008113{
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02008114 if( ssl == NULL ||
8115 dst == NULL ||
8116 ssl->session == NULL ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008117 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02008118 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008119 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02008120 }
8121
Manuel Pégourié-Gonnard06650f62013-08-02 15:34:52 +02008122 return( ssl_session_copy( dst, ssl->session ) );
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02008123}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008124#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard74718032013-07-30 12:41:56 +02008125
Paul Bakker5121ce52009-01-03 21:22:43 +00008126/*
Paul Bakker1961b702013-01-25 14:49:24 +01008127 * Perform a single step of the SSL handshake
Paul Bakker5121ce52009-01-03 21:22:43 +00008128 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008129int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008130{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008131 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker5121ce52009-01-03 21:22:43 +00008132
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02008133 if( ssl == NULL || ssl->conf == NULL )
8134 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8135
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008136#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008137 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008138 ret = mbedtls_ssl_handshake_client_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00008139#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008140#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008141 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008142 ret = mbedtls_ssl_handshake_server_step( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00008143#endif
8144
Paul Bakker1961b702013-01-25 14:49:24 +01008145 return( ret );
8146}
8147
8148/*
8149 * Perform the SSL handshake
8150 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008151int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
Paul Bakker1961b702013-01-25 14:49:24 +01008152{
8153 int ret = 0;
8154
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02008155 if( ssl == NULL || ssl->conf == NULL )
8156 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008158 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
Paul Bakker1961b702013-01-25 14:49:24 +01008159
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008160 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker1961b702013-01-25 14:49:24 +01008161 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008162 ret = mbedtls_ssl_handshake_step( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01008163
8164 if( ret != 0 )
8165 break;
8166 }
8167
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008168 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008169
8170 return( ret );
8171}
8172
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008173#if defined(MBEDTLS_SSL_RENEGOTIATION)
8174#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00008175/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008176 * Write HelloRequest to request renegotiation on server
Paul Bakker48916f92012-09-16 19:57:18 +00008177 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008178static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008179{
8180 int ret;
8181
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008182 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008183
8184 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008185 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
8186 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008187
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008188 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008189 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02008190 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008191 return( ret );
8192 }
8193
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008194 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008195
8196 return( 0 );
8197}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008198#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008199
8200/*
8201 * Actually renegotiate current connection, triggered by either:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008202 * - any side: calling mbedtls_ssl_renegotiate(),
8203 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
8204 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
Manuel Pégourié-Gonnard55e4ff22014-08-19 11:16:35 +02008205 * the initial handshake is completed.
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008206 * If the handshake doesn't complete due to waiting for I/O, it will continue
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008207 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008208 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008209static int ssl_start_renegotiation( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00008210{
8211 int ret;
8212
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008213 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008214
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008215 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
8216 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00008217
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02008218 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
8219 * the ServerHello will have message_seq = 1" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008220#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008221 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008222 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02008223 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008224 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02008225 ssl->handshake->out_msg_seq = 1;
8226 else
8227 ssl->handshake->in_msg_seq = 1;
Manuel Pégourié-Gonnard0557bd52014-08-19 19:18:39 +02008228 }
8229#endif
8230
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008231 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
8232 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
Paul Bakker48916f92012-09-16 19:57:18 +00008233
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008234 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00008235 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008236 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker48916f92012-09-16 19:57:18 +00008237 return( ret );
8238 }
8239
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008240 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008241
8242 return( 0 );
8243}
8244
8245/*
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008246 * Renegotiate current connection on client,
8247 * or request renegotiation on server
8248 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008249int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008250{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008251 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008252
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02008253 if( ssl == NULL || ssl->conf == NULL )
8254 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8255
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008256#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008257 /* On server, just send the request */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008258 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008259 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008260 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
8261 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008262
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008263 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02008264
8265 /* Did we already try/start sending HelloRequest? */
8266 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008267 return( mbedtls_ssl_flush_output( ssl ) );
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02008268
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008269 return( ssl_write_hello_request( ssl ) );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008270 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008271#endif /* MBEDTLS_SSL_SRV_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008272
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008273#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008274 /*
8275 * On client, either start the renegotiation process or,
8276 * if already in progress, continue the handshake
8277 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008278 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008279 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008280 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
8281 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008282
8283 if( ( ret = ssl_start_renegotiation( ssl ) ) != 0 )
8284 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008285 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008286 return( ret );
8287 }
8288 }
8289 else
8290 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008291 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008292 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008293 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008294 return( ret );
8295 }
8296 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008297#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard9c1e1892013-10-30 16:41:21 +01008298
Paul Bakker37ce0ff2013-10-31 14:32:04 +01008299 return( ret );
Manuel Pégourié-Gonnard214eed32013-10-30 13:06:54 +01008300}
8301
8302/*
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008303 * Check record counters and renegotiate if they're above the limit.
8304 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008305static int ssl_check_ctr_renegotiate( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008306{
Andres AG2196c7f2016-12-15 17:01:16 +00008307 size_t ep_len = ssl_ep_len( ssl );
8308 int in_ctr_cmp;
8309 int out_ctr_cmp;
8310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008311 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ||
8312 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008313 ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008314 {
8315 return( 0 );
8316 }
8317
Andres AG2196c7f2016-12-15 17:01:16 +00008318 in_ctr_cmp = memcmp( ssl->in_ctr + ep_len,
8319 ssl->conf->renego_period + ep_len, 8 - ep_len );
Hanno Becker19859472018-08-06 09:40:20 +01008320 out_ctr_cmp = memcmp( ssl->cur_out_ctr + ep_len,
Andres AG2196c7f2016-12-15 17:01:16 +00008321 ssl->conf->renego_period + ep_len, 8 - ep_len );
8322
8323 if( in_ctr_cmp <= 0 && out_ctr_cmp <= 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008324 {
8325 return( 0 );
8326 }
8327
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02008328 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008329 return( mbedtls_ssl_renegotiate( ssl ) );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008330}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008331#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker5121ce52009-01-03 21:22:43 +00008332
8333/*
8334 * Receive application data decrypted from the SSL layer
8335 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008336int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +00008337{
Hanno Becker4a810fb2017-05-24 16:27:30 +01008338 int ret;
Paul Bakker23986e52011-04-24 08:57:21 +00008339 size_t n;
Paul Bakker5121ce52009-01-03 21:22:43 +00008340
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02008341 if( ssl == NULL || ssl->conf == NULL )
8342 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8343
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008344 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008345
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008346#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008347 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008348 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008349 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008350 return( ret );
8351
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02008352 if( ssl->handshake != NULL &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008353 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02008354 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02008355 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02008356 return( ret );
8357 }
Manuel Pégourié-Gonnardabf16242014-09-23 09:42:16 +02008358 }
8359#endif
8360
Hanno Becker4a810fb2017-05-24 16:27:30 +01008361 /*
8362 * Check if renegotiation is necessary and/or handshake is
8363 * in process. If yes, perform/continue, and fall through
8364 * if an unexpected packet is received while the client
8365 * is waiting for the ServerHello.
8366 *
8367 * (There is no equivalent to the last condition on
8368 * the server-side as it is not treated as within
8369 * a handshake while waiting for the ClientHello
8370 * after a renegotiation request.)
8371 */
8372
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008373#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +01008374 ret = ssl_check_ctr_renegotiate( ssl );
8375 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
8376 ret != 0 )
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008377 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008378 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnardb4458052014-11-04 21:04:22 +01008379 return( ret );
8380 }
8381#endif
8382
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008383 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00008384 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008385 ret = mbedtls_ssl_handshake( ssl );
Hanno Becker4a810fb2017-05-24 16:27:30 +01008386 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
8387 ret != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008388 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008389 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008390 return( ret );
8391 }
8392 }
8393
Hanno Beckere41158b2017-10-23 13:30:32 +01008394 /* Loop as long as no application data record is available */
Hanno Becker90333da2017-10-10 11:27:13 +01008395 while( ssl->in_offt == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00008396 {
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02008397 /* Start timer if not already running */
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +02008398 if( ssl->f_get_timer != NULL &&
8399 ssl->f_get_timer( ssl->p_timer ) == -1 )
8400 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008401 ssl_set_timer( ssl, ssl->conf->read_timeout );
Manuel Pégourié-Gonnard545102e2015-05-13 17:28:43 +02008402 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02008403
Hanno Becker327c93b2018-08-15 13:56:18 +01008404 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008405 {
Hanno Becker4a810fb2017-05-24 16:27:30 +01008406 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
8407 return( 0 );
Paul Bakker831a7552011-05-18 13:32:51 +00008408
Hanno Becker4a810fb2017-05-24 16:27:30 +01008409 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
8410 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008411 }
8412
8413 if( ssl->in_msglen == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008414 ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +00008415 {
8416 /*
8417 * OpenSSL sends empty messages to randomize the IV
8418 */
Hanno Becker327c93b2018-08-15 13:56:18 +01008419 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008420 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008421 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
Paul Bakker831a7552011-05-18 13:32:51 +00008422 return( 0 );
8423
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008424 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008425 return( ret );
8426 }
8427 }
8428
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008429 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker48916f92012-09-16 19:57:18 +00008430 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008431 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received handshake message" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008432
Hanno Becker4a810fb2017-05-24 16:27:30 +01008433 /*
8434 * - For client-side, expect SERVER_HELLO_REQUEST.
8435 * - For server-side, expect CLIENT_HELLO.
8436 * - Fail (TLS) or silently drop record (DTLS) in other cases.
8437 */
8438
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008439#if defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008440 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008441 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST ||
Hanno Becker4a810fb2017-05-24 16:27:30 +01008442 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ) )
Paul Bakker48916f92012-09-16 19:57:18 +00008443 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008444 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008445
8446 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008447#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008448 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Hanno Becker90333da2017-10-10 11:27:13 +01008449 {
8450 continue;
8451 }
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008452#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008453 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008454 }
Hanno Becker4a810fb2017-05-24 16:27:30 +01008455#endif /* MBEDTLS_SSL_CLI_C */
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008456
Hanno Becker4a810fb2017-05-24 16:27:30 +01008457#if defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008458 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008459 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008460 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008461 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008462
8463 /* With DTLS, drop the packet (probably from last handshake) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008464#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008465 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Hanno Becker90333da2017-10-10 11:27:13 +01008466 {
8467 continue;
8468 }
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02008469#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008470 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker48916f92012-09-16 19:57:18 +00008471 }
Hanno Becker4a810fb2017-05-24 16:27:30 +01008472#endif /* MBEDTLS_SSL_SRV_C */
8473
Hanno Becker21df7f92017-10-17 11:03:26 +01008474#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker4a810fb2017-05-24 16:27:30 +01008475 /* Determine whether renegotiation attempt should be accepted */
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +01008476 if( ! ( ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
8477 ( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
8478 ssl->conf->allow_legacy_renegotiation ==
8479 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) ) )
8480 {
8481 /*
8482 * Accept renegotiation request
8483 */
Paul Bakker48916f92012-09-16 19:57:18 +00008484
Hanno Beckerb4ff0aa2017-10-17 11:03:04 +01008485 /* DTLS clients need to know renego is server-initiated */
8486#if defined(MBEDTLS_SSL_PROTO_DTLS)
8487 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
8488 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
8489 {
8490 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
8491 }
8492#endif
8493 ret = ssl_start_renegotiation( ssl );
8494 if( ret != MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO &&
8495 ret != 0 )
8496 {
8497 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
8498 return( ret );
8499 }
8500 }
8501 else
Hanno Becker21df7f92017-10-17 11:03:26 +01008502#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +00008503 {
Hanno Becker4a810fb2017-05-24 16:27:30 +01008504 /*
8505 * Refuse renegotiation
8506 */
8507
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008508 MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008509
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008510#if defined(MBEDTLS_SSL_PROTO_SSL3)
8511 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker48916f92012-09-16 19:57:18 +00008512 {
Gilles Peskine92e44262017-05-10 17:27:49 +02008513 /* SSLv3 does not have a "no_renegotiation" warning, so
8514 we send a fatal alert and abort the connection. */
8515 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
8516 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
8517 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00008518 }
8519 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008520#endif /* MBEDTLS_SSL_PROTO_SSL3 */
8521#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
8522 defined(MBEDTLS_SSL_PROTO_TLS1_2)
8523 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00008524 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008525 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
8526 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
8527 MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00008528 {
8529 return( ret );
8530 }
Paul Bakker48916f92012-09-16 19:57:18 +00008531 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02008532 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008533#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 ||
8534 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02008535 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008536 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
8537 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02008538 }
Paul Bakker48916f92012-09-16 19:57:18 +00008539 }
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02008540
Hanno Becker90333da2017-10-10 11:27:13 +01008541 /* At this point, we don't know whether the renegotiation has been
8542 * completed or not. The cases to consider are the following:
8543 * 1) The renegotiation is complete. In this case, no new record
8544 * has been read yet.
8545 * 2) The renegotiation is incomplete because the client received
8546 * an application data record while awaiting the ServerHello.
8547 * 3) The renegotiation is incomplete because the client received
8548 * a non-handshake, non-application data message while awaiting
8549 * the ServerHello.
8550 * In each of these case, looping will be the proper action:
8551 * - For 1), the next iteration will read a new record and check
8552 * if it's application data.
8553 * - For 2), the loop condition isn't satisfied as application data
8554 * is present, hence continue is the same as break
8555 * - For 3), the loop condition is satisfied and read_record
8556 * will re-deliver the message that was held back by the client
8557 * when expecting the ServerHello.
8558 */
8559 continue;
Paul Bakker48916f92012-09-16 19:57:18 +00008560 }
Hanno Becker21df7f92017-10-17 11:03:26 +01008561#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008562 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +01008563 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008564 if( ssl->conf->renego_max_records >= 0 )
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02008565 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008566 if( ++ssl->renego_records_seen > ssl->conf->renego_max_records )
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02008567 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008568 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02008569 "but not honored by client" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008570 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02008571 }
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02008572 }
Manuel Pégourié-Gonnard6d8404d2013-10-30 16:41:45 +01008573 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008574#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02008575
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008576 /* Fatal and closure alerts handled by mbedtls_ssl_read_record() */
8577 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02008578 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008579 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01008580 return( MBEDTLS_ERR_SSL_WANT_READ );
Manuel Pégourié-Gonnardf26a1e82014-08-19 12:28:50 +02008581 }
8582
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008583 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
Paul Bakker5121ce52009-01-03 21:22:43 +00008584 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008585 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
8586 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00008587 }
8588
8589 ssl->in_offt = ssl->in_msg;
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +02008590
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02008591 /* We're going to return something now, cancel timer,
8592 * except if handshake (renegotiation) is in progress */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008593 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02008594 ssl_set_timer( ssl, 0 );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02008595
Manuel Pégourié-Gonnard286a1362015-05-13 16:22:05 +02008596#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02008597 /* If we requested renego but received AppData, resend HelloRequest.
8598 * Do it now, after setting in_offt, to avoid taking this branch
8599 * again if ssl_write_hello_request() returns WANT_WRITE */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008600#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008601 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008602 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02008603 {
Manuel Pégourié-Gonnarddf3acd82014-10-15 15:07:45 +02008604 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02008605 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008606 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
Manuel Pégourié-Gonnard26a4cf62014-10-15 13:52:48 +02008607 return( ret );
8608 }
8609 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008610#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
Hanno Becker4a810fb2017-05-24 16:27:30 +01008611#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker5121ce52009-01-03 21:22:43 +00008612 }
8613
8614 n = ( len < ssl->in_msglen )
8615 ? len : ssl->in_msglen;
8616
8617 memcpy( buf, ssl->in_offt, n );
8618 ssl->in_msglen -= n;
8619
8620 if( ssl->in_msglen == 0 )
Hanno Becker4a810fb2017-05-24 16:27:30 +01008621 {
8622 /* all bytes consumed */
Paul Bakker5121ce52009-01-03 21:22:43 +00008623 ssl->in_offt = NULL;
Hanno Beckerbdf39052017-06-09 10:42:03 +01008624 ssl->keep_current_message = 0;
Hanno Becker4a810fb2017-05-24 16:27:30 +01008625 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008626 else
Hanno Becker4a810fb2017-05-24 16:27:30 +01008627 {
Paul Bakker5121ce52009-01-03 21:22:43 +00008628 /* more data available */
8629 ssl->in_offt += n;
Hanno Becker4a810fb2017-05-24 16:27:30 +01008630 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008631
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008632 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008633
Paul Bakker23986e52011-04-24 08:57:21 +00008634 return( (int) n );
Paul Bakker5121ce52009-01-03 21:22:43 +00008635}
8636
8637/*
Andres Amaya Garcia5b923522017-09-28 14:41:17 +01008638 * Send application data to be encrypted by the SSL layer, taking care of max
8639 * fragment length and buffer size.
8640 *
8641 * According to RFC 5246 Section 6.2.1:
8642 *
8643 * Zero-length fragments of Application data MAY be sent as they are
8644 * potentially useful as a traffic analysis countermeasure.
8645 *
8646 * Therefore, it is possible that the input message length is 0 and the
8647 * corresponding return code is 0 on success.
Paul Bakker5121ce52009-01-03 21:22:43 +00008648 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02008649static int ssl_write_real( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02008650 const unsigned char *buf, size_t len )
Paul Bakker5121ce52009-01-03 21:22:43 +00008651{
Manuel Pégourié-Gonnard9468ff12017-09-21 13:49:50 +02008652 int ret = mbedtls_ssl_get_max_out_record_payload( ssl );
8653 const size_t max_len = (size_t) ret;
8654
8655 if( ret < 0 )
8656 {
8657 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_max_out_record_payload", ret );
8658 return( ret );
8659 }
8660
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02008661 if( len > max_len )
8662 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008663#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02008664 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02008665 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008666 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02008667 "maximum fragment length: %d > %d",
8668 len, max_len ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008669 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02008670 }
8671 else
8672#endif
8673 len = max_len;
8674 }
Paul Bakker887bd502011-06-08 13:10:54 +00008675
Paul Bakker5121ce52009-01-03 21:22:43 +00008676 if( ssl->out_left != 0 )
8677 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +01008678 /*
8679 * The user has previously tried to send the data and
8680 * MBEDTLS_ERR_SSL_WANT_WRITE or the message was only partially
8681 * written. In this case, we expect the high-level write function
8682 * (e.g. mbedtls_ssl_write()) to be called with the same parameters
8683 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008684 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008685 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008686 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008687 return( ret );
8688 }
8689 }
Paul Bakker887bd502011-06-08 13:10:54 +00008690 else
Paul Bakker1fd00bf2011-03-14 20:50:15 +00008691 {
Andres Amaya Garcia5b923522017-09-28 14:41:17 +01008692 /*
8693 * The user is trying to send a message the first time, so we need to
8694 * copy the data into the internal buffers and setup the data structure
8695 * to keep track of partial writes
8696 */
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02008697 ssl->out_msglen = len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008698 ssl->out_msgtype = MBEDTLS_SSL_MSG_APPLICATION_DATA;
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02008699 memcpy( ssl->out_msg, buf, len );
Paul Bakker887bd502011-06-08 13:10:54 +00008700
Hanno Becker67bc7c32018-08-06 11:33:50 +01008701 if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
Paul Bakker887bd502011-06-08 13:10:54 +00008702 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008703 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker887bd502011-06-08 13:10:54 +00008704 return( ret );
8705 }
Paul Bakker5121ce52009-01-03 21:22:43 +00008706 }
8707
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02008708 return( (int) len );
Paul Bakker5121ce52009-01-03 21:22:43 +00008709}
8710
8711/*
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01008712 * Write application data, doing 1/n-1 splitting if necessary.
8713 *
8714 * With non-blocking I/O, ssl_write_real() may return WANT_WRITE,
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01008715 * then the caller will call us again with the same arguments, so
Hanno Becker2b187c42017-09-18 14:58:11 +01008716 * remember whether we already did the split or not.
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01008717 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008718#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02008719static int ssl_write_split( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02008720 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01008721{
8722 int ret;
8723
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01008724 if( ssl->conf->cbc_record_splitting ==
8725 MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED ||
Manuel Pégourié-Gonnardcfa477e2015-01-07 14:50:54 +01008726 len <= 1 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008727 ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_1 ||
8728 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc )
8729 != MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01008730 {
8731 return( ssl_write_real( ssl, buf, len ) );
8732 }
8733
8734 if( ssl->split_done == 0 )
8735 {
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +01008736 if( ( ret = ssl_write_real( ssl, buf, 1 ) ) <= 0 )
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01008737 return( ret );
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +01008738 ssl->split_done = 1;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01008739 }
8740
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +01008741 if( ( ret = ssl_write_real( ssl, buf + 1, len - 1 ) ) <= 0 )
8742 return( ret );
8743 ssl->split_done = 0;
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01008744
8745 return( ret + 1 );
8746}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008747#endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */
Manuel Pégourié-Gonnardd76314c2015-01-07 12:39:44 +01008748
8749/*
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02008750 * Write application data (public-facing wrapper)
8751 */
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02008752int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02008753{
8754 int ret;
8755
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02008756 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02008757
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02008758 if( ssl == NULL || ssl->conf == NULL )
8759 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8760
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02008761#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02008762 if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
8763 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02008764 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02008765 return( ret );
8766 }
8767#endif
8768
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02008769 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02008770 {
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02008771 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02008772 {
Manuel Pégourié-Gonnard151dc772015-05-14 13:55:51 +02008773 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02008774 return( ret );
8775 }
8776 }
8777
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02008778#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02008779 ret = ssl_write_split( ssl, buf, len );
8780#else
8781 ret = ssl_write_real( ssl, buf, len );
8782#endif
8783
Manuel Pégourié-Gonnard144bc222015-04-17 20:39:07 +02008784 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) );
Manuel Pégourié-Gonnarda2fce212015-04-15 19:09:03 +02008785
8786 return( ret );
8787}
8788
8789/*
Paul Bakker5121ce52009-01-03 21:22:43 +00008790 * Notify the peer that the connection is being closed
8791 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008792int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00008793{
8794 int ret;
8795
Manuel Pégourié-Gonnardf81ee2e2015-09-01 17:43:40 +02008796 if( ssl == NULL || ssl->conf == NULL )
8797 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
8798
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008799 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008800
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +02008801 if( ssl->out_left != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008802 return( mbedtls_ssl_flush_output( ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008803
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008804 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
Paul Bakker5121ce52009-01-03 21:22:43 +00008805 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008806 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
8807 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
8808 MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00008809 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008810 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00008811 return( ret );
8812 }
8813 }
8814
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008815 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00008816
Manuel Pégourié-Gonnarda13500f2014-08-19 16:14:04 +02008817 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00008818}
8819
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008820void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform )
Paul Bakker48916f92012-09-16 19:57:18 +00008821{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008822 if( transform == NULL )
8823 return;
8824
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008825#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker48916f92012-09-16 19:57:18 +00008826 deflateEnd( &transform->ctx_deflate );
8827 inflateEnd( &transform->ctx_inflate );
8828#endif
8829
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008830 mbedtls_cipher_free( &transform->cipher_ctx_enc );
8831 mbedtls_cipher_free( &transform->cipher_ctx_dec );
Manuel Pégourié-Gonnardf71e5872013-09-23 17:12:43 +02008832
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008833 mbedtls_md_free( &transform->md_ctx_enc );
8834 mbedtls_md_free( &transform->md_ctx_dec );
Paul Bakker61d113b2013-07-04 11:51:43 +02008835
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05008836 mbedtls_platform_zeroize( transform, sizeof( mbedtls_ssl_transform ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008837}
8838
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008839#if defined(MBEDTLS_X509_CRT_PARSE_C)
8840static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02008841{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008842 mbedtls_ssl_key_cert *cur = key_cert, *next;
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02008843
8844 while( cur != NULL )
8845 {
8846 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008847 mbedtls_free( cur );
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02008848 cur = next;
8849 }
8850}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008851#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02008852
Hanno Becker0271f962018-08-16 13:23:47 +01008853#if defined(MBEDTLS_SSL_PROTO_DTLS)
8854
8855static void ssl_buffering_free( mbedtls_ssl_context *ssl )
8856{
8857 unsigned offset;
8858 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
8859
8860 if( hs == NULL )
8861 return;
8862
Hanno Becker283f5ef2018-08-24 09:34:47 +01008863 ssl_free_buffered_record( ssl );
8864
Hanno Becker0271f962018-08-16 13:23:47 +01008865 for( offset = 0; offset < MBEDTLS_SSL_MAX_BUFFERED_HS; offset++ )
Hanno Beckere605b192018-08-21 15:59:07 +01008866 ssl_buffering_free_slot( ssl, offset );
8867}
8868
8869static void ssl_buffering_free_slot( mbedtls_ssl_context *ssl,
8870 uint8_t slot )
8871{
8872 mbedtls_ssl_handshake_params * const hs = ssl->handshake;
8873 mbedtls_ssl_hs_buffer * const hs_buf = &hs->buffering.hs[slot];
Hanno Beckerb309b922018-08-23 13:18:05 +01008874
8875 if( slot >= MBEDTLS_SSL_MAX_BUFFERED_HS )
8876 return;
8877
Hanno Beckere605b192018-08-21 15:59:07 +01008878 if( hs_buf->is_valid == 1 )
Hanno Becker0271f962018-08-16 13:23:47 +01008879 {
Hanno Beckere605b192018-08-21 15:59:07 +01008880 hs->buffering.total_bytes_buffered -= hs_buf->data_len;
Hanno Becker805f2e12018-10-12 16:31:41 +01008881 mbedtls_platform_zeroize( hs_buf->data, hs_buf->data_len );
Hanno Beckere605b192018-08-21 15:59:07 +01008882 mbedtls_free( hs_buf->data );
8883 memset( hs_buf, 0, sizeof( mbedtls_ssl_hs_buffer ) );
Hanno Becker0271f962018-08-16 13:23:47 +01008884 }
8885}
8886
8887#endif /* MBEDTLS_SSL_PROTO_DTLS */
8888
Gilles Peskine9b562d52018-04-25 20:32:43 +02008889void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
Paul Bakker48916f92012-09-16 19:57:18 +00008890{
Gilles Peskine9b562d52018-04-25 20:32:43 +02008891 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
8892
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008893 if( handshake == NULL )
8894 return;
8895
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02008896#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
8897 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 )
8898 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02008899 ssl->conf->f_async_cancel( ssl );
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02008900 handshake->async_in_progress = 0;
8901 }
8902#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
8903
Manuel Pégourié-Gonnardb9d64e52015-07-06 14:18:56 +02008904#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
8905 defined(MBEDTLS_SSL_PROTO_TLS1_1)
8906 mbedtls_md5_free( &handshake->fin_md5 );
8907 mbedtls_sha1_free( &handshake->fin_sha1 );
8908#endif
8909#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
8910#if defined(MBEDTLS_SHA256_C)
8911 mbedtls_sha256_free( &handshake->fin_sha256 );
8912#endif
8913#if defined(MBEDTLS_SHA512_C)
8914 mbedtls_sha512_free( &handshake->fin_sha512 );
8915#endif
8916#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
8917
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008918#if defined(MBEDTLS_DHM_C)
8919 mbedtls_dhm_free( &handshake->dhm_ctx );
Paul Bakker48916f92012-09-16 19:57:18 +00008920#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008921#if defined(MBEDTLS_ECDH_C)
8922 mbedtls_ecdh_free( &handshake->ecdh_ctx );
Paul Bakker61d113b2013-07-04 11:51:43 +02008923#endif
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02008924#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02008925 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
Manuel Pégourié-Gonnard77c06462015-09-17 13:59:49 +02008926#if defined(MBEDTLS_SSL_CLI_C)
8927 mbedtls_free( handshake->ecjpake_cache );
8928 handshake->ecjpake_cache = NULL;
8929 handshake->ecjpake_cache_len = 0;
8930#endif
Manuel Pégourié-Gonnard76cfd3f2015-09-15 12:10:54 +02008931#endif
Paul Bakker61d113b2013-07-04 11:51:43 +02008932
Janos Follath4ae5c292016-02-10 11:27:43 +00008933#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
8934 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Paul Bakker9af723c2014-05-01 13:03:14 +02008935 /* explicit void pointer cast for buggy MS compiler */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008936 mbedtls_free( (void *) handshake->curves );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02008937#endif
8938
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01008939#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
8940 if( handshake->psk != NULL )
8941 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05008942 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len );
Manuel Pégourié-Gonnard4b682962015-05-07 15:59:54 +01008943 mbedtls_free( handshake->psk );
8944 }
8945#endif
8946
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008947#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
8948 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02008949 /*
8950 * Free only the linked list wrapper, not the keys themselves
8951 * since the belong to the SNI callback
8952 */
8953 if( handshake->sni_key_cert != NULL )
8954 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008955 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02008956
8957 while( cur != NULL )
8958 {
8959 next = cur->next;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008960 mbedtls_free( cur );
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +02008961 cur = next;
8962 }
8963 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008964#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +02008965
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02008966#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
Manuel Pégourié-Gonnard6b7301c2017-08-15 12:08:45 +02008967 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx );
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02008968#endif
8969
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008970#if defined(MBEDTLS_SSL_PROTO_DTLS)
8971 mbedtls_free( handshake->verify_cookie );
Manuel Pégourié-Gonnardffa67be2014-09-19 11:18:57 +02008972 ssl_flight_free( handshake->flight );
Hanno Becker0271f962018-08-16 13:23:47 +01008973 ssl_buffering_free( ssl );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02008974#endif
8975
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05008976 mbedtls_platform_zeroize( handshake,
8977 sizeof( mbedtls_ssl_handshake_params ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008978}
8979
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008980void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
Paul Bakker48916f92012-09-16 19:57:18 +00008981{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02008982 if( session == NULL )
8983 return;
8984
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008985#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker0a597072012-09-25 21:55:46 +00008986 if( session->peer_cert != NULL )
Paul Bakker48916f92012-09-16 19:57:18 +00008987 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008988 mbedtls_x509_crt_free( session->peer_cert );
8989 mbedtls_free( session->peer_cert );
Paul Bakker48916f92012-09-16 19:57:18 +00008990 }
Paul Bakkered27a042013-04-18 22:46:23 +02008991#endif
Paul Bakker0a597072012-09-25 21:55:46 +00008992
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02008993#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02008994 mbedtls_free( session->ticket );
Paul Bakkera503a632013-08-14 13:48:06 +02008995#endif
Manuel Pégourié-Gonnard75d44012013-08-02 14:44:04 +02008996
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05008997 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) );
Paul Bakker48916f92012-09-16 19:57:18 +00008998}
8999
Paul Bakker5121ce52009-01-03 21:22:43 +00009000/*
9001 * Free an SSL context
9002 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009003void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00009004{
Paul Bakkeraccaffe2014-06-26 13:37:14 +02009005 if( ssl == NULL )
9006 return;
9007
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009008 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00009009
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01009010 if( ssl->out_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00009011 {
Angus Grattond8213d02016-05-25 20:56:48 +10009012 mbedtls_platform_zeroize( ssl->out_buf, MBEDTLS_SSL_OUT_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009013 mbedtls_free( ssl->out_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00009014 }
9015
Manuel Pégourié-Gonnard7ee6f0e2014-02-13 10:54:07 +01009016 if( ssl->in_buf != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00009017 {
Angus Grattond8213d02016-05-25 20:56:48 +10009018 mbedtls_platform_zeroize( ssl->in_buf, MBEDTLS_SSL_IN_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009019 mbedtls_free( ssl->in_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00009020 }
9021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009022#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakker16770332013-10-11 09:59:44 +02009023 if( ssl->compress_buf != NULL )
9024 {
Angus Grattond8213d02016-05-25 20:56:48 +10009025 mbedtls_platform_zeroize( ssl->compress_buf, MBEDTLS_SSL_COMPRESS_BUFFER_LEN );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009026 mbedtls_free( ssl->compress_buf );
Paul Bakker16770332013-10-11 09:59:44 +02009027 }
9028#endif
9029
Paul Bakker48916f92012-09-16 19:57:18 +00009030 if( ssl->transform )
9031 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009032 mbedtls_ssl_transform_free( ssl->transform );
9033 mbedtls_free( ssl->transform );
Paul Bakker48916f92012-09-16 19:57:18 +00009034 }
9035
9036 if( ssl->handshake )
9037 {
Gilles Peskine9b562d52018-04-25 20:32:43 +02009038 mbedtls_ssl_handshake_free( ssl );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009039 mbedtls_ssl_transform_free( ssl->transform_negotiate );
9040 mbedtls_ssl_session_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00009041
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009042 mbedtls_free( ssl->handshake );
9043 mbedtls_free( ssl->transform_negotiate );
9044 mbedtls_free( ssl->session_negotiate );
Paul Bakker48916f92012-09-16 19:57:18 +00009045 }
9046
Paul Bakkerc0463502013-02-14 11:19:38 +01009047 if( ssl->session )
9048 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009049 mbedtls_ssl_session_free( ssl->session );
9050 mbedtls_free( ssl->session );
Paul Bakkerc0463502013-02-14 11:19:38 +01009051 }
9052
Manuel Pégourié-Gonnard55fab2d2015-05-11 16:15:19 +02009053#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker66d5d072014-06-17 16:39:18 +02009054 if( ssl->hostname != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00009055 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009056 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009057 mbedtls_free( ssl->hostname );
Paul Bakker5121ce52009-01-03 21:22:43 +00009058 }
Paul Bakker0be444a2013-08-27 21:55:01 +02009059#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00009060
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009061#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
9062 if( mbedtls_ssl_hw_record_finish != NULL )
Paul Bakker05ef8352012-05-08 09:17:57 +00009063 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009064 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) );
9065 mbedtls_ssl_hw_record_finish( ssl );
Paul Bakker05ef8352012-05-08 09:17:57 +00009066 }
9067#endif
9068
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02009069#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009070 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +02009071#endif
9072
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009073 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
Paul Bakker2da561c2009-02-05 18:00:28 +00009074
Paul Bakker86f04f42013-02-14 11:20:09 +01009075 /* Actually clear after last debug message */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009076 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00009077}
9078
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009079/*
9080 * Initialze mbedtls_ssl_config
9081 */
9082void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
9083{
9084 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
9085}
9086
Simon Butcherc97b6972015-12-27 23:48:17 +00009087#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01009088static int ssl_preset_default_hashes[] = {
9089#if defined(MBEDTLS_SHA512_C)
9090 MBEDTLS_MD_SHA512,
9091 MBEDTLS_MD_SHA384,
9092#endif
9093#if defined(MBEDTLS_SHA256_C)
9094 MBEDTLS_MD_SHA256,
9095 MBEDTLS_MD_SHA224,
9096#endif
Gilles Peskine5d2511c2017-05-12 13:16:40 +02009097#if defined(MBEDTLS_SHA1_C) && defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01009098 MBEDTLS_MD_SHA1,
9099#endif
9100 MBEDTLS_MD_NONE
9101};
Simon Butcherc97b6972015-12-27 23:48:17 +00009102#endif
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01009103
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009104static int ssl_preset_suiteb_ciphersuites[] = {
9105 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
9106 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
9107 0
9108};
9109
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009110#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009111static int ssl_preset_suiteb_hashes[] = {
9112 MBEDTLS_MD_SHA256,
9113 MBEDTLS_MD_SHA384,
9114 MBEDTLS_MD_NONE
9115};
9116#endif
9117
9118#if defined(MBEDTLS_ECP_C)
9119static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = {
Jaeden Amero16529b22019-06-03 08:27:16 +01009120#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009121 MBEDTLS_ECP_DP_SECP256R1,
Jaeden Amero16529b22019-06-03 08:27:16 +01009122#endif
9123#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009124 MBEDTLS_ECP_DP_SECP384R1,
Jaeden Amero16529b22019-06-03 08:27:16 +01009125#endif
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009126 MBEDTLS_ECP_DP_NONE
9127};
9128#endif
9129
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009130/*
Tillmann Karras588ad502015-09-25 04:27:22 +02009131 * Load default in mbedtls_ssl_config
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009132 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02009133int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009134 int endpoint, int transport, int preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009135{
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02009136#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009137 int ret;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02009138#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009139
Manuel Pégourié-Gonnard0de074f2015-05-14 12:58:01 +02009140 /* Use the functions here so that they are covered in tests,
9141 * but otherwise access member directly for efficiency */
9142 mbedtls_ssl_conf_endpoint( conf, endpoint );
9143 mbedtls_ssl_conf_transport( conf, transport );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009144
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009145 /*
9146 * Things that are common to all presets
9147 */
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02009148#if defined(MBEDTLS_SSL_CLI_C)
9149 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
9150 {
9151 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
9152#if defined(MBEDTLS_SSL_SESSION_TICKETS)
9153 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
9154#endif
9155 }
9156#endif
9157
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009158#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009159 conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED;
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02009160#endif
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009161
9162#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
9163 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
9164#endif
9165
9166#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
9167 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
9168#endif
9169
Manuel Pégourié-Gonnard17eab2b2015-05-05 16:34:53 +01009170#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
9171 conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED;
9172#endif
9173
Manuel Pégourié-Gonnarde057d3b2015-05-20 10:59:43 +02009174#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009175 conf->f_cookie_write = ssl_cookie_write_dummy;
9176 conf->f_cookie_check = ssl_cookie_check_dummy;
9177#endif
9178
9179#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
9180 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
9181#endif
9182
Janos Follath088ce432017-04-10 12:42:31 +01009183#if defined(MBEDTLS_SSL_SRV_C)
9184 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
9185#endif
9186
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009187#if defined(MBEDTLS_SSL_PROTO_DTLS)
9188 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
9189 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
9190#endif
9191
9192#if defined(MBEDTLS_SSL_RENEGOTIATION)
9193 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
Andres AG2196c7f2016-12-15 17:01:16 +00009194 memset( conf->renego_period, 0x00, 2 );
9195 memset( conf->renego_period + 2, 0xFF, 6 );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009196#endif
9197
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009198#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
9199 if( endpoint == MBEDTLS_SSL_IS_SERVER )
9200 {
Hanno Becker00d0a682017-10-04 13:14:29 +01009201 const unsigned char dhm_p[] =
9202 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
9203 const unsigned char dhm_g[] =
9204 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
9205
Hanno Beckera90658f2017-10-04 15:29:08 +01009206 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf,
9207 dhm_p, sizeof( dhm_p ),
9208 dhm_g, sizeof( dhm_g ) ) ) != 0 )
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009209 {
9210 return( ret );
9211 }
9212 }
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02009213#endif
9214
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009215 /*
9216 * Preset-specific defaults
9217 */
9218 switch( preset )
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009219 {
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009220 /*
9221 * NSA Suite B
9222 */
9223 case MBEDTLS_SSL_PRESET_SUITEB:
9224 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
9225 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
9226 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
9227 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
9228
9229 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
9230 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
9231 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
9232 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
9233 ssl_preset_suiteb_ciphersuites;
9234
9235#if defined(MBEDTLS_X509_CRT_PARSE_C)
9236 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009237#endif
9238
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009239#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009240 conf->sig_hashes = ssl_preset_suiteb_hashes;
9241#endif
9242
9243#if defined(MBEDTLS_ECP_C)
9244 conf->curve_list = ssl_preset_suiteb_curves;
9245#endif
Manuel Pégourié-Gonnardc98204e2015-08-11 04:21:01 +02009246 break;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009247
9248 /*
9249 * Default
9250 */
9251 default:
Ron Eldor5e9f14d2017-05-28 10:46:38 +03009252 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION >
9253 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ?
9254 MBEDTLS_SSL_MIN_MAJOR_VERSION :
9255 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION;
9256 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION >
9257 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ?
9258 MBEDTLS_SSL_MIN_MINOR_VERSION :
9259 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009260 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
9261 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
9262
9263#if defined(MBEDTLS_SSL_PROTO_DTLS)
9264 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
9265 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
9266#endif
9267
9268 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
9269 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
9270 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
9271 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
9272 mbedtls_ssl_list_ciphersuites();
9273
9274#if defined(MBEDTLS_X509_CRT_PARSE_C)
9275 conf->cert_profile = &mbedtls_x509_crt_profile_default;
9276#endif
9277
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009278#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard47229c72015-12-04 15:02:56 +01009279 conf->sig_hashes = ssl_preset_default_hashes;
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02009280#endif
9281
9282#if defined(MBEDTLS_ECP_C)
9283 conf->curve_list = mbedtls_ecp_grp_id_list();
9284#endif
9285
9286#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
9287 conf->dhm_min_bitlen = 1024;
9288#endif
9289 }
9290
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009291 return( 0 );
9292}
9293
9294/*
9295 * Free mbedtls_ssl_config
9296 */
9297void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
9298{
9299#if defined(MBEDTLS_DHM_C)
9300 mbedtls_mpi_free( &conf->dhm_P );
9301 mbedtls_mpi_free( &conf->dhm_G );
9302#endif
9303
9304#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
9305 if( conf->psk != NULL )
9306 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009307 mbedtls_platform_zeroize( conf->psk, conf->psk_len );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009308 mbedtls_free( conf->psk );
Azim Khan27e8a122018-03-21 14:24:11 +00009309 conf->psk = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009310 conf->psk_len = 0;
junyeonLEE316b1622017-12-20 16:29:30 +09009311 }
9312
9313 if( conf->psk_identity != NULL )
9314 {
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009315 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len );
junyeonLEE316b1622017-12-20 16:29:30 +09009316 mbedtls_free( conf->psk_identity );
Azim Khan27e8a122018-03-21 14:24:11 +00009317 conf->psk_identity = NULL;
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009318 conf->psk_identity_len = 0;
9319 }
9320#endif
9321
9322#if defined(MBEDTLS_X509_CRT_PARSE_C)
9323 ssl_key_cert_free( conf->key_cert );
9324#endif
9325
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05009326 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) );
Manuel Pégourié-Gonnardcd523e22015-05-04 13:35:39 +02009327}
9328
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02009329#if defined(MBEDTLS_PK_C) && \
9330 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02009331/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009332 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02009333 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009334unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02009335{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009336#if defined(MBEDTLS_RSA_C)
9337 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
9338 return( MBEDTLS_SSL_SIG_RSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02009339#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009340#if defined(MBEDTLS_ECDSA_C)
9341 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
9342 return( MBEDTLS_SSL_SIG_ECDSA );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02009343#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009344 return( MBEDTLS_SSL_SIG_ANON );
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02009345}
9346
Hanno Becker7e5437a2017-04-28 17:15:26 +01009347unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type )
9348{
9349 switch( type ) {
9350 case MBEDTLS_PK_RSA:
9351 return( MBEDTLS_SSL_SIG_RSA );
9352 case MBEDTLS_PK_ECDSA:
9353 case MBEDTLS_PK_ECKEY:
9354 return( MBEDTLS_SSL_SIG_ECDSA );
9355 default:
9356 return( MBEDTLS_SSL_SIG_ANON );
9357 }
9358}
9359
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009360mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009361{
9362 switch( sig )
9363 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009364#if defined(MBEDTLS_RSA_C)
9365 case MBEDTLS_SSL_SIG_RSA:
9366 return( MBEDTLS_PK_RSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009367#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009368#if defined(MBEDTLS_ECDSA_C)
9369 case MBEDTLS_SSL_SIG_ECDSA:
9370 return( MBEDTLS_PK_ECDSA );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009371#endif
9372 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009373 return( MBEDTLS_PK_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009374 }
9375}
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02009376#endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009377
Hanno Becker7e5437a2017-04-28 17:15:26 +01009378#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
9379 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
9380
9381/* Find an entry in a signature-hash set matching a given hash algorithm. */
9382mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
9383 mbedtls_pk_type_t sig_alg )
9384{
9385 switch( sig_alg )
9386 {
9387 case MBEDTLS_PK_RSA:
9388 return( set->rsa );
9389 case MBEDTLS_PK_ECDSA:
9390 return( set->ecdsa );
9391 default:
9392 return( MBEDTLS_MD_NONE );
9393 }
9394}
9395
9396/* Add a signature-hash-pair to a signature-hash set */
9397void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
9398 mbedtls_pk_type_t sig_alg,
9399 mbedtls_md_type_t md_alg )
9400{
9401 switch( sig_alg )
9402 {
9403 case MBEDTLS_PK_RSA:
9404 if( set->rsa == MBEDTLS_MD_NONE )
9405 set->rsa = md_alg;
9406 break;
9407
9408 case MBEDTLS_PK_ECDSA:
9409 if( set->ecdsa == MBEDTLS_MD_NONE )
9410 set->ecdsa = md_alg;
9411 break;
9412
9413 default:
9414 break;
9415 }
9416}
9417
9418/* Allow exactly one hash algorithm for each signature. */
9419void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
9420 mbedtls_md_type_t md_alg )
9421{
9422 set->rsa = md_alg;
9423 set->ecdsa = md_alg;
9424}
9425
9426#endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
9427 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
9428
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02009429/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02009430 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
Manuel Pégourié-Gonnard1a483832013-09-20 12:29:15 +02009431 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009432mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009433{
9434 switch( hash )
9435 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009436#if defined(MBEDTLS_MD5_C)
9437 case MBEDTLS_SSL_HASH_MD5:
9438 return( MBEDTLS_MD_MD5 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009439#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009440#if defined(MBEDTLS_SHA1_C)
9441 case MBEDTLS_SSL_HASH_SHA1:
9442 return( MBEDTLS_MD_SHA1 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009443#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009444#if defined(MBEDTLS_SHA256_C)
9445 case MBEDTLS_SSL_HASH_SHA224:
9446 return( MBEDTLS_MD_SHA224 );
9447 case MBEDTLS_SSL_HASH_SHA256:
9448 return( MBEDTLS_MD_SHA256 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009449#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009450#if defined(MBEDTLS_SHA512_C)
9451 case MBEDTLS_SSL_HASH_SHA384:
9452 return( MBEDTLS_MD_SHA384 );
9453 case MBEDTLS_SSL_HASH_SHA512:
9454 return( MBEDTLS_MD_SHA512 );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009455#endif
9456 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009457 return( MBEDTLS_MD_NONE );
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02009458 }
9459}
9460
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02009461/*
9462 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
9463 */
9464unsigned char mbedtls_ssl_hash_from_md_alg( int md )
9465{
9466 switch( md )
9467 {
9468#if defined(MBEDTLS_MD5_C)
9469 case MBEDTLS_MD_MD5:
9470 return( MBEDTLS_SSL_HASH_MD5 );
9471#endif
9472#if defined(MBEDTLS_SHA1_C)
9473 case MBEDTLS_MD_SHA1:
9474 return( MBEDTLS_SSL_HASH_SHA1 );
9475#endif
9476#if defined(MBEDTLS_SHA256_C)
9477 case MBEDTLS_MD_SHA224:
9478 return( MBEDTLS_SSL_HASH_SHA224 );
9479 case MBEDTLS_MD_SHA256:
9480 return( MBEDTLS_SSL_HASH_SHA256 );
9481#endif
9482#if defined(MBEDTLS_SHA512_C)
9483 case MBEDTLS_MD_SHA384:
9484 return( MBEDTLS_SSL_HASH_SHA384 );
9485 case MBEDTLS_MD_SHA512:
9486 return( MBEDTLS_SSL_HASH_SHA512 );
9487#endif
9488 default:
9489 return( MBEDTLS_SSL_HASH_NONE );
9490 }
9491}
9492
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02009493#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01009494/*
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02009495 * Check if a curve proposed by the peer is in our list.
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02009496 * Return 0 if we're willing to use it, -1 otherwise.
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01009497 */
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02009498int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01009499{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009500 const mbedtls_ecp_group_id *gid;
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01009501
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02009502 if( ssl->conf->curve_list == NULL )
9503 return( -1 );
9504
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02009505 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01009506 if( *gid == grp_id )
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02009507 return( 0 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01009508
Manuel Pégourié-Gonnard9d412d82015-06-17 12:10:46 +02009509 return( -1 );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01009510}
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02009511#endif /* MBEDTLS_ECP_C */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02009512
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009513#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02009514/*
9515 * Check if a hash proposed by the peer is in our list.
9516 * Return 0 if we're willing to use it, -1 otherwise.
9517 */
9518int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
9519 mbedtls_md_type_t md )
9520{
9521 const int *cur;
9522
9523 if( ssl->conf->sig_hashes == NULL )
9524 return( -1 );
9525
9526 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
9527 if( *cur == (int) md )
9528 return( 0 );
9529
9530 return( -1 );
9531}
Manuel Pégourié-Gonnarde5f30722015-10-22 17:01:15 +02009532#endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02009533
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009534#if defined(MBEDTLS_X509_CRT_PARSE_C)
9535int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
9536 const mbedtls_ssl_ciphersuite_t *ciphersuite,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01009537 int cert_endpoint,
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02009538 uint32_t *flags )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02009539{
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01009540 int ret = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009541#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02009542 int usage = 0;
9543#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009544#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02009545 const char *ext_oid;
9546 size_t ext_len;
9547#endif
9548
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009549#if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \
9550 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02009551 ((void) cert);
9552 ((void) cert_endpoint);
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01009553 ((void) flags);
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02009554#endif
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02009555
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009556#if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
9557 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02009558 {
9559 /* Server part of the key exchange */
9560 switch( ciphersuite->key_exchange )
9561 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009562 case MBEDTLS_KEY_EXCHANGE_RSA:
9563 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01009564 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02009565 break;
9566
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009567 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
9568 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
9569 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
9570 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02009571 break;
9572
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009573 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
9574 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01009575 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02009576 break;
9577
9578 /* Don't use default: we want warnings when adding new values */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009579 case MBEDTLS_KEY_EXCHANGE_NONE:
9580 case MBEDTLS_KEY_EXCHANGE_PSK:
9581 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
9582 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
Manuel Pégourié-Gonnard557535d2015-09-15 17:53:32 +02009583 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02009584 usage = 0;
9585 }
9586 }
9587 else
9588 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009589 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
9590 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02009591 }
9592
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009593 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01009594 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01009595 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01009596 ret = -1;
9597 }
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02009598#else
9599 ((void) ciphersuite);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009600#endif /* MBEDTLS_X509_CHECK_KEY_USAGE */
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02009601
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009602#if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
9603 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02009604 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009605 ext_oid = MBEDTLS_OID_SERVER_AUTH;
9606 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02009607 }
9608 else
9609 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009610 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
9611 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02009612 }
9613
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009614 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01009615 {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +01009616 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01009617 ret = -1;
9618 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009619#endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02009620
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01009621 return( ret );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02009622}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009623#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard3a306b92014-04-29 15:11:17 +02009624
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01009625/*
9626 * Convert version numbers to/from wire format
9627 * and, for DTLS, to/from TLS equivalent.
9628 *
9629 * For TLS this is the identity.
Brian J Murray1903fb32016-11-06 04:45:15 -08009630 * For DTLS, use 1's complement (v -> 255 - v, and then map as follows:
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01009631 * 1.0 <-> 3.2 (DTLS 1.0 is based on TLS 1.1)
9632 * 1.x <-> 3.x+1 for x != 0 (DTLS 1.2 based on TLS 1.2)
9633 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009634void mbedtls_ssl_write_version( int major, int minor, int transport,
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01009635 unsigned char ver[2] )
9636{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009637#if defined(MBEDTLS_SSL_PROTO_DTLS)
9638 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01009639 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009640 if( minor == MBEDTLS_SSL_MINOR_VERSION_2 )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01009641 --minor; /* DTLS 1.0 stored as TLS 1.1 internally */
9642
9643 ver[0] = (unsigned char)( 255 - ( major - 2 ) );
9644 ver[1] = (unsigned char)( 255 - ( minor - 1 ) );
9645 }
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01009646 else
9647#else
9648 ((void) transport);
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01009649#endif
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01009650 {
9651 ver[0] = (unsigned char) major;
9652 ver[1] = (unsigned char) minor;
9653 }
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01009654}
9655
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009656void mbedtls_ssl_read_version( int *major, int *minor, int transport,
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01009657 const unsigned char ver[2] )
9658{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009659#if defined(MBEDTLS_SSL_PROTO_DTLS)
9660 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01009661 {
9662 *major = 255 - ver[0] + 2;
9663 *minor = 255 - ver[1] + 1;
9664
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009665 if( *minor == MBEDTLS_SSL_MINOR_VERSION_1 )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01009666 ++*minor; /* DTLS 1.0 stored as TLS 1.1 internally */
9667 }
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01009668 else
9669#else
9670 ((void) transport);
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01009671#endif
Manuel Pégourié-Gonnard34c10112014-03-25 13:36:22 +01009672 {
9673 *major = ver[0];
9674 *minor = ver[1];
9675 }
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01009676}
9677
Simon Butcher99000142016-10-13 17:21:01 +01009678int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
9679{
9680#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
9681 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
9682 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
9683
9684 switch( md )
9685 {
9686#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
9687#if defined(MBEDTLS_MD5_C)
9688 case MBEDTLS_SSL_HASH_MD5:
Janos Follath182013f2016-10-25 10:50:22 +01009689 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
Simon Butcher99000142016-10-13 17:21:01 +01009690#endif
9691#if defined(MBEDTLS_SHA1_C)
9692 case MBEDTLS_SSL_HASH_SHA1:
9693 ssl->handshake->calc_verify = ssl_calc_verify_tls;
9694 break;
9695#endif
9696#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
9697#if defined(MBEDTLS_SHA512_C)
9698 case MBEDTLS_SSL_HASH_SHA384:
9699 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
9700 break;
9701#endif
9702#if defined(MBEDTLS_SHA256_C)
9703 case MBEDTLS_SSL_HASH_SHA256:
9704 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
9705 break;
9706#endif
9707 default:
9708 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
9709 }
9710
9711 return 0;
9712#else /* !MBEDTLS_SSL_PROTO_TLS1_2 */
9713 (void) ssl;
9714 (void) md;
9715
9716 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH;
9717#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
9718}
9719
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009720#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
9721 defined(MBEDTLS_SSL_PROTO_TLS1_1)
9722int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
9723 unsigned char *output,
9724 unsigned char *data, size_t data_len )
9725{
9726 int ret = 0;
9727 mbedtls_md5_context mbedtls_md5;
9728 mbedtls_sha1_context mbedtls_sha1;
9729
9730 mbedtls_md5_init( &mbedtls_md5 );
9731 mbedtls_sha1_init( &mbedtls_sha1 );
9732
9733 /*
9734 * digitally-signed struct {
9735 * opaque md5_hash[16];
9736 * opaque sha_hash[20];
9737 * };
9738 *
9739 * md5_hash
9740 * MD5(ClientHello.random + ServerHello.random
9741 * + ServerParams);
9742 * sha_hash
9743 * SHA(ClientHello.random + ServerHello.random
9744 * + ServerParams);
9745 */
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009746 if( ( ret = mbedtls_md5_starts_ret( &mbedtls_md5 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009747 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009748 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009749 goto exit;
9750 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009751 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009752 ssl->handshake->randbytes, 64 ) ) != 0 )
9753 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009754 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009755 goto exit;
9756 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009757 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5, data, data_len ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009758 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009759 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009760 goto exit;
9761 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009762 if( ( ret = mbedtls_md5_finish_ret( &mbedtls_md5, output ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009763 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009764 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009765 goto exit;
9766 }
9767
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009768 if( ( ret = mbedtls_sha1_starts_ret( &mbedtls_sha1 ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009769 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009770 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_starts_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009771 goto exit;
9772 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009773 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009774 ssl->handshake->randbytes, 64 ) ) != 0 )
9775 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009776 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009777 goto exit;
9778 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009779 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1, data,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009780 data_len ) ) != 0 )
9781 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009782 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009783 goto exit;
9784 }
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009785 if( ( ret = mbedtls_sha1_finish_ret( &mbedtls_sha1,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009786 output + 16 ) ) != 0 )
9787 {
Gilles Peskine9e4f77c2018-01-22 11:48:08 +01009788 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_finish_ret", ret );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009789 goto exit;
9790 }
9791
9792exit:
9793 mbedtls_md5_free( &mbedtls_md5 );
9794 mbedtls_sha1_free( &mbedtls_sha1 );
9795
9796 if( ret != 0 )
9797 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
9798 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
9799
9800 return( ret );
9801
9802}
9803#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
9804 MBEDTLS_SSL_PROTO_TLS1_1 */
9805
9806#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
9807 defined(MBEDTLS_SSL_PROTO_TLS1_2)
9808int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
Gilles Peskineca1d7422018-04-24 11:53:22 +02009809 unsigned char *hash, size_t *hashlen,
9810 unsigned char *data, size_t data_len,
9811 mbedtls_md_type_t md_alg )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009812{
9813 int ret = 0;
9814 mbedtls_md_context_t ctx;
9815 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
Gilles Peskineca1d7422018-04-24 11:53:22 +02009816 *hashlen = mbedtls_md_get_size( md_info );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009817
9818 mbedtls_md_init( &ctx );
9819
9820 /*
9821 * digitally-signed struct {
9822 * opaque client_random[32];
9823 * opaque server_random[32];
9824 * ServerDHParams params;
9825 * };
9826 */
9827 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
9828 {
9829 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
9830 goto exit;
9831 }
9832 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 )
9833 {
9834 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret );
9835 goto exit;
9836 }
9837 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 )
9838 {
9839 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
9840 goto exit;
9841 }
9842 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 )
9843 {
9844 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret );
9845 goto exit;
9846 }
Gilles Peskineca1d7422018-04-24 11:53:22 +02009847 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 )
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01009848 {
9849 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret );
9850 goto exit;
9851 }
9852
9853exit:
9854 mbedtls_md_free( &ctx );
9855
9856 if( ret != 0 )
9857 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
9858 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
9859
9860 return( ret );
9861}
9862#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
9863 MBEDTLS_SSL_PROTO_TLS1_2 */
9864
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02009865#endif /* MBEDTLS_SSL_TLS_C */