Lines Matching +full:restore +full:- +full:keys
6 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
77 * extension in order to get constant-flow behaviour. in mbedtls_ct_hmac()
136 * deliberately-crafted input), in case the caller doesn't in mbedtls_ct_hmac()
197 * extension to the MD API in order to get constant-flow behaviour. in mbedtls_ct_hmac()
201 * patterns (see RFC 2104, sec. 2), which are stored in ctx->hmac_ctx. in mbedtls_ct_hmac()
209 const mbedtls_md_type_t md_alg = mbedtls_md_get_type(ctx->md_info); in mbedtls_ct_hmac()
210 /* TLS 1.2 only supports SHA-384, SHA-256, SHA-1, MD-5, in mbedtls_ct_hmac()
211 * all of which have the same block size except SHA-384. */ in mbedtls_ct_hmac()
213 const unsigned char * const ikey = ctx->hmac_ctx; in mbedtls_ct_hmac()
215 const size_t hash_size = mbedtls_md_get_size(ctx->md_info); in mbedtls_ct_hmac()
231 MD_CHK(mbedtls_md_setup(&aux, ctx->md_info, 0)); in mbedtls_ct_hmac()
240 * deliberately-crafted input), in case the caller doesn't in mbedtls_ct_hmac()
288 if (ssl->f_set_timer == NULL) { in mbedtls_ssl_set_timer()
293 ssl->f_set_timer(ssl->p_timer, millisecs / 4, millisecs); in mbedtls_ssl_set_timer()
297 * Return -1 is timer is expired, 0 if it isn't.
301 if (ssl->f_get_timer == NULL) { in mbedtls_ssl_check_timer()
305 if (ssl->f_get_timer(ssl->p_timer) == 2) { in mbedtls_ssl_check_timer()
307 return -1; in mbedtls_ssl_check_timer()
330 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM) { in mbedtls_ssl_check_record()
344 if (ssl->transform_in != NULL) { in mbedtls_ssl_check_record()
345 ret = mbedtls_ssl_decrypt_buf(ssl, ssl->transform_in, &rec); in mbedtls_ssl_check_record()
355 /* On success, we have decrypted the buffer in-place, so make in mbedtls_ssl_check_record()
395 size_t out_buf_len = ssl->out_buf_len; in ssl_get_maximum_datagram_size()
410 size_t const bytes_written = ssl->out_left; in ssl_get_remaining_space_in_datagram()
413 /* Double-check that the write-index hasn't gone in ssl_get_remaining_space_in_datagram()
420 return (int) (mtu - bytes_written); in ssl_get_remaining_space_in_datagram()
446 if (max_len <= ssl->out_left) { in ssl_get_remaining_payload_in_datagram()
450 max_len -= ssl->out_left; in ssl_get_remaining_payload_in_datagram()
469 remaining -= expansion; in ssl_get_remaining_payload_in_datagram()
479 * returning -1 if the maximum value has already been reached.
486 if (ssl->handshake->retransmit_timeout >= ssl->conf->hs_timeout_max) { in ssl_double_retransmit_timeout()
487 return -1; in ssl_double_retransmit_timeout()
495 * on most non-IP stacks too. */ in ssl_double_retransmit_timeout()
496 if (ssl->handshake->retransmit_timeout != ssl->conf->hs_timeout_min) { in ssl_double_retransmit_timeout()
497 ssl->handshake->mtu = 508; in ssl_double_retransmit_timeout()
498 MBEDTLS_SSL_DEBUG_MSG(2, ("mtu autoreduction to %d bytes", ssl->handshake->mtu)); in ssl_double_retransmit_timeout()
501 new_timeout = 2 * ssl->handshake->retransmit_timeout; in ssl_double_retransmit_timeout()
504 if (new_timeout < ssl->handshake->retransmit_timeout || in ssl_double_retransmit_timeout()
505 new_timeout > ssl->conf->hs_timeout_max) { in ssl_double_retransmit_timeout()
506 new_timeout = ssl->conf->hs_timeout_max; in ssl_double_retransmit_timeout()
509 ssl->handshake->retransmit_timeout = new_timeout; in ssl_double_retransmit_timeout()
511 (unsigned long) ssl->handshake->retransmit_timeout)); in ssl_double_retransmit_timeout()
518 ssl->handshake->retransmit_timeout = ssl->conf->hs_timeout_min; in ssl_reset_retransmit_timeout()
520 (unsigned long) ssl->handshake->retransmit_timeout)); in ssl_reset_retransmit_timeout()
533 return (granularity - (len + 1) % granularity) % granularity; in ssl_compute_padding_length()
548 * - `content`: The beginning of the buffer holding the
550 * - `*content_size`: The length of the plaintext in Bytes.
551 * - `max_len`: The number of Bytes available starting from
553 * - `rec_type`: The desired record content type.
556 * - `content`: The beginning of the resulting (D)TLSInnerPlaintext structure.
557 * - `*content_size`: The length of the resulting (D)TLSInnerPlaintext structure.
560 * - `0` on success.
561 * - A negative error code if `max_len` didn't offer enough space
575 return -1; in ssl_build_inner_plaintext()
579 remaining--; in ssl_build_inner_plaintext()
582 return -1; in ssl_build_inner_plaintext()
586 remaining -= pad; in ssl_build_inner_plaintext()
604 return -1; in ssl_parse_inner_plaintext()
606 remaining--; in ssl_parse_inner_plaintext()
631 * size = 8 + 1 + 1 + 1 + 2 + 2 + 6 + 2 + CID-length
632 * = 23 + CID-length
635 according to draft-ietf-tls-dtls-connection-id-05
636 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05
638 * size = 13 + 1 + CID-length
642 * Per Section 5.3 of draft-ietf-tls-dtls-connection-id-05 the
678 * CID specification published in draft-ietf-tls-dtls-connection-id-05, in ssl_extract_add_data_from_record()
681 * We will distinguish between the non-CID and the CID cases below. in ssl_extract_add_data_from_record()
683 * --- Non-CID cases --- in ssl_extract_add_data_from_record()
701 * ciphertext length from the inner plaintext length rec->data_len via in ssl_extract_add_data_from_record()
705 * --- CID cases --- in ssl_extract_add_data_from_record()
711 * Encrypt-then-MAC Processing (with CID): in ssl_extract_add_data_from_record()
752 * Section 5.3 of draft-ietf-tls-dtls-connection-id-05 (for legacy CID use) in ssl_extract_add_data_from_record()
764 size_t ad_len_field = rec->data_len; in ssl_extract_add_data_from_record()
785 if (rec->cid_len != 0) { in ssl_extract_add_data_from_record()
791 *cur = rec->type; in ssl_extract_add_data_from_record()
795 *cur = rec->cid_len; in ssl_extract_add_data_from_record()
801 memcpy(cur, rec->ctr, sizeof(rec->ctr)); in ssl_extract_add_data_from_record()
802 cur += sizeof(rec->ctr); in ssl_extract_add_data_from_record()
807 *cur = rec->type; in ssl_extract_add_data_from_record()
811 memcpy(cur, rec->ver, sizeof(rec->ver)); in ssl_extract_add_data_from_record()
812 cur += sizeof(rec->ver); in ssl_extract_add_data_from_record()
817 if (rec->cid_len != 0) { in ssl_extract_add_data_from_record()
819 memcpy(cur, rec->cid, rec->cid_len); in ssl_extract_add_data_from_record()
820 cur += rec->cid_len; in ssl_extract_add_data_from_record()
823 *cur = rec->cid_len; in ssl_extract_add_data_from_record()
833 if (rec->cid_len != 0) { in ssl_extract_add_data_from_record()
835 memcpy(cur, rec->ctr, sizeof(rec->ctr)); in ssl_extract_add_data_from_record()
836 cur += sizeof(rec->ctr); in ssl_extract_add_data_from_record()
839 memcpy(cur, rec->cid, rec->cid_len); in ssl_extract_add_data_from_record()
840 cur += rec->cid_len; in ssl_extract_add_data_from_record()
852 *add_data_len = (size_t) (cur - add_data); in ssl_extract_add_data_from_record()
860 return transform->ivlen != transform->fixed_ivlen; in ssl_transform_aead_dynamic_iv_is_explicit()
897 dst_iv += dst_iv_len - dynamic_iv_len; in ssl_build_record_nonce()
943 || rec->buf == NULL in mbedtls_ssl_encrypt_buf()
944 || rec->buf_len < rec->data_offset in mbedtls_ssl_encrypt_buf()
945 || rec->buf_len - rec->data_offset < rec->data_len in mbedtls_ssl_encrypt_buf()
947 || rec->cid_len != 0 in mbedtls_ssl_encrypt_buf()
956 data = rec->buf + rec->data_offset; in mbedtls_ssl_encrypt_buf()
957 post_avail = rec->buf_len - (rec->data_len + rec->data_offset); in mbedtls_ssl_encrypt_buf()
959 data, rec->data_len); in mbedtls_ssl_encrypt_buf()
961 if (rec->data_len > MBEDTLS_SSL_OUT_CONTENT_LEN) { in mbedtls_ssl_encrypt_buf()
964 rec->data_len, in mbedtls_ssl_encrypt_buf()
974 * Note that this changes `rec->data_len`, and hence in mbedtls_ssl_encrypt_buf()
979 * is hence no risk of double-addition of the inner plaintext. in mbedtls_ssl_encrypt_buf()
982 if (transform->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { in mbedtls_ssl_encrypt_buf()
984 ssl_compute_padding_length(rec->data_len, in mbedtls_ssl_encrypt_buf()
987 &rec->data_len, in mbedtls_ssl_encrypt_buf()
989 rec->type, in mbedtls_ssl_encrypt_buf()
994 rec->type = MBEDTLS_SSL_MSG_APPLICATION_DATA; in mbedtls_ssl_encrypt_buf()
1002 rec->cid_len = transform->out_cid_len; in mbedtls_ssl_encrypt_buf()
1003 memcpy(rec->cid, transform->out_cid, transform->out_cid_len); in mbedtls_ssl_encrypt_buf()
1004 MBEDTLS_SSL_DEBUG_BUF(3, "CID", rec->cid, rec->cid_len); in mbedtls_ssl_encrypt_buf()
1006 if (rec->cid_len != 0) { in mbedtls_ssl_encrypt_buf()
1008 ssl_compute_padding_length(rec->data_len, in mbedtls_ssl_encrypt_buf()
1014 * Note that this changes `rec->data_len`, and hence in mbedtls_ssl_encrypt_buf()
1018 &rec->data_len, in mbedtls_ssl_encrypt_buf()
1020 rec->type, in mbedtls_ssl_encrypt_buf()
1025 rec->type = MBEDTLS_SSL_MSG_CID; in mbedtls_ssl_encrypt_buf()
1029 post_avail = rec->buf_len - (rec->data_len + rec->data_offset); in mbedtls_ssl_encrypt_buf()
1037 if (post_avail < transform->maclen) { in mbedtls_ssl_encrypt_buf()
1051 transform->tls_version, in mbedtls_ssl_encrypt_buf()
1052 transform->taglen); in mbedtls_ssl_encrypt_buf()
1055 status = psa_mac_sign_setup(&operation, transform->psa_mac_enc, in mbedtls_ssl_encrypt_buf()
1056 transform->psa_mac_alg); in mbedtls_ssl_encrypt_buf()
1066 status = psa_mac_update(&operation, data, rec->data_len); in mbedtls_ssl_encrypt_buf()
1077 ret = mbedtls_md_hmac_update(&transform->md_ctx_enc, add_data, in mbedtls_ssl_encrypt_buf()
1082 ret = mbedtls_md_hmac_update(&transform->md_ctx_enc, data, rec->data_len); in mbedtls_ssl_encrypt_buf()
1086 ret = mbedtls_md_hmac_finish(&transform->md_ctx_enc, mac); in mbedtls_ssl_encrypt_buf()
1090 ret = mbedtls_md_hmac_reset(&transform->md_ctx_enc); in mbedtls_ssl_encrypt_buf()
1096 memcpy(data + rec->data_len, mac, transform->maclen); in mbedtls_ssl_encrypt_buf()
1099 MBEDTLS_SSL_DEBUG_BUF(4, "computed mac", data + rec->data_len, in mbedtls_ssl_encrypt_buf()
1100 transform->maclen); in mbedtls_ssl_encrypt_buf()
1102 rec->data_len += transform->maclen; in mbedtls_ssl_encrypt_buf()
1103 post_avail -= transform->maclen; in mbedtls_ssl_encrypt_buf()
1107 mbedtls_platform_zeroize(mac, transform->maclen); in mbedtls_ssl_encrypt_buf()
1129 rec->data_len, 0)); in mbedtls_ssl_encrypt_buf()
1149 if (post_avail < transform->taglen) { in mbedtls_ssl_encrypt_buf()
1159 * can be chosen freely - in particular, it need not in mbedtls_ssl_encrypt_buf()
1166 dynamic_iv = rec->ctr; in mbedtls_ssl_encrypt_buf()
1167 dynamic_iv_len = sizeof(rec->ctr); in mbedtls_ssl_encrypt_buf()
1170 transform->iv_enc, in mbedtls_ssl_encrypt_buf()
1171 transform->fixed_ivlen, in mbedtls_ssl_encrypt_buf()
1180 transform->tls_version, in mbedtls_ssl_encrypt_buf()
1181 transform->taglen); in mbedtls_ssl_encrypt_buf()
1184 iv, transform->ivlen); in mbedtls_ssl_encrypt_buf()
1192 rec->data_len)); in mbedtls_ssl_encrypt_buf()
1198 status = psa_aead_encrypt(transform->psa_key_enc, in mbedtls_ssl_encrypt_buf()
1199 transform->psa_alg, in mbedtls_ssl_encrypt_buf()
1200 iv, transform->ivlen, in mbedtls_ssl_encrypt_buf()
1202 data, rec->data_len, in mbedtls_ssl_encrypt_buf()
1203 data, rec->buf_len - (data - rec->buf), in mbedtls_ssl_encrypt_buf()
1204 &rec->data_len); in mbedtls_ssl_encrypt_buf()
1212 if ((ret = mbedtls_cipher_auth_encrypt_ext(&transform->cipher_ctx_enc, in mbedtls_ssl_encrypt_buf()
1213 iv, transform->ivlen, in mbedtls_ssl_encrypt_buf()
1215 data, rec->data_len, /* src */ in mbedtls_ssl_encrypt_buf()
1216 … data, rec->buf_len - (size_t) (data - rec->buf), /* dst */ in mbedtls_ssl_encrypt_buf()
1217 &rec->data_len, in mbedtls_ssl_encrypt_buf()
1218 transform->taglen)) != 0) { in mbedtls_ssl_encrypt_buf()
1225 data + rec->data_len - transform->taglen, in mbedtls_ssl_encrypt_buf()
1226 transform->taglen); in mbedtls_ssl_encrypt_buf()
1228 post_avail -= transform->taglen; in mbedtls_ssl_encrypt_buf()
1234 if (rec->data_offset < dynamic_iv_len) { in mbedtls_ssl_encrypt_buf()
1239 memcpy(data - dynamic_iv_len, dynamic_iv, dynamic_iv_len); in mbedtls_ssl_encrypt_buf()
1240 rec->data_offset -= dynamic_iv_len; in mbedtls_ssl_encrypt_buf()
1241 rec->data_len += dynamic_iv_len; in mbedtls_ssl_encrypt_buf()
1261 padlen = transform->ivlen - (rec->data_len + 1) % transform->ivlen; in mbedtls_ssl_encrypt_buf()
1262 if (padlen == transform->ivlen) { in mbedtls_ssl_encrypt_buf()
1273 data[rec->data_len + i] = (unsigned char) padlen; in mbedtls_ssl_encrypt_buf()
1276 rec->data_len += padlen + 1; in mbedtls_ssl_encrypt_buf()
1277 post_avail -= padlen + 1; in mbedtls_ssl_encrypt_buf()
1281 * Prepend per-record IV for block cipher in TLS v1.2 as per in mbedtls_ssl_encrypt_buf()
1289 if (rec->data_offset < transform->ivlen) { in mbedtls_ssl_encrypt_buf()
1297 ret = f_rng(p_rng, transform->iv_enc, transform->ivlen); in mbedtls_ssl_encrypt_buf()
1302 memcpy(data - transform->ivlen, transform->iv_enc, transform->ivlen); in mbedtls_ssl_encrypt_buf()
1309 rec->data_len, transform->ivlen, in mbedtls_ssl_encrypt_buf()
1314 transform->psa_key_enc, transform->psa_alg); in mbedtls_ssl_encrypt_buf()
1322 status = psa_cipher_set_iv(&cipher_op, transform->iv_enc, transform->ivlen); in mbedtls_ssl_encrypt_buf()
1332 data, rec->data_len, in mbedtls_ssl_encrypt_buf()
1333 data, rec->data_len, &olen); in mbedtls_ssl_encrypt_buf()
1343 data + olen, rec->data_len - olen, in mbedtls_ssl_encrypt_buf()
1355 if ((ret = mbedtls_cipher_crypt(&transform->cipher_ctx_enc, in mbedtls_ssl_encrypt_buf()
1356 transform->iv_enc, in mbedtls_ssl_encrypt_buf()
1357 transform->ivlen, in mbedtls_ssl_encrypt_buf()
1358 data, rec->data_len, in mbedtls_ssl_encrypt_buf()
1365 if (rec->data_len != olen) { in mbedtls_ssl_encrypt_buf()
1370 data -= transform->ivlen; in mbedtls_ssl_encrypt_buf()
1371 rec->data_offset -= transform->ivlen; in mbedtls_ssl_encrypt_buf()
1372 rec->data_len += transform->ivlen; in mbedtls_ssl_encrypt_buf()
1385 if (post_avail < transform->maclen) { in mbedtls_ssl_encrypt_buf()
1391 rec, transform->tls_version, in mbedtls_ssl_encrypt_buf()
1392 transform->taglen); in mbedtls_ssl_encrypt_buf()
1395 MBEDTLS_SSL_DEBUG_BUF(4, "MAC'd meta-data", add_data, in mbedtls_ssl_encrypt_buf()
1398 status = psa_mac_sign_setup(&operation, transform->psa_mac_enc, in mbedtls_ssl_encrypt_buf()
1399 transform->psa_mac_alg); in mbedtls_ssl_encrypt_buf()
1409 status = psa_mac_update(&operation, data, rec->data_len); in mbedtls_ssl_encrypt_buf()
1421 ret = mbedtls_md_hmac_update(&transform->md_ctx_enc, add_data, in mbedtls_ssl_encrypt_buf()
1426 ret = mbedtls_md_hmac_update(&transform->md_ctx_enc, in mbedtls_ssl_encrypt_buf()
1427 data, rec->data_len); in mbedtls_ssl_encrypt_buf()
1431 ret = mbedtls_md_hmac_finish(&transform->md_ctx_enc, mac); in mbedtls_ssl_encrypt_buf()
1435 ret = mbedtls_md_hmac_reset(&transform->md_ctx_enc); in mbedtls_ssl_encrypt_buf()
1441 memcpy(data + rec->data_len, mac, transform->maclen); in mbedtls_ssl_encrypt_buf()
1443 rec->data_len += transform->maclen; in mbedtls_ssl_encrypt_buf()
1444 post_avail -= transform->maclen; in mbedtls_ssl_encrypt_buf()
1448 mbedtls_platform_zeroize(mac, transform->maclen); in mbedtls_ssl_encrypt_buf()
1513 rec->buf == NULL || in mbedtls_ssl_decrypt_buf()
1514 rec->buf_len < rec->data_offset || in mbedtls_ssl_decrypt_buf()
1515 rec->buf_len - rec->data_offset < rec->data_len) { in mbedtls_ssl_decrypt_buf()
1520 data = rec->buf + rec->data_offset; in mbedtls_ssl_decrypt_buf()
1527 if (rec->cid_len != transform->in_cid_len || in mbedtls_ssl_decrypt_buf()
1528 memcmp(rec->cid, transform->in_cid, rec->cid_len) != 0) { in mbedtls_ssl_decrypt_buf()
1535 if (rec->data_len < transform->maclen) { in mbedtls_ssl_decrypt_buf()
1539 rec->data_len, transform->maclen)); in mbedtls_ssl_decrypt_buf()
1561 * can be chosen freely - in particular, it need not in mbedtls_ssl_decrypt_buf()
1564 dynamic_iv_len = sizeof(rec->ctr); in mbedtls_ssl_decrypt_buf()
1566 if (rec->data_len < dynamic_iv_len) { in mbedtls_ssl_decrypt_buf()
1569 rec->data_len, in mbedtls_ssl_decrypt_buf()
1576 rec->data_offset += dynamic_iv_len; in mbedtls_ssl_decrypt_buf()
1577 rec->data_len -= dynamic_iv_len; in mbedtls_ssl_decrypt_buf()
1579 dynamic_iv = rec->ctr; in mbedtls_ssl_decrypt_buf()
1583 if (rec->data_len < transform->taglen) { in mbedtls_ssl_decrypt_buf()
1586 rec->data_len, in mbedtls_ssl_decrypt_buf()
1587 transform->taglen)); in mbedtls_ssl_decrypt_buf()
1590 rec->data_len -= transform->taglen; in mbedtls_ssl_decrypt_buf()
1596 transform->iv_dec, in mbedtls_ssl_decrypt_buf()
1597 transform->fixed_ivlen, in mbedtls_ssl_decrypt_buf()
1606 transform->tls_version, in mbedtls_ssl_decrypt_buf()
1607 transform->taglen); in mbedtls_ssl_decrypt_buf()
1617 MBEDTLS_SSL_DEBUG_BUF(4, "IV used", iv, transform->ivlen); in mbedtls_ssl_decrypt_buf()
1618 MBEDTLS_SSL_DEBUG_BUF(4, "TAG used", data + rec->data_len, in mbedtls_ssl_decrypt_buf()
1619 transform->taglen); in mbedtls_ssl_decrypt_buf()
1625 status = psa_aead_decrypt(transform->psa_key_dec, in mbedtls_ssl_decrypt_buf()
1626 transform->psa_alg, in mbedtls_ssl_decrypt_buf()
1627 iv, transform->ivlen, in mbedtls_ssl_decrypt_buf()
1629 data, rec->data_len + transform->taglen, in mbedtls_ssl_decrypt_buf()
1630 data, rec->buf_len - (data - rec->buf), in mbedtls_ssl_decrypt_buf()
1640 (&transform->cipher_ctx_dec, in mbedtls_ssl_decrypt_buf()
1641 iv, transform->ivlen, in mbedtls_ssl_decrypt_buf()
1643 data, rec->data_len + transform->taglen, /* src */ in mbedtls_ssl_decrypt_buf()
1644 data, rec->buf_len - (size_t) (data - rec->buf), &olen, /* dst */ in mbedtls_ssl_decrypt_buf()
1645 transform->taglen)) != 0) { in mbedtls_ssl_decrypt_buf()
1658 /* Double-check that AEAD decryption doesn't change content length. */ in mbedtls_ssl_decrypt_buf()
1659 if (olen != rec->data_len) { in mbedtls_ssl_decrypt_buf()
1680 minlen += transform->ivlen; in mbedtls_ssl_decrypt_buf()
1685 * - The CBC cipher text must not be empty and hence in mbedtls_ssl_decrypt_buf()
1686 * at least of size transform->ivlen. in mbedtls_ssl_decrypt_buf()
1688 * Together with the potential IV-prefix, this explains in mbedtls_ssl_decrypt_buf()
1691 * - The record must contain a MAC, either in plain or in mbedtls_ssl_decrypt_buf()
1692 * encrypted, depending on whether Encrypt-then-MAC in mbedtls_ssl_decrypt_buf()
1694 * - If it is, the message contains the IV-prefix, in mbedtls_ssl_decrypt_buf()
1696 * - If it is not, the padded plaintext, and hence in mbedtls_ssl_decrypt_buf()
1704 if (rec->data_len < minlen + transform->ivlen || in mbedtls_ssl_decrypt_buf()
1705 rec->data_len < minlen + transform->maclen + 1) { in mbedtls_ssl_decrypt_buf()
1710 rec->data_len, in mbedtls_ssl_decrypt_buf()
1711 transform->ivlen, in mbedtls_ssl_decrypt_buf()
1712 transform->maclen)); in mbedtls_ssl_decrypt_buf()
1739 rec->data_len -= transform->maclen; in mbedtls_ssl_decrypt_buf()
1741 transform->tls_version, in mbedtls_ssl_decrypt_buf()
1742 transform->taglen); in mbedtls_ssl_decrypt_buf()
1745 MBEDTLS_SSL_DEBUG_BUF(4, "MAC'd meta-data", add_data, in mbedtls_ssl_decrypt_buf()
1748 status = psa_mac_verify_setup(&operation, transform->psa_mac_dec, in mbedtls_ssl_decrypt_buf()
1749 transform->psa_mac_alg); in mbedtls_ssl_decrypt_buf()
1759 status = psa_mac_update(&operation, data, rec->data_len); in mbedtls_ssl_decrypt_buf()
1765 status = psa_mac_verify_finish(&operation, data + rec->data_len, in mbedtls_ssl_decrypt_buf()
1766 transform->maclen); in mbedtls_ssl_decrypt_buf()
1771 ret = mbedtls_md_hmac_update(&transform->md_ctx_dec, add_data, in mbedtls_ssl_decrypt_buf()
1776 ret = mbedtls_md_hmac_update(&transform->md_ctx_dec, in mbedtls_ssl_decrypt_buf()
1777 data, rec->data_len); in mbedtls_ssl_decrypt_buf()
1781 ret = mbedtls_md_hmac_finish(&transform->md_ctx_dec, mac_expect); in mbedtls_ssl_decrypt_buf()
1785 ret = mbedtls_md_hmac_reset(&transform->md_ctx_dec); in mbedtls_ssl_decrypt_buf()
1790 MBEDTLS_SSL_DEBUG_BUF(4, "message mac", data + rec->data_len, in mbedtls_ssl_decrypt_buf()
1791 transform->maclen); in mbedtls_ssl_decrypt_buf()
1793 transform->maclen); in mbedtls_ssl_decrypt_buf()
1796 if (mbedtls_ct_memcmp(data + rec->data_len, mac_expect, in mbedtls_ssl_decrypt_buf()
1797 transform->maclen) != 0) { in mbedtls_ssl_decrypt_buf()
1813 mbedtls_platform_zeroize(mac_expect, transform->maclen); in mbedtls_ssl_decrypt_buf()
1831 if (rec->data_len % transform->ivlen != 0) { in mbedtls_ssl_decrypt_buf()
1834 rec->data_len, transform->ivlen)); in mbedtls_ssl_decrypt_buf()
1843 memcpy(transform->iv_dec, data, transform->ivlen); in mbedtls_ssl_decrypt_buf()
1845 data += transform->ivlen; in mbedtls_ssl_decrypt_buf()
1846 rec->data_offset += transform->ivlen; in mbedtls_ssl_decrypt_buf()
1847 rec->data_len -= transform->ivlen; in mbedtls_ssl_decrypt_buf()
1854 transform->psa_key_dec, transform->psa_alg); in mbedtls_ssl_decrypt_buf()
1862 status = psa_cipher_set_iv(&cipher_op, transform->iv_dec, transform->ivlen); in mbedtls_ssl_decrypt_buf()
1871 data, rec->data_len, in mbedtls_ssl_decrypt_buf()
1872 data, rec->data_len, &olen); in mbedtls_ssl_decrypt_buf()
1881 data + olen, rec->data_len - olen, in mbedtls_ssl_decrypt_buf()
1893 if ((ret = mbedtls_cipher_crypt(&transform->cipher_ctx_dec, in mbedtls_ssl_decrypt_buf()
1894 transform->iv_dec, transform->ivlen, in mbedtls_ssl_decrypt_buf()
1895 data, rec->data_len, data, &olen)) != 0) { in mbedtls_ssl_decrypt_buf()
1901 /* Double-check that length hasn't changed during decryption. */ in mbedtls_ssl_decrypt_buf()
1902 if (rec->data_len != olen) { in mbedtls_ssl_decrypt_buf()
1911 padlen = data[rec->data_len - 1]; in mbedtls_ssl_decrypt_buf()
1915 rec->data_len, in mbedtls_ssl_decrypt_buf()
1921 if (rec->data_len < transform->maclen + padlen + 1) { in mbedtls_ssl_decrypt_buf()
1925 rec->data_len, in mbedtls_ssl_decrypt_buf()
1926 transform->maclen, in mbedtls_ssl_decrypt_buf()
1931 rec->data_len, in mbedtls_ssl_decrypt_buf()
1932 transform->maclen + padlen + 1); in mbedtls_ssl_decrypt_buf()
1954 size_t const padding_idx = rec->data_len - padlen; in mbedtls_ssl_decrypt_buf()
1955 size_t const num_checks = rec->data_len <= 256 ? rec->data_len : 256; in mbedtls_ssl_decrypt_buf()
1956 size_t const start_idx = rec->data_len - num_checks; in mbedtls_ssl_decrypt_buf()
1959 for (idx = start_idx; idx < rec->data_len; idx++) { in mbedtls_ssl_decrypt_buf()
1961 * (check[idx] == padlen - 1); in mbedtls_ssl_decrypt_buf()
1965 const mbedtls_ct_condition_t b = mbedtls_ct_uint_eq(check[idx], padlen - 1); in mbedtls_ssl_decrypt_buf()
1984 rec->data_len -= padlen; in mbedtls_ssl_decrypt_buf()
1994 data, rec->data_len); in mbedtls_ssl_decrypt_buf()
2022 rec->data_len -= transform->maclen; in mbedtls_ssl_decrypt_buf()
2024 transform->tls_version, in mbedtls_ssl_decrypt_buf()
2025 transform->taglen); in mbedtls_ssl_decrypt_buf()
2033 * data_len -= padlen. in mbedtls_ssl_decrypt_buf()
2036 * length, as we previously did in_msglen -= maclen too. in mbedtls_ssl_decrypt_buf()
2038 const size_t max_len = rec->data_len + padlen; in mbedtls_ssl_decrypt_buf()
2039 const size_t min_len = (max_len > 256) ? max_len - 256 : 0; in mbedtls_ssl_decrypt_buf()
2042 ret = mbedtls_ct_hmac(transform->psa_mac_dec, in mbedtls_ssl_decrypt_buf()
2043 transform->psa_mac_alg, in mbedtls_ssl_decrypt_buf()
2045 data, rec->data_len, min_len, max_len, in mbedtls_ssl_decrypt_buf()
2048 ret = mbedtls_ct_hmac(&transform->md_ctx_dec, in mbedtls_ssl_decrypt_buf()
2050 data, rec->data_len, min_len, max_len, in mbedtls_ssl_decrypt_buf()
2059 rec->data_len, in mbedtls_ssl_decrypt_buf()
2061 transform->maclen); in mbedtls_ssl_decrypt_buf()
2065 MBEDTLS_SSL_DEBUG_BUF(4, "expected mac", mac_expect, transform->maclen); in mbedtls_ssl_decrypt_buf()
2066 MBEDTLS_SSL_DEBUG_BUF(4, "message mac", mac_peer, transform->maclen); in mbedtls_ssl_decrypt_buf()
2070 transform->maclen) != 0) { in mbedtls_ssl_decrypt_buf()
2079 mbedtls_platform_zeroize(mac_peer, transform->maclen); in mbedtls_ssl_decrypt_buf()
2080 mbedtls_platform_zeroize(mac_expect, transform->maclen); in mbedtls_ssl_decrypt_buf()
2101 if (transform->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { in mbedtls_ssl_decrypt_buf()
2103 ret = ssl_parse_inner_plaintext(data, &rec->data_len, in mbedtls_ssl_decrypt_buf()
2104 &rec->type); in mbedtls_ssl_decrypt_buf()
2113 if (rec->cid_len != 0) { in mbedtls_ssl_decrypt_buf()
2114 ret = ssl_parse_inner_plaintext(data, &rec->data_len, in mbedtls_ssl_decrypt_buf()
2115 &rec->type); in mbedtls_ssl_decrypt_buf()
2133 * The amount of data already fetched is in ssl->in_left.
2139 * With stream transport (TLS) on success ssl->in_left == nb_want, but
2140 * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
2143 * For DTLS, it is up to the caller to set ssl->next_record_offset when
2151 size_t in_buf_len = ssl->in_buf_len; in mbedtls_ssl_fetch_input()
2158 if (ssl->f_recv == NULL && ssl->f_recv_timeout == NULL) { in mbedtls_ssl_fetch_input()
2163 if (nb_want > in_buf_len - (size_t) (ssl->in_hdr - ssl->in_buf)) { in mbedtls_ssl_fetch_input()
2169 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_fetch_input()
2182 if (ssl->next_record_offset != 0) { in mbedtls_ssl_fetch_input()
2183 if (ssl->in_left < ssl->next_record_offset) { in mbedtls_ssl_fetch_input()
2188 ssl->in_left -= ssl->next_record_offset; in mbedtls_ssl_fetch_input()
2190 if (ssl->in_left != 0) { in mbedtls_ssl_fetch_input()
2193 ssl->next_record_offset)); in mbedtls_ssl_fetch_input()
2194 memmove(ssl->in_hdr, in mbedtls_ssl_fetch_input()
2195 ssl->in_hdr + ssl->next_record_offset, in mbedtls_ssl_fetch_input()
2196 ssl->in_left); in mbedtls_ssl_fetch_input()
2199 ssl->next_record_offset = 0; in mbedtls_ssl_fetch_input()
2204 ssl->in_left, nb_want)); in mbedtls_ssl_fetch_input()
2209 if (nb_want <= ssl->in_left) { in mbedtls_ssl_fetch_input()
2219 if (ssl->in_left != 0) { in mbedtls_ssl_fetch_input()
2226 * This avoids by-passing the timer when repeatedly receiving messages in mbedtls_ssl_fetch_input()
2233 len = in_buf_len - (size_t) (ssl->in_hdr - ssl->in_buf); in mbedtls_ssl_fetch_input()
2236 timeout = ssl->handshake->retransmit_timeout; in mbedtls_ssl_fetch_input()
2238 timeout = ssl->conf->read_timeout; in mbedtls_ssl_fetch_input()
2243 if (ssl->f_recv_timeout != NULL) { in mbedtls_ssl_fetch_input()
2244 ret = ssl->f_recv_timeout(ssl->p_bio, ssl->in_hdr, len, in mbedtls_ssl_fetch_input()
2247 ret = ssl->f_recv(ssl->p_bio, ssl->in_hdr, len); in mbedtls_ssl_fetch_input()
2250 MBEDTLS_SSL_DEBUG_RET(2, "ssl->f_recv(_timeout)", ret); in mbedtls_ssl_fetch_input()
2261 if (ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER) { in mbedtls_ssl_fetch_input()
2275 else if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && in mbedtls_ssl_fetch_input()
2276 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING) { in mbedtls_ssl_fetch_input()
2292 ssl->in_left = ret; in mbedtls_ssl_fetch_input()
2298 ssl->in_left, nb_want)); in mbedtls_ssl_fetch_input()
2300 while (ssl->in_left < nb_want) { in mbedtls_ssl_fetch_input()
2301 len = nb_want - ssl->in_left; in mbedtls_ssl_fetch_input()
2306 if (ssl->f_recv_timeout != NULL) { in mbedtls_ssl_fetch_input()
2307 ret = ssl->f_recv_timeout(ssl->p_bio, in mbedtls_ssl_fetch_input()
2308 ssl->in_hdr + ssl->in_left, len, in mbedtls_ssl_fetch_input()
2309 ssl->conf->read_timeout); in mbedtls_ssl_fetch_input()
2311 ret = ssl->f_recv(ssl->p_bio, in mbedtls_ssl_fetch_input()
2312 ssl->in_hdr + ssl->in_left, len); in mbedtls_ssl_fetch_input()
2318 ssl->in_left, nb_want)); in mbedtls_ssl_fetch_input()
2319 MBEDTLS_SSL_DEBUG_RET(2, "ssl->f_recv(_timeout)", ret); in mbedtls_ssl_fetch_input()
2337 ssl->in_left += ret; in mbedtls_ssl_fetch_input()
2356 if (ssl->f_send == NULL) { in mbedtls_ssl_flush_output()
2362 if (ssl->out_left == 0) { in mbedtls_ssl_flush_output()
2367 while (ssl->out_left > 0) { in mbedtls_ssl_flush_output()
2370 mbedtls_ssl_out_hdr_len(ssl) + ssl->out_msglen, ssl->out_left)); in mbedtls_ssl_flush_output()
2372 buf = ssl->out_hdr - ssl->out_left; in mbedtls_ssl_flush_output()
2373 ret = ssl->f_send(ssl->p_bio, buf, ssl->out_left); in mbedtls_ssl_flush_output()
2375 MBEDTLS_SSL_DEBUG_RET(2, "ssl->f_send", ret); in mbedtls_ssl_flush_output()
2381 if ((size_t) ret > ssl->out_left) { in mbedtls_ssl_flush_output()
2385 ret, ssl->out_left)); in mbedtls_ssl_flush_output()
2389 ssl->out_left -= ret; in mbedtls_ssl_flush_output()
2393 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_flush_output()
2394 ssl->out_hdr = ssl->out_buf; in mbedtls_ssl_flush_output()
2398 ssl->out_hdr = ssl->out_buf + 8; in mbedtls_ssl_flush_output()
2400 mbedtls_ssl_update_out_pointers(ssl, ssl->transform_out); in mbedtls_ssl_flush_output()
2420 ssl->out_msg, ssl->out_msglen); in ssl_flight_append()
2429 if ((msg->p = mbedtls_calloc(1, ssl->out_msglen)) == NULL) { in ssl_flight_append()
2431 ssl->out_msglen)); in ssl_flight_append()
2437 memcpy(msg->p, ssl->out_msg, ssl->out_msglen); in ssl_flight_append()
2438 msg->len = ssl->out_msglen; in ssl_flight_append()
2439 msg->type = ssl->out_msgtype; in ssl_flight_append()
2440 msg->next = NULL; in ssl_flight_append()
2443 if (ssl->handshake->flight == NULL) { in ssl_flight_append()
2444 ssl->handshake->flight = msg; in ssl_flight_append()
2446 mbedtls_ssl_flight_item *cur = ssl->handshake->flight; in ssl_flight_append()
2447 while (cur->next != NULL) { in ssl_flight_append()
2448 cur = cur->next; in ssl_flight_append()
2450 cur->next = msg; in ssl_flight_append()
2466 next = cur->next; in mbedtls_ssl_flight_free()
2468 mbedtls_free(cur->p); in mbedtls_ssl_flight_free()
2484 if (ssl->transform_out == ssl->handshake->alt_transform_out) { in ssl_swap_epochs()
2492 tmp_transform = ssl->transform_out; in ssl_swap_epochs()
2493 ssl->transform_out = ssl->handshake->alt_transform_out; in ssl_swap_epochs()
2494 ssl->handshake->alt_transform_out = tmp_transform; in ssl_swap_epochs()
2497 memcpy(tmp_out_ctr, ssl->cur_out_ctr, sizeof(tmp_out_ctr)); in ssl_swap_epochs()
2498 memcpy(ssl->cur_out_ctr, ssl->handshake->alt_out_ctr, in ssl_swap_epochs()
2499 sizeof(ssl->cur_out_ctr)); in ssl_swap_epochs()
2500 memcpy(ssl->handshake->alt_out_ctr, tmp_out_ctr, in ssl_swap_epochs()
2501 sizeof(ssl->handshake->alt_out_ctr)); in ssl_swap_epochs()
2504 mbedtls_ssl_update_out_pointers(ssl, ssl->transform_out); in ssl_swap_epochs()
2537 if (ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING) { in mbedtls_ssl_flight_transmit()
2540 ssl->handshake->cur_msg = ssl->handshake->flight; in mbedtls_ssl_flight_transmit()
2541 ssl->handshake->cur_msg_p = ssl->handshake->flight->p + 12; in mbedtls_ssl_flight_transmit()
2547 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING; in mbedtls_ssl_flight_transmit()
2550 while (ssl->handshake->cur_msg != NULL) { in mbedtls_ssl_flight_transmit()
2552 const mbedtls_ssl_flight_item * const cur = ssl->handshake->cur_msg; in mbedtls_ssl_flight_transmit()
2555 (cur->type == MBEDTLS_SSL_MSG_HANDSHAKE && in mbedtls_ssl_flight_transmit()
2556 cur->p[0] == MBEDTLS_SSL_HS_FINISHED); in mbedtls_ssl_flight_transmit()
2558 int const force_flush = ssl->disable_datagram_packing == 1 ? in mbedtls_ssl_flight_transmit()
2564 if (is_finished && ssl->handshake->cur_msg_p == (cur->p + 12)) { in mbedtls_ssl_flight_transmit()
2579 if (cur->type == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC) { in mbedtls_ssl_flight_transmit()
2588 memcpy(ssl->out_msg, cur->p, cur->len); in mbedtls_ssl_flight_transmit()
2589 ssl->out_msglen = cur->len; in mbedtls_ssl_flight_transmit()
2590 ssl->out_msgtype = cur->type; in mbedtls_ssl_flight_transmit()
2593 ssl->handshake->cur_msg_p += cur->len; in mbedtls_ssl_flight_transmit()
2595 const unsigned char * const p = ssl->handshake->cur_msg_p; in mbedtls_ssl_flight_transmit()
2596 const size_t hs_len = cur->len - 12; in mbedtls_ssl_flight_transmit()
2597 const size_t frag_off = (size_t) (p - (cur->p + 12)); in mbedtls_ssl_flight_transmit()
2598 const size_t rem_len = hs_len - frag_off; in mbedtls_ssl_flight_transmit()
2615 max_hs_frag_len = max_frag_len - 12; in mbedtls_ssl_flight_transmit()
2629 memcpy(ssl->out_msg, cur->p, 6); in mbedtls_ssl_flight_transmit()
2631 ssl->out_msg[6] = MBEDTLS_BYTE_2(frag_off); in mbedtls_ssl_flight_transmit()
2632 ssl->out_msg[7] = MBEDTLS_BYTE_1(frag_off); in mbedtls_ssl_flight_transmit()
2633 ssl->out_msg[8] = MBEDTLS_BYTE_0(frag_off); in mbedtls_ssl_flight_transmit()
2635 ssl->out_msg[9] = MBEDTLS_BYTE_2(cur_hs_frag_len); in mbedtls_ssl_flight_transmit()
2636 ssl->out_msg[10] = MBEDTLS_BYTE_1(cur_hs_frag_len); in mbedtls_ssl_flight_transmit()
2637 ssl->out_msg[11] = MBEDTLS_BYTE_0(cur_hs_frag_len); in mbedtls_ssl_flight_transmit()
2639 MBEDTLS_SSL_DEBUG_BUF(3, "handshake header", ssl->out_msg, 12); in mbedtls_ssl_flight_transmit()
2642 memcpy(ssl->out_msg + 12, p, cur_hs_frag_len); in mbedtls_ssl_flight_transmit()
2643 ssl->out_msglen = cur_hs_frag_len + 12; in mbedtls_ssl_flight_transmit()
2644 ssl->out_msgtype = cur->type; in mbedtls_ssl_flight_transmit()
2647 ssl->handshake->cur_msg_p += cur_hs_frag_len; in mbedtls_ssl_flight_transmit()
2651 if (ssl->handshake->cur_msg_p >= cur->p + cur->len) { in mbedtls_ssl_flight_transmit()
2652 if (cur->next != NULL) { in mbedtls_ssl_flight_transmit()
2653 ssl->handshake->cur_msg = cur->next; in mbedtls_ssl_flight_transmit()
2654 ssl->handshake->cur_msg_p = cur->next->p + 12; in mbedtls_ssl_flight_transmit()
2656 ssl->handshake->cur_msg = NULL; in mbedtls_ssl_flight_transmit()
2657 ssl->handshake->cur_msg_p = NULL; in mbedtls_ssl_flight_transmit()
2674 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED; in mbedtls_ssl_flight_transmit()
2676 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING; in mbedtls_ssl_flight_transmit()
2677 mbedtls_ssl_set_timer(ssl, ssl->handshake->retransmit_timeout); in mbedtls_ssl_flight_transmit()
2691 mbedtls_ssl_flight_free(ssl->handshake->flight); in mbedtls_ssl_recv_flight_completed()
2692 ssl->handshake->flight = NULL; in mbedtls_ssl_recv_flight_completed()
2693 ssl->handshake->cur_msg = NULL; in mbedtls_ssl_recv_flight_completed()
2696 ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq; in mbedtls_ssl_recv_flight_completed()
2699 ssl->handshake->buffering.seen_ccs = 0; in mbedtls_ssl_recv_flight_completed()
2707 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE && in mbedtls_ssl_recv_flight_completed()
2708 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED) { in mbedtls_ssl_recv_flight_completed()
2709 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED; in mbedtls_ssl_recv_flight_completed()
2711 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING; in mbedtls_ssl_recv_flight_completed()
2721 mbedtls_ssl_set_timer(ssl, ssl->handshake->retransmit_timeout); in mbedtls_ssl_send_flight_completed()
2723 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE && in mbedtls_ssl_send_flight_completed()
2724 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED) { in mbedtls_ssl_send_flight_completed()
2725 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED; in mbedtls_ssl_send_flight_completed()
2727 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING; in mbedtls_ssl_send_flight_completed()
2745 *buf = ssl->out_msg + 4; in mbedtls_ssl_start_handshake_msg()
2746 *buf_len = MBEDTLS_SSL_OUT_CONTENT_LEN - 4; in mbedtls_ssl_start_handshake_msg()
2748 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; in mbedtls_ssl_start_handshake_msg()
2749 ssl->out_msg[0] = hs_type; in mbedtls_ssl_start_handshake_msg()
2757 * - fill in handshake headers
2758 * - update handshake checksum
2759 * - DTLS: save message for resending
2760 * - then pass to the record layer
2766 * - ssl->out_msglen: 4 + actual handshake message len
2768 * - ssl->out_msg[0]: the handshake type (ClientHello, ServerHello, etc)
2769 * - ssl->out_msg + 4: the handshake message body
2772 * - ssl->out_msglen: the length of the record contents
2774 * - ssl->out_msg: the record contents (handshake headers + content)
2781 const size_t hs_len = ssl->out_msglen - 4; in mbedtls_ssl_write_handshake_msg_ext()
2782 const unsigned char hs_type = ssl->out_msg[0]; in mbedtls_ssl_write_handshake_msg_ext()
2789 if (ssl->out_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE && in mbedtls_ssl_write_handshake_msg_ext()
2790 ssl->out_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC) { in mbedtls_ssl_write_handshake_msg_ext()
2796 * HelloRequest we should be in a handshake - double check. */ in mbedtls_ssl_write_handshake_msg_ext()
2797 if (!(ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE && in mbedtls_ssl_write_handshake_msg_ext()
2799 ssl->handshake == NULL) { in mbedtls_ssl_write_handshake_msg_ext()
2805 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in mbedtls_ssl_write_handshake_msg_ext()
2806 ssl->handshake != NULL && in mbedtls_ssl_write_handshake_msg_ext()
2807 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING) { in mbedtls_ssl_write_handshake_msg_ext()
2813 /* Double-check that we did not exceed the bounds in mbedtls_ssl_write_handshake_msg_ext()
2821 if (ssl->out_msglen > MBEDTLS_SSL_OUT_CONTENT_LEN) { in mbedtls_ssl_write_handshake_msg_ext()
2825 ssl->out_msglen, in mbedtls_ssl_write_handshake_msg_ext()
2833 if (ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE) { in mbedtls_ssl_write_handshake_msg_ext()
2834 ssl->out_msg[1] = MBEDTLS_BYTE_2(hs_len); in mbedtls_ssl_write_handshake_msg_ext()
2835 ssl->out_msg[2] = MBEDTLS_BYTE_1(hs_len); in mbedtls_ssl_write_handshake_msg_ext()
2836 ssl->out_msg[3] = MBEDTLS_BYTE_0(hs_len); in mbedtls_ssl_write_handshake_msg_ext()
2846 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_write_handshake_msg_ext()
2848 if (MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen < 8) { in mbedtls_ssl_write_handshake_msg_ext()
2853 (size_t) (MBEDTLS_SSL_OUT_CONTENT_LEN - 12))); in mbedtls_ssl_write_handshake_msg_ext()
2857 memmove(ssl->out_msg + 12, ssl->out_msg + 4, hs_len); in mbedtls_ssl_write_handshake_msg_ext()
2858 ssl->out_msglen += 8; in mbedtls_ssl_write_handshake_msg_ext()
2862 MBEDTLS_PUT_UINT16_BE(ssl->handshake->out_msg_seq, ssl->out_msg, 4); in mbedtls_ssl_write_handshake_msg_ext()
2863 ++(ssl->handshake->out_msg_seq); in mbedtls_ssl_write_handshake_msg_ext()
2865 ssl->out_msg[4] = 0; in mbedtls_ssl_write_handshake_msg_ext()
2866 ssl->out_msg[5] = 0; in mbedtls_ssl_write_handshake_msg_ext()
2871 memset(ssl->out_msg + 6, 0x00, 3); in mbedtls_ssl_write_handshake_msg_ext()
2872 memcpy(ssl->out_msg + 9, ssl->out_msg + 1, 3); in mbedtls_ssl_write_handshake_msg_ext()
2878 ret = ssl->handshake->update_checksum(ssl, ssl->out_msg, in mbedtls_ssl_write_handshake_msg_ext()
2879 ssl->out_msglen); in mbedtls_ssl_write_handshake_msg_ext()
2889 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in mbedtls_ssl_write_handshake_msg_ext()
2890 !(ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE && in mbedtls_ssl_write_handshake_msg_ext()
2919 ssl->out_msglen = msg_with_header_len; in mbedtls_ssl_finish_handshake_msg()
2934 * - ssl->out_msgtype: type of the message (AppData, Handshake, Alert, CCS)
2935 * - ssl->out_msglen: length of the record content (excl headers)
2936 * - ssl->out_msg: record content
2941 size_t len = ssl->out_msglen; in mbedtls_ssl_write_record()
2950 size_t out_buf_len = ssl->out_buf_len; in mbedtls_ssl_write_record()
2956 mbedtls_ssl_protocol_version tls_ver = ssl->tls_version; in mbedtls_ssl_write_record()
2964 mbedtls_ssl_write_version(ssl->out_hdr + 1, ssl->conf->transport, in mbedtls_ssl_write_record()
2967 memcpy(ssl->out_ctr, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN); in mbedtls_ssl_write_record()
2968 MBEDTLS_PUT_UINT16_BE(len, ssl->out_len, 0); in mbedtls_ssl_write_record()
2970 if (ssl->transform_out != NULL) { in mbedtls_ssl_write_record()
2973 rec.buf = ssl->out_iv; in mbedtls_ssl_write_record()
2974 rec.buf_len = out_buf_len - (size_t) (ssl->out_iv - ssl->out_buf); in mbedtls_ssl_write_record()
2975 rec.data_len = ssl->out_msglen; in mbedtls_ssl_write_record()
2976 rec.data_offset = (size_t) (ssl->out_msg - rec.buf); in mbedtls_ssl_write_record()
2978 memcpy(&rec.ctr[0], ssl->out_ctr, sizeof(rec.ctr)); in mbedtls_ssl_write_record()
2979 mbedtls_ssl_write_version(rec.ver, ssl->conf->transport, tls_ver); in mbedtls_ssl_write_record()
2980 rec.type = ssl->out_msgtype; in mbedtls_ssl_write_record()
2987 if ((ret = mbedtls_ssl_encrypt_buf(ssl, ssl->transform_out, &rec, in mbedtls_ssl_write_record()
2988 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { in mbedtls_ssl_write_record()
2999 ssl->out_msgtype = rec.type; in mbedtls_ssl_write_record()
3001 memcpy(ssl->out_cid, rec.cid, rec.cid_len); in mbedtls_ssl_write_record()
3003 ssl->out_msglen = len = rec.data_len; in mbedtls_ssl_write_record()
3004 MBEDTLS_PUT_UINT16_BE(rec.data_len, ssl->out_len, 0); in mbedtls_ssl_write_record()
3010 /* In case of DTLS, double-check that we don't exceed in mbedtls_ssl_write_record()
3012 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_write_record()
3026 ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype; in mbedtls_ssl_write_record()
3030 ssl->out_hdr[0], ssl->out_hdr[1], in mbedtls_ssl_write_record()
3031 ssl->out_hdr[2], len)); in mbedtls_ssl_write_record()
3034 ssl->out_hdr, protected_record_size); in mbedtls_ssl_write_record()
3036 ssl->out_left += protected_record_size; in mbedtls_ssl_write_record()
3037 ssl->out_hdr += protected_record_size; in mbedtls_ssl_write_record()
3038 mbedtls_ssl_update_out_pointers(ssl, ssl->transform_out); in mbedtls_ssl_write_record()
3040 for (i = 8; i > mbedtls_ssl_ep_len(ssl); i--) { in mbedtls_ssl_write_record()
3041 if (++ssl->cur_out_ctr[i - 1] != 0) { in mbedtls_ssl_write_record()
3054 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in mbedtls_ssl_write_record()
3091 if (ssl->in_msglen < ssl->in_hslen || in ssl_hs_is_proper_fragment()
3092 memcmp(ssl->in_msg + 6, "\0\0\0", 3) != 0 || in ssl_hs_is_proper_fragment()
3093 memcmp(ssl->in_msg + 9, ssl->in_msg + 1, 3) != 0) { in ssl_hs_is_proper_fragment()
3101 return MBEDTLS_GET_UINT24_BE(ssl->in_msg, 9); in ssl_get_hs_frag_len()
3106 return MBEDTLS_GET_UINT24_BE(ssl->in_msg, 6); in ssl_get_hs_frag_off()
3119 return -1; in ssl_check_hs_header()
3122 if (frag_len > msg_len - frag_off) { in ssl_check_hs_header()
3123 return -1; in ssl_check_hs_header()
3126 if (frag_len + 12 > ssl->in_msglen) { in ssl_check_hs_header()
3127 return -1; in ssl_check_hs_header()
3140 start_bits = 8 - (offset % 8); in ssl_bitmask_set()
3146 for (; len != 0; len--) { in ssl_bitmask_set()
3147 mask[first_byte_idx] |= 1 << (start_bits - len); in ssl_bitmask_set()
3155 len -= start_bits; in ssl_bitmask_set()
3157 for (; start_bits != 0; start_bits--) { in ssl_bitmask_set()
3158 mask[first_byte_idx] |= 1 << (start_bits - 1); in ssl_bitmask_set()
3166 len -= end_bits; /* Now len % 8 == 0 */ in ssl_bitmask_set()
3168 for (; end_bits != 0; end_bits--) { in ssl_bitmask_set()
3169 mask[last_byte_idx] |= 1 << (8 - end_bits); in ssl_bitmask_set()
3186 return -1; in ssl_bitmask_check()
3191 if ((mask[len / 8] & (1 << (7 - i))) == 0) { in ssl_bitmask_check()
3192 return -1; in ssl_bitmask_check()
3219 return MBEDTLS_GET_UINT24_BE(ssl->in_msg, 1); in ssl_get_hs_total_len()
3224 if (ssl->badmac_seen_or_in_hsfraglen == 0) { in mbedtls_ssl_prepare_handshake_record()
3230 if (ssl->in_msglen < mbedtls_ssl_hs_hdr_len(ssl)) { in mbedtls_ssl_prepare_handshake_record()
3232 ssl->in_msglen)); in mbedtls_ssl_prepare_handshake_record()
3236 ssl->in_hslen = mbedtls_ssl_hs_hdr_len(ssl) + ssl_get_hs_total_len(ssl); in mbedtls_ssl_prepare_handshake_record()
3242 ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen)); in mbedtls_ssl_prepare_handshake_record()
3244 if (ssl->transform_in != NULL) { in mbedtls_ssl_prepare_handshake_record()
3246 " iv-buf=%d hdr-buf=%d hdr-buf=%d", in mbedtls_ssl_prepare_handshake_record()
3247 (int) (ssl->in_iv - ssl->in_buf), in mbedtls_ssl_prepare_handshake_record()
3248 (int) (ssl->in_hdr - ssl->in_buf), in mbedtls_ssl_prepare_handshake_record()
3249 (int) (ssl->in_msg - ssl->in_buf))); in mbedtls_ssl_prepare_handshake_record()
3253 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_prepare_handshake_record()
3255 unsigned int recv_msg_seq = MBEDTLS_GET_UINT16_BE(ssl->in_msg, 4); in mbedtls_ssl_prepare_handshake_record()
3262 if (ssl->handshake != NULL && in mbedtls_ssl_prepare_handshake_record()
3264 recv_msg_seq != ssl->handshake->in_msg_seq) || in mbedtls_ssl_prepare_handshake_record()
3266 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO))) { in mbedtls_ssl_prepare_handshake_record()
3267 if (recv_msg_seq > ssl->handshake->in_msg_seq) { in mbedtls_ssl_prepare_handshake_record()
3272 ssl->handshake->in_msg_seq)); in mbedtls_ssl_prepare_handshake_record()
3279 if (recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 && in mbedtls_ssl_prepare_handshake_record()
3280 ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST) { in mbedtls_ssl_prepare_handshake_record()
3284 ssl->handshake->in_flight_start_seq)); in mbedtls_ssl_prepare_handshake_record()
3291 MBEDTLS_SSL_DEBUG_MSG(2, ("dropping out-of-sequence message: " in mbedtls_ssl_prepare_handshake_record()
3294 ssl->handshake->in_msg_seq)); in mbedtls_ssl_prepare_handshake_record()
3313 ssl->in_buf + MBEDTLS_SSL_SEQUENCE_NUMBER_LEN; in mbedtls_ssl_prepare_handshake_record()
3316 unsigned char *payload_end = payload_start + ssl->badmac_seen_or_in_hsfraglen; in mbedtls_ssl_prepare_handshake_record()
3318 const size_t hs_remain = ssl->in_hslen - ssl->badmac_seen_or_in_hsfraglen; in mbedtls_ssl_prepare_handshake_record()
3325 ssl->in_msglen > hs_remain ? hs_remain : ssl->in_msglen; in mbedtls_ssl_prepare_handshake_record()
3331 (ssl->badmac_seen_or_in_hsfraglen != 0 ? in mbedtls_ssl_prepare_handshake_record()
3333 hs_this_fragment_len == ssl->in_hslen ? in mbedtls_ssl_prepare_handshake_record()
3336 ssl->in_msglen, in mbedtls_ssl_prepare_handshake_record()
3337 ssl->badmac_seen_or_in_hsfraglen, in mbedtls_ssl_prepare_handshake_record()
3338 ssl->badmac_seen_or_in_hsfraglen + in mbedtls_ssl_prepare_handshake_record()
3340 ssl->in_hslen)); in mbedtls_ssl_prepare_handshake_record()
3345 * - When receiving a non-initial handshake fragment, append it to in mbedtls_ssl_prepare_handshake_record()
3347 * - Even the initial handshake fragment is moved, if it was in mbedtls_ssl_prepare_handshake_record()
3353 size_t const in_buf_len = ssl->in_buf_len; in mbedtls_ssl_prepare_handshake_record()
3357 if (payload_end + ssl->in_msglen > ssl->in_buf + in_buf_len) { in mbedtls_ssl_prepare_handshake_record()
3362 ssl->in_msglen, in mbedtls_ssl_prepare_handshake_record()
3363 (void *) ssl->in_msg, (void *) payload_end, in mbedtls_ssl_prepare_handshake_record()
3364 (void *) ssl->in_buf, in_buf_len)); in mbedtls_ssl_prepare_handshake_record()
3367 memmove(payload_end, ssl->in_msg, ssl->in_msglen); in mbedtls_ssl_prepare_handshake_record()
3369 ssl->badmac_seen_or_in_hsfraglen += (unsigned) ssl->in_msglen; in mbedtls_ssl_prepare_handshake_record()
3370 payload_end += ssl->in_msglen; in mbedtls_ssl_prepare_handshake_record()
3372 if (ssl->badmac_seen_or_in_hsfraglen < ssl->in_hslen) { in mbedtls_ssl_prepare_handshake_record()
3375 ssl->badmac_seen_or_in_hsfraglen, ssl->in_hslen)); in mbedtls_ssl_prepare_handshake_record()
3376 ssl->in_hdr = payload_end; in mbedtls_ssl_prepare_handshake_record()
3377 ssl->in_msglen = 0; in mbedtls_ssl_prepare_handshake_record()
3381 ssl->in_msglen = ssl->badmac_seen_or_in_hsfraglen; in mbedtls_ssl_prepare_handshake_record()
3382 ssl->badmac_seen_or_in_hsfraglen = 0; in mbedtls_ssl_prepare_handshake_record()
3383 ssl->in_hdr = reassembled_record_start; in mbedtls_ssl_prepare_handshake_record()
3387 if (ssl->in_msglen > 0xffff) { in mbedtls_ssl_prepare_handshake_record()
3391 ssl->in_msglen)); in mbedtls_ssl_prepare_handshake_record()
3394 MBEDTLS_PUT_UINT16_BE(ssl->in_msglen, ssl->in_len, 0); in mbedtls_ssl_prepare_handshake_record()
3396 size_t record_len = mbedtls_ssl_in_hdr_len(ssl) + ssl->in_msglen; in mbedtls_ssl_prepare_handshake_record()
3399 ssl->in_hdr, record_len); in mbedtls_ssl_prepare_handshake_record()
3400 if (ssl->in_hslen < ssl->in_msglen) { in mbedtls_ssl_prepare_handshake_record()
3404 ssl->in_hslen, in mbedtls_ssl_prepare_handshake_record()
3405 ssl->in_msglen - ssl->in_hslen)); in mbedtls_ssl_prepare_handshake_record()
3416 mbedtls_ssl_handshake_params * const hs = ssl->handshake; in mbedtls_ssl_update_handshake_status()
3419 ret = ssl->handshake->update_checksum(ssl, ssl->in_msg, ssl->in_hslen); in mbedtls_ssl_update_handshake_status()
3428 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in mbedtls_ssl_update_handshake_status()
3429 ssl->handshake != NULL) { in mbedtls_ssl_update_handshake_status()
3434 hs->in_msg_seq++; in mbedtls_ssl_update_handshake_status()
3444 for (offset = 0, hs_buf = &hs->buffering.hs[0]; in mbedtls_ssl_update_handshake_status()
3458 * DTLS anti-replay: RFC 6347 4.1.2.6
3461 * Bit n is set iff record number in_window_top - n has been seen.
3470 ssl->in_window_top = 0; in mbedtls_ssl_dtls_replay_reset()
3471 ssl->in_window = 0; in mbedtls_ssl_dtls_replay_reset()
3491 original_in_ctr = ssl->in_ctr; in mbedtls_ssl_dtls_record_replay_check()
3494 ssl->in_ctr = record_in_ctr; in mbedtls_ssl_dtls_record_replay_check()
3498 // restore the counter in mbedtls_ssl_dtls_record_replay_check()
3499 ssl->in_ctr = original_in_ctr; in mbedtls_ssl_dtls_record_replay_check()
3505 * Return 0 if sequence number is acceptable, -1 otherwise
3509 uint64_t rec_seqnum = ssl_load_six_bytes(ssl->in_ctr + 2); in mbedtls_ssl_dtls_replay_check()
3512 if (ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED) { in mbedtls_ssl_dtls_replay_check()
3516 if (rec_seqnum > ssl->in_window_top) { in mbedtls_ssl_dtls_replay_check()
3520 bit = ssl->in_window_top - rec_seqnum; in mbedtls_ssl_dtls_replay_check()
3523 return -1; in mbedtls_ssl_dtls_replay_check()
3526 if ((ssl->in_window & ((uint64_t) 1 << bit)) != 0) { in mbedtls_ssl_dtls_replay_check()
3527 return -1; in mbedtls_ssl_dtls_replay_check()
3538 uint64_t rec_seqnum = ssl_load_six_bytes(ssl->in_ctr + 2); in mbedtls_ssl_dtls_replay_update()
3540 if (ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED) { in mbedtls_ssl_dtls_replay_update()
3544 if (rec_seqnum > ssl->in_window_top) { in mbedtls_ssl_dtls_replay_update()
3546 uint64_t shift = rec_seqnum - ssl->in_window_top; in mbedtls_ssl_dtls_replay_update()
3549 ssl->in_window = 1; in mbedtls_ssl_dtls_replay_update()
3551 ssl->in_window <<= shift; in mbedtls_ssl_dtls_replay_update()
3552 ssl->in_window |= 1; in mbedtls_ssl_dtls_replay_update()
3555 ssl->in_window_top = rec_seqnum; in mbedtls_ssl_dtls_replay_update()
3558 uint64_t bit = ssl->in_window_top - rec_seqnum; in mbedtls_ssl_dtls_replay_update()
3561 ssl->in_window |= (uint64_t) 1 << bit; in mbedtls_ssl_dtls_replay_update()
3573 * - if cookie is valid, return 0
3574 * - if ClientHello looks superficially valid but cookie is not,
3577 * - otherwise return a specific error code
3593 * done when actually parsing the ClientHello - skipping those checks in mbedtls_ssl_check_dtls_clihlo_cookie()
3596 * 0-0 ContentType type; copied, must be handshake in mbedtls_ssl_check_dtls_clihlo_cookie()
3597 * 1-2 ProtocolVersion version; copied in mbedtls_ssl_check_dtls_clihlo_cookie()
3598 * 3-4 uint16 epoch; copied, must be 0 in mbedtls_ssl_check_dtls_clihlo_cookie()
3599 * 5-10 uint48 sequence_number; copied in mbedtls_ssl_check_dtls_clihlo_cookie()
3600 * 11-12 uint16 length; (ignored) in mbedtls_ssl_check_dtls_clihlo_cookie()
3602 * 13-13 HandshakeType msg_type; (ignored) in mbedtls_ssl_check_dtls_clihlo_cookie()
3603 * 14-16 uint24 length; (ignored) in mbedtls_ssl_check_dtls_clihlo_cookie()
3604 * 17-18 uint16 message_seq; copied in mbedtls_ssl_check_dtls_clihlo_cookie()
3605 * 19-21 uint24 fragment_offset; copied, must be 0 in mbedtls_ssl_check_dtls_clihlo_cookie()
3606 * 22-24 uint24 fragment_length; (ignored) in mbedtls_ssl_check_dtls_clihlo_cookie()
3608 * 25-26 ProtocolVersion client_version; (ignored) in mbedtls_ssl_check_dtls_clihlo_cookie()
3609 * 27-58 Random random; (ignored) in mbedtls_ssl_check_dtls_clihlo_cookie()
3610 * 59-xx SessionID session_id; 1 byte len + sid_len content in mbedtls_ssl_check_dtls_clihlo_cookie()
3611 * 60+ opaque cookie<0..2^8-1>; 1 byte len + content in mbedtls_ssl_check_dtls_clihlo_cookie()
3640 (unsigned) in_len - 61)); in mbedtls_ssl_check_dtls_clihlo_cookie()
3650 (unsigned) (in_len - sid_len - 61))); in mbedtls_ssl_check_dtls_clihlo_cookie()
3656 if (ssl->conf->f_cookie_check(ssl->conf->p_cookie, in mbedtls_ssl_check_dtls_clihlo_cookie()
3666 * 0-0 ContentType type; copied in mbedtls_ssl_check_dtls_clihlo_cookie()
3667 * 1-2 ProtocolVersion version; copied in mbedtls_ssl_check_dtls_clihlo_cookie()
3668 * 3-4 uint16 epoch; copied in mbedtls_ssl_check_dtls_clihlo_cookie()
3669 * 5-10 uint48 sequence_number; copied in mbedtls_ssl_check_dtls_clihlo_cookie()
3670 * 11-12 uint16 length; olen - 13 in mbedtls_ssl_check_dtls_clihlo_cookie()
3672 * 13-13 HandshakeType msg_type; hello_verify_request in mbedtls_ssl_check_dtls_clihlo_cookie()
3673 * 14-16 uint24 length; olen - 25 in mbedtls_ssl_check_dtls_clihlo_cookie()
3674 * 17-18 uint16 message_seq; copied in mbedtls_ssl_check_dtls_clihlo_cookie()
3675 * 19-21 uint24 fragment_offset; copied in mbedtls_ssl_check_dtls_clihlo_cookie()
3676 * 22-24 uint24 fragment_length; olen - 25 in mbedtls_ssl_check_dtls_clihlo_cookie()
3678 * 25-26 ProtocolVersion server_version; 0xfe 0xff in mbedtls_ssl_check_dtls_clihlo_cookie()
3679 * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie in mbedtls_ssl_check_dtls_clihlo_cookie()
3695 if (ssl->conf->f_cookie_write(ssl->conf->p_cookie, in mbedtls_ssl_check_dtls_clihlo_cookie()
3701 *olen = (size_t) (p - obuf); in mbedtls_ssl_check_dtls_clihlo_cookie()
3704 obuf[27] = (unsigned char) (*olen - 28); in mbedtls_ssl_check_dtls_clihlo_cookie()
3706 obuf[14] = obuf[22] = MBEDTLS_BYTE_2(*olen - 25); in mbedtls_ssl_check_dtls_clihlo_cookie()
3707 obuf[15] = obuf[23] = MBEDTLS_BYTE_1(*olen - 25); in mbedtls_ssl_check_dtls_clihlo_cookie()
3708 obuf[16] = obuf[24] = MBEDTLS_BYTE_0(*olen - 25); in mbedtls_ssl_check_dtls_clihlo_cookie()
3710 MBEDTLS_PUT_UINT16_BE(*olen - 13, obuf, 11); in mbedtls_ssl_check_dtls_clihlo_cookie()
3722 * - if the input looks like a ClientHello without cookies,
3724 * - if the input looks like a ClientHello with a valid cookie,
3727 * - if anything goes wrong, return a specific error code
3741 if (ssl->conf->f_cookie_write == NULL || in ssl_handle_possible_reconnect()
3742 ssl->conf->f_cookie_check == NULL) { in ssl_handle_possible_reconnect()
3752 ssl->cli_id, ssl->cli_id_len, in ssl_handle_possible_reconnect()
3753 ssl->in_buf, ssl->in_left, in ssl_handle_possible_reconnect()
3754 ssl->out_buf, MBEDTLS_SSL_OUT_CONTENT_LEN, &len); in ssl_handle_possible_reconnect()
3762 ssl->out_buf, len); in ssl_handle_possible_reconnect()
3766 send_ret = ssl->f_send(ssl->p_bio, ssl->out_buf, len); in ssl_handle_possible_reconnect()
3767 MBEDTLS_SSL_DEBUG_RET(2, "ssl->f_send", send_ret); in ssl_handle_possible_reconnect()
3855 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_parse_record_header()
3876 rec->type = buf[rec_hdr_type_offset]; in ssl_parse_record_header()
3880 rec->cid_len = 0; in ssl_parse_record_header()
3882 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in ssl_parse_record_header()
3883 ssl->conf->cid_len != 0 && in ssl_parse_record_header()
3884 rec->type == MBEDTLS_SSL_MSG_CID) { in ssl_parse_record_header()
3900 rec_hdr_cid_len = ssl->conf->cid_len; in ssl_parse_record_header()
3914 rec->cid_len = (uint8_t) rec_hdr_cid_len; in ssl_parse_record_header()
3915 memcpy(rec->cid, buf + rec_hdr_cid_offset, rec_hdr_cid_len); in ssl_parse_record_header()
3919 if (ssl_check_record_type(rec->type)) { in ssl_parse_record_header()
3921 (unsigned) rec->type)); in ssl_parse_record_header()
3929 rec->ver[0] = buf[rec_hdr_version_offset + 0]; in ssl_parse_record_header()
3930 rec->ver[1] = buf[rec_hdr_version_offset + 1]; in ssl_parse_record_header()
3933 ssl->conf->transport); in ssl_parse_record_header()
3935 if (tls_version > ssl->conf->max_tls_version) { in ssl_parse_record_header()
3938 (unsigned) ssl->conf->max_tls_version)); in ssl_parse_record_header()
3947 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_parse_record_header()
3949 memcpy(&rec->ctr[0], buf + rec_hdr_ctr_offset, in ssl_parse_record_header()
3955 memcpy(&rec->ctr[0], ssl->in_ctr, rec_hdr_ctr_len); in ssl_parse_record_header()
3962 rec->data_offset = rec_hdr_len_offset + rec_hdr_len_len; in ssl_parse_record_header()
3963 rec->data_len = MBEDTLS_GET_UINT16_BE(buf, rec_hdr_len_offset); in ssl_parse_record_header()
3964 MBEDTLS_SSL_DEBUG_BUF(4, "input record header", buf, rec->data_offset); in ssl_parse_record_header()
3968 rec->type, (unsigned) tls_version, rec->data_len)); in ssl_parse_record_header()
3970 rec->buf = buf; in ssl_parse_record_header()
3971 rec->buf_len = rec->data_offset + rec->data_len; in ssl_parse_record_header()
3973 if (rec->data_len == 0) { in ssl_parse_record_header()
3979 * DTLS-related tests. in ssl_parse_record_header()
3991 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_parse_record_header()
3992 rec_epoch = MBEDTLS_GET_UINT16_BE(rec->ctr, 0); in ssl_parse_record_header()
3996 if (len < rec->data_offset + rec->data_len) { in ssl_parse_record_header()
4001 (unsigned) (rec->data_offset + rec->data_len))); in ssl_parse_record_header()
4005 /* Records from other, non-matching epochs are silently discarded. in ssl_parse_record_header()
4006 * (The case of same-port Client reconnects must be considered in in ssl_parse_record_header()
4008 if (rec_epoch != ssl->in_epoch) { in ssl_parse_record_header()
4011 ssl->in_epoch, (unsigned long) rec_epoch)); in ssl_parse_record_header()
4015 if (rec_epoch == (unsigned) ssl->in_epoch + 1) { in ssl_parse_record_header()
4026 &rec->ctr[0]) != 0) { in ssl_parse_record_header()
4042 unsigned int rec_epoch = MBEDTLS_GET_UINT16_BE(ssl->in_ctr, 0); in ssl_check_client_reconnect()
4051 ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && in ssl_check_client_reconnect()
4053 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE && in ssl_check_client_reconnect()
4054 ssl->in_left > 13 && in ssl_check_client_reconnect()
4055 ssl->in_buf[13] == MBEDTLS_SSL_HS_CLIENT_HELLO) { in ssl_check_client_reconnect()
4075 rec->buf, rec->buf_len); in ssl_prepare_record_content()
4083 if (ssl->transform_in != NULL && in ssl_prepare_record_content()
4084 ssl->transform_in->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { in ssl_prepare_record_content()
4085 if (rec->type == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC) { in ssl_prepare_record_content()
4091 if (!done && ssl->transform_in != NULL) { in ssl_prepare_record_content()
4092 unsigned char const old_msg_type = rec->type; in ssl_prepare_record_content()
4094 if ((ret = mbedtls_ssl_decrypt_buf(ssl, ssl->transform_in, in ssl_prepare_record_content()
4102 * It is encrypted with early keys and should be ignored as stated in ssl_prepare_record_content()
4105 * "Ignore the extension and return a regular 1-RTT response. The in ssl_prepare_record_content()
4111 * server proceeds as with an ordinary 1-RTT handshake." in ssl_prepare_record_content()
4114 (ssl->discard_early_data_record == in ssl_prepare_record_content()
4119 ret = mbedtls_ssl_tls13_check_early_data_len(ssl, rec->data_len); in ssl_prepare_record_content()
4129 ssl->conf->ignore_unexpected_cid in ssl_prepare_record_content()
4151 if (ssl->discard_early_data_record == in ssl_prepare_record_content()
4153 ssl->discard_early_data_record = MBEDTLS_SSL_EARLY_DATA_NO_DISCARD; in ssl_prepare_record_content()
4157 if (old_msg_type != rec->type) { in ssl_prepare_record_content()
4159 old_msg_type, rec->type)); in ssl_prepare_record_content()
4163 rec->buf + rec->data_offset, rec->data_len); in ssl_prepare_record_content()
4171 * might change during decryption, re-check the record in ssl_prepare_record_content()
4173 if (ssl_check_record_type(rec->type)) { in ssl_prepare_record_content()
4179 if (rec->data_len == 0) { in ssl_prepare_record_content()
4181 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 in ssl_prepare_record_content()
4182 && rec->type != MBEDTLS_SSL_MSG_APPLICATION_DATA) { in ssl_prepare_record_content()
4183 … /* TLS v1.2 explicitly disallows zero-length messages which are not application data */ in ssl_prepare_record_content()
4184 MBEDTLS_SSL_DEBUG_MSG(1, ("invalid zero-length message type: %d", ssl->in_msgtype)); in ssl_prepare_record_content()
4189 ssl->nb_zero++; in ssl_prepare_record_content()
4195 if (ssl->nb_zero > 3) { in ssl_prepare_record_content()
4204 ssl->nb_zero = 0; in ssl_prepare_record_content()
4208 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_prepare_record_content()
4215 i > mbedtls_ssl_ep_len(ssl); i--) { in ssl_prepare_record_content()
4216 if (++ssl->in_ctr[i - 1] != 0) { in ssl_prepare_record_content()
4235 * The early data is encrypted with early keys and should be ignored as in ssl_prepare_record_content()
4244 if (ssl->discard_early_data_record == MBEDTLS_SSL_EARLY_DATA_DISCARD) { in ssl_prepare_record_content()
4245 if (rec->type == MBEDTLS_SSL_MSG_APPLICATION_DATA) { in ssl_prepare_record_content()
4247 ret = mbedtls_ssl_tls13_check_early_data_len(ssl, rec->data_len); in ssl_prepare_record_content()
4256 } else if (rec->type == MBEDTLS_SSL_MSG_HANDSHAKE) { in ssl_prepare_record_content()
4257 ssl->discard_early_data_record = MBEDTLS_SSL_EARLY_DATA_NO_DISCARD; in ssl_prepare_record_content()
4263 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_prepare_record_content()
4270 if (rec->data_len > MBEDTLS_SSL_IN_CONTENT_LEN) { in ssl_prepare_record_content()
4281 * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
4301 if (ssl->keep_current_message == 0) { in mbedtls_ssl_read_record()
4315 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in mbedtls_ssl_read_record()
4358 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE && in mbedtls_ssl_read_record()
4368 ssl->keep_current_message = 0; in mbedtls_ssl_read_record()
4380 if (ssl->in_left > ssl->next_record_offset) { in ssl_next_record_is_in_datagram()
4390 mbedtls_ssl_handshake_params * const hs = ssl->handshake; in ssl_load_buffered_message()
4395 return -1; in ssl_load_buffered_message()
4400 if (ssl->state == MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC || in ssl_load_buffered_message()
4401 ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC) { in ssl_load_buffered_message()
4404 if (!hs->buffering.seen_ccs) { in ssl_load_buffered_message()
4406 ret = -1; in ssl_load_buffered_message()
4411 ssl->in_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC; in ssl_load_buffered_message()
4412 ssl->in_msglen = 1; in ssl_load_buffered_message()
4413 ssl->in_msg[0] = 1; in ssl_load_buffered_message()
4416 ssl->in_left = 0; in ssl_load_buffered_message()
4417 ssl->next_record_offset = 0; in ssl_load_buffered_message()
4419 hs->buffering.seen_ccs = 0; in ssl_load_buffered_message()
4428 hs_buf = &hs->buffering.hs[offset]; in ssl_load_buffered_message()
4429 if (hs_buf->is_valid == 1) { in ssl_load_buffered_message()
4431 hs->in_msg_seq + offset, in ssl_load_buffered_message()
4432 hs_buf->is_complete ? "fully" : "partially")); in ssl_load_buffered_message()
4440 hs_buf = &hs->buffering.hs[0]; in ssl_load_buffered_message()
4441 if ((hs_buf->is_valid == 1) && (hs_buf->is_complete == 1)) { in ssl_load_buffered_message()
4443 size_t msg_len = MBEDTLS_GET_UINT24_BE(hs_buf->data, 1); in ssl_load_buffered_message()
4445 /* Double-check that we haven't accidentally buffered in ssl_load_buffered_message()
4452 MBEDTLS_SSL_DEBUG_MSG(2, ("Next handshake message has been buffered - load")); in ssl_load_buffered_message()
4454 hs_buf->data, msg_len + 12); in ssl_load_buffered_message()
4456 ssl->in_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; in ssl_load_buffered_message()
4457 ssl->in_hslen = msg_len + 12; in ssl_load_buffered_message()
4458 ssl->in_msglen = msg_len + 12; in ssl_load_buffered_message()
4459 memcpy(ssl->in_msg, hs_buf->data, ssl->in_hslen); in ssl_load_buffered_message()
4465 hs->in_msg_seq)); in ssl_load_buffered_message()
4468 ret = -1; in ssl_load_buffered_message()
4481 mbedtls_ssl_handshake_params * const hs = ssl->handshake; in ssl_buffer_make_space()
4489 if (desired <= (MBEDTLS_SSL_DTLS_MAX_BUFFERING - in ssl_buffer_make_space()
4490 hs->buffering.total_bytes_buffered)) { in ssl_buffer_make_space()
4498 for (offset = MBEDTLS_SSL_MAX_BUFFERED_HS - 1; in ssl_buffer_make_space()
4499 offset >= 0; offset--) { in ssl_buffer_make_space()
4508 if (desired <= (MBEDTLS_SSL_DTLS_MAX_BUFFERING - in ssl_buffer_make_space()
4509 hs->buffering.total_bytes_buffered)) { in ssl_buffer_make_space()
4515 return -1; in ssl_buffer_make_space()
4522 mbedtls_ssl_handshake_params * const hs = ssl->handshake; in ssl_buffer_message()
4530 switch (ssl->in_msgtype) { in ssl_buffer_message()
4534 hs->buffering.seen_ccs = 1; in ssl_buffer_message()
4540 unsigned recv_msg_seq = MBEDTLS_GET_UINT16_BE(ssl->in_msg, 4); in ssl_buffer_message()
4542 size_t msg_len = ssl->in_hslen - 12; in ssl_buffer_message()
4545 * message - double-check nonetheless. */ in ssl_buffer_message()
4546 if (recv_msg_seq < ssl->handshake->in_msg_seq) { in ssl_buffer_message()
4551 recv_msg_seq_offset = recv_msg_seq - ssl->handshake->in_msg_seq; in ssl_buffer_message()
4553 /* Silently ignore -- message too far in the future */ in ssl_buffer_message()
4556 "buffering window %u - %u", in ssl_buffer_message()
4557 recv_msg_seq, ssl->handshake->in_msg_seq, in ssl_buffer_message()
4558 ssl->handshake->in_msg_seq + MBEDTLS_SSL_MAX_BUFFERED_HS - in ssl_buffer_message()
4567 hs_buf = &hs->buffering.hs[recv_msg_seq_offset]; in ssl_buffer_message()
4570 if (!hs_buf->is_valid) { in ssl_buffer_message()
4573 hs_buf->is_fragmented = in ssl_buffer_message()
4578 * This is an implementation-specific limitation in ssl_buffer_message()
4587 if (hs->buffering.total_bytes_buffered > in ssl_buffer_message()
4594 hs_buf->is_fragmented); in ssl_buffer_message()
4596 if (reassembly_buf_sz > (MBEDTLS_SSL_DTLS_MAX_BUFFERING - in ssl_buffer_message()
4597 hs->buffering.total_bytes_buffered)) { in ssl_buffer_message()
4600 * of space limitations -- ignore. */ in ssl_buffer_message()
4604 " would exceed the compile-time limit %" in ssl_buffer_message()
4607 " bytes buffered) -- ignore\n", in ssl_buffer_message()
4609 hs->buffering.total_bytes_buffered)); in ssl_buffer_message()
4615 " would exceed the compile-time limit %" in ssl_buffer_message()
4618 … " bytes buffered) -- attempt to make space by freeing buffered future messages\n", in ssl_buffer_message()
4620 hs->buffering.total_bytes_buffered)); in ssl_buffer_message()
4629 " the compile-time limit %" in ssl_buffer_message()
4632 " bytes buffered) -- fail\n", in ssl_buffer_message()
4636 hs->buffering.total_bytes_buffered)); in ssl_buffer_message()
4647 hs_buf->data = mbedtls_calloc(1, reassembly_buf_sz); in ssl_buffer_message()
4648 if (hs_buf->data == NULL) { in ssl_buffer_message()
4652 hs_buf->data_len = reassembly_buf_sz; in ssl_buffer_message()
4656 memcpy(hs_buf->data, ssl->in_msg, 6); in ssl_buffer_message()
4657 memset(hs_buf->data + 6, 0, 3); in ssl_buffer_message()
4658 memcpy(hs_buf->data + 9, hs_buf->data + 1, 3); in ssl_buffer_message()
4660 hs_buf->is_valid = 1; in ssl_buffer_message()
4662 hs->buffering.total_bytes_buffered += reassembly_buf_sz; in ssl_buffer_message()
4665 if (memcmp(hs_buf->data, ssl->in_msg, 4) != 0) { in ssl_buffer_message()
4666 MBEDTLS_SSL_DEBUG_MSG(1, ("Fragment header mismatch - ignore")); in ssl_buffer_message()
4672 if (!hs_buf->is_complete) { in ssl_buffer_message()
4674 unsigned char * const msg = hs_buf->data + 12; in ssl_buffer_message()
4688 memcpy(msg + frag_off, ssl->in_msg + 12, frag_len); in ssl_buffer_message()
4690 if (hs_buf->is_fragmented) { in ssl_buffer_message()
4693 hs_buf->is_complete = (ssl_bitmask_check(bitmask, in ssl_buffer_message()
4696 hs_buf->is_complete = 1; in ssl_buffer_message()
4700 hs_buf->is_complete ? "" : "not yet ")); in ssl_buffer_message()
4722 * Consume last content-layer message and potentially in ssl_consume_current_message()
4737 * Don't do anything - the record layer provides in ssl_consume_current_message()
4744 if (ssl->in_hslen != 0) { in ssl_consume_current_message()
4746 * is in flight, as corrupting ssl->in_msglen during in ssl_consume_current_message()
4747 * ssl->in_offt != NULL is fatal. */ in ssl_consume_current_message()
4748 if (ssl->in_offt != NULL) { in ssl_consume_current_message()
4753 if (ssl->badmac_seen_or_in_hsfraglen != 0) { in ssl_consume_current_message()
4757 ssl->badmac_seen_or_in_hsfraglen, ssl->in_hslen)); in ssl_consume_current_message()
4778 * Additionally, ssl->in_hslen might be arbitrarily out of in ssl_consume_current_message()
4782 if (ssl->in_hslen < ssl->in_msglen) { in ssl_consume_current_message()
4783 ssl->in_msglen -= ssl->in_hslen; in ssl_consume_current_message()
4784 memmove(ssl->in_msg, ssl->in_msg + ssl->in_hslen, in ssl_consume_current_message()
4785 ssl->in_msglen); in ssl_consume_current_message()
4786 MBEDTLS_PUT_UINT16_BE(ssl->in_msglen, ssl->in_len, 0); in ssl_consume_current_message()
4789 ssl->in_msg, ssl->in_msglen); in ssl_consume_current_message()
4791 ssl->in_msglen = 0; in ssl_consume_current_message()
4794 ssl->in_hslen = 0; in ssl_consume_current_message()
4797 else if (ssl->in_offt != NULL) { in ssl_consume_current_message()
4802 ssl->in_msglen = 0; in ssl_consume_current_message()
4811 if (ssl->in_msglen > 0) { in ssl_record_is_in_progress()
4822 mbedtls_ssl_handshake_params * const hs = ssl->handshake; in ssl_free_buffered_record()
4827 if (hs->buffering.future_record.data != NULL) { in ssl_free_buffered_record()
4828 hs->buffering.total_bytes_buffered -= in ssl_free_buffered_record()
4829 hs->buffering.future_record.len; in ssl_free_buffered_record()
4831 mbedtls_free(hs->buffering.future_record.data); in ssl_free_buffered_record()
4832 hs->buffering.future_record.data = NULL; in ssl_free_buffered_record()
4839 mbedtls_ssl_handshake_params * const hs = ssl->handshake; in ssl_load_buffered_record()
4844 size_t in_buf_len = ssl->in_buf_len; in ssl_load_buffered_record()
4848 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_load_buffered_record()
4856 rec = hs->buffering.future_record.data; in ssl_load_buffered_record()
4857 rec_len = hs->buffering.future_record.len; in ssl_load_buffered_record()
4858 rec_epoch = hs->buffering.future_record.epoch; in ssl_load_buffered_record()
4872 if (rec_epoch != ssl->in_epoch) { in ssl_load_buffered_record()
4877 MBEDTLS_SSL_DEBUG_MSG(2, ("Found buffered record from current epoch - load")); in ssl_load_buffered_record()
4879 /* Double-check that the record is not too large */ in ssl_load_buffered_record()
4880 if (rec_len > in_buf_len - (size_t) (ssl->in_hdr - ssl->in_buf)) { in ssl_load_buffered_record()
4885 memcpy(ssl->in_hdr, rec, rec_len); in ssl_load_buffered_record()
4886 ssl->in_left = rec_len; in ssl_load_buffered_record()
4887 ssl->next_record_offset = 0; in ssl_load_buffered_record()
4900 mbedtls_ssl_handshake_params * const hs = ssl->handshake; in ssl_buffer_future_record()
4909 if (rec->type != MBEDTLS_SSL_MSG_HANDSHAKE) { in ssl_buffer_future_record()
4914 if (hs->buffering.future_record.data != NULL) { in ssl_buffer_future_record()
4919 if (rec->buf_len > (MBEDTLS_SSL_DTLS_MAX_BUFFERING - in ssl_buffer_future_record()
4920 hs->buffering.total_bytes_buffered)) { in ssl_buffer_future_record()
4922 " would exceed the compile-time limit %" MBEDTLS_PRINTF_SIZET in ssl_buffer_future_record()
4924 " bytes buffered) -- ignore\n", in ssl_buffer_future_record()
4925 rec->buf_len, (size_t) MBEDTLS_SSL_DTLS_MAX_BUFFERING, in ssl_buffer_future_record()
4926 hs->buffering.total_bytes_buffered)); in ssl_buffer_future_record()
4932 ssl->in_epoch + 1U)); in ssl_buffer_future_record()
4933 MBEDTLS_SSL_DEBUG_BUF(3, "Buffered record", rec->buf, rec->buf_len); in ssl_buffer_future_record()
4937 hs->buffering.future_record.epoch = ssl->in_epoch + 1; in ssl_buffer_future_record()
4938 hs->buffering.future_record.len = rec->buf_len; in ssl_buffer_future_record()
4940 hs->buffering.future_record.data = in ssl_buffer_future_record()
4941 mbedtls_calloc(1, hs->buffering.future_record.len); in ssl_buffer_future_record()
4942 if (hs->buffering.future_record.data == NULL) { in ssl_buffer_future_record()
4948 memcpy(hs->buffering.future_record.data, rec->buf, rec->buf_len); in ssl_buffer_future_record()
4950 hs->buffering.total_bytes_buffered += rec->buf_len; in ssl_buffer_future_record()
4965 * On success, this call will set ssl->in_left to in ssl_get_next_record()
4968 * essentially be no-ops. */ in ssl_get_next_record()
4984 ret = ssl_parse_record_header(ssl, ssl->in_hdr, ssl->in_left, &rec); in ssl_get_next_record()
4987 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_get_next_record()
5006 ssl->in_msgtype = rec.type; in ssl_get_next_record()
5008 ssl->in_len = ssl->in_cid + rec.cid_len; in ssl_get_next_record()
5010 ssl->in_iv = ssl->in_msg = ssl->in_len + 2; in ssl_get_next_record()
5011 ssl->in_msglen = rec.data_len; in ssl_get_next_record()
5021 ssl->next_record_offset = rec.buf_len; in ssl_get_next_record()
5027 ssl->next_record_offset = 0; in ssl_get_next_record()
5028 ssl->in_left = 0; in ssl_get_next_record()
5044 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_get_next_record()
5046 ssl->next_record_offset = rec.buf_len; in ssl_get_next_record()
5047 if (ssl->next_record_offset < ssl->in_left) { in ssl_get_next_record()
5062 ssl->in_left = 0; in ssl_get_next_record()
5071 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_get_next_record()
5077 if (ssl->state == MBEDTLS_SSL_CLIENT_FINISHED || in ssl_get_next_record()
5078 ssl->state == MBEDTLS_SSL_SERVER_FINISHED) { in ssl_get_next_record()
5089 if (ssl->conf->badmac_limit != 0) { in ssl_get_next_record()
5090 ++ssl->badmac_seen_or_in_hsfraglen; in ssl_get_next_record()
5091 if (ssl->badmac_seen_or_in_hsfraglen >= ssl->conf->badmac_limit) { in ssl_get_next_record()
5100 ssl->next_record_offset = 0; in ssl_get_next_record()
5101 ssl->in_left = 0; in ssl_get_next_record()
5129 ssl->in_len = ssl->in_cid + rec.cid_len; in ssl_get_next_record()
5131 ssl->in_iv = ssl->in_len + 2; in ssl_get_next_record()
5134 * so re-read it. */ in ssl_get_next_record()
5135 ssl->in_msgtype = rec.type; in ssl_get_next_record()
5137 * the server-side ssl_parse_client_hello() reparses the in ssl_get_next_record()
5140 ssl->in_hdr[0] = rec.type; in ssl_get_next_record()
5141 ssl->in_msg = rec.buf + rec.data_offset; in ssl_get_next_record()
5142 ssl->in_msglen = rec.data_len; in ssl_get_next_record()
5143 MBEDTLS_PUT_UINT16_BE(rec.data_len, ssl->in_len, 0); in ssl_get_next_record()
5156 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM && in mbedtls_ssl_handle_message_type()
5157 ssl->badmac_seen_or_in_hsfraglen != 0 && in mbedtls_ssl_handle_message_type()
5158 ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) { in mbedtls_ssl_handle_message_type()
5159 MBEDTLS_SSL_DEBUG_MSG(1, ("non-handshake message in the middle" in mbedtls_ssl_handle_message_type()
5167 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE) { in mbedtls_ssl_handle_message_type()
5173 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC) { in mbedtls_ssl_handle_message_type()
5174 if (ssl->in_msglen != 1) { in mbedtls_ssl_handle_message_type()
5176 ssl->in_msglen)); in mbedtls_ssl_handle_message_type()
5180 if (ssl->in_msg[0] != 1) { in mbedtls_ssl_handle_message_type()
5182 ssl->in_msg[0])); in mbedtls_ssl_handle_message_type()
5187 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in mbedtls_ssl_handle_message_type()
5188 ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC && in mbedtls_ssl_handle_message_type()
5189 ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC) { in mbedtls_ssl_handle_message_type()
5190 if (ssl->handshake == NULL) { in mbedtls_ssl_handle_message_type()
5195 MBEDTLS_SSL_DEBUG_MSG(1, ("received out-of-order ChangeCipherSpec - remember")); in mbedtls_ssl_handle_message_type()
5201 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { in mbedtls_ssl_handle_message_type()
5209 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT) { in mbedtls_ssl_handle_message_type()
5210 if (ssl->in_msglen != 2) { in mbedtls_ssl_handle_message_type()
5215 ssl->in_msglen)); in mbedtls_ssl_handle_message_type()
5220 ssl->in_msg[0], ssl->in_msg[1])); in mbedtls_ssl_handle_message_type()
5223 * Ignore non-fatal alerts, except close_notify and no_renegotiation in mbedtls_ssl_handle_message_type()
5225 if (ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL) { in mbedtls_ssl_handle_message_type()
5227 ssl->in_msg[1])); in mbedtls_ssl_handle_message_type()
5231 if (ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING && in mbedtls_ssl_handle_message_type()
5232 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY) { in mbedtls_ssl_handle_message_type()
5238 if (ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING && in mbedtls_ssl_handle_message_type()
5239 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION) { in mbedtls_ssl_handle_message_type()
5250 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_handle_message_type()
5253 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA && in mbedtls_ssl_handle_message_type()
5256 && !(ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && in mbedtls_ssl_handle_message_type()
5257 ssl->state == MBEDTLS_SSL_SERVER_HELLO) in mbedtls_ssl_handle_message_type()
5264 if (ssl->handshake != NULL && in mbedtls_ssl_handle_message_type()
5287 if (ssl == NULL || ssl->conf == NULL) { in mbedtls_ssl_send_alert_message()
5291 if (ssl->out_left != 0) { in mbedtls_ssl_send_alert_message()
5298 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT; in mbedtls_ssl_send_alert_message()
5299 ssl->out_msglen = 2; in mbedtls_ssl_send_alert_message()
5300 ssl->out_msg[0] = level; in mbedtls_ssl_send_alert_message()
5301 ssl->out_msg[1] = message; in mbedtls_ssl_send_alert_message()
5318 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC; in mbedtls_ssl_write_change_cipher_spec()
5319 ssl->out_msglen = 1; in mbedtls_ssl_write_change_cipher_spec()
5320 ssl->out_msg[0] = 1; in mbedtls_ssl_write_change_cipher_spec()
5345 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC) { in mbedtls_ssl_parse_change_cipher_spec()
5361 ssl->transform_in = ssl->transform_negotiate; in mbedtls_ssl_parse_change_cipher_spec()
5363 ssl->session_in = ssl->session_negotiate; in mbedtls_ssl_parse_change_cipher_spec()
5366 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_parse_change_cipher_spec()
5372 if (++ssl->in_epoch == 0) { in mbedtls_ssl_parse_change_cipher_spec()
5380 memset(ssl->in_ctr, 0, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN); in mbedtls_ssl_parse_change_cipher_spec()
5391 /* Once ssl->out_hdr as the address of the beginning of the
5395 * (entering MAC computation) in the 8 bytes before ssl->out_hdr,
5402 return transform->ivlen - transform->fixed_ivlen; in ssl_transform_get_explicit_iv_len()
5409 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_update_out_pointers()
5410 ssl->out_ctr = ssl->out_hdr + 3; in mbedtls_ssl_update_out_pointers()
5412 ssl->out_cid = ssl->out_ctr + MBEDTLS_SSL_SEQUENCE_NUMBER_LEN; in mbedtls_ssl_update_out_pointers()
5413 ssl->out_len = ssl->out_cid; in mbedtls_ssl_update_out_pointers()
5415 ssl->out_len += transform->out_cid_len; in mbedtls_ssl_update_out_pointers()
5418 ssl->out_len = ssl->out_ctr + MBEDTLS_SSL_SEQUENCE_NUMBER_LEN; in mbedtls_ssl_update_out_pointers()
5420 ssl->out_iv = ssl->out_len + 2; in mbedtls_ssl_update_out_pointers()
5424 ssl->out_len = ssl->out_hdr + 3; in mbedtls_ssl_update_out_pointers()
5426 ssl->out_cid = ssl->out_len; in mbedtls_ssl_update_out_pointers()
5428 ssl->out_iv = ssl->out_hdr + 5; in mbedtls_ssl_update_out_pointers()
5431 ssl->out_msg = ssl->out_iv; in mbedtls_ssl_update_out_pointers()
5434 ssl->out_msg += ssl_transform_get_explicit_iv_len(transform); in mbedtls_ssl_update_out_pointers()
5438 /* Once ssl->in_hdr as the address of the beginning of the
5442 * (entering MAC computation) in the 8 bytes before ssl->in_hdr,
5449 * of unprotected TLS/DTLS records, with both ssl->in_iv in mbedtls_ssl_update_in_pointers()
5450 * and ssl->in_msg pointing to the beginning of the record in mbedtls_ssl_update_in_pointers()
5453 * When decrypting a protected record, ssl->in_msg in mbedtls_ssl_update_in_pointers()
5459 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_update_in_pointers()
5464 ssl->in_ctr = ssl->in_hdr + 3; in mbedtls_ssl_update_in_pointers()
5466 ssl->in_cid = ssl->in_ctr + MBEDTLS_SSL_SEQUENCE_NUMBER_LEN; in mbedtls_ssl_update_in_pointers()
5467 ssl->in_len = ssl->in_cid; /* Default: no CID */ in mbedtls_ssl_update_in_pointers()
5469 ssl->in_len = ssl->in_ctr + MBEDTLS_SSL_SEQUENCE_NUMBER_LEN; in mbedtls_ssl_update_in_pointers()
5471 ssl->in_iv = ssl->in_len + 2; in mbedtls_ssl_update_in_pointers()
5475 ssl->in_ctr = ssl->in_buf; in mbedtls_ssl_update_in_pointers()
5476 ssl->in_len = ssl->in_hdr + 3; in mbedtls_ssl_update_in_pointers()
5478 ssl->in_cid = ssl->in_len; in mbedtls_ssl_update_in_pointers()
5480 ssl->in_iv = ssl->in_hdr + 5; in mbedtls_ssl_update_in_pointers()
5484 ssl->in_msg = ssl->in_iv; in mbedtls_ssl_update_in_pointers()
5494 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_reset_in_pointers()
5495 ssl->in_hdr = ssl->in_buf; in mbedtls_ssl_reset_in_pointers()
5499 ssl->in_hdr = ssl->in_buf + MBEDTLS_SSL_SEQUENCE_NUMBER_LEN; in mbedtls_ssl_reset_in_pointers()
5510 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_reset_out_pointers()
5511 ssl->out_hdr = ssl->out_buf; in mbedtls_ssl_reset_out_pointers()
5515 ssl->out_ctr = ssl->out_buf; in mbedtls_ssl_reset_out_pointers()
5516 ssl->out_hdr = ssl->out_buf + MBEDTLS_SSL_SEQUENCE_NUMBER_LEN; in mbedtls_ssl_reset_out_pointers()
5527 return ssl->in_offt == NULL ? 0 : ssl->in_msglen; in mbedtls_ssl_get_bytes_avail()
5537 if (ssl->keep_current_message == 1) { in mbedtls_ssl_check_pending()
5547 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in mbedtls_ssl_check_pending()
5548 ssl->in_left > ssl->next_record_offset) { in mbedtls_ssl_check_pending()
5558 if (ssl->in_hslen > 0 && ssl->in_hslen < ssl->in_msglen) { in mbedtls_ssl_check_pending()
5567 if (ssl->in_offt != NULL) { in mbedtls_ssl_check_pending()
5586 const mbedtls_ssl_transform *transform = ssl->transform_out; in mbedtls_ssl_get_record_expansion()
5601 if (transform->psa_alg == PSA_ALG_GCM || in mbedtls_ssl_get_record_expansion()
5602 transform->psa_alg == PSA_ALG_CCM || in mbedtls_ssl_get_record_expansion()
5603 transform->psa_alg == PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 8) || in mbedtls_ssl_get_record_expansion()
5604 transform->psa_alg == PSA_ALG_CHACHA20_POLY1305 || in mbedtls_ssl_get_record_expansion()
5605 transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER) { in mbedtls_ssl_get_record_expansion()
5606 transform_expansion = transform->minlen; in mbedtls_ssl_get_record_expansion()
5607 } else if (transform->psa_alg == PSA_ALG_CBC_NO_PADDING) { in mbedtls_ssl_get_record_expansion()
5608 (void) psa_get_key_attributes(transform->psa_key_enc, &attr); in mbedtls_ssl_get_record_expansion()
5614 transform_expansion += transform->maclen; in mbedtls_ssl_get_record_expansion()
5632 switch (mbedtls_cipher_get_cipher_mode(&transform->cipher_ctx_enc)) { in mbedtls_ssl_get_record_expansion()
5637 transform_expansion = transform->minlen; in mbedtls_ssl_get_record_expansion()
5643 &transform->cipher_ctx_enc); in mbedtls_ssl_get_record_expansion()
5646 transform_expansion += transform->maclen; in mbedtls_ssl_get_record_expansion()
5668 if (transform->out_cid_len != 0) { in mbedtls_ssl_get_record_expansion()
5688 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING || in ssl_check_ctr_renegotiate()
5689 ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED) { in ssl_check_ctr_renegotiate()
5693 in_ctr_cmp = memcmp(ssl->in_ctr + ep_len, in ssl_check_ctr_renegotiate()
5694 &ssl->conf->renego_period[ep_len], in ssl_check_ctr_renegotiate()
5695 MBEDTLS_SSL_SEQUENCE_NUMBER_LEN - ep_len); in ssl_check_ctr_renegotiate()
5696 out_ctr_cmp = memcmp(&ssl->cur_out_ctr[ep_len], in ssl_check_ctr_renegotiate()
5697 &ssl->conf->renego_period[ep_len], in ssl_check_ctr_renegotiate()
5698 sizeof(ssl->cur_out_ctr) - ep_len); in ssl_check_ctr_renegotiate()
5716 if ((ssl->in_hslen == mbedtls_ssl_hs_hdr_len(ssl)) || in ssl_tls13_is_new_session_ticket()
5717 (ssl->in_msg[0] != MBEDTLS_SSL_HS_NEW_SESSION_TICKET)) { in ssl_tls13_is_new_session_ticket()
5729 MBEDTLS_SSL_DEBUG_MSG(3, ("received post-handshake message")); in ssl_tls13_handle_hs_message_post_handshake()
5732 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { in ssl_tls13_handle_hs_message_post_handshake()
5736 if (mbedtls_ssl_conf_is_signal_new_session_tickets_enabled(ssl->conf) == in ssl_tls13_handle_hs_message_post_handshake()
5738 ssl->keep_current_message = 1; in ssl_tls13_handle_hs_message_post_handshake()
5766 * of post-handshake handshake messages changes significantly in TLS 1.3,
5776 * - For client-side, expect SERVER_HELLO_REQUEST. in ssl_tls12_handle_hs_message_post_handshake()
5777 * - For server-side, expect CLIENT_HELLO. in ssl_tls12_handle_hs_message_post_handshake()
5778 * - Fail (TLS) or silently drop record (DTLS) in other cases. in ssl_tls12_handle_hs_message_post_handshake()
5782 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT && in ssl_tls12_handle_hs_message_post_handshake()
5783 (ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST || in ssl_tls12_handle_hs_message_post_handshake()
5784 ssl->in_hslen != mbedtls_ssl_hs_hdr_len(ssl))) { in ssl_tls12_handle_hs_message_post_handshake()
5789 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_tls12_handle_hs_message_post_handshake()
5798 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && in ssl_tls12_handle_hs_message_post_handshake()
5799 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO) { in ssl_tls12_handle_hs_message_post_handshake()
5804 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_tls12_handle_hs_message_post_handshake()
5814 if (!(ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED || in ssl_tls12_handle_hs_message_post_handshake()
5815 (ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && in ssl_tls12_handle_hs_message_post_handshake()
5816 ssl->conf->allow_legacy_renegotiation == in ssl_tls12_handle_hs_message_post_handshake()
5822 /* DTLS clients need to know renego is server-initiated */ in ssl_tls12_handle_hs_message_post_handshake()
5824 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && in ssl_tls12_handle_hs_message_post_handshake()
5825 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { in ssl_tls12_handle_hs_message_post_handshake()
5826 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING; in ssl_tls12_handle_hs_message_post_handshake()
5861 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { in ssl_handle_hs_message_post_handshake()
5867 if (ssl->tls_version <= MBEDTLS_SSL_VERSION_TLS1_2) { in ssl_handle_hs_message_post_handshake()
5881 * - First byte of application data not read yet in the input
5883 * - The number of bytes of data not read yet is `in_msglen`.
5895 size_t n = (len < ssl->in_msglen) ? len : ssl->in_msglen; in ssl_read_application_data()
5898 memcpy(buf, ssl->in_offt, n); in ssl_read_application_data()
5899 ssl->in_msglen -= n; in ssl_read_application_data()
5904 mbedtls_platform_zeroize(ssl->in_offt, n); in ssl_read_application_data()
5906 if (ssl->in_msglen == 0) { in ssl_read_application_data()
5908 ssl->in_offt = NULL; in ssl_read_application_data()
5909 ssl->keep_current_message = 0; in ssl_read_application_data()
5912 ssl->in_offt += n; in ssl_read_application_data()
5925 if (ssl == NULL || ssl->conf == NULL) { in mbedtls_ssl_read()
5932 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in mbedtls_ssl_read()
5937 if (ssl->handshake != NULL && in mbedtls_ssl_read()
5938 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING) { in mbedtls_ssl_read()
5953 * the server-side as it is not treated as within in mbedtls_ssl_read()
5967 if (ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER) { in mbedtls_ssl_read()
5977 while (ssl->in_offt == NULL) { in mbedtls_ssl_read()
5979 if (ssl->f_get_timer != NULL && in mbedtls_ssl_read()
5980 ssl->f_get_timer(ssl->p_timer) == -1) { in mbedtls_ssl_read()
5981 mbedtls_ssl_set_timer(ssl, ssl->conf->read_timeout); in mbedtls_ssl_read()
5993 if (ssl->in_msglen == 0 && in mbedtls_ssl_read()
5994 ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA) { in mbedtls_ssl_read()
6008 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE) { in mbedtls_ssl_read()
6017 * by the post-handshake message has been completed or not. The cases in mbedtls_ssl_read()
6024 * a non-handshake, non-application data message while awaiting in mbedtls_ssl_read()
6028 * - For 1), the next iteration will read a new record and check in mbedtls_ssl_read()
6030 * - For 2), the loop condition isn't satisfied as application data in mbedtls_ssl_read()
6032 * - For 3), the loop condition is satisfied and read_record in mbedtls_ssl_read()
6033 * will re-deliver the message that was held back by the client in mbedtls_ssl_read()
6040 else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING) { in mbedtls_ssl_read()
6041 if (ssl->conf->renego_max_records >= 0) { in mbedtls_ssl_read()
6042 if (++ssl->renego_records_seen > ssl->conf->renego_max_records) { in mbedtls_ssl_read()
6052 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT) { in mbedtls_ssl_read()
6053 MBEDTLS_SSL_DEBUG_MSG(2, ("ignoring non-fatal non-closure alert")); in mbedtls_ssl_read()
6057 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA) { in mbedtls_ssl_read()
6062 ssl->in_offt = ssl->in_msg; in mbedtls_ssl_read()
6075 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && in mbedtls_ssl_read()
6076 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING) { in mbedtls_ssl_read()
6098 if (ssl == NULL || (ssl->conf == NULL)) { in mbedtls_ssl_read_early_data()
6106 if ((ssl->state != MBEDTLS_SSL_END_OF_EARLY_DATA) || in mbedtls_ssl_read_early_data()
6107 (ssl->in_offt == NULL)) { in mbedtls_ssl_read_early_data()
6121 * Zero-length fragments of Application data MAY be sent as they are
6141 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { in ssl_write_real()
6152 if (ssl->out_left != 0) { in ssl_write_real()
6156 * written. In this case, we expect the high-level write function in ssl_write_real()
6169 ssl->out_msglen = len; in ssl_write_real()
6170 ssl->out_msgtype = MBEDTLS_SSL_MSG_APPLICATION_DATA; in ssl_write_real()
6172 memcpy(ssl->out_msg, buf, len); in ssl_write_real()
6185 * Write application data (public-facing wrapper)
6193 if (ssl == NULL || ssl->conf == NULL) { in mbedtls_ssl_write()
6204 if (ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER) { in mbedtls_ssl_write()
6228 if (ssl == NULL || (conf = ssl->conf) == NULL) { in mbedtls_ssl_write_early_data()
6232 if (conf->endpoint != MBEDTLS_SSL_IS_CLIENT) { in mbedtls_ssl_write_early_data()
6237 (conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) || in mbedtls_ssl_write_early_data()
6238 (conf->early_data_enabled != MBEDTLS_SSL_EARLY_DATA_ENABLED)) { in mbedtls_ssl_write_early_data()
6242 if (ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_3) { in mbedtls_ssl_write_early_data()
6258 if ((ssl->early_data_state == MBEDTLS_SSL_EARLY_DATA_STATE_IDLE) || in mbedtls_ssl_write_early_data()
6259 (ssl->early_data_state == MBEDTLS_SSL_EARLY_DATA_STATE_IND_SENT)) { in mbedtls_ssl_write_early_data()
6260 while ((ssl->early_data_state == MBEDTLS_SSL_EARLY_DATA_STATE_IDLE) || in mbedtls_ssl_write_early_data()
6261 (ssl->early_data_state == MBEDTLS_SSL_EARLY_DATA_STATE_IND_SENT)) { in mbedtls_ssl_write_early_data()
6274 remaining = ssl->session_negotiate->max_early_data_size; in mbedtls_ssl_write_early_data()
6283 if ((ssl->early_data_state != MBEDTLS_SSL_EARLY_DATA_STATE_CAN_WRITE) && in mbedtls_ssl_write_early_data()
6284 (ssl->early_data_state != MBEDTLS_SSL_EARLY_DATA_STATE_ACCEPTED)) { in mbedtls_ssl_write_early_data()
6288 remaining = ssl->session_negotiate->max_early_data_size - in mbedtls_ssl_write_early_data()
6289 ssl->total_early_data_size; in mbedtls_ssl_write_early_data()
6302 if (((ssl->early_data_state != MBEDTLS_SSL_EARLY_DATA_STATE_CAN_WRITE) && in mbedtls_ssl_write_early_data()
6303 (ssl->early_data_state != MBEDTLS_SSL_EARLY_DATA_STATE_ACCEPTED)) in mbedtls_ssl_write_early_data()
6314 ssl->total_early_data_size += ret; in mbedtls_ssl_write_early_data()
6330 if (ssl == NULL || ssl->conf == NULL) { in mbedtls_ssl_close_notify()
6357 psa_destroy_key(transform->psa_key_enc); in mbedtls_ssl_transform_free()
6358 psa_destroy_key(transform->psa_key_dec); in mbedtls_ssl_transform_free()
6360 mbedtls_cipher_free(&transform->cipher_ctx_enc); in mbedtls_ssl_transform_free()
6361 mbedtls_cipher_free(&transform->cipher_ctx_dec); in mbedtls_ssl_transform_free()
6366 psa_destroy_key(transform->psa_mac_enc); in mbedtls_ssl_transform_free()
6367 psa_destroy_key(transform->psa_mac_dec); in mbedtls_ssl_transform_free()
6369 mbedtls_md_free(&transform->md_ctx_enc); in mbedtls_ssl_transform_free()
6370 mbedtls_md_free(&transform->md_ctx_dec); in mbedtls_ssl_transform_free()
6380 ssl->transform_in = transform; in mbedtls_ssl_set_inbound_transform()
6381 memset(ssl->in_ctr, 0, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN); in mbedtls_ssl_set_inbound_transform()
6387 ssl->transform_out = transform; in mbedtls_ssl_set_outbound_transform()
6388 memset(ssl->cur_out_ctr, 0, sizeof(ssl->cur_out_ctr)); in mbedtls_ssl_set_outbound_transform()
6396 mbedtls_ssl_handshake_params * const hs = ssl->handshake; in mbedtls_ssl_buffering_free()
6412 mbedtls_ssl_handshake_params * const hs = ssl->handshake; in ssl_buffering_free_slot()
6413 mbedtls_ssl_hs_buffer * const hs_buf = &hs->buffering.hs[slot]; in ssl_buffering_free_slot()
6419 if (hs_buf->is_valid == 1) { in ssl_buffering_free_slot()
6420 hs->buffering.total_bytes_buffered -= hs_buf->data_len; in ssl_buffering_free_slot()
6421 mbedtls_zeroize_and_free(hs_buf->data, hs_buf->data_len); in ssl_buffering_free_slot()
6433 * For DTLS, map as follows, then use 1's complement (v -> ~v):
6434 * 1.x <-> 3.x+1 for x != 0 (DTLS 1.2 based on TLS 1.2)
6444 ~(tls_version - (tls_version == 0x0302 ? 0x0202 : 0x0201)); in mbedtls_ssl_write_version()
6462 ~(tls_version - (tls_version == 0xfeff ? 0x0202 : 0x0201)); in mbedtls_ssl_read_version()
6474 * returned, ssl->alert_reason otherwise.
6481 if (ssl->send_alert == 0) { in mbedtls_ssl_handle_pending_alert()
6487 ssl->alert_type); in mbedtls_ssl_handle_pending_alert()
6493 ssl->send_alert = 0; in mbedtls_ssl_handle_pending_alert()
6500 return ssl->alert_reason; in mbedtls_ssl_handle_pending_alert()
6510 ssl->send_alert = 1; in mbedtls_ssl_pend_fatal_alert()
6511 ssl->alert_type = alert_type; in mbedtls_ssl_pend_fatal_alert()
6512 ssl->alert_reason = alert_reason; in mbedtls_ssl_pend_fatal_alert()