1 /* 2 * SSLv3/TLSv1 shared functions 3 * 4 * Copyright The Mbed TLS Contributors 5 * SPDX-License-Identifier: Apache-2.0 6 * 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may 8 * not use this file except in compliance with the License. 9 * You may obtain a copy of the License at 10 * 11 * http://www.apache.org/licenses/LICENSE-2.0 12 * 13 * Unless required by applicable law or agreed to in writing, software 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16 * See the License for the specific language governing permissions and 17 * limitations under the License. 18 */ 19 /* 20 * The SSL 3.0 specification was drafted by Netscape in 1996, 21 * and became an IETF standard in 1999. 22 * 23 * http://wp.netscape.com/eng/ssl3/ 24 * http://www.ietf.org/rfc/rfc2246.txt 25 * http://www.ietf.org/rfc/rfc4346.txt 26 */ 27 28 #include "common.h" 29 30 #if defined(MBEDTLS_SSL_TLS_C) 31 32 #if defined(MBEDTLS_PLATFORM_C) 33 #include "mbedtls/platform.h" 34 #else 35 #include <stdlib.h> 36 #define mbedtls_calloc calloc 37 #define mbedtls_free free 38 #endif 39 40 #include "mbedtls/ssl.h" 41 #include "mbedtls/ssl_internal.h" 42 #include "mbedtls/debug.h" 43 #include "mbedtls/error.h" 44 #include "mbedtls/platform_util.h" 45 #include "mbedtls/version.h" 46 47 #include <string.h> 48 49 #if defined(MBEDTLS_USE_PSA_CRYPTO) 50 #include "mbedtls/psa_util.h" 51 #include "psa/crypto.h" 52 #endif 53 54 #if defined(MBEDTLS_X509_CRT_PARSE_C) 55 #include "mbedtls/oid.h" 56 #endif 57 58 #if defined(MBEDTLS_SSL_PROTO_DTLS) 59 60 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 61 /* Top-level Connection ID API */ 62 63 int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf, 64 size_t len, 65 int ignore_other_cid ) 66 { 67 if( len > MBEDTLS_SSL_CID_IN_LEN_MAX ) 68 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 69 70 if( ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_FAIL && 71 ignore_other_cid != MBEDTLS_SSL_UNEXPECTED_CID_IGNORE ) 72 { 73 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 74 } 75 76 conf->ignore_unexpected_cid = ignore_other_cid; 77 conf->cid_len = len; 78 return( 0 ); 79 } 80 81 int mbedtls_ssl_set_cid( mbedtls_ssl_context *ssl, 82 int enable, 83 unsigned char const *own_cid, 84 size_t own_cid_len ) 85 { 86 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 87 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 88 89 ssl->negotiate_cid = enable; 90 if( enable == MBEDTLS_SSL_CID_DISABLED ) 91 { 92 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Disable use of CID extension." ) ); 93 return( 0 ); 94 } 95 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Enable use of CID extension." ) ); 96 MBEDTLS_SSL_DEBUG_BUF( 3, "Own CID", own_cid, own_cid_len ); 97 98 if( own_cid_len != ssl->conf->cid_len ) 99 { 100 MBEDTLS_SSL_DEBUG_MSG( 3, ( "CID length %u does not match CID length %u in config", 101 (unsigned) own_cid_len, 102 (unsigned) ssl->conf->cid_len ) ); 103 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 104 } 105 106 memcpy( ssl->own_cid, own_cid, own_cid_len ); 107 /* Truncation is not an issue here because 108 * MBEDTLS_SSL_CID_IN_LEN_MAX at most 255. */ 109 ssl->own_cid_len = (uint8_t) own_cid_len; 110 111 return( 0 ); 112 } 113 114 int mbedtls_ssl_get_peer_cid( mbedtls_ssl_context *ssl, 115 int *enabled, 116 unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ], 117 size_t *peer_cid_len ) 118 { 119 *enabled = MBEDTLS_SSL_CID_DISABLED; 120 121 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM || 122 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ) 123 { 124 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 125 } 126 127 /* We report MBEDTLS_SSL_CID_DISABLED in case the CID extensions 128 * were used, but client and server requested the empty CID. 129 * This is indistinguishable from not using the CID extension 130 * in the first place. */ 131 if( ssl->transform_in->in_cid_len == 0 && 132 ssl->transform_in->out_cid_len == 0 ) 133 { 134 return( 0 ); 135 } 136 137 if( peer_cid_len != NULL ) 138 { 139 *peer_cid_len = ssl->transform_in->out_cid_len; 140 if( peer_cid != NULL ) 141 { 142 memcpy( peer_cid, ssl->transform_in->out_cid, 143 ssl->transform_in->out_cid_len ); 144 } 145 } 146 147 *enabled = MBEDTLS_SSL_CID_ENABLED; 148 149 return( 0 ); 150 } 151 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ 152 153 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 154 155 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 156 /* 157 * Convert max_fragment_length codes to length. 158 * RFC 6066 says: 159 * enum{ 160 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255) 161 * } MaxFragmentLength; 162 * and we add 0 -> extension unused 163 */ 164 static unsigned int ssl_mfl_code_to_length( int mfl ) 165 { 166 switch( mfl ) 167 { 168 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE: 169 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN ); 170 case MBEDTLS_SSL_MAX_FRAG_LEN_512: 171 return 512; 172 case MBEDTLS_SSL_MAX_FRAG_LEN_1024: 173 return 1024; 174 case MBEDTLS_SSL_MAX_FRAG_LEN_2048: 175 return 2048; 176 case MBEDTLS_SSL_MAX_FRAG_LEN_4096: 177 return 4096; 178 default: 179 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN ); 180 } 181 } 182 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 183 184 int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst, 185 const mbedtls_ssl_session *src ) 186 { 187 mbedtls_ssl_session_free( dst ); 188 memcpy( dst, src, sizeof( mbedtls_ssl_session ) ); 189 190 #if defined(MBEDTLS_X509_CRT_PARSE_C) 191 192 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 193 if( src->peer_cert != NULL ) 194 { 195 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 196 197 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) ); 198 if( dst->peer_cert == NULL ) 199 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 200 201 mbedtls_x509_crt_init( dst->peer_cert ); 202 203 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p, 204 src->peer_cert->raw.len ) ) != 0 ) 205 { 206 mbedtls_free( dst->peer_cert ); 207 dst->peer_cert = NULL; 208 return( ret ); 209 } 210 } 211 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 212 if( src->peer_cert_digest != NULL ) 213 { 214 dst->peer_cert_digest = 215 mbedtls_calloc( 1, src->peer_cert_digest_len ); 216 if( dst->peer_cert_digest == NULL ) 217 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 218 219 memcpy( dst->peer_cert_digest, src->peer_cert_digest, 220 src->peer_cert_digest_len ); 221 dst->peer_cert_digest_type = src->peer_cert_digest_type; 222 dst->peer_cert_digest_len = src->peer_cert_digest_len; 223 } 224 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 225 226 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 227 228 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) 229 if( src->ticket != NULL ) 230 { 231 dst->ticket = mbedtls_calloc( 1, src->ticket_len ); 232 if( dst->ticket == NULL ) 233 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 234 235 memcpy( dst->ticket, src->ticket, src->ticket_len ); 236 } 237 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */ 238 239 return( 0 ); 240 } 241 242 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) 243 static int resize_buffer( unsigned char **buffer, size_t len_new, size_t *len_old ) 244 { 245 unsigned char* resized_buffer = mbedtls_calloc( 1, len_new ); 246 if( resized_buffer == NULL ) 247 return -1; 248 249 /* We want to copy len_new bytes when downsizing the buffer, and 250 * len_old bytes when upsizing, so we choose the smaller of two sizes, 251 * to fit one buffer into another. Size checks, ensuring that no data is 252 * lost, are done outside of this function. */ 253 memcpy( resized_buffer, *buffer, 254 ( len_new < *len_old ) ? len_new : *len_old ); 255 mbedtls_platform_zeroize( *buffer, *len_old ); 256 mbedtls_free( *buffer ); 257 258 *buffer = resized_buffer; 259 *len_old = len_new; 260 261 return 0; 262 } 263 264 static void handle_buffer_resizing( mbedtls_ssl_context *ssl, int downsizing, 265 size_t in_buf_new_len, 266 size_t out_buf_new_len ) 267 { 268 int modified = 0; 269 size_t written_in = 0, iv_offset_in = 0, len_offset_in = 0; 270 size_t written_out = 0, iv_offset_out = 0, len_offset_out = 0; 271 if( ssl->in_buf != NULL ) 272 { 273 written_in = ssl->in_msg - ssl->in_buf; 274 iv_offset_in = ssl->in_iv - ssl->in_buf; 275 len_offset_in = ssl->in_len - ssl->in_buf; 276 if( downsizing ? 277 ssl->in_buf_len > in_buf_new_len && ssl->in_left < in_buf_new_len : 278 ssl->in_buf_len < in_buf_new_len ) 279 { 280 if( resize_buffer( &ssl->in_buf, in_buf_new_len, &ssl->in_buf_len ) != 0 ) 281 { 282 MBEDTLS_SSL_DEBUG_MSG( 1, ( "input buffer resizing failed - out of memory" ) ); 283 } 284 else 285 { 286 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating in_buf to %" MBEDTLS_PRINTF_SIZET, 287 in_buf_new_len ) ); 288 modified = 1; 289 } 290 } 291 } 292 293 if( ssl->out_buf != NULL ) 294 { 295 written_out = ssl->out_msg - ssl->out_buf; 296 iv_offset_out = ssl->out_iv - ssl->out_buf; 297 len_offset_out = ssl->out_len - ssl->out_buf; 298 if( downsizing ? 299 ssl->out_buf_len > out_buf_new_len && ssl->out_left < out_buf_new_len : 300 ssl->out_buf_len < out_buf_new_len ) 301 { 302 if( resize_buffer( &ssl->out_buf, out_buf_new_len, &ssl->out_buf_len ) != 0 ) 303 { 304 MBEDTLS_SSL_DEBUG_MSG( 1, ( "output buffer resizing failed - out of memory" ) ); 305 } 306 else 307 { 308 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reallocating out_buf to %" MBEDTLS_PRINTF_SIZET, 309 out_buf_new_len ) ); 310 modified = 1; 311 } 312 } 313 } 314 if( modified ) 315 { 316 /* Update pointers here to avoid doing it twice. */ 317 mbedtls_ssl_reset_in_out_pointers( ssl ); 318 /* Fields below might not be properly updated with record 319 * splitting or with CID, so they are manually updated here. */ 320 ssl->out_msg = ssl->out_buf + written_out; 321 ssl->out_len = ssl->out_buf + len_offset_out; 322 ssl->out_iv = ssl->out_buf + iv_offset_out; 323 324 ssl->in_msg = ssl->in_buf + written_in; 325 ssl->in_len = ssl->in_buf + len_offset_in; 326 ssl->in_iv = ssl->in_buf + iv_offset_in; 327 } 328 } 329 #endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */ 330 331 /* 332 * Key material generation 333 */ 334 #if defined(MBEDTLS_SSL_PROTO_SSL3) 335 static int ssl3_prf( const unsigned char *secret, size_t slen, 336 const char *label, 337 const unsigned char *random, size_t rlen, 338 unsigned char *dstbuf, size_t dlen ) 339 { 340 int ret = 0; 341 size_t i; 342 mbedtls_md5_context md5; 343 mbedtls_sha1_context sha1; 344 unsigned char padding[16]; 345 unsigned char sha1sum[20]; 346 ((void)label); 347 348 mbedtls_md5_init( &md5 ); 349 mbedtls_sha1_init( &sha1 ); 350 351 /* 352 * SSLv3: 353 * block = 354 * MD5( secret + SHA1( 'A' + secret + random ) ) + 355 * MD5( secret + SHA1( 'BB' + secret + random ) ) + 356 * MD5( secret + SHA1( 'CCC' + secret + random ) ) + 357 * ... 358 */ 359 for( i = 0; i < dlen / 16; i++ ) 360 { 361 memset( padding, (unsigned char) ('A' + i), 1 + i ); 362 363 if( ( ret = mbedtls_sha1_starts_ret( &sha1 ) ) != 0 ) 364 goto exit; 365 if( ( ret = mbedtls_sha1_update_ret( &sha1, padding, 1 + i ) ) != 0 ) 366 goto exit; 367 if( ( ret = mbedtls_sha1_update_ret( &sha1, secret, slen ) ) != 0 ) 368 goto exit; 369 if( ( ret = mbedtls_sha1_update_ret( &sha1, random, rlen ) ) != 0 ) 370 goto exit; 371 if( ( ret = mbedtls_sha1_finish_ret( &sha1, sha1sum ) ) != 0 ) 372 goto exit; 373 374 if( ( ret = mbedtls_md5_starts_ret( &md5 ) ) != 0 ) 375 goto exit; 376 if( ( ret = mbedtls_md5_update_ret( &md5, secret, slen ) ) != 0 ) 377 goto exit; 378 if( ( ret = mbedtls_md5_update_ret( &md5, sha1sum, 20 ) ) != 0 ) 379 goto exit; 380 if( ( ret = mbedtls_md5_finish_ret( &md5, dstbuf + i * 16 ) ) != 0 ) 381 goto exit; 382 } 383 384 exit: 385 mbedtls_md5_free( &md5 ); 386 mbedtls_sha1_free( &sha1 ); 387 388 mbedtls_platform_zeroize( padding, sizeof( padding ) ); 389 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) ); 390 391 return( ret ); 392 } 393 #endif /* MBEDTLS_SSL_PROTO_SSL3 */ 394 395 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) 396 static int tls1_prf( const unsigned char *secret, size_t slen, 397 const char *label, 398 const unsigned char *random, size_t rlen, 399 unsigned char *dstbuf, size_t dlen ) 400 { 401 size_t nb, hs; 402 size_t i, j, k; 403 const unsigned char *S1, *S2; 404 unsigned char *tmp; 405 size_t tmp_len = 0; 406 unsigned char h_i[20]; 407 const mbedtls_md_info_t *md_info; 408 mbedtls_md_context_t md_ctx; 409 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 410 411 mbedtls_md_init( &md_ctx ); 412 413 tmp_len = 20 + strlen( label ) + rlen; 414 tmp = mbedtls_calloc( 1, tmp_len ); 415 if( tmp == NULL ) 416 { 417 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED; 418 goto exit; 419 } 420 421 hs = ( slen + 1 ) / 2; 422 S1 = secret; 423 S2 = secret + slen - hs; 424 425 nb = strlen( label ); 426 memcpy( tmp + 20, label, nb ); 427 memcpy( tmp + 20 + nb, random, rlen ); 428 nb += rlen; 429 430 /* 431 * First compute P_md5(secret,label+random)[0..dlen] 432 */ 433 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) == NULL ) 434 { 435 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; 436 goto exit; 437 } 438 439 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 ) 440 { 441 goto exit; 442 } 443 444 mbedtls_md_hmac_starts( &md_ctx, S1, hs ); 445 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb ); 446 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp ); 447 448 for( i = 0; i < dlen; i += 16 ) 449 { 450 mbedtls_md_hmac_reset ( &md_ctx ); 451 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb ); 452 mbedtls_md_hmac_finish( &md_ctx, h_i ); 453 454 mbedtls_md_hmac_reset ( &md_ctx ); 455 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 ); 456 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp ); 457 458 k = ( i + 16 > dlen ) ? dlen % 16 : 16; 459 460 for( j = 0; j < k; j++ ) 461 dstbuf[i + j] = h_i[j]; 462 } 463 464 mbedtls_md_free( &md_ctx ); 465 466 /* 467 * XOR out with P_sha1(secret,label+random)[0..dlen] 468 */ 469 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) == NULL ) 470 { 471 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; 472 goto exit; 473 } 474 475 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 ) 476 { 477 goto exit; 478 } 479 480 mbedtls_md_hmac_starts( &md_ctx, S2, hs ); 481 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb ); 482 mbedtls_md_hmac_finish( &md_ctx, tmp ); 483 484 for( i = 0; i < dlen; i += 20 ) 485 { 486 mbedtls_md_hmac_reset ( &md_ctx ); 487 mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb ); 488 mbedtls_md_hmac_finish( &md_ctx, h_i ); 489 490 mbedtls_md_hmac_reset ( &md_ctx ); 491 mbedtls_md_hmac_update( &md_ctx, tmp, 20 ); 492 mbedtls_md_hmac_finish( &md_ctx, tmp ); 493 494 k = ( i + 20 > dlen ) ? dlen % 20 : 20; 495 496 for( j = 0; j < k; j++ ) 497 dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] ); 498 } 499 500 exit: 501 mbedtls_md_free( &md_ctx ); 502 503 mbedtls_platform_zeroize( tmp, tmp_len ); 504 mbedtls_platform_zeroize( h_i, sizeof( h_i ) ); 505 506 mbedtls_free( tmp ); 507 return( ret ); 508 } 509 #endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */ 510 511 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 512 #if defined(MBEDTLS_USE_PSA_CRYPTO) 513 514 static psa_status_t setup_psa_key_derivation( psa_key_derivation_operation_t* derivation, 515 psa_key_id_t key, 516 psa_algorithm_t alg, 517 const unsigned char* seed, size_t seed_length, 518 const unsigned char* label, size_t label_length, 519 size_t capacity ) 520 { 521 psa_status_t status; 522 523 status = psa_key_derivation_setup( derivation, alg ); 524 if( status != PSA_SUCCESS ) 525 return( status ); 526 527 if( PSA_ALG_IS_TLS12_PRF( alg ) || PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) ) 528 { 529 status = psa_key_derivation_input_bytes( derivation, 530 PSA_KEY_DERIVATION_INPUT_SEED, 531 seed, seed_length ); 532 if( status != PSA_SUCCESS ) 533 return( status ); 534 535 if( mbedtls_svc_key_id_is_null( key ) ) 536 { 537 status = psa_key_derivation_input_bytes( 538 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, 539 NULL, 0 ); 540 } 541 else 542 { 543 status = psa_key_derivation_input_key( 544 derivation, PSA_KEY_DERIVATION_INPUT_SECRET, key ); 545 } 546 if( status != PSA_SUCCESS ) 547 return( status ); 548 549 status = psa_key_derivation_input_bytes( derivation, 550 PSA_KEY_DERIVATION_INPUT_LABEL, 551 label, label_length ); 552 if( status != PSA_SUCCESS ) 553 return( status ); 554 } 555 else 556 { 557 return( PSA_ERROR_NOT_SUPPORTED ); 558 } 559 560 status = psa_key_derivation_set_capacity( derivation, capacity ); 561 if( status != PSA_SUCCESS ) 562 return( status ); 563 564 return( PSA_SUCCESS ); 565 } 566 567 static int tls_prf_generic( mbedtls_md_type_t md_type, 568 const unsigned char *secret, size_t slen, 569 const char *label, 570 const unsigned char *random, size_t rlen, 571 unsigned char *dstbuf, size_t dlen ) 572 { 573 psa_status_t status; 574 psa_algorithm_t alg; 575 psa_key_id_t master_key = MBEDTLS_SVC_KEY_ID_INIT; 576 psa_key_derivation_operation_t derivation = 577 PSA_KEY_DERIVATION_OPERATION_INIT; 578 579 if( md_type == MBEDTLS_MD_SHA384 ) 580 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_384); 581 else 582 alg = PSA_ALG_TLS12_PRF(PSA_ALG_SHA_256); 583 584 /* Normally a "secret" should be long enough to be impossible to 585 * find by brute force, and in particular should not be empty. But 586 * this PRF is also used to derive an IV, in particular in EAP-TLS, 587 * and for this use case it makes sense to have a 0-length "secret". 588 * Since the key API doesn't allow importing a key of length 0, 589 * keep master_key=0, which setup_psa_key_derivation() understands 590 * to mean a 0-length "secret" input. */ 591 if( slen != 0 ) 592 { 593 psa_key_attributes_t key_attributes = psa_key_attributes_init(); 594 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE ); 595 psa_set_key_algorithm( &key_attributes, alg ); 596 psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE ); 597 598 status = psa_import_key( &key_attributes, secret, slen, &master_key ); 599 if( status != PSA_SUCCESS ) 600 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); 601 } 602 603 status = setup_psa_key_derivation( &derivation, 604 master_key, alg, 605 random, rlen, 606 (unsigned char const *) label, 607 (size_t) strlen( label ), 608 dlen ); 609 if( status != PSA_SUCCESS ) 610 { 611 psa_key_derivation_abort( &derivation ); 612 psa_destroy_key( master_key ); 613 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); 614 } 615 616 status = psa_key_derivation_output_bytes( &derivation, dstbuf, dlen ); 617 if( status != PSA_SUCCESS ) 618 { 619 psa_key_derivation_abort( &derivation ); 620 psa_destroy_key( master_key ); 621 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); 622 } 623 624 status = psa_key_derivation_abort( &derivation ); 625 if( status != PSA_SUCCESS ) 626 { 627 psa_destroy_key( master_key ); 628 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); 629 } 630 631 if( ! mbedtls_svc_key_id_is_null( master_key ) ) 632 status = psa_destroy_key( master_key ); 633 if( status != PSA_SUCCESS ) 634 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); 635 636 return( 0 ); 637 } 638 639 #else /* MBEDTLS_USE_PSA_CRYPTO */ 640 641 static int tls_prf_generic( mbedtls_md_type_t md_type, 642 const unsigned char *secret, size_t slen, 643 const char *label, 644 const unsigned char *random, size_t rlen, 645 unsigned char *dstbuf, size_t dlen ) 646 { 647 size_t nb; 648 size_t i, j, k, md_len; 649 unsigned char *tmp; 650 size_t tmp_len = 0; 651 unsigned char h_i[MBEDTLS_MD_MAX_SIZE]; 652 const mbedtls_md_info_t *md_info; 653 mbedtls_md_context_t md_ctx; 654 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 655 656 mbedtls_md_init( &md_ctx ); 657 658 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL ) 659 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 660 661 md_len = mbedtls_md_get_size( md_info ); 662 663 tmp_len = md_len + strlen( label ) + rlen; 664 tmp = mbedtls_calloc( 1, tmp_len ); 665 if( tmp == NULL ) 666 { 667 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED; 668 goto exit; 669 } 670 671 nb = strlen( label ); 672 memcpy( tmp + md_len, label, nb ); 673 memcpy( tmp + md_len + nb, random, rlen ); 674 nb += rlen; 675 676 /* 677 * Compute P_<hash>(secret, label + random)[0..dlen] 678 */ 679 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 ) 680 goto exit; 681 682 mbedtls_md_hmac_starts( &md_ctx, secret, slen ); 683 mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb ); 684 mbedtls_md_hmac_finish( &md_ctx, tmp ); 685 686 for( i = 0; i < dlen; i += md_len ) 687 { 688 mbedtls_md_hmac_reset ( &md_ctx ); 689 mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb ); 690 mbedtls_md_hmac_finish( &md_ctx, h_i ); 691 692 mbedtls_md_hmac_reset ( &md_ctx ); 693 mbedtls_md_hmac_update( &md_ctx, tmp, md_len ); 694 mbedtls_md_hmac_finish( &md_ctx, tmp ); 695 696 k = ( i + md_len > dlen ) ? dlen % md_len : md_len; 697 698 for( j = 0; j < k; j++ ) 699 dstbuf[i + j] = h_i[j]; 700 } 701 702 exit: 703 mbedtls_md_free( &md_ctx ); 704 705 mbedtls_platform_zeroize( tmp, tmp_len ); 706 mbedtls_platform_zeroize( h_i, sizeof( h_i ) ); 707 708 mbedtls_free( tmp ); 709 710 return( ret ); 711 } 712 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 713 #if defined(MBEDTLS_SHA256_C) 714 static int tls_prf_sha256( const unsigned char *secret, size_t slen, 715 const char *label, 716 const unsigned char *random, size_t rlen, 717 unsigned char *dstbuf, size_t dlen ) 718 { 719 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen, 720 label, random, rlen, dstbuf, dlen ) ); 721 } 722 #endif /* MBEDTLS_SHA256_C */ 723 724 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 725 static int tls_prf_sha384( const unsigned char *secret, size_t slen, 726 const char *label, 727 const unsigned char *random, size_t rlen, 728 unsigned char *dstbuf, size_t dlen ) 729 { 730 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen, 731 label, random, rlen, dstbuf, dlen ) ); 732 } 733 #endif /* MBEDTLS_SHA512_C && !MBEDTLS_SHA512_NO_SHA384 */ 734 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 735 736 static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t ); 737 738 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ 739 defined(MBEDTLS_SSL_PROTO_TLS1_1) 740 static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *, const unsigned char *, size_t ); 741 #endif 742 743 #if defined(MBEDTLS_SSL_PROTO_SSL3) 744 static void ssl_calc_verify_ssl( const mbedtls_ssl_context *, unsigned char *, size_t * ); 745 static void ssl_calc_finished_ssl( mbedtls_ssl_context *, unsigned char *, int ); 746 #endif 747 748 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) 749 static void ssl_calc_verify_tls( const mbedtls_ssl_context *, unsigned char*, size_t * ); 750 static void ssl_calc_finished_tls( mbedtls_ssl_context *, unsigned char *, int ); 751 #endif 752 753 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 754 #if defined(MBEDTLS_SHA256_C) 755 static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t ); 756 static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * ); 757 static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int ); 758 #endif 759 760 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 761 static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t ); 762 static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * ); 763 static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int ); 764 #endif 765 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 766 767 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) && \ 768 defined(MBEDTLS_USE_PSA_CRYPTO) 769 static int ssl_use_opaque_psk( mbedtls_ssl_context const *ssl ) 770 { 771 if( ssl->conf->f_psk != NULL ) 772 { 773 /* If we've used a callback to select the PSK, 774 * the static configuration is irrelevant. */ 775 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) ) 776 return( 1 ); 777 778 return( 0 ); 779 } 780 781 if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) ) 782 return( 1 ); 783 784 return( 0 ); 785 } 786 #endif /* MBEDTLS_USE_PSA_CRYPTO && 787 MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */ 788 789 #if defined(MBEDTLS_SSL_EXPORT_KEYS) 790 static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf ) 791 { 792 #if defined(MBEDTLS_SSL_PROTO_SSL3) 793 if( tls_prf == ssl3_prf ) 794 { 795 return( MBEDTLS_SSL_TLS_PRF_SSL3 ); 796 } 797 else 798 #endif 799 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) 800 if( tls_prf == tls1_prf ) 801 { 802 return( MBEDTLS_SSL_TLS_PRF_TLS1 ); 803 } 804 else 805 #endif 806 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 807 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 808 if( tls_prf == tls_prf_sha384 ) 809 { 810 return( MBEDTLS_SSL_TLS_PRF_SHA384 ); 811 } 812 else 813 #endif 814 #if defined(MBEDTLS_SHA256_C) 815 if( tls_prf == tls_prf_sha256 ) 816 { 817 return( MBEDTLS_SSL_TLS_PRF_SHA256 ); 818 } 819 else 820 #endif 821 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 822 return( MBEDTLS_SSL_TLS_PRF_NONE ); 823 } 824 #endif /* MBEDTLS_SSL_EXPORT_KEYS */ 825 826 int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf, 827 const unsigned char *secret, size_t slen, 828 const char *label, 829 const unsigned char *random, size_t rlen, 830 unsigned char *dstbuf, size_t dlen ) 831 { 832 mbedtls_ssl_tls_prf_cb *tls_prf = NULL; 833 834 switch( prf ) 835 { 836 #if defined(MBEDTLS_SSL_PROTO_SSL3) 837 case MBEDTLS_SSL_TLS_PRF_SSL3: 838 tls_prf = ssl3_prf; 839 break; 840 #endif /* MBEDTLS_SSL_PROTO_SSL3 */ 841 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) 842 case MBEDTLS_SSL_TLS_PRF_TLS1: 843 tls_prf = tls1_prf; 844 break; 845 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */ 846 847 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 848 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 849 case MBEDTLS_SSL_TLS_PRF_SHA384: 850 tls_prf = tls_prf_sha384; 851 break; 852 #endif /* MBEDTLS_SHA512_C && !MBEDTLS_SHA512_NO_SHA384 */ 853 #if defined(MBEDTLS_SHA256_C) 854 case MBEDTLS_SSL_TLS_PRF_SHA256: 855 tls_prf = tls_prf_sha256; 856 break; 857 #endif /* MBEDTLS_SHA256_C */ 858 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 859 default: 860 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); 861 } 862 863 return( tls_prf( secret, slen, label, random, rlen, dstbuf, dlen ) ); 864 } 865 866 /* Type for the TLS PRF */ 867 typedef int ssl_tls_prf_t(const unsigned char *, size_t, const char *, 868 const unsigned char *, size_t, 869 unsigned char *, size_t); 870 871 /* 872 * Populate a transform structure with session keys and all the other 873 * necessary information. 874 * 875 * Parameters: 876 * - [in/out]: transform: structure to populate 877 * [in] must be just initialised with mbedtls_ssl_transform_init() 878 * [out] fully populated, ready for use by mbedtls_ssl_{en,de}crypt_buf() 879 * - [in] ciphersuite 880 * - [in] master 881 * - [in] encrypt_then_mac 882 * - [in] trunc_hmac 883 * - [in] compression 884 * - [in] tls_prf: pointer to PRF to use for key derivation 885 * - [in] randbytes: buffer holding ServerHello.random + ClientHello.random 886 * - [in] minor_ver: SSL/TLS minor version 887 * - [in] endpoint: client or server 888 * - [in] ssl: optionally used for: 889 * - MBEDTLS_SSL_HW_RECORD_ACCEL: whole context (non-const) 890 * - MBEDTLS_SSL_EXPORT_KEYS: ssl->conf->{f,p}_export_keys 891 * - MBEDTLS_DEBUG_C: ssl->conf->{f,p}_dbg 892 */ 893 static int ssl_populate_transform( mbedtls_ssl_transform *transform, 894 int ciphersuite, 895 const unsigned char master[48], 896 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) 897 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 898 int encrypt_then_mac, 899 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ 900 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) 901 int trunc_hmac, 902 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ 903 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */ 904 #if defined(MBEDTLS_ZLIB_SUPPORT) 905 int compression, 906 #endif 907 ssl_tls_prf_t tls_prf, 908 const unsigned char randbytes[64], 909 int minor_ver, 910 unsigned endpoint, 911 #if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL) 912 const 913 #endif 914 mbedtls_ssl_context *ssl ) 915 { 916 int ret = 0; 917 #if defined(MBEDTLS_USE_PSA_CRYPTO) 918 int psa_fallthrough; 919 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 920 unsigned char keyblk[256]; 921 unsigned char *key1; 922 unsigned char *key2; 923 unsigned char *mac_enc; 924 unsigned char *mac_dec; 925 size_t mac_key_len = 0; 926 size_t iv_copy_len; 927 unsigned keylen; 928 const mbedtls_ssl_ciphersuite_t *ciphersuite_info; 929 const mbedtls_cipher_info_t *cipher_info; 930 const mbedtls_md_info_t *md_info; 931 932 #if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL) && \ 933 !defined(MBEDTLS_SSL_EXPORT_KEYS) && \ 934 !defined(MBEDTLS_DEBUG_C) 935 ssl = NULL; /* make sure we don't use it except for those cases */ 936 (void) ssl; 937 #endif 938 939 /* 940 * Some data just needs copying into the structure 941 */ 942 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \ 943 defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) 944 transform->encrypt_then_mac = encrypt_then_mac; 945 #endif 946 transform->minor_ver = minor_ver; 947 948 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) 949 memcpy( transform->randbytes, randbytes, sizeof( transform->randbytes ) ); 950 #endif 951 952 /* 953 * Get various info structures 954 */ 955 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite ); 956 if( ciphersuite_info == NULL ) 957 { 958 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found", 959 ciphersuite ) ); 960 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 961 } 962 963 cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher ); 964 if( cipher_info == NULL ) 965 { 966 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found", 967 ciphersuite_info->cipher ) ); 968 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 969 } 970 971 md_info = mbedtls_md_info_from_type( ciphersuite_info->mac ); 972 if( md_info == NULL ) 973 { 974 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found", 975 (unsigned) ciphersuite_info->mac ) ); 976 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 977 } 978 979 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 980 /* Copy own and peer's CID if the use of the CID 981 * extension has been negotiated. */ 982 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_ENABLED ) 983 { 984 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Copy CIDs into SSL transform" ) ); 985 986 transform->in_cid_len = ssl->own_cid_len; 987 memcpy( transform->in_cid, ssl->own_cid, ssl->own_cid_len ); 988 MBEDTLS_SSL_DEBUG_BUF( 3, "Incoming CID", transform->in_cid, 989 transform->in_cid_len ); 990 991 transform->out_cid_len = ssl->handshake->peer_cid_len; 992 memcpy( transform->out_cid, ssl->handshake->peer_cid, 993 ssl->handshake->peer_cid_len ); 994 MBEDTLS_SSL_DEBUG_BUF( 3, "Outgoing CID", transform->out_cid, 995 transform->out_cid_len ); 996 } 997 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ 998 999 /* 1000 * Compute key block using the PRF 1001 */ 1002 ret = tls_prf( master, 48, "key expansion", randbytes, 64, keyblk, 256 ); 1003 if( ret != 0 ) 1004 { 1005 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret ); 1006 return( ret ); 1007 } 1008 1009 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s", 1010 mbedtls_ssl_get_ciphersuite_name( ciphersuite ) ) ); 1011 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", master, 48 ); 1012 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", randbytes, 64 ); 1013 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 ); 1014 1015 /* 1016 * Determine the appropriate key, IV and MAC length. 1017 */ 1018 1019 keylen = cipher_info->key_bitlen / 8; 1020 1021 #if defined(MBEDTLS_GCM_C) || \ 1022 defined(MBEDTLS_CCM_C) || \ 1023 defined(MBEDTLS_CHACHAPOLY_C) 1024 if( cipher_info->mode == MBEDTLS_MODE_GCM || 1025 cipher_info->mode == MBEDTLS_MODE_CCM || 1026 cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY ) 1027 { 1028 size_t explicit_ivlen; 1029 1030 transform->maclen = 0; 1031 mac_key_len = 0; 1032 transform->taglen = 1033 ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16; 1034 1035 /* All modes haves 96-bit IVs, but the length of the static parts vary 1036 * with mode and version: 1037 * - For GCM and CCM in TLS 1.2, there's a static IV of 4 Bytes 1038 * (to be concatenated with a dynamically chosen IV of 8 Bytes) 1039 * - For ChaChaPoly in TLS 1.2, and all modes in TLS 1.3, there's 1040 * a static IV of 12 Bytes (to be XOR'ed with the 8 Byte record 1041 * sequence number). 1042 */ 1043 transform->ivlen = 12; 1044 #if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL) 1045 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 ) 1046 { 1047 transform->fixed_ivlen = 12; 1048 } 1049 else 1050 #endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */ 1051 { 1052 if( cipher_info->mode == MBEDTLS_MODE_CHACHAPOLY ) 1053 transform->fixed_ivlen = 12; 1054 else 1055 transform->fixed_ivlen = 4; 1056 } 1057 1058 /* Minimum length of encrypted record */ 1059 explicit_ivlen = transform->ivlen - transform->fixed_ivlen; 1060 transform->minlen = explicit_ivlen + transform->taglen; 1061 } 1062 else 1063 #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */ 1064 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) 1065 if( cipher_info->mode == MBEDTLS_MODE_STREAM || 1066 cipher_info->mode == MBEDTLS_MODE_CBC ) 1067 { 1068 /* Initialize HMAC contexts */ 1069 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 || 1070 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 ) 1071 { 1072 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret ); 1073 goto end; 1074 } 1075 1076 /* Get MAC length */ 1077 mac_key_len = mbedtls_md_get_size( md_info ); 1078 transform->maclen = mac_key_len; 1079 1080 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) 1081 /* 1082 * If HMAC is to be truncated, we shall keep the leftmost bytes, 1083 * (rfc 6066 page 13 or rfc 2104 section 4), 1084 * so we only need to adjust the length here. 1085 */ 1086 if( trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED ) 1087 { 1088 transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN; 1089 1090 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT) 1091 /* Fall back to old, non-compliant version of the truncated 1092 * HMAC implementation which also truncates the key 1093 * (Mbed TLS versions from 1.3 to 2.6.0) */ 1094 mac_key_len = transform->maclen; 1095 #endif 1096 } 1097 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ 1098 1099 /* IV length */ 1100 transform->ivlen = cipher_info->iv_size; 1101 1102 /* Minimum length */ 1103 if( cipher_info->mode == MBEDTLS_MODE_STREAM ) 1104 transform->minlen = transform->maclen; 1105 else 1106 { 1107 /* 1108 * GenericBlockCipher: 1109 * 1. if EtM is in use: one block plus MAC 1110 * otherwise: * first multiple of blocklen greater than maclen 1111 * 2. IV except for SSL3 and TLS 1.0 1112 */ 1113 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 1114 if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED ) 1115 { 1116 transform->minlen = transform->maclen 1117 + cipher_info->block_size; 1118 } 1119 else 1120 #endif 1121 { 1122 transform->minlen = transform->maclen 1123 + cipher_info->block_size 1124 - transform->maclen % cipher_info->block_size; 1125 } 1126 1127 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) 1128 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 || 1129 minor_ver == MBEDTLS_SSL_MINOR_VERSION_1 ) 1130 ; /* No need to adjust minlen */ 1131 else 1132 #endif 1133 #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2) 1134 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_2 || 1135 minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) 1136 { 1137 transform->minlen += transform->ivlen; 1138 } 1139 else 1140 #endif 1141 { 1142 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 1143 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; 1144 goto end; 1145 } 1146 } 1147 } 1148 else 1149 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */ 1150 { 1151 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 1152 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 1153 } 1154 1155 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u", 1156 (unsigned) keylen, 1157 (unsigned) transform->minlen, 1158 (unsigned) transform->ivlen, 1159 (unsigned) transform->maclen ) ); 1160 1161 /* 1162 * Finally setup the cipher contexts, IVs and MAC secrets. 1163 */ 1164 #if defined(MBEDTLS_SSL_CLI_C) 1165 if( endpoint == MBEDTLS_SSL_IS_CLIENT ) 1166 { 1167 key1 = keyblk + mac_key_len * 2; 1168 key2 = keyblk + mac_key_len * 2 + keylen; 1169 1170 mac_enc = keyblk; 1171 mac_dec = keyblk + mac_key_len; 1172 1173 /* 1174 * This is not used in TLS v1.1. 1175 */ 1176 iv_copy_len = ( transform->fixed_ivlen ) ? 1177 transform->fixed_ivlen : transform->ivlen; 1178 memcpy( transform->iv_enc, key2 + keylen, iv_copy_len ); 1179 memcpy( transform->iv_dec, key2 + keylen + iv_copy_len, 1180 iv_copy_len ); 1181 } 1182 else 1183 #endif /* MBEDTLS_SSL_CLI_C */ 1184 #if defined(MBEDTLS_SSL_SRV_C) 1185 if( endpoint == MBEDTLS_SSL_IS_SERVER ) 1186 { 1187 key1 = keyblk + mac_key_len * 2 + keylen; 1188 key2 = keyblk + mac_key_len * 2; 1189 1190 mac_enc = keyblk + mac_key_len; 1191 mac_dec = keyblk; 1192 1193 /* 1194 * This is not used in TLS v1.1. 1195 */ 1196 iv_copy_len = ( transform->fixed_ivlen ) ? 1197 transform->fixed_ivlen : transform->ivlen; 1198 memcpy( transform->iv_dec, key1 + keylen, iv_copy_len ); 1199 memcpy( transform->iv_enc, key1 + keylen + iv_copy_len, 1200 iv_copy_len ); 1201 } 1202 else 1203 #endif /* MBEDTLS_SSL_SRV_C */ 1204 { 1205 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 1206 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; 1207 goto end; 1208 } 1209 1210 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) 1211 #if defined(MBEDTLS_SSL_PROTO_SSL3) 1212 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) 1213 { 1214 if( mac_key_len > sizeof( transform->mac_enc ) ) 1215 { 1216 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 1217 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; 1218 goto end; 1219 } 1220 1221 memcpy( transform->mac_enc, mac_enc, mac_key_len ); 1222 memcpy( transform->mac_dec, mac_dec, mac_key_len ); 1223 } 1224 else 1225 #endif /* MBEDTLS_SSL_PROTO_SSL3 */ 1226 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ 1227 defined(MBEDTLS_SSL_PROTO_TLS1_2) 1228 if( minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 ) 1229 { 1230 /* For HMAC-based ciphersuites, initialize the HMAC transforms. 1231 For AEAD-based ciphersuites, there is nothing to do here. */ 1232 if( mac_key_len != 0 ) 1233 { 1234 mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, mac_key_len ); 1235 mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, mac_key_len ); 1236 } 1237 } 1238 else 1239 #endif 1240 { 1241 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 1242 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; 1243 goto end; 1244 } 1245 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */ 1246 1247 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) 1248 if( mbedtls_ssl_hw_record_init != NULL ) 1249 { 1250 ret = 0; 1251 1252 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) ); 1253 1254 if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, keylen, 1255 transform->iv_enc, transform->iv_dec, 1256 iv_copy_len, 1257 mac_enc, mac_dec, 1258 mac_key_len ) ) != 0 ) 1259 { 1260 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret ); 1261 ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; 1262 goto end; 1263 } 1264 } 1265 #else 1266 ((void) mac_dec); 1267 ((void) mac_enc); 1268 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */ 1269 1270 #if defined(MBEDTLS_SSL_EXPORT_KEYS) 1271 if( ssl->conf->f_export_keys != NULL ) 1272 { 1273 ssl->conf->f_export_keys( ssl->conf->p_export_keys, 1274 master, keyblk, 1275 mac_key_len, keylen, 1276 iv_copy_len ); 1277 } 1278 1279 if( ssl->conf->f_export_keys_ext != NULL ) 1280 { 1281 ssl->conf->f_export_keys_ext( ssl->conf->p_export_keys, 1282 master, keyblk, 1283 mac_key_len, keylen, 1284 iv_copy_len, 1285 randbytes + 32, 1286 randbytes, 1287 tls_prf_get_type( tls_prf ) ); 1288 } 1289 #endif 1290 1291 #if defined(MBEDTLS_USE_PSA_CRYPTO) 1292 1293 /* Only use PSA-based ciphers for TLS-1.2. 1294 * That's relevant at least for TLS-1.0, where 1295 * we assume that mbedtls_cipher_crypt() updates 1296 * the structure field for the IV, which the PSA-based 1297 * implementation currently doesn't. */ 1298 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 1299 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) 1300 { 1301 ret = mbedtls_cipher_setup_psa( &transform->cipher_ctx_enc, 1302 cipher_info, transform->taglen ); 1303 if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ) 1304 { 1305 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup_psa", ret ); 1306 goto end; 1307 } 1308 1309 if( ret == 0 ) 1310 { 1311 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Successfully setup PSA-based encryption cipher context" ) ); 1312 psa_fallthrough = 0; 1313 } 1314 else 1315 { 1316 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to setup PSA-based cipher context for record encryption - fall through to default setup." ) ); 1317 psa_fallthrough = 1; 1318 } 1319 } 1320 else 1321 psa_fallthrough = 1; 1322 #else 1323 psa_fallthrough = 1; 1324 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 1325 1326 if( psa_fallthrough == 1 ) 1327 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 1328 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc, 1329 cipher_info ) ) != 0 ) 1330 { 1331 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret ); 1332 goto end; 1333 } 1334 1335 #if defined(MBEDTLS_USE_PSA_CRYPTO) 1336 /* Only use PSA-based ciphers for TLS-1.2. 1337 * That's relevant at least for TLS-1.0, where 1338 * we assume that mbedtls_cipher_crypt() updates 1339 * the structure field for the IV, which the PSA-based 1340 * implementation currently doesn't. */ 1341 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 1342 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) 1343 { 1344 ret = mbedtls_cipher_setup_psa( &transform->cipher_ctx_dec, 1345 cipher_info, transform->taglen ); 1346 if( ret != 0 && ret != MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE ) 1347 { 1348 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup_psa", ret ); 1349 goto end; 1350 } 1351 1352 if( ret == 0 ) 1353 { 1354 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Successfully setup PSA-based decryption cipher context" ) ); 1355 psa_fallthrough = 0; 1356 } 1357 else 1358 { 1359 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to setup PSA-based cipher context for record decryption - fall through to default setup." ) ); 1360 psa_fallthrough = 1; 1361 } 1362 } 1363 else 1364 psa_fallthrough = 1; 1365 #else 1366 psa_fallthrough = 1; 1367 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 1368 1369 if( psa_fallthrough == 1 ) 1370 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 1371 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec, 1372 cipher_info ) ) != 0 ) 1373 { 1374 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret ); 1375 goto end; 1376 } 1377 1378 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1, 1379 cipher_info->key_bitlen, 1380 MBEDTLS_ENCRYPT ) ) != 0 ) 1381 { 1382 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret ); 1383 goto end; 1384 } 1385 1386 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2, 1387 cipher_info->key_bitlen, 1388 MBEDTLS_DECRYPT ) ) != 0 ) 1389 { 1390 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret ); 1391 goto end; 1392 } 1393 1394 #if defined(MBEDTLS_CIPHER_MODE_CBC) 1395 if( cipher_info->mode == MBEDTLS_MODE_CBC ) 1396 { 1397 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc, 1398 MBEDTLS_PADDING_NONE ) ) != 0 ) 1399 { 1400 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret ); 1401 goto end; 1402 } 1403 1404 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec, 1405 MBEDTLS_PADDING_NONE ) ) != 0 ) 1406 { 1407 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret ); 1408 goto end; 1409 } 1410 } 1411 #endif /* MBEDTLS_CIPHER_MODE_CBC */ 1412 1413 1414 /* Initialize Zlib contexts */ 1415 #if defined(MBEDTLS_ZLIB_SUPPORT) 1416 if( compression == MBEDTLS_SSL_COMPRESS_DEFLATE ) 1417 { 1418 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) ); 1419 1420 memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) ); 1421 memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) ); 1422 1423 if( deflateInit( &transform->ctx_deflate, 1424 Z_DEFAULT_COMPRESSION ) != Z_OK || 1425 inflateInit( &transform->ctx_inflate ) != Z_OK ) 1426 { 1427 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) ); 1428 ret = MBEDTLS_ERR_SSL_COMPRESSION_FAILED; 1429 goto end; 1430 } 1431 } 1432 #endif /* MBEDTLS_ZLIB_SUPPORT */ 1433 1434 end: 1435 mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) ); 1436 return( ret ); 1437 } 1438 1439 /* 1440 * Set appropriate PRF function and other SSL / TLS 1.0/1.1 / TLS1.2 functions 1441 * 1442 * Inputs: 1443 * - SSL/TLS minor version 1444 * - hash associated with the ciphersuite (only used by TLS 1.2) 1445 * 1446 * Outputs: 1447 * - the tls_prf, calc_verify and calc_finished members of handshake structure 1448 */ 1449 static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake, 1450 int minor_ver, 1451 mbedtls_md_type_t hash ) 1452 { 1453 #if !defined(MBEDTLS_SSL_PROTO_TLS1_2) || \ 1454 !( defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) ) 1455 (void) hash; 1456 #endif 1457 1458 #if defined(MBEDTLS_SSL_PROTO_SSL3) 1459 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) 1460 { 1461 handshake->tls_prf = ssl3_prf; 1462 handshake->calc_verify = ssl_calc_verify_ssl; 1463 handshake->calc_finished = ssl_calc_finished_ssl; 1464 } 1465 else 1466 #endif 1467 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) 1468 if( minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ) 1469 { 1470 handshake->tls_prf = tls1_prf; 1471 handshake->calc_verify = ssl_calc_verify_tls; 1472 handshake->calc_finished = ssl_calc_finished_tls; 1473 } 1474 else 1475 #endif 1476 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 1477 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 1478 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 && 1479 hash == MBEDTLS_MD_SHA384 ) 1480 { 1481 handshake->tls_prf = tls_prf_sha384; 1482 handshake->calc_verify = ssl_calc_verify_tls_sha384; 1483 handshake->calc_finished = ssl_calc_finished_tls_sha384; 1484 } 1485 else 1486 #endif 1487 #if defined(MBEDTLS_SHA256_C) 1488 if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) 1489 { 1490 handshake->tls_prf = tls_prf_sha256; 1491 handshake->calc_verify = ssl_calc_verify_tls_sha256; 1492 handshake->calc_finished = ssl_calc_finished_tls_sha256; 1493 } 1494 else 1495 #endif 1496 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 1497 { 1498 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 1499 } 1500 1501 return( 0 ); 1502 } 1503 1504 /* 1505 * Compute master secret if needed 1506 * 1507 * Parameters: 1508 * [in/out] handshake 1509 * [in] resume, premaster, extended_ms, calc_verify, tls_prf 1510 * (PSA-PSK) ciphersuite_info, psk_opaque 1511 * [out] premaster (cleared) 1512 * [out] master 1513 * [in] ssl: optionally used for debugging, EMS and PSA-PSK 1514 * debug: conf->f_dbg, conf->p_dbg 1515 * EMS: passed to calc_verify (debug + (SSL3) session_negotiate) 1516 * PSA-PSA: minor_ver, conf 1517 */ 1518 static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake, 1519 unsigned char *master, 1520 const mbedtls_ssl_context *ssl ) 1521 { 1522 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 1523 1524 /* cf. RFC 5246, Section 8.1: 1525 * "The master secret is always exactly 48 bytes in length." */ 1526 size_t const master_secret_len = 48; 1527 1528 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 1529 unsigned char session_hash[48]; 1530 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ 1531 1532 /* The label for the KDF used for key expansion. 1533 * This is either "master secret" or "extended master secret" 1534 * depending on whether the Extended Master Secret extension 1535 * is used. */ 1536 char const *lbl = "master secret"; 1537 1538 /* The salt for the KDF used for key expansion. 1539 * - If the Extended Master Secret extension is not used, 1540 * this is ClientHello.Random + ServerHello.Random 1541 * (see Sect. 8.1 in RFC 5246). 1542 * - If the Extended Master Secret extension is used, 1543 * this is the transcript of the handshake so far. 1544 * (see Sect. 4 in RFC 7627). */ 1545 unsigned char const *salt = handshake->randbytes; 1546 size_t salt_len = 64; 1547 1548 #if !defined(MBEDTLS_DEBUG_C) && \ 1549 !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \ 1550 !(defined(MBEDTLS_USE_PSA_CRYPTO) && \ 1551 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)) 1552 ssl = NULL; /* make sure we don't use it except for those cases */ 1553 (void) ssl; 1554 #endif 1555 1556 if( handshake->resume != 0 ) 1557 { 1558 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) ); 1559 return( 0 ); 1560 } 1561 1562 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 1563 if( handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED ) 1564 { 1565 lbl = "extended master secret"; 1566 salt = session_hash; 1567 handshake->calc_verify( ssl, session_hash, &salt_len ); 1568 1569 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash for extended master secret", 1570 session_hash, salt_len ); 1571 } 1572 #endif /* MBEDTLS_SSL_EXTENDED_MS_ENABLED */ 1573 1574 #if defined(MBEDTLS_USE_PSA_CRYPTO) && \ 1575 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) 1576 if( handshake->ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK && 1577 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 && 1578 ssl_use_opaque_psk( ssl ) == 1 ) 1579 { 1580 /* Perform PSK-to-MS expansion in a single step. */ 1581 psa_status_t status; 1582 psa_algorithm_t alg; 1583 psa_key_id_t psk; 1584 psa_key_derivation_operation_t derivation = 1585 PSA_KEY_DERIVATION_OPERATION_INIT; 1586 mbedtls_md_type_t hash_alg = handshake->ciphersuite_info->mac; 1587 1588 MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) ); 1589 1590 psk = mbedtls_ssl_get_opaque_psk( ssl ); 1591 1592 if( hash_alg == MBEDTLS_MD_SHA384 ) 1593 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384); 1594 else 1595 alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256); 1596 1597 status = setup_psa_key_derivation( &derivation, psk, alg, 1598 salt, salt_len, 1599 (unsigned char const *) lbl, 1600 (size_t) strlen( lbl ), 1601 master_secret_len ); 1602 if( status != PSA_SUCCESS ) 1603 { 1604 psa_key_derivation_abort( &derivation ); 1605 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); 1606 } 1607 1608 status = psa_key_derivation_output_bytes( &derivation, 1609 master, 1610 master_secret_len ); 1611 if( status != PSA_SUCCESS ) 1612 { 1613 psa_key_derivation_abort( &derivation ); 1614 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); 1615 } 1616 1617 status = psa_key_derivation_abort( &derivation ); 1618 if( status != PSA_SUCCESS ) 1619 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); 1620 } 1621 else 1622 #endif 1623 { 1624 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen, 1625 lbl, salt, salt_len, 1626 master, 1627 master_secret_len ); 1628 if( ret != 0 ) 1629 { 1630 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret ); 1631 return( ret ); 1632 } 1633 1634 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret", 1635 handshake->premaster, 1636 handshake->pmslen ); 1637 1638 mbedtls_platform_zeroize( handshake->premaster, 1639 sizeof(handshake->premaster) ); 1640 } 1641 1642 return( 0 ); 1643 } 1644 1645 int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl ) 1646 { 1647 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 1648 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info = 1649 ssl->handshake->ciphersuite_info; 1650 1651 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) ); 1652 1653 /* Set PRF, calc_verify and calc_finished function pointers */ 1654 ret = ssl_set_handshake_prfs( ssl->handshake, 1655 ssl->minor_ver, 1656 ciphersuite_info->mac ); 1657 if( ret != 0 ) 1658 { 1659 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_set_handshake_prfs", ret ); 1660 return( ret ); 1661 } 1662 1663 /* Compute master secret if needed */ 1664 ret = ssl_compute_master( ssl->handshake, 1665 ssl->session_negotiate->master, 1666 ssl ); 1667 if( ret != 0 ) 1668 { 1669 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compute_master", ret ); 1670 return( ret ); 1671 } 1672 1673 /* Swap the client and server random values: 1674 * - MS derivation wanted client+server (RFC 5246 8.1) 1675 * - key derivation wants server+client (RFC 5246 6.3) */ 1676 { 1677 unsigned char tmp[64]; 1678 memcpy( tmp, ssl->handshake->randbytes, 64 ); 1679 memcpy( ssl->handshake->randbytes, tmp + 32, 32 ); 1680 memcpy( ssl->handshake->randbytes + 32, tmp, 32 ); 1681 mbedtls_platform_zeroize( tmp, sizeof( tmp ) ); 1682 } 1683 1684 /* Populate transform structure */ 1685 ret = ssl_populate_transform( ssl->transform_negotiate, 1686 ssl->session_negotiate->ciphersuite, 1687 ssl->session_negotiate->master, 1688 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) 1689 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 1690 ssl->session_negotiate->encrypt_then_mac, 1691 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ 1692 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) 1693 ssl->session_negotiate->trunc_hmac, 1694 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ 1695 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */ 1696 #if defined(MBEDTLS_ZLIB_SUPPORT) 1697 ssl->session_negotiate->compression, 1698 #endif 1699 ssl->handshake->tls_prf, 1700 ssl->handshake->randbytes, 1701 ssl->minor_ver, 1702 ssl->conf->endpoint, 1703 ssl ); 1704 if( ret != 0 ) 1705 { 1706 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_populate_transform", ret ); 1707 return( ret ); 1708 } 1709 1710 /* We no longer need Server/ClientHello.random values */ 1711 mbedtls_platform_zeroize( ssl->handshake->randbytes, 1712 sizeof( ssl->handshake->randbytes ) ); 1713 1714 /* Allocate compression buffer */ 1715 #if defined(MBEDTLS_ZLIB_SUPPORT) 1716 if( ssl->session_negotiate->compression == MBEDTLS_SSL_COMPRESS_DEFLATE && 1717 ssl->compress_buf == NULL ) 1718 { 1719 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) ); 1720 ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_COMPRESS_BUFFER_LEN ); 1721 if( ssl->compress_buf == NULL ) 1722 { 1723 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", 1724 MBEDTLS_SSL_COMPRESS_BUFFER_LEN ) ); 1725 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 1726 } 1727 } 1728 #endif 1729 1730 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) ); 1731 1732 return( 0 ); 1733 } 1734 1735 #if defined(MBEDTLS_SSL_PROTO_SSL3) 1736 void ssl_calc_verify_ssl( const mbedtls_ssl_context *ssl, 1737 unsigned char *hash, 1738 size_t *hlen ) 1739 { 1740 mbedtls_md5_context md5; 1741 mbedtls_sha1_context sha1; 1742 unsigned char pad_1[48]; 1743 unsigned char pad_2[48]; 1744 1745 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) ); 1746 1747 mbedtls_md5_init( &md5 ); 1748 mbedtls_sha1_init( &sha1 ); 1749 1750 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 ); 1751 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 ); 1752 1753 memset( pad_1, 0x36, 48 ); 1754 memset( pad_2, 0x5C, 48 ); 1755 1756 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 ); 1757 mbedtls_md5_update_ret( &md5, pad_1, 48 ); 1758 mbedtls_md5_finish_ret( &md5, hash ); 1759 1760 mbedtls_md5_starts_ret( &md5 ); 1761 mbedtls_md5_update_ret( &md5, ssl->session_negotiate->master, 48 ); 1762 mbedtls_md5_update_ret( &md5, pad_2, 48 ); 1763 mbedtls_md5_update_ret( &md5, hash, 16 ); 1764 mbedtls_md5_finish_ret( &md5, hash ); 1765 1766 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 ); 1767 mbedtls_sha1_update_ret( &sha1, pad_1, 40 ); 1768 mbedtls_sha1_finish_ret( &sha1, hash + 16 ); 1769 1770 mbedtls_sha1_starts_ret( &sha1 ); 1771 mbedtls_sha1_update_ret( &sha1, ssl->session_negotiate->master, 48 ); 1772 mbedtls_sha1_update_ret( &sha1, pad_2, 40 ); 1773 mbedtls_sha1_update_ret( &sha1, hash + 16, 20 ); 1774 mbedtls_sha1_finish_ret( &sha1, hash + 16 ); 1775 1776 *hlen = 36; 1777 1778 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen ); 1779 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) ); 1780 1781 mbedtls_md5_free( &md5 ); 1782 mbedtls_sha1_free( &sha1 ); 1783 1784 return; 1785 } 1786 #endif /* MBEDTLS_SSL_PROTO_SSL3 */ 1787 1788 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) 1789 void ssl_calc_verify_tls( const mbedtls_ssl_context *ssl, 1790 unsigned char *hash, 1791 size_t *hlen ) 1792 { 1793 mbedtls_md5_context md5; 1794 mbedtls_sha1_context sha1; 1795 1796 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) ); 1797 1798 mbedtls_md5_init( &md5 ); 1799 mbedtls_sha1_init( &sha1 ); 1800 1801 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 ); 1802 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 ); 1803 1804 mbedtls_md5_finish_ret( &md5, hash ); 1805 mbedtls_sha1_finish_ret( &sha1, hash + 16 ); 1806 1807 *hlen = 36; 1808 1809 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen ); 1810 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) ); 1811 1812 mbedtls_md5_free( &md5 ); 1813 mbedtls_sha1_free( &sha1 ); 1814 1815 return; 1816 } 1817 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */ 1818 1819 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 1820 #if defined(MBEDTLS_SHA256_C) 1821 void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl, 1822 unsigned char *hash, 1823 size_t *hlen ) 1824 { 1825 #if defined(MBEDTLS_USE_PSA_CRYPTO) 1826 size_t hash_size; 1827 psa_status_t status; 1828 psa_hash_operation_t sha256_psa = psa_hash_operation_init(); 1829 1830 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha256" ) ); 1831 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa ); 1832 if( status != PSA_SUCCESS ) 1833 { 1834 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) ); 1835 return; 1836 } 1837 1838 status = psa_hash_finish( &sha256_psa, hash, 32, &hash_size ); 1839 if( status != PSA_SUCCESS ) 1840 { 1841 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) ); 1842 return; 1843 } 1844 1845 *hlen = 32; 1846 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen ); 1847 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) ); 1848 #else 1849 mbedtls_sha256_context sha256; 1850 1851 mbedtls_sha256_init( &sha256 ); 1852 1853 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) ); 1854 1855 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 ); 1856 mbedtls_sha256_finish_ret( &sha256, hash ); 1857 1858 *hlen = 32; 1859 1860 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen ); 1861 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) ); 1862 1863 mbedtls_sha256_free( &sha256 ); 1864 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 1865 return; 1866 } 1867 #endif /* MBEDTLS_SHA256_C */ 1868 1869 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 1870 void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl, 1871 unsigned char *hash, 1872 size_t *hlen ) 1873 { 1874 #if defined(MBEDTLS_USE_PSA_CRYPTO) 1875 size_t hash_size; 1876 psa_status_t status; 1877 psa_hash_operation_t sha384_psa = psa_hash_operation_init(); 1878 1879 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> PSA calc verify sha384" ) ); 1880 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa ); 1881 if( status != PSA_SUCCESS ) 1882 { 1883 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) ); 1884 return; 1885 } 1886 1887 status = psa_hash_finish( &sha384_psa, hash, 48, &hash_size ); 1888 if( status != PSA_SUCCESS ) 1889 { 1890 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) ); 1891 return; 1892 } 1893 1894 *hlen = 48; 1895 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated verify result", hash, *hlen ); 1896 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= PSA calc verify" ) ); 1897 #else 1898 mbedtls_sha512_context sha512; 1899 1900 mbedtls_sha512_init( &sha512 ); 1901 1902 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) ); 1903 1904 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 ); 1905 mbedtls_sha512_finish_ret( &sha512, hash ); 1906 1907 *hlen = 48; 1908 1909 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, *hlen ); 1910 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) ); 1911 1912 mbedtls_sha512_free( &sha512 ); 1913 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 1914 return; 1915 } 1916 #endif /* MBEDTLS_SHA512_C && !MBEDTLS_SHA512_NO_SHA384 */ 1917 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 1918 1919 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) 1920 int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex ) 1921 { 1922 unsigned char *p = ssl->handshake->premaster; 1923 unsigned char *end = p + sizeof( ssl->handshake->premaster ); 1924 const unsigned char *psk = NULL; 1925 size_t psk_len = 0; 1926 1927 if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len ) 1928 == MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ) 1929 { 1930 /* 1931 * This should never happen because the existence of a PSK is always 1932 * checked before calling this function 1933 */ 1934 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 1935 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 1936 } 1937 1938 /* 1939 * PMS = struct { 1940 * opaque other_secret<0..2^16-1>; 1941 * opaque psk<0..2^16-1>; 1942 * }; 1943 * with "other_secret" depending on the particular key exchange 1944 */ 1945 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) 1946 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK ) 1947 { 1948 if( end - p < 2 ) 1949 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 1950 1951 *(p++) = (unsigned char)( psk_len >> 8 ); 1952 *(p++) = (unsigned char)( psk_len ); 1953 1954 if( end < p || (size_t)( end - p ) < psk_len ) 1955 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 1956 1957 memset( p, 0, psk_len ); 1958 p += psk_len; 1959 } 1960 else 1961 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */ 1962 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) 1963 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) 1964 { 1965 /* 1966 * other_secret already set by the ClientKeyExchange message, 1967 * and is 48 bytes long 1968 */ 1969 if( end - p < 2 ) 1970 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 1971 1972 *p++ = 0; 1973 *p++ = 48; 1974 p += 48; 1975 } 1976 else 1977 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ 1978 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) 1979 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK ) 1980 { 1981 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 1982 size_t len; 1983 1984 /* Write length only when we know the actual value */ 1985 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx, 1986 p + 2, end - ( p + 2 ), &len, 1987 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) 1988 { 1989 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret ); 1990 return( ret ); 1991 } 1992 *(p++) = (unsigned char)( len >> 8 ); 1993 *(p++) = (unsigned char)( len ); 1994 p += len; 1995 1996 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K ); 1997 } 1998 else 1999 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ 2000 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) 2001 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) 2002 { 2003 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2004 size_t zlen; 2005 2006 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen, 2007 p + 2, end - ( p + 2 ), 2008 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) 2009 { 2010 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret ); 2011 return( ret ); 2012 } 2013 2014 *(p++) = (unsigned char)( zlen >> 8 ); 2015 *(p++) = (unsigned char)( zlen ); 2016 p += zlen; 2017 2018 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx, 2019 MBEDTLS_DEBUG_ECDH_Z ); 2020 } 2021 else 2022 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ 2023 { 2024 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 2025 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 2026 } 2027 2028 /* opaque psk<0..2^16-1>; */ 2029 if( end - p < 2 ) 2030 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 2031 2032 *(p++) = (unsigned char)( psk_len >> 8 ); 2033 *(p++) = (unsigned char)( psk_len ); 2034 2035 if( end < p || (size_t)( end - p ) < psk_len ) 2036 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 2037 2038 memcpy( p, psk, psk_len ); 2039 p += psk_len; 2040 2041 ssl->handshake->pmslen = p - ssl->handshake->premaster; 2042 2043 return( 0 ); 2044 } 2045 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ 2046 2047 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION) 2048 static int ssl_write_hello_request( mbedtls_ssl_context *ssl ); 2049 2050 #if defined(MBEDTLS_SSL_PROTO_DTLS) 2051 int mbedtls_ssl_resend_hello_request( mbedtls_ssl_context *ssl ) 2052 { 2053 /* If renegotiation is not enforced, retransmit until we would reach max 2054 * timeout if we were using the usual handshake doubling scheme */ 2055 if( ssl->conf->renego_max_records < 0 ) 2056 { 2057 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1; 2058 unsigned char doublings = 1; 2059 2060 while( ratio != 0 ) 2061 { 2062 ++doublings; 2063 ratio >>= 1; 2064 } 2065 2066 if( ++ssl->renego_records_seen > doublings ) 2067 { 2068 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) ); 2069 return( 0 ); 2070 } 2071 } 2072 2073 return( ssl_write_hello_request( ssl ) ); 2074 } 2075 #endif 2076 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */ 2077 2078 #if defined(MBEDTLS_X509_CRT_PARSE_C) 2079 static void ssl_clear_peer_cert( mbedtls_ssl_session *session ) 2080 { 2081 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 2082 if( session->peer_cert != NULL ) 2083 { 2084 mbedtls_x509_crt_free( session->peer_cert ); 2085 mbedtls_free( session->peer_cert ); 2086 session->peer_cert = NULL; 2087 } 2088 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 2089 if( session->peer_cert_digest != NULL ) 2090 { 2091 /* Zeroization is not necessary. */ 2092 mbedtls_free( session->peer_cert_digest ); 2093 session->peer_cert_digest = NULL; 2094 session->peer_cert_digest_type = MBEDTLS_MD_NONE; 2095 session->peer_cert_digest_len = 0; 2096 } 2097 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 2098 } 2099 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 2100 2101 /* 2102 * Handshake functions 2103 */ 2104 #if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 2105 /* No certificate support -> dummy functions */ 2106 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl ) 2107 { 2108 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 2109 ssl->handshake->ciphersuite_info; 2110 2111 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) ); 2112 2113 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) ) 2114 { 2115 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) ); 2116 ssl->state++; 2117 return( 0 ); 2118 } 2119 2120 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 2121 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 2122 } 2123 2124 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl ) 2125 { 2126 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 2127 ssl->handshake->ciphersuite_info; 2128 2129 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) ); 2130 2131 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) ) 2132 { 2133 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) ); 2134 ssl->state++; 2135 return( 0 ); 2136 } 2137 2138 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 2139 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 2140 } 2141 2142 #else /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 2143 /* Some certificate support -> implement write and parse */ 2144 2145 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl ) 2146 { 2147 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 2148 size_t i, n; 2149 const mbedtls_x509_crt *crt; 2150 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 2151 ssl->handshake->ciphersuite_info; 2152 2153 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) ); 2154 2155 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) ) 2156 { 2157 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) ); 2158 ssl->state++; 2159 return( 0 ); 2160 } 2161 2162 #if defined(MBEDTLS_SSL_CLI_C) 2163 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) 2164 { 2165 if( ssl->client_auth == 0 ) 2166 { 2167 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) ); 2168 ssl->state++; 2169 return( 0 ); 2170 } 2171 2172 #if defined(MBEDTLS_SSL_PROTO_SSL3) 2173 /* 2174 * If using SSLv3 and got no cert, send an Alert message 2175 * (otherwise an empty Certificate message will be sent). 2176 */ 2177 if( mbedtls_ssl_own_cert( ssl ) == NULL && 2178 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) 2179 { 2180 ssl->out_msglen = 2; 2181 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT; 2182 ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING; 2183 ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT; 2184 2185 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) ); 2186 goto write_msg; 2187 } 2188 #endif /* MBEDTLS_SSL_PROTO_SSL3 */ 2189 } 2190 #endif /* MBEDTLS_SSL_CLI_C */ 2191 #if defined(MBEDTLS_SSL_SRV_C) 2192 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) 2193 { 2194 if( mbedtls_ssl_own_cert( ssl ) == NULL ) 2195 { 2196 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) ); 2197 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED ); 2198 } 2199 } 2200 #endif 2201 2202 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) ); 2203 2204 /* 2205 * 0 . 0 handshake type 2206 * 1 . 3 handshake length 2207 * 4 . 6 length of all certs 2208 * 7 . 9 length of cert. 1 2209 * 10 . n-1 peer certificate 2210 * n . n+2 length of cert. 2 2211 * n+3 . ... upper level cert, etc. 2212 */ 2213 i = 7; 2214 crt = mbedtls_ssl_own_cert( ssl ); 2215 2216 while( crt != NULL ) 2217 { 2218 n = crt->raw.len; 2219 if( n > MBEDTLS_SSL_OUT_CONTENT_LEN - 3 - i ) 2220 { 2221 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %" MBEDTLS_PRINTF_SIZET 2222 " > %" MBEDTLS_PRINTF_SIZET, 2223 i + 3 + n, (size_t) MBEDTLS_SSL_OUT_CONTENT_LEN ) ); 2224 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE ); 2225 } 2226 2227 ssl->out_msg[i ] = (unsigned char)( n >> 16 ); 2228 ssl->out_msg[i + 1] = (unsigned char)( n >> 8 ); 2229 ssl->out_msg[i + 2] = (unsigned char)( n ); 2230 2231 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n ); 2232 i += n; crt = crt->next; 2233 } 2234 2235 ssl->out_msg[4] = (unsigned char)( ( i - 7 ) >> 16 ); 2236 ssl->out_msg[5] = (unsigned char)( ( i - 7 ) >> 8 ); 2237 ssl->out_msg[6] = (unsigned char)( ( i - 7 ) ); 2238 2239 ssl->out_msglen = i; 2240 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 2241 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE; 2242 2243 #if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C) 2244 write_msg: 2245 #endif 2246 2247 ssl->state++; 2248 2249 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 ) 2250 { 2251 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret ); 2252 return( ret ); 2253 } 2254 2255 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) ); 2256 2257 return( ret ); 2258 } 2259 2260 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C) 2261 2262 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 2263 static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl, 2264 unsigned char *crt_buf, 2265 size_t crt_buf_len ) 2266 { 2267 mbedtls_x509_crt const * const peer_crt = ssl->session->peer_cert; 2268 2269 if( peer_crt == NULL ) 2270 return( -1 ); 2271 2272 if( peer_crt->raw.len != crt_buf_len ) 2273 return( -1 ); 2274 2275 return( memcmp( peer_crt->raw.p, crt_buf, peer_crt->raw.len ) ); 2276 } 2277 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 2278 static int ssl_check_peer_crt_unchanged( mbedtls_ssl_context *ssl, 2279 unsigned char *crt_buf, 2280 size_t crt_buf_len ) 2281 { 2282 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2283 unsigned char const * const peer_cert_digest = 2284 ssl->session->peer_cert_digest; 2285 mbedtls_md_type_t const peer_cert_digest_type = 2286 ssl->session->peer_cert_digest_type; 2287 mbedtls_md_info_t const * const digest_info = 2288 mbedtls_md_info_from_type( peer_cert_digest_type ); 2289 unsigned char tmp_digest[MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN]; 2290 size_t digest_len; 2291 2292 if( peer_cert_digest == NULL || digest_info == NULL ) 2293 return( -1 ); 2294 2295 digest_len = mbedtls_md_get_size( digest_info ); 2296 if( digest_len > MBEDTLS_SSL_PEER_CERT_DIGEST_MAX_LEN ) 2297 return( -1 ); 2298 2299 ret = mbedtls_md( digest_info, crt_buf, crt_buf_len, tmp_digest ); 2300 if( ret != 0 ) 2301 return( -1 ); 2302 2303 return( memcmp( tmp_digest, peer_cert_digest, digest_len ) ); 2304 } 2305 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 2306 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */ 2307 2308 /* 2309 * Once the certificate message is read, parse it into a cert chain and 2310 * perform basic checks, but leave actual verification to the caller 2311 */ 2312 static int ssl_parse_certificate_chain( mbedtls_ssl_context *ssl, 2313 mbedtls_x509_crt *chain ) 2314 { 2315 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2316 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C) 2317 int crt_cnt=0; 2318 #endif 2319 size_t i, n; 2320 uint8_t alert; 2321 2322 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) 2323 { 2324 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) ); 2325 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 2326 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE ); 2327 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 2328 } 2329 2330 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE || 2331 ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 ) 2332 { 2333 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) ); 2334 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 2335 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 2336 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); 2337 } 2338 2339 i = mbedtls_ssl_hs_hdr_len( ssl ); 2340 2341 /* 2342 * Same message structure as in mbedtls_ssl_write_certificate() 2343 */ 2344 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2]; 2345 2346 if( ssl->in_msg[i] != 0 || 2347 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) ) 2348 { 2349 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) ); 2350 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 2351 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 2352 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); 2353 } 2354 2355 /* Make &ssl->in_msg[i] point to the beginning of the CRT chain. */ 2356 i += 3; 2357 2358 /* Iterate through and parse the CRTs in the provided chain. */ 2359 while( i < ssl->in_hslen ) 2360 { 2361 /* Check that there's room for the next CRT's length fields. */ 2362 if ( i + 3 > ssl->in_hslen ) { 2363 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) ); 2364 mbedtls_ssl_send_alert_message( ssl, 2365 MBEDTLS_SSL_ALERT_LEVEL_FATAL, 2366 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 2367 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); 2368 } 2369 /* In theory, the CRT can be up to 2**24 Bytes, but we don't support 2370 * anything beyond 2**16 ~ 64K. */ 2371 if( ssl->in_msg[i] != 0 ) 2372 { 2373 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) ); 2374 mbedtls_ssl_send_alert_message( ssl, 2375 MBEDTLS_SSL_ALERT_LEVEL_FATAL, 2376 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 2377 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); 2378 } 2379 2380 /* Read length of the next CRT in the chain. */ 2381 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 ) 2382 | (unsigned int) ssl->in_msg[i + 2]; 2383 i += 3; 2384 2385 if( n < 128 || i + n > ssl->in_hslen ) 2386 { 2387 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) ); 2388 mbedtls_ssl_send_alert_message( ssl, 2389 MBEDTLS_SSL_ALERT_LEVEL_FATAL, 2390 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 2391 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); 2392 } 2393 2394 /* Check if we're handling the first CRT in the chain. */ 2395 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C) 2396 if( crt_cnt++ == 0 && 2397 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT && 2398 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) 2399 { 2400 /* During client-side renegotiation, check that the server's 2401 * end-CRTs hasn't changed compared to the initial handshake, 2402 * mitigating the triple handshake attack. On success, reuse 2403 * the original end-CRT instead of parsing it again. */ 2404 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Check that peer CRT hasn't changed during renegotiation" ) ); 2405 if( ssl_check_peer_crt_unchanged( ssl, 2406 &ssl->in_msg[i], 2407 n ) != 0 ) 2408 { 2409 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) ); 2410 mbedtls_ssl_send_alert_message( ssl, 2411 MBEDTLS_SSL_ALERT_LEVEL_FATAL, 2412 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED ); 2413 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); 2414 } 2415 2416 /* Now we can safely free the original chain. */ 2417 ssl_clear_peer_cert( ssl->session ); 2418 } 2419 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */ 2420 2421 /* Parse the next certificate in the chain. */ 2422 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 2423 ret = mbedtls_x509_crt_parse_der( chain, ssl->in_msg + i, n ); 2424 #else 2425 /* If we don't need to store the CRT chain permanently, parse 2426 * it in-place from the input buffer instead of making a copy. */ 2427 ret = mbedtls_x509_crt_parse_der_nocopy( chain, ssl->in_msg + i, n ); 2428 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 2429 switch( ret ) 2430 { 2431 case 0: /*ok*/ 2432 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND: 2433 /* Ignore certificate with an unknown algorithm: maybe a 2434 prior certificate was already trusted. */ 2435 break; 2436 2437 case MBEDTLS_ERR_X509_ALLOC_FAILED: 2438 alert = MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR; 2439 goto crt_parse_der_failed; 2440 2441 case MBEDTLS_ERR_X509_UNKNOWN_VERSION: 2442 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT; 2443 goto crt_parse_der_failed; 2444 2445 default: 2446 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT; 2447 crt_parse_der_failed: 2448 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, alert ); 2449 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret ); 2450 return( ret ); 2451 } 2452 2453 i += n; 2454 } 2455 2456 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", chain ); 2457 return( 0 ); 2458 } 2459 2460 #if defined(MBEDTLS_SSL_SRV_C) 2461 static int ssl_srv_check_client_no_crt_notification( mbedtls_ssl_context *ssl ) 2462 { 2463 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) 2464 return( -1 ); 2465 2466 #if defined(MBEDTLS_SSL_PROTO_SSL3) 2467 /* 2468 * Check if the client sent an empty certificate 2469 */ 2470 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) 2471 { 2472 if( ssl->in_msglen == 2 && 2473 ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT && 2474 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING && 2475 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT ) 2476 { 2477 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) ); 2478 return( 0 ); 2479 } 2480 2481 return( -1 ); 2482 } 2483 #endif /* MBEDTLS_SSL_PROTO_SSL3 */ 2484 2485 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ 2486 defined(MBEDTLS_SSL_PROTO_TLS1_2) 2487 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) && 2488 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE && 2489 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE && 2490 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 ) 2491 { 2492 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) ); 2493 return( 0 ); 2494 } 2495 2496 return( -1 ); 2497 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \ 2498 MBEDTLS_SSL_PROTO_TLS1_2 */ 2499 } 2500 #endif /* MBEDTLS_SSL_SRV_C */ 2501 2502 /* Check if a certificate message is expected. 2503 * Return either 2504 * - SSL_CERTIFICATE_EXPECTED, or 2505 * - SSL_CERTIFICATE_SKIP 2506 * indicating whether a Certificate message is expected or not. 2507 */ 2508 #define SSL_CERTIFICATE_EXPECTED 0 2509 #define SSL_CERTIFICATE_SKIP 1 2510 static int ssl_parse_certificate_coordinate( mbedtls_ssl_context *ssl, 2511 int authmode ) 2512 { 2513 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 2514 ssl->handshake->ciphersuite_info; 2515 2516 if( !mbedtls_ssl_ciphersuite_uses_srv_cert( ciphersuite_info ) ) 2517 return( SSL_CERTIFICATE_SKIP ); 2518 2519 #if defined(MBEDTLS_SSL_SRV_C) 2520 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) 2521 { 2522 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) 2523 return( SSL_CERTIFICATE_SKIP ); 2524 2525 if( authmode == MBEDTLS_SSL_VERIFY_NONE ) 2526 { 2527 ssl->session_negotiate->verify_result = 2528 MBEDTLS_X509_BADCERT_SKIP_VERIFY; 2529 return( SSL_CERTIFICATE_SKIP ); 2530 } 2531 } 2532 #else 2533 ((void) authmode); 2534 #endif /* MBEDTLS_SSL_SRV_C */ 2535 2536 return( SSL_CERTIFICATE_EXPECTED ); 2537 } 2538 2539 static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl, 2540 int authmode, 2541 mbedtls_x509_crt *chain, 2542 void *rs_ctx ) 2543 { 2544 int ret = 0; 2545 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 2546 ssl->handshake->ciphersuite_info; 2547 int have_ca_chain = 0; 2548 2549 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *); 2550 void *p_vrfy; 2551 2552 if( authmode == MBEDTLS_SSL_VERIFY_NONE ) 2553 return( 0 ); 2554 2555 if( ssl->f_vrfy != NULL ) 2556 { 2557 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use context-specific verification callback" ) ); 2558 f_vrfy = ssl->f_vrfy; 2559 p_vrfy = ssl->p_vrfy; 2560 } 2561 else 2562 { 2563 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use configuration-specific verification callback" ) ); 2564 f_vrfy = ssl->conf->f_vrfy; 2565 p_vrfy = ssl->conf->p_vrfy; 2566 } 2567 2568 /* 2569 * Main check: verify certificate 2570 */ 2571 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) 2572 if( ssl->conf->f_ca_cb != NULL ) 2573 { 2574 ((void) rs_ctx); 2575 have_ca_chain = 1; 2576 2577 MBEDTLS_SSL_DEBUG_MSG( 3, ( "use CA callback for X.509 CRT verification" ) ); 2578 ret = mbedtls_x509_crt_verify_with_ca_cb( 2579 chain, 2580 ssl->conf->f_ca_cb, 2581 ssl->conf->p_ca_cb, 2582 ssl->conf->cert_profile, 2583 ssl->hostname, 2584 &ssl->session_negotiate->verify_result, 2585 f_vrfy, p_vrfy ); 2586 } 2587 else 2588 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ 2589 { 2590 mbedtls_x509_crt *ca_chain; 2591 mbedtls_x509_crl *ca_crl; 2592 2593 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 2594 if( ssl->handshake->sni_ca_chain != NULL ) 2595 { 2596 ca_chain = ssl->handshake->sni_ca_chain; 2597 ca_crl = ssl->handshake->sni_ca_crl; 2598 } 2599 else 2600 #endif 2601 { 2602 ca_chain = ssl->conf->ca_chain; 2603 ca_crl = ssl->conf->ca_crl; 2604 } 2605 2606 if( ca_chain != NULL ) 2607 have_ca_chain = 1; 2608 2609 ret = mbedtls_x509_crt_verify_restartable( 2610 chain, 2611 ca_chain, ca_crl, 2612 ssl->conf->cert_profile, 2613 ssl->hostname, 2614 &ssl->session_negotiate->verify_result, 2615 f_vrfy, p_vrfy, rs_ctx ); 2616 } 2617 2618 if( ret != 0 ) 2619 { 2620 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret ); 2621 } 2622 2623 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) 2624 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS ) 2625 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS ); 2626 #endif 2627 2628 /* 2629 * Secondary checks: always done, but change 'ret' only if it was 0 2630 */ 2631 2632 #if defined(MBEDTLS_ECP_C) 2633 { 2634 const mbedtls_pk_context *pk = &chain->pk; 2635 2636 /* If certificate uses an EC key, make sure the curve is OK */ 2637 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) && 2638 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 ) 2639 { 2640 ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY; 2641 2642 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) ); 2643 if( ret == 0 ) 2644 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE; 2645 } 2646 } 2647 #endif /* MBEDTLS_ECP_C */ 2648 2649 if( mbedtls_ssl_check_cert_usage( chain, 2650 ciphersuite_info, 2651 ! ssl->conf->endpoint, 2652 &ssl->session_negotiate->verify_result ) != 0 ) 2653 { 2654 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) ); 2655 if( ret == 0 ) 2656 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE; 2657 } 2658 2659 /* mbedtls_x509_crt_verify_with_profile is supposed to report a 2660 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED, 2661 * with details encoded in the verification flags. All other kinds 2662 * of error codes, including those from the user provided f_vrfy 2663 * functions, are treated as fatal and lead to a failure of 2664 * ssl_parse_certificate even if verification was optional. */ 2665 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL && 2666 ( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED || 2667 ret == MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ) ) 2668 { 2669 ret = 0; 2670 } 2671 2672 if( have_ca_chain == 0 && authmode == MBEDTLS_SSL_VERIFY_REQUIRED ) 2673 { 2674 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) ); 2675 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED; 2676 } 2677 2678 if( ret != 0 ) 2679 { 2680 uint8_t alert; 2681 2682 /* The certificate may have been rejected for several reasons. 2683 Pick one and send the corresponding alert. Which alert to send 2684 may be a subject of debate in some cases. */ 2685 if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_OTHER ) 2686 alert = MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED; 2687 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH ) 2688 alert = MBEDTLS_SSL_ALERT_MSG_BAD_CERT; 2689 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_KEY_USAGE ) 2690 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT; 2691 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXT_KEY_USAGE ) 2692 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT; 2693 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NS_CERT_TYPE ) 2694 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT; 2695 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_PK ) 2696 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT; 2697 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_BAD_KEY ) 2698 alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT; 2699 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_EXPIRED ) 2700 alert = MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED; 2701 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_REVOKED ) 2702 alert = MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED; 2703 else if( ssl->session_negotiate->verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED ) 2704 alert = MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA; 2705 else 2706 alert = MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN; 2707 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 2708 alert ); 2709 } 2710 2711 #if defined(MBEDTLS_DEBUG_C) 2712 if( ssl->session_negotiate->verify_result != 0 ) 2713 { 2714 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %08x", 2715 (unsigned int) ssl->session_negotiate->verify_result ) ); 2716 } 2717 else 2718 { 2719 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) ); 2720 } 2721 #endif /* MBEDTLS_DEBUG_C */ 2722 2723 return( ret ); 2724 } 2725 2726 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 2727 static int ssl_remember_peer_crt_digest( mbedtls_ssl_context *ssl, 2728 unsigned char *start, size_t len ) 2729 { 2730 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2731 /* Remember digest of the peer's end-CRT. */ 2732 ssl->session_negotiate->peer_cert_digest = 2733 mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ); 2734 if( ssl->session_negotiate->peer_cert_digest == NULL ) 2735 { 2736 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", 2737 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN ) ); 2738 mbedtls_ssl_send_alert_message( ssl, 2739 MBEDTLS_SSL_ALERT_LEVEL_FATAL, 2740 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR ); 2741 2742 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 2743 } 2744 2745 ret = mbedtls_md( mbedtls_md_info_from_type( 2746 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ), 2747 start, len, 2748 ssl->session_negotiate->peer_cert_digest ); 2749 2750 ssl->session_negotiate->peer_cert_digest_type = 2751 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE; 2752 ssl->session_negotiate->peer_cert_digest_len = 2753 MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN; 2754 2755 return( ret ); 2756 } 2757 2758 static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl, 2759 unsigned char *start, size_t len ) 2760 { 2761 unsigned char *end = start + len; 2762 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2763 2764 /* Make a copy of the peer's raw public key. */ 2765 mbedtls_pk_init( &ssl->handshake->peer_pubkey ); 2766 ret = mbedtls_pk_parse_subpubkey( &start, end, 2767 &ssl->handshake->peer_pubkey ); 2768 if( ret != 0 ) 2769 { 2770 /* We should have parsed the public key before. */ 2771 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 2772 } 2773 2774 return( 0 ); 2775 } 2776 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 2777 2778 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl ) 2779 { 2780 int ret = 0; 2781 int crt_expected; 2782 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 2783 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET 2784 ? ssl->handshake->sni_authmode 2785 : ssl->conf->authmode; 2786 #else 2787 const int authmode = ssl->conf->authmode; 2788 #endif 2789 void *rs_ctx = NULL; 2790 mbedtls_x509_crt *chain = NULL; 2791 2792 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) ); 2793 2794 crt_expected = ssl_parse_certificate_coordinate( ssl, authmode ); 2795 if( crt_expected == SSL_CERTIFICATE_SKIP ) 2796 { 2797 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) ); 2798 goto exit; 2799 } 2800 2801 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) 2802 if( ssl->handshake->ecrs_enabled && 2803 ssl->handshake->ecrs_state == ssl_ecrs_crt_verify ) 2804 { 2805 chain = ssl->handshake->ecrs_peer_cert; 2806 ssl->handshake->ecrs_peer_cert = NULL; 2807 goto crt_verify; 2808 } 2809 #endif 2810 2811 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 ) 2812 { 2813 /* mbedtls_ssl_read_record may have sent an alert already. We 2814 let it decide whether to alert. */ 2815 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); 2816 goto exit; 2817 } 2818 2819 #if defined(MBEDTLS_SSL_SRV_C) 2820 if( ssl_srv_check_client_no_crt_notification( ssl ) == 0 ) 2821 { 2822 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING; 2823 2824 if( authmode != MBEDTLS_SSL_VERIFY_OPTIONAL ) 2825 ret = MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE; 2826 2827 goto exit; 2828 } 2829 #endif /* MBEDTLS_SSL_SRV_C */ 2830 2831 /* Clear existing peer CRT structure in case we tried to 2832 * reuse a session but it failed, and allocate a new one. */ 2833 ssl_clear_peer_cert( ssl->session_negotiate ); 2834 2835 chain = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) ); 2836 if( chain == NULL ) 2837 { 2838 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", 2839 sizeof( mbedtls_x509_crt ) ) ); 2840 mbedtls_ssl_send_alert_message( ssl, 2841 MBEDTLS_SSL_ALERT_LEVEL_FATAL, 2842 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR ); 2843 2844 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED; 2845 goto exit; 2846 } 2847 mbedtls_x509_crt_init( chain ); 2848 2849 ret = ssl_parse_certificate_chain( ssl, chain ); 2850 if( ret != 0 ) 2851 goto exit; 2852 2853 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) 2854 if( ssl->handshake->ecrs_enabled) 2855 ssl->handshake->ecrs_state = ssl_ecrs_crt_verify; 2856 2857 crt_verify: 2858 if( ssl->handshake->ecrs_enabled) 2859 rs_ctx = &ssl->handshake->ecrs_ctx; 2860 #endif 2861 2862 ret = ssl_parse_certificate_verify( ssl, authmode, 2863 chain, rs_ctx ); 2864 if( ret != 0 ) 2865 goto exit; 2866 2867 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 2868 { 2869 unsigned char *crt_start, *pk_start; 2870 size_t crt_len, pk_len; 2871 2872 /* We parse the CRT chain without copying, so 2873 * these pointers point into the input buffer, 2874 * and are hence still valid after freeing the 2875 * CRT chain. */ 2876 2877 crt_start = chain->raw.p; 2878 crt_len = chain->raw.len; 2879 2880 pk_start = chain->pk_raw.p; 2881 pk_len = chain->pk_raw.len; 2882 2883 /* Free the CRT structures before computing 2884 * digest and copying the peer's public key. */ 2885 mbedtls_x509_crt_free( chain ); 2886 mbedtls_free( chain ); 2887 chain = NULL; 2888 2889 ret = ssl_remember_peer_crt_digest( ssl, crt_start, crt_len ); 2890 if( ret != 0 ) 2891 goto exit; 2892 2893 ret = ssl_remember_peer_pubkey( ssl, pk_start, pk_len ); 2894 if( ret != 0 ) 2895 goto exit; 2896 } 2897 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 2898 /* Pass ownership to session structure. */ 2899 ssl->session_negotiate->peer_cert = chain; 2900 chain = NULL; 2901 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 2902 2903 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) ); 2904 2905 exit: 2906 2907 if( ret == 0 ) 2908 ssl->state++; 2909 2910 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) 2911 if( ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS ) 2912 { 2913 ssl->handshake->ecrs_peer_cert = chain; 2914 chain = NULL; 2915 } 2916 #endif 2917 2918 if( chain != NULL ) 2919 { 2920 mbedtls_x509_crt_free( chain ); 2921 mbedtls_free( chain ); 2922 } 2923 2924 return( ret ); 2925 } 2926 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 2927 2928 void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl, 2929 const mbedtls_ssl_ciphersuite_t *ciphersuite_info ) 2930 { 2931 ((void) ciphersuite_info); 2932 2933 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ 2934 defined(MBEDTLS_SSL_PROTO_TLS1_1) 2935 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ) 2936 ssl->handshake->update_checksum = ssl_update_checksum_md5sha1; 2937 else 2938 #endif 2939 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 2940 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 2941 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 ) 2942 ssl->handshake->update_checksum = ssl_update_checksum_sha384; 2943 else 2944 #endif 2945 #if defined(MBEDTLS_SHA256_C) 2946 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 ) 2947 ssl->handshake->update_checksum = ssl_update_checksum_sha256; 2948 else 2949 #endif 2950 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 2951 { 2952 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 2953 return; 2954 } 2955 } 2956 2957 void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl ) 2958 { 2959 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ 2960 defined(MBEDTLS_SSL_PROTO_TLS1_1) 2961 mbedtls_md5_starts_ret( &ssl->handshake->fin_md5 ); 2962 mbedtls_sha1_starts_ret( &ssl->handshake->fin_sha1 ); 2963 #endif 2964 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 2965 #if defined(MBEDTLS_SHA256_C) 2966 #if defined(MBEDTLS_USE_PSA_CRYPTO) 2967 psa_hash_abort( &ssl->handshake->fin_sha256_psa ); 2968 psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 ); 2969 #else 2970 mbedtls_sha256_starts_ret( &ssl->handshake->fin_sha256, 0 ); 2971 #endif 2972 #endif 2973 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 2974 #if defined(MBEDTLS_USE_PSA_CRYPTO) 2975 psa_hash_abort( &ssl->handshake->fin_sha384_psa ); 2976 psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 ); 2977 #else 2978 mbedtls_sha512_starts_ret( &ssl->handshake->fin_sha512, 1 ); 2979 #endif 2980 #endif 2981 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 2982 } 2983 2984 static void ssl_update_checksum_start( mbedtls_ssl_context *ssl, 2985 const unsigned char *buf, size_t len ) 2986 { 2987 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ 2988 defined(MBEDTLS_SSL_PROTO_TLS1_1) 2989 mbedtls_md5_update_ret( &ssl->handshake->fin_md5 , buf, len ); 2990 mbedtls_sha1_update_ret( &ssl->handshake->fin_sha1, buf, len ); 2991 #endif 2992 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 2993 #if defined(MBEDTLS_SHA256_C) 2994 #if defined(MBEDTLS_USE_PSA_CRYPTO) 2995 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len ); 2996 #else 2997 mbedtls_sha256_update_ret( &ssl->handshake->fin_sha256, buf, len ); 2998 #endif 2999 #endif 3000 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 3001 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3002 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len ); 3003 #else 3004 mbedtls_sha512_update_ret( &ssl->handshake->fin_sha512, buf, len ); 3005 #endif 3006 #endif 3007 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 3008 } 3009 3010 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ 3011 defined(MBEDTLS_SSL_PROTO_TLS1_1) 3012 static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *ssl, 3013 const unsigned char *buf, size_t len ) 3014 { 3015 mbedtls_md5_update_ret( &ssl->handshake->fin_md5 , buf, len ); 3016 mbedtls_sha1_update_ret( &ssl->handshake->fin_sha1, buf, len ); 3017 } 3018 #endif 3019 3020 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 3021 #if defined(MBEDTLS_SHA256_C) 3022 static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl, 3023 const unsigned char *buf, size_t len ) 3024 { 3025 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3026 psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len ); 3027 #else 3028 mbedtls_sha256_update_ret( &ssl->handshake->fin_sha256, buf, len ); 3029 #endif 3030 } 3031 #endif 3032 3033 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 3034 static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl, 3035 const unsigned char *buf, size_t len ) 3036 { 3037 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3038 psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len ); 3039 #else 3040 mbedtls_sha512_update_ret( &ssl->handshake->fin_sha512, buf, len ); 3041 #endif 3042 } 3043 #endif 3044 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 3045 3046 #if defined(MBEDTLS_SSL_PROTO_SSL3) 3047 static void ssl_calc_finished_ssl( 3048 mbedtls_ssl_context *ssl, unsigned char *buf, int from ) 3049 { 3050 const char *sender; 3051 mbedtls_md5_context md5; 3052 mbedtls_sha1_context sha1; 3053 3054 unsigned char padbuf[48]; 3055 unsigned char md5sum[16]; 3056 unsigned char sha1sum[20]; 3057 3058 mbedtls_ssl_session *session = ssl->session_negotiate; 3059 if( !session ) 3060 session = ssl->session; 3061 3062 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) ); 3063 3064 mbedtls_md5_init( &md5 ); 3065 mbedtls_sha1_init( &sha1 ); 3066 3067 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 ); 3068 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 ); 3069 3070 /* 3071 * SSLv3: 3072 * hash = 3073 * MD5( master + pad2 + 3074 * MD5( handshake + sender + master + pad1 ) ) 3075 * + SHA1( master + pad2 + 3076 * SHA1( handshake + sender + master + pad1 ) ) 3077 */ 3078 3079 #if !defined(MBEDTLS_MD5_ALT) 3080 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *) 3081 md5.state, sizeof( md5.state ) ); 3082 #endif 3083 3084 #if !defined(MBEDTLS_SHA1_ALT) 3085 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *) 3086 sha1.state, sizeof( sha1.state ) ); 3087 #endif 3088 3089 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT" 3090 : "SRVR"; 3091 3092 memset( padbuf, 0x36, 48 ); 3093 3094 mbedtls_md5_update_ret( &md5, (const unsigned char *) sender, 4 ); 3095 mbedtls_md5_update_ret( &md5, session->master, 48 ); 3096 mbedtls_md5_update_ret( &md5, padbuf, 48 ); 3097 mbedtls_md5_finish_ret( &md5, md5sum ); 3098 3099 mbedtls_sha1_update_ret( &sha1, (const unsigned char *) sender, 4 ); 3100 mbedtls_sha1_update_ret( &sha1, session->master, 48 ); 3101 mbedtls_sha1_update_ret( &sha1, padbuf, 40 ); 3102 mbedtls_sha1_finish_ret( &sha1, sha1sum ); 3103 3104 memset( padbuf, 0x5C, 48 ); 3105 3106 mbedtls_md5_starts_ret( &md5 ); 3107 mbedtls_md5_update_ret( &md5, session->master, 48 ); 3108 mbedtls_md5_update_ret( &md5, padbuf, 48 ); 3109 mbedtls_md5_update_ret( &md5, md5sum, 16 ); 3110 mbedtls_md5_finish_ret( &md5, buf ); 3111 3112 mbedtls_sha1_starts_ret( &sha1 ); 3113 mbedtls_sha1_update_ret( &sha1, session->master, 48 ); 3114 mbedtls_sha1_update_ret( &sha1, padbuf , 40 ); 3115 mbedtls_sha1_update_ret( &sha1, sha1sum, 20 ); 3116 mbedtls_sha1_finish_ret( &sha1, buf + 16 ); 3117 3118 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 ); 3119 3120 mbedtls_md5_free( &md5 ); 3121 mbedtls_sha1_free( &sha1 ); 3122 3123 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) ); 3124 mbedtls_platform_zeroize( md5sum, sizeof( md5sum ) ); 3125 mbedtls_platform_zeroize( sha1sum, sizeof( sha1sum ) ); 3126 3127 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) ); 3128 } 3129 #endif /* MBEDTLS_SSL_PROTO_SSL3 */ 3130 3131 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) 3132 static void ssl_calc_finished_tls( 3133 mbedtls_ssl_context *ssl, unsigned char *buf, int from ) 3134 { 3135 int len = 12; 3136 const char *sender; 3137 mbedtls_md5_context md5; 3138 mbedtls_sha1_context sha1; 3139 unsigned char padbuf[36]; 3140 3141 mbedtls_ssl_session *session = ssl->session_negotiate; 3142 if( !session ) 3143 session = ssl->session; 3144 3145 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) ); 3146 3147 mbedtls_md5_init( &md5 ); 3148 mbedtls_sha1_init( &sha1 ); 3149 3150 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 ); 3151 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 ); 3152 3153 /* 3154 * TLSv1: 3155 * hash = PRF( master, finished_label, 3156 * MD5( handshake ) + SHA1( handshake ) )[0..11] 3157 */ 3158 3159 #if !defined(MBEDTLS_MD5_ALT) 3160 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *) 3161 md5.state, sizeof( md5.state ) ); 3162 #endif 3163 3164 #if !defined(MBEDTLS_SHA1_ALT) 3165 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *) 3166 sha1.state, sizeof( sha1.state ) ); 3167 #endif 3168 3169 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) 3170 ? "client finished" 3171 : "server finished"; 3172 3173 mbedtls_md5_finish_ret( &md5, padbuf ); 3174 mbedtls_sha1_finish_ret( &sha1, padbuf + 16 ); 3175 3176 ssl->handshake->tls_prf( session->master, 48, sender, 3177 padbuf, 36, buf, len ); 3178 3179 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len ); 3180 3181 mbedtls_md5_free( &md5 ); 3182 mbedtls_sha1_free( &sha1 ); 3183 3184 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) ); 3185 3186 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) ); 3187 } 3188 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */ 3189 3190 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 3191 #if defined(MBEDTLS_SHA256_C) 3192 static void ssl_calc_finished_tls_sha256( 3193 mbedtls_ssl_context *ssl, unsigned char *buf, int from ) 3194 { 3195 int len = 12; 3196 const char *sender; 3197 unsigned char padbuf[32]; 3198 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3199 size_t hash_size; 3200 psa_hash_operation_t sha256_psa = PSA_HASH_OPERATION_INIT; 3201 psa_status_t status; 3202 #else 3203 mbedtls_sha256_context sha256; 3204 #endif 3205 3206 mbedtls_ssl_session *session = ssl->session_negotiate; 3207 if( !session ) 3208 session = ssl->session; 3209 3210 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) 3211 ? "client finished" 3212 : "server finished"; 3213 3214 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3215 sha256_psa = psa_hash_operation_init(); 3216 3217 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha256" ) ); 3218 3219 status = psa_hash_clone( &ssl->handshake->fin_sha256_psa, &sha256_psa ); 3220 if( status != PSA_SUCCESS ) 3221 { 3222 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) ); 3223 return; 3224 } 3225 3226 status = psa_hash_finish( &sha256_psa, padbuf, sizeof( padbuf ), &hash_size ); 3227 if( status != PSA_SUCCESS ) 3228 { 3229 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) ); 3230 return; 3231 } 3232 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 32 ); 3233 #else 3234 3235 mbedtls_sha256_init( &sha256 ); 3236 3237 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) ); 3238 3239 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 ); 3240 3241 /* 3242 * TLSv1.2: 3243 * hash = PRF( master, finished_label, 3244 * Hash( handshake ) )[0.11] 3245 */ 3246 3247 #if !defined(MBEDTLS_SHA256_ALT) 3248 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *) 3249 sha256.state, sizeof( sha256.state ) ); 3250 #endif 3251 3252 mbedtls_sha256_finish_ret( &sha256, padbuf ); 3253 mbedtls_sha256_free( &sha256 ); 3254 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 3255 3256 ssl->handshake->tls_prf( session->master, 48, sender, 3257 padbuf, 32, buf, len ); 3258 3259 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len ); 3260 3261 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) ); 3262 3263 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) ); 3264 } 3265 #endif /* MBEDTLS_SHA256_C */ 3266 3267 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 3268 3269 static void ssl_calc_finished_tls_sha384( 3270 mbedtls_ssl_context *ssl, unsigned char *buf, int from ) 3271 { 3272 int len = 12; 3273 const char *sender; 3274 unsigned char padbuf[48]; 3275 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3276 size_t hash_size; 3277 psa_hash_operation_t sha384_psa = PSA_HASH_OPERATION_INIT; 3278 psa_status_t status; 3279 #else 3280 mbedtls_sha512_context sha512; 3281 #endif 3282 3283 mbedtls_ssl_session *session = ssl->session_negotiate; 3284 if( !session ) 3285 session = ssl->session; 3286 3287 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) 3288 ? "client finished" 3289 : "server finished"; 3290 3291 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3292 sha384_psa = psa_hash_operation_init(); 3293 3294 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc PSA finished tls sha384" ) ); 3295 3296 status = psa_hash_clone( &ssl->handshake->fin_sha384_psa, &sha384_psa ); 3297 if( status != PSA_SUCCESS ) 3298 { 3299 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash clone failed" ) ); 3300 return; 3301 } 3302 3303 status = psa_hash_finish( &sha384_psa, padbuf, sizeof( padbuf ), &hash_size ); 3304 if( status != PSA_SUCCESS ) 3305 { 3306 MBEDTLS_SSL_DEBUG_MSG( 2, ( "PSA hash finish failed" ) ); 3307 return; 3308 } 3309 MBEDTLS_SSL_DEBUG_BUF( 3, "PSA calculated padbuf", padbuf, 48 ); 3310 #else 3311 mbedtls_sha512_init( &sha512 ); 3312 3313 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) ); 3314 3315 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 ); 3316 3317 /* 3318 * TLSv1.2: 3319 * hash = PRF( master, finished_label, 3320 * Hash( handshake ) )[0.11] 3321 */ 3322 3323 #if !defined(MBEDTLS_SHA512_ALT) 3324 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *) 3325 sha512.state, sizeof( sha512.state ) ); 3326 #endif 3327 /* mbedtls_sha512_finish_ret's output parameter is declared as a 3328 * 64-byte buffer, but sice we're using SHA-384, we know that the 3329 * output fits in 48 bytes. This is correct C, but GCC 11.1 warns 3330 * about it. 3331 */ 3332 #if defined(__GNUC__) && __GNUC__ >= 11 3333 #pragma GCC diagnostic push 3334 #pragma GCC diagnostic ignored "-Wstringop-overflow" 3335 #endif 3336 mbedtls_sha512_finish_ret( &sha512, padbuf ); 3337 #if defined(__GNUC__) && __GNUC__ >= 11 3338 #pragma GCC diagnostic pop 3339 #endif 3340 3341 mbedtls_sha512_free( &sha512 ); 3342 #endif 3343 3344 ssl->handshake->tls_prf( session->master, 48, sender, 3345 padbuf, 48, buf, len ); 3346 3347 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len ); 3348 3349 mbedtls_platform_zeroize( padbuf, sizeof( padbuf ) ); 3350 3351 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) ); 3352 } 3353 #endif /* MBEDTLS_SHA512_C && !MBEDTLS_SHA512_NO_SHA384 */ 3354 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 3355 3356 void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl ) 3357 { 3358 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) ); 3359 3360 /* 3361 * Free our handshake params 3362 */ 3363 mbedtls_ssl_handshake_free( ssl ); 3364 mbedtls_free( ssl->handshake ); 3365 ssl->handshake = NULL; 3366 3367 /* 3368 * Free the previous transform and swith in the current one 3369 */ 3370 if( ssl->transform ) 3371 { 3372 mbedtls_ssl_transform_free( ssl->transform ); 3373 mbedtls_free( ssl->transform ); 3374 } 3375 ssl->transform = ssl->transform_negotiate; 3376 ssl->transform_negotiate = NULL; 3377 3378 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) ); 3379 } 3380 3381 void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl ) 3382 { 3383 int resume = ssl->handshake->resume; 3384 3385 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) ); 3386 3387 #if defined(MBEDTLS_SSL_RENEGOTIATION) 3388 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) 3389 { 3390 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE; 3391 ssl->renego_records_seen = 0; 3392 } 3393 #endif 3394 3395 /* 3396 * Free the previous session and switch in the current one 3397 */ 3398 if( ssl->session ) 3399 { 3400 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 3401 /* RFC 7366 3.1: keep the EtM state */ 3402 ssl->session_negotiate->encrypt_then_mac = 3403 ssl->session->encrypt_then_mac; 3404 #endif 3405 3406 mbedtls_ssl_session_free( ssl->session ); 3407 mbedtls_free( ssl->session ); 3408 } 3409 ssl->session = ssl->session_negotiate; 3410 ssl->session_negotiate = NULL; 3411 3412 /* 3413 * Add cache entry 3414 */ 3415 if( ssl->conf->f_set_cache != NULL && 3416 ssl->session->id_len != 0 && 3417 resume == 0 ) 3418 { 3419 if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 ) 3420 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) ); 3421 } 3422 3423 #if defined(MBEDTLS_SSL_PROTO_DTLS) 3424 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 3425 ssl->handshake->flight != NULL ) 3426 { 3427 /* Cancel handshake timer */ 3428 mbedtls_ssl_set_timer( ssl, 0 ); 3429 3430 /* Keep last flight around in case we need to resend it: 3431 * we need the handshake and transform structures for that */ 3432 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) ); 3433 } 3434 else 3435 #endif 3436 mbedtls_ssl_handshake_wrapup_free_hs_transform( ssl ); 3437 3438 ssl->state++; 3439 3440 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) ); 3441 } 3442 3443 int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl ) 3444 { 3445 int ret, hash_len; 3446 3447 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) ); 3448 3449 mbedtls_ssl_update_out_pointers( ssl, ssl->transform_negotiate ); 3450 3451 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint ); 3452 3453 /* 3454 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites 3455 * may define some other value. Currently (early 2016), no defined 3456 * ciphersuite does this (and this is unlikely to change as activity has 3457 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here. 3458 */ 3459 hash_len = ( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12; 3460 3461 #if defined(MBEDTLS_SSL_RENEGOTIATION) 3462 ssl->verify_data_len = hash_len; 3463 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len ); 3464 #endif 3465 3466 ssl->out_msglen = 4 + hash_len; 3467 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 3468 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED; 3469 3470 /* 3471 * In case of session resuming, invert the client and server 3472 * ChangeCipherSpec messages order. 3473 */ 3474 if( ssl->handshake->resume != 0 ) 3475 { 3476 #if defined(MBEDTLS_SSL_CLI_C) 3477 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) 3478 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP; 3479 #endif 3480 #if defined(MBEDTLS_SSL_SRV_C) 3481 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) 3482 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC; 3483 #endif 3484 } 3485 else 3486 ssl->state++; 3487 3488 /* 3489 * Switch to our negotiated transform and session parameters for outbound 3490 * data. 3491 */ 3492 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) ); 3493 3494 #if defined(MBEDTLS_SSL_PROTO_DTLS) 3495 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 3496 { 3497 unsigned char i; 3498 3499 /* Remember current epoch settings for resending */ 3500 ssl->handshake->alt_transform_out = ssl->transform_out; 3501 memcpy( ssl->handshake->alt_out_ctr, ssl->cur_out_ctr, 8 ); 3502 3503 /* Set sequence_number to zero */ 3504 memset( ssl->cur_out_ctr + 2, 0, 6 ); 3505 3506 /* Increment epoch */ 3507 for( i = 2; i > 0; i-- ) 3508 if( ++ssl->cur_out_ctr[i - 1] != 0 ) 3509 break; 3510 3511 /* The loop goes to its end iff the counter is wrapping */ 3512 if( i == 0 ) 3513 { 3514 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) ); 3515 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING ); 3516 } 3517 } 3518 else 3519 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 3520 memset( ssl->cur_out_ctr, 0, 8 ); 3521 3522 ssl->transform_out = ssl->transform_negotiate; 3523 ssl->session_out = ssl->session_negotiate; 3524 3525 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) 3526 if( mbedtls_ssl_hw_record_activate != NULL ) 3527 { 3528 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 ) 3529 { 3530 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret ); 3531 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); 3532 } 3533 } 3534 #endif 3535 3536 #if defined(MBEDTLS_SSL_PROTO_DTLS) 3537 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 3538 mbedtls_ssl_send_flight_completed( ssl ); 3539 #endif 3540 3541 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 ) 3542 { 3543 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret ); 3544 return( ret ); 3545 } 3546 3547 #if defined(MBEDTLS_SSL_PROTO_DTLS) 3548 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 3549 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 ) 3550 { 3551 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret ); 3552 return( ret ); 3553 } 3554 #endif 3555 3556 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) ); 3557 3558 return( 0 ); 3559 } 3560 3561 #if defined(MBEDTLS_SSL_PROTO_SSL3) 3562 #define SSL_MAX_HASH_LEN 36 3563 #else 3564 #define SSL_MAX_HASH_LEN 12 3565 #endif 3566 3567 int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl ) 3568 { 3569 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3570 unsigned int hash_len; 3571 unsigned char buf[SSL_MAX_HASH_LEN]; 3572 3573 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) ); 3574 3575 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 ); 3576 3577 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 ) 3578 { 3579 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); 3580 return( ret ); 3581 } 3582 3583 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) 3584 { 3585 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) ); 3586 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 3587 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE ); 3588 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 3589 } 3590 3591 /* There is currently no ciphersuite using another length with TLS 1.2 */ 3592 #if defined(MBEDTLS_SSL_PROTO_SSL3) 3593 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) 3594 hash_len = 36; 3595 else 3596 #endif 3597 hash_len = 12; 3598 3599 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED || 3600 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len ) 3601 { 3602 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) ); 3603 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 3604 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 3605 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED ); 3606 } 3607 3608 if( mbedtls_ssl_safer_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), 3609 buf, hash_len ) != 0 ) 3610 { 3611 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) ); 3612 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 3613 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR ); 3614 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED ); 3615 } 3616 3617 #if defined(MBEDTLS_SSL_RENEGOTIATION) 3618 ssl->verify_data_len = hash_len; 3619 memcpy( ssl->peer_verify_data, buf, hash_len ); 3620 #endif 3621 3622 if( ssl->handshake->resume != 0 ) 3623 { 3624 #if defined(MBEDTLS_SSL_CLI_C) 3625 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) 3626 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC; 3627 #endif 3628 #if defined(MBEDTLS_SSL_SRV_C) 3629 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) 3630 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP; 3631 #endif 3632 } 3633 else 3634 ssl->state++; 3635 3636 #if defined(MBEDTLS_SSL_PROTO_DTLS) 3637 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 3638 mbedtls_ssl_recv_flight_completed( ssl ); 3639 #endif 3640 3641 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) ); 3642 3643 return( 0 ); 3644 } 3645 3646 static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake ) 3647 { 3648 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) ); 3649 3650 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ 3651 defined(MBEDTLS_SSL_PROTO_TLS1_1) 3652 mbedtls_md5_init( &handshake->fin_md5 ); 3653 mbedtls_sha1_init( &handshake->fin_sha1 ); 3654 mbedtls_md5_starts_ret( &handshake->fin_md5 ); 3655 mbedtls_sha1_starts_ret( &handshake->fin_sha1 ); 3656 #endif 3657 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 3658 #if defined(MBEDTLS_SHA256_C) 3659 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3660 handshake->fin_sha256_psa = psa_hash_operation_init(); 3661 psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 ); 3662 #else 3663 mbedtls_sha256_init( &handshake->fin_sha256 ); 3664 mbedtls_sha256_starts_ret( &handshake->fin_sha256, 0 ); 3665 #endif 3666 #endif 3667 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 3668 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3669 handshake->fin_sha384_psa = psa_hash_operation_init(); 3670 psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 ); 3671 #else 3672 mbedtls_sha512_init( &handshake->fin_sha512 ); 3673 mbedtls_sha512_starts_ret( &handshake->fin_sha512, 1 ); 3674 #endif 3675 #endif 3676 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 3677 3678 handshake->update_checksum = ssl_update_checksum_start; 3679 3680 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ 3681 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 3682 mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs ); 3683 #endif 3684 3685 #if defined(MBEDTLS_DHM_C) 3686 mbedtls_dhm_init( &handshake->dhm_ctx ); 3687 #endif 3688 #if defined(MBEDTLS_ECDH_C) 3689 mbedtls_ecdh_init( &handshake->ecdh_ctx ); 3690 #endif 3691 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 3692 mbedtls_ecjpake_init( &handshake->ecjpake_ctx ); 3693 #if defined(MBEDTLS_SSL_CLI_C) 3694 handshake->ecjpake_cache = NULL; 3695 handshake->ecjpake_cache_len = 0; 3696 #endif 3697 #endif 3698 3699 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) 3700 mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx ); 3701 #endif 3702 3703 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 3704 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET; 3705 #endif 3706 3707 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ 3708 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 3709 mbedtls_pk_init( &handshake->peer_pubkey ); 3710 #endif 3711 } 3712 3713 void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform ) 3714 { 3715 memset( transform, 0, sizeof(mbedtls_ssl_transform) ); 3716 3717 mbedtls_cipher_init( &transform->cipher_ctx_enc ); 3718 mbedtls_cipher_init( &transform->cipher_ctx_dec ); 3719 3720 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) 3721 mbedtls_md_init( &transform->md_ctx_enc ); 3722 mbedtls_md_init( &transform->md_ctx_dec ); 3723 #endif 3724 } 3725 3726 void mbedtls_ssl_session_init( mbedtls_ssl_session *session ) 3727 { 3728 memset( session, 0, sizeof(mbedtls_ssl_session) ); 3729 } 3730 3731 static int ssl_handshake_init( mbedtls_ssl_context *ssl ) 3732 { 3733 /* Clear old handshake information if present */ 3734 if( ssl->transform_negotiate ) 3735 mbedtls_ssl_transform_free( ssl->transform_negotiate ); 3736 if( ssl->session_negotiate ) 3737 mbedtls_ssl_session_free( ssl->session_negotiate ); 3738 if( ssl->handshake ) 3739 mbedtls_ssl_handshake_free( ssl ); 3740 3741 /* 3742 * Either the pointers are now NULL or cleared properly and can be freed. 3743 * Now allocate missing structures. 3744 */ 3745 if( ssl->transform_negotiate == NULL ) 3746 { 3747 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) ); 3748 } 3749 3750 if( ssl->session_negotiate == NULL ) 3751 { 3752 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) ); 3753 } 3754 3755 if( ssl->handshake == NULL ) 3756 { 3757 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) ); 3758 } 3759 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) 3760 /* If the buffers are too small - reallocate */ 3761 3762 handle_buffer_resizing( ssl, 0, MBEDTLS_SSL_IN_BUFFER_LEN, 3763 MBEDTLS_SSL_OUT_BUFFER_LEN ); 3764 #endif 3765 3766 /* All pointers should exist and can be directly freed without issue */ 3767 if( ssl->handshake == NULL || 3768 ssl->transform_negotiate == NULL || 3769 ssl->session_negotiate == NULL ) 3770 { 3771 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) ); 3772 3773 mbedtls_free( ssl->handshake ); 3774 mbedtls_free( ssl->transform_negotiate ); 3775 mbedtls_free( ssl->session_negotiate ); 3776 3777 ssl->handshake = NULL; 3778 ssl->transform_negotiate = NULL; 3779 ssl->session_negotiate = NULL; 3780 3781 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 3782 } 3783 3784 /* Initialize structures */ 3785 mbedtls_ssl_session_init( ssl->session_negotiate ); 3786 mbedtls_ssl_transform_init( ssl->transform_negotiate ); 3787 ssl_handshake_params_init( ssl->handshake ); 3788 3789 #if defined(MBEDTLS_SSL_PROTO_DTLS) 3790 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 3791 { 3792 ssl->handshake->alt_transform_out = ssl->transform_out; 3793 3794 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) 3795 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING; 3796 else 3797 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING; 3798 3799 mbedtls_ssl_set_timer( ssl, 0 ); 3800 } 3801 #endif 3802 3803 return( 0 ); 3804 } 3805 3806 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) 3807 /* Dummy cookie callbacks for defaults */ 3808 static int ssl_cookie_write_dummy( void *ctx, 3809 unsigned char **p, unsigned char *end, 3810 const unsigned char *cli_id, size_t cli_id_len ) 3811 { 3812 ((void) ctx); 3813 ((void) p); 3814 ((void) end); 3815 ((void) cli_id); 3816 ((void) cli_id_len); 3817 3818 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); 3819 } 3820 3821 static int ssl_cookie_check_dummy( void *ctx, 3822 const unsigned char *cookie, size_t cookie_len, 3823 const unsigned char *cli_id, size_t cli_id_len ) 3824 { 3825 ((void) ctx); 3826 ((void) cookie); 3827 ((void) cookie_len); 3828 ((void) cli_id); 3829 ((void) cli_id_len); 3830 3831 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); 3832 } 3833 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */ 3834 3835 /* 3836 * Initialize an SSL context 3837 */ 3838 void mbedtls_ssl_init( mbedtls_ssl_context *ssl ) 3839 { 3840 memset( ssl, 0, sizeof( mbedtls_ssl_context ) ); 3841 } 3842 3843 /* 3844 * Setup an SSL context 3845 */ 3846 3847 int mbedtls_ssl_setup( mbedtls_ssl_context *ssl, 3848 const mbedtls_ssl_config *conf ) 3849 { 3850 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3851 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN; 3852 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN; 3853 3854 ssl->conf = conf; 3855 3856 /* 3857 * Prepare base structures 3858 */ 3859 3860 /* Set to NULL in case of an error condition */ 3861 ssl->out_buf = NULL; 3862 3863 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) 3864 ssl->in_buf_len = in_buf_len; 3865 #endif 3866 ssl->in_buf = mbedtls_calloc( 1, in_buf_len ); 3867 if( ssl->in_buf == NULL ) 3868 { 3869 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", in_buf_len ) ); 3870 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED; 3871 goto error; 3872 } 3873 3874 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) 3875 ssl->out_buf_len = out_buf_len; 3876 #endif 3877 ssl->out_buf = mbedtls_calloc( 1, out_buf_len ); 3878 if( ssl->out_buf == NULL ) 3879 { 3880 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%" MBEDTLS_PRINTF_SIZET " bytes) failed", out_buf_len ) ); 3881 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED; 3882 goto error; 3883 } 3884 3885 mbedtls_ssl_reset_in_out_pointers( ssl ); 3886 3887 #if defined(MBEDTLS_SSL_DTLS_SRTP) 3888 memset( &ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info) ); 3889 #endif 3890 3891 if( ( ret = ssl_handshake_init( ssl ) ) != 0 ) 3892 goto error; 3893 3894 return( 0 ); 3895 3896 error: 3897 mbedtls_free( ssl->in_buf ); 3898 mbedtls_free( ssl->out_buf ); 3899 3900 ssl->conf = NULL; 3901 3902 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) 3903 ssl->in_buf_len = 0; 3904 ssl->out_buf_len = 0; 3905 #endif 3906 ssl->in_buf = NULL; 3907 ssl->out_buf = NULL; 3908 3909 ssl->in_hdr = NULL; 3910 ssl->in_ctr = NULL; 3911 ssl->in_len = NULL; 3912 ssl->in_iv = NULL; 3913 ssl->in_msg = NULL; 3914 3915 ssl->out_hdr = NULL; 3916 ssl->out_ctr = NULL; 3917 ssl->out_len = NULL; 3918 ssl->out_iv = NULL; 3919 ssl->out_msg = NULL; 3920 3921 return( ret ); 3922 } 3923 3924 /* 3925 * Reset an initialized and used SSL context for re-use while retaining 3926 * all application-set variables, function pointers and data. 3927 * 3928 * If partial is non-zero, keep data in the input buffer and client ID. 3929 * (Use when a DTLS client reconnects from the same port.) 3930 */ 3931 int mbedtls_ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial ) 3932 { 3933 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3934 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) 3935 size_t in_buf_len = ssl->in_buf_len; 3936 size_t out_buf_len = ssl->out_buf_len; 3937 #else 3938 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN; 3939 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN; 3940 #endif 3941 3942 #if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || \ 3943 !defined(MBEDTLS_SSL_SRV_C) 3944 ((void) partial); 3945 #endif 3946 3947 ssl->state = MBEDTLS_SSL_HELLO_REQUEST; 3948 3949 /* Cancel any possibly running timer */ 3950 mbedtls_ssl_set_timer( ssl, 0 ); 3951 3952 #if defined(MBEDTLS_SSL_RENEGOTIATION) 3953 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE; 3954 ssl->renego_records_seen = 0; 3955 3956 ssl->verify_data_len = 0; 3957 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN ); 3958 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN ); 3959 #endif 3960 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION; 3961 3962 ssl->in_offt = NULL; 3963 mbedtls_ssl_reset_in_out_pointers( ssl ); 3964 3965 ssl->in_msgtype = 0; 3966 ssl->in_msglen = 0; 3967 #if defined(MBEDTLS_SSL_PROTO_DTLS) 3968 ssl->next_record_offset = 0; 3969 ssl->in_epoch = 0; 3970 #endif 3971 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) 3972 mbedtls_ssl_dtls_replay_reset( ssl ); 3973 #endif 3974 3975 ssl->in_hslen = 0; 3976 ssl->nb_zero = 0; 3977 3978 ssl->keep_current_message = 0; 3979 3980 ssl->out_msgtype = 0; 3981 ssl->out_msglen = 0; 3982 ssl->out_left = 0; 3983 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) 3984 if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED ) 3985 ssl->split_done = 0; 3986 #endif 3987 3988 memset( ssl->cur_out_ctr, 0, sizeof( ssl->cur_out_ctr ) ); 3989 3990 ssl->transform_in = NULL; 3991 ssl->transform_out = NULL; 3992 3993 ssl->session_in = NULL; 3994 ssl->session_out = NULL; 3995 3996 memset( ssl->out_buf, 0, out_buf_len ); 3997 3998 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C) 3999 if( partial == 0 ) 4000 #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */ 4001 { 4002 ssl->in_left = 0; 4003 memset( ssl->in_buf, 0, in_buf_len ); 4004 } 4005 4006 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) 4007 if( mbedtls_ssl_hw_record_reset != NULL ) 4008 { 4009 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) ); 4010 if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 ) 4011 { 4012 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret ); 4013 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); 4014 } 4015 } 4016 #endif 4017 4018 if( ssl->transform ) 4019 { 4020 mbedtls_ssl_transform_free( ssl->transform ); 4021 mbedtls_free( ssl->transform ); 4022 ssl->transform = NULL; 4023 } 4024 4025 if( ssl->session ) 4026 { 4027 mbedtls_ssl_session_free( ssl->session ); 4028 mbedtls_free( ssl->session ); 4029 ssl->session = NULL; 4030 } 4031 4032 #if defined(MBEDTLS_SSL_ALPN) 4033 ssl->alpn_chosen = NULL; 4034 #endif 4035 4036 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) 4037 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) 4038 if( partial == 0 ) 4039 #endif 4040 { 4041 mbedtls_free( ssl->cli_id ); 4042 ssl->cli_id = NULL; 4043 ssl->cli_id_len = 0; 4044 } 4045 #endif 4046 4047 if( ( ret = ssl_handshake_init( ssl ) ) != 0 ) 4048 return( ret ); 4049 4050 return( 0 ); 4051 } 4052 4053 /* 4054 * Reset an initialized and used SSL context for re-use while retaining 4055 * all application-set variables, function pointers and data. 4056 */ 4057 int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl ) 4058 { 4059 return( mbedtls_ssl_session_reset_int( ssl, 0 ) ); 4060 } 4061 4062 /* 4063 * SSL set accessors 4064 */ 4065 void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint ) 4066 { 4067 conf->endpoint = endpoint; 4068 } 4069 4070 void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport ) 4071 { 4072 conf->transport = transport; 4073 } 4074 4075 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) 4076 void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode ) 4077 { 4078 conf->anti_replay = mode; 4079 } 4080 #endif 4081 4082 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) 4083 void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit ) 4084 { 4085 conf->badmac_limit = limit; 4086 } 4087 #endif 4088 4089 #if defined(MBEDTLS_SSL_PROTO_DTLS) 4090 4091 void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context *ssl, 4092 unsigned allow_packing ) 4093 { 4094 ssl->disable_datagram_packing = !allow_packing; 4095 } 4096 4097 void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf, 4098 uint32_t min, uint32_t max ) 4099 { 4100 conf->hs_timeout_min = min; 4101 conf->hs_timeout_max = max; 4102 } 4103 #endif 4104 4105 void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode ) 4106 { 4107 conf->authmode = authmode; 4108 } 4109 4110 #if defined(MBEDTLS_X509_CRT_PARSE_C) 4111 void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf, 4112 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), 4113 void *p_vrfy ) 4114 { 4115 conf->f_vrfy = f_vrfy; 4116 conf->p_vrfy = p_vrfy; 4117 } 4118 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 4119 4120 void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf, 4121 int (*f_rng)(void *, unsigned char *, size_t), 4122 void *p_rng ) 4123 { 4124 conf->f_rng = f_rng; 4125 conf->p_rng = p_rng; 4126 } 4127 4128 void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf, 4129 void (*f_dbg)(void *, int, const char *, int, const char *), 4130 void *p_dbg ) 4131 { 4132 conf->f_dbg = f_dbg; 4133 conf->p_dbg = p_dbg; 4134 } 4135 4136 void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl, 4137 void *p_bio, 4138 mbedtls_ssl_send_t *f_send, 4139 mbedtls_ssl_recv_t *f_recv, 4140 mbedtls_ssl_recv_timeout_t *f_recv_timeout ) 4141 { 4142 ssl->p_bio = p_bio; 4143 ssl->f_send = f_send; 4144 ssl->f_recv = f_recv; 4145 ssl->f_recv_timeout = f_recv_timeout; 4146 } 4147 4148 #if defined(MBEDTLS_SSL_PROTO_DTLS) 4149 void mbedtls_ssl_set_mtu( mbedtls_ssl_context *ssl, uint16_t mtu ) 4150 { 4151 ssl->mtu = mtu; 4152 } 4153 #endif 4154 4155 void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout ) 4156 { 4157 conf->read_timeout = timeout; 4158 } 4159 4160 void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl, 4161 void *p_timer, 4162 mbedtls_ssl_set_timer_t *f_set_timer, 4163 mbedtls_ssl_get_timer_t *f_get_timer ) 4164 { 4165 ssl->p_timer = p_timer; 4166 ssl->f_set_timer = f_set_timer; 4167 ssl->f_get_timer = f_get_timer; 4168 4169 /* Make sure we start with no timer running */ 4170 mbedtls_ssl_set_timer( ssl, 0 ); 4171 } 4172 4173 #if defined(MBEDTLS_SSL_SRV_C) 4174 void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf, 4175 void *p_cache, 4176 int (*f_get_cache)(void *, mbedtls_ssl_session *), 4177 int (*f_set_cache)(void *, const mbedtls_ssl_session *) ) 4178 { 4179 conf->p_cache = p_cache; 4180 conf->f_get_cache = f_get_cache; 4181 conf->f_set_cache = f_set_cache; 4182 } 4183 #endif /* MBEDTLS_SSL_SRV_C */ 4184 4185 #if defined(MBEDTLS_SSL_CLI_C) 4186 int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session ) 4187 { 4188 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 4189 4190 if( ssl == NULL || 4191 session == NULL || 4192 ssl->session_negotiate == NULL || 4193 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT ) 4194 { 4195 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4196 } 4197 4198 if( ( ret = mbedtls_ssl_session_copy( ssl->session_negotiate, 4199 session ) ) != 0 ) 4200 return( ret ); 4201 4202 ssl->handshake->resume = 1; 4203 4204 return( 0 ); 4205 } 4206 #endif /* MBEDTLS_SSL_CLI_C */ 4207 4208 void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf, 4209 const int *ciphersuites ) 4210 { 4211 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = ciphersuites; 4212 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = ciphersuites; 4213 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = ciphersuites; 4214 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = ciphersuites; 4215 } 4216 4217 void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf, 4218 const int *ciphersuites, 4219 int major, int minor ) 4220 { 4221 if( major != MBEDTLS_SSL_MAJOR_VERSION_3 ) 4222 return; 4223 4224 if( minor < MBEDTLS_SSL_MINOR_VERSION_0 || minor > MBEDTLS_SSL_MINOR_VERSION_3 ) 4225 return; 4226 4227 conf->ciphersuite_list[minor] = ciphersuites; 4228 } 4229 4230 #if defined(MBEDTLS_X509_CRT_PARSE_C) 4231 void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf, 4232 const mbedtls_x509_crt_profile *profile ) 4233 { 4234 conf->cert_profile = profile; 4235 } 4236 4237 /* Append a new keycert entry to a (possibly empty) list */ 4238 static int ssl_append_key_cert( mbedtls_ssl_key_cert **head, 4239 mbedtls_x509_crt *cert, 4240 mbedtls_pk_context *key ) 4241 { 4242 mbedtls_ssl_key_cert *new_cert; 4243 4244 new_cert = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) ); 4245 if( new_cert == NULL ) 4246 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 4247 4248 new_cert->cert = cert; 4249 new_cert->key = key; 4250 new_cert->next = NULL; 4251 4252 /* Update head is the list was null, else add to the end */ 4253 if( *head == NULL ) 4254 { 4255 *head = new_cert; 4256 } 4257 else 4258 { 4259 mbedtls_ssl_key_cert *cur = *head; 4260 while( cur->next != NULL ) 4261 cur = cur->next; 4262 cur->next = new_cert; 4263 } 4264 4265 return( 0 ); 4266 } 4267 4268 int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf, 4269 mbedtls_x509_crt *own_cert, 4270 mbedtls_pk_context *pk_key ) 4271 { 4272 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) ); 4273 } 4274 4275 void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf, 4276 mbedtls_x509_crt *ca_chain, 4277 mbedtls_x509_crl *ca_crl ) 4278 { 4279 conf->ca_chain = ca_chain; 4280 conf->ca_crl = ca_crl; 4281 4282 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) 4283 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb() 4284 * cannot be used together. */ 4285 conf->f_ca_cb = NULL; 4286 conf->p_ca_cb = NULL; 4287 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ 4288 } 4289 4290 #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) 4291 void mbedtls_ssl_conf_ca_cb( mbedtls_ssl_config *conf, 4292 mbedtls_x509_crt_ca_cb_t f_ca_cb, 4293 void *p_ca_cb ) 4294 { 4295 conf->f_ca_cb = f_ca_cb; 4296 conf->p_ca_cb = p_ca_cb; 4297 4298 /* mbedtls_ssl_conf_ca_chain() and mbedtls_ssl_conf_ca_cb() 4299 * cannot be used together. */ 4300 conf->ca_chain = NULL; 4301 conf->ca_crl = NULL; 4302 } 4303 #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ 4304 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 4305 4306 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 4307 int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl, 4308 mbedtls_x509_crt *own_cert, 4309 mbedtls_pk_context *pk_key ) 4310 { 4311 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert, 4312 own_cert, pk_key ) ); 4313 } 4314 4315 void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl, 4316 mbedtls_x509_crt *ca_chain, 4317 mbedtls_x509_crl *ca_crl ) 4318 { 4319 ssl->handshake->sni_ca_chain = ca_chain; 4320 ssl->handshake->sni_ca_crl = ca_crl; 4321 } 4322 4323 void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl, 4324 int authmode ) 4325 { 4326 ssl->handshake->sni_authmode = authmode; 4327 } 4328 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ 4329 4330 #if defined(MBEDTLS_X509_CRT_PARSE_C) 4331 void mbedtls_ssl_set_verify( mbedtls_ssl_context *ssl, 4332 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), 4333 void *p_vrfy ) 4334 { 4335 ssl->f_vrfy = f_vrfy; 4336 ssl->p_vrfy = p_vrfy; 4337 } 4338 #endif 4339 4340 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 4341 /* 4342 * Set EC J-PAKE password for current handshake 4343 */ 4344 int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl, 4345 const unsigned char *pw, 4346 size_t pw_len ) 4347 { 4348 mbedtls_ecjpake_role role; 4349 4350 if( ssl->handshake == NULL || ssl->conf == NULL ) 4351 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4352 4353 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) 4354 role = MBEDTLS_ECJPAKE_SERVER; 4355 else 4356 role = MBEDTLS_ECJPAKE_CLIENT; 4357 4358 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx, 4359 role, 4360 MBEDTLS_MD_SHA256, 4361 MBEDTLS_ECP_DP_SECP256R1, 4362 pw, pw_len ) ); 4363 } 4364 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 4365 4366 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) 4367 4368 static void ssl_conf_remove_psk( mbedtls_ssl_config *conf ) 4369 { 4370 /* Remove reference to existing PSK, if any. */ 4371 #if defined(MBEDTLS_USE_PSA_CRYPTO) 4372 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) ) 4373 { 4374 /* The maintenance of the PSK key slot is the 4375 * user's responsibility. */ 4376 conf->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT; 4377 } 4378 /* This and the following branch should never 4379 * be taken simultaenously as we maintain the 4380 * invariant that raw and opaque PSKs are never 4381 * configured simultaneously. As a safeguard, 4382 * though, `else` is omitted here. */ 4383 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 4384 if( conf->psk != NULL ) 4385 { 4386 mbedtls_platform_zeroize( conf->psk, conf->psk_len ); 4387 4388 mbedtls_free( conf->psk ); 4389 conf->psk = NULL; 4390 conf->psk_len = 0; 4391 } 4392 4393 /* Remove reference to PSK identity, if any. */ 4394 if( conf->psk_identity != NULL ) 4395 { 4396 mbedtls_free( conf->psk_identity ); 4397 conf->psk_identity = NULL; 4398 conf->psk_identity_len = 0; 4399 } 4400 } 4401 4402 /* This function assumes that PSK identity in the SSL config is unset. 4403 * It checks that the provided identity is well-formed and attempts 4404 * to make a copy of it in the SSL config. 4405 * On failure, the PSK identity in the config remains unset. */ 4406 static int ssl_conf_set_psk_identity( mbedtls_ssl_config *conf, 4407 unsigned char const *psk_identity, 4408 size_t psk_identity_len ) 4409 { 4410 /* Identity len will be encoded on two bytes */ 4411 if( psk_identity == NULL || 4412 ( psk_identity_len >> 16 ) != 0 || 4413 psk_identity_len > MBEDTLS_SSL_OUT_CONTENT_LEN ) 4414 { 4415 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4416 } 4417 4418 conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ); 4419 if( conf->psk_identity == NULL ) 4420 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 4421 4422 conf->psk_identity_len = psk_identity_len; 4423 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len ); 4424 4425 return( 0 ); 4426 } 4427 4428 int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf, 4429 const unsigned char *psk, size_t psk_len, 4430 const unsigned char *psk_identity, size_t psk_identity_len ) 4431 { 4432 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 4433 /* Remove opaque/raw PSK + PSK Identity */ 4434 ssl_conf_remove_psk( conf ); 4435 4436 /* Check and set raw PSK */ 4437 if( psk == NULL ) 4438 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4439 if( psk_len == 0 ) 4440 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4441 if( psk_len > MBEDTLS_PSK_MAX_LEN ) 4442 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4443 4444 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ) 4445 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 4446 conf->psk_len = psk_len; 4447 memcpy( conf->psk, psk, conf->psk_len ); 4448 4449 /* Check and set PSK Identity */ 4450 ret = ssl_conf_set_psk_identity( conf, psk_identity, psk_identity_len ); 4451 if( ret != 0 ) 4452 ssl_conf_remove_psk( conf ); 4453 4454 return( ret ); 4455 } 4456 4457 static void ssl_remove_psk( mbedtls_ssl_context *ssl ) 4458 { 4459 #if defined(MBEDTLS_USE_PSA_CRYPTO) 4460 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) ) 4461 { 4462 ssl->handshake->psk_opaque = MBEDTLS_SVC_KEY_ID_INIT; 4463 } 4464 else 4465 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 4466 if( ssl->handshake->psk != NULL ) 4467 { 4468 mbedtls_platform_zeroize( ssl->handshake->psk, 4469 ssl->handshake->psk_len ); 4470 mbedtls_free( ssl->handshake->psk ); 4471 ssl->handshake->psk_len = 0; 4472 } 4473 } 4474 4475 int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl, 4476 const unsigned char *psk, size_t psk_len ) 4477 { 4478 if( psk == NULL || ssl->handshake == NULL ) 4479 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4480 4481 if( psk_len > MBEDTLS_PSK_MAX_LEN ) 4482 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4483 4484 ssl_remove_psk( ssl ); 4485 4486 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ) 4487 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 4488 4489 ssl->handshake->psk_len = psk_len; 4490 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len ); 4491 4492 return( 0 ); 4493 } 4494 4495 #if defined(MBEDTLS_USE_PSA_CRYPTO) 4496 int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf, 4497 psa_key_id_t psk, 4498 const unsigned char *psk_identity, 4499 size_t psk_identity_len ) 4500 { 4501 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 4502 /* Clear opaque/raw PSK + PSK Identity, if present. */ 4503 ssl_conf_remove_psk( conf ); 4504 4505 /* Check and set opaque PSK */ 4506 if( mbedtls_svc_key_id_is_null( psk ) ) 4507 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4508 conf->psk_opaque = psk; 4509 4510 /* Check and set PSK Identity */ 4511 ret = ssl_conf_set_psk_identity( conf, psk_identity, 4512 psk_identity_len ); 4513 if( ret != 0 ) 4514 ssl_conf_remove_psk( conf ); 4515 4516 return( ret ); 4517 } 4518 4519 int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl, 4520 psa_key_id_t psk ) 4521 { 4522 if( ( mbedtls_svc_key_id_is_null( psk ) ) || 4523 ( ssl->handshake == NULL ) ) 4524 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4525 4526 ssl_remove_psk( ssl ); 4527 ssl->handshake->psk_opaque = psk; 4528 return( 0 ); 4529 } 4530 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 4531 4532 void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf, 4533 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *, 4534 size_t), 4535 void *p_psk ) 4536 { 4537 conf->f_psk = f_psk; 4538 conf->p_psk = p_psk; 4539 } 4540 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ 4541 4542 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C) 4543 4544 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 4545 int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G ) 4546 { 4547 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 4548 4549 if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 || 4550 ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 ) 4551 { 4552 mbedtls_mpi_free( &conf->dhm_P ); 4553 mbedtls_mpi_free( &conf->dhm_G ); 4554 return( ret ); 4555 } 4556 4557 return( 0 ); 4558 } 4559 #endif /* MBEDTLS_DEPRECATED_REMOVED */ 4560 4561 int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config *conf, 4562 const unsigned char *dhm_P, size_t P_len, 4563 const unsigned char *dhm_G, size_t G_len ) 4564 { 4565 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 4566 4567 if( ( ret = mbedtls_mpi_read_binary( &conf->dhm_P, dhm_P, P_len ) ) != 0 || 4568 ( ret = mbedtls_mpi_read_binary( &conf->dhm_G, dhm_G, G_len ) ) != 0 ) 4569 { 4570 mbedtls_mpi_free( &conf->dhm_P ); 4571 mbedtls_mpi_free( &conf->dhm_G ); 4572 return( ret ); 4573 } 4574 4575 return( 0 ); 4576 } 4577 4578 int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx ) 4579 { 4580 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 4581 4582 if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 || 4583 ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 ) 4584 { 4585 mbedtls_mpi_free( &conf->dhm_P ); 4586 mbedtls_mpi_free( &conf->dhm_G ); 4587 return( ret ); 4588 } 4589 4590 return( 0 ); 4591 } 4592 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */ 4593 4594 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C) 4595 /* 4596 * Set the minimum length for Diffie-Hellman parameters 4597 */ 4598 void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf, 4599 unsigned int bitlen ) 4600 { 4601 conf->dhm_min_bitlen = bitlen; 4602 } 4603 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */ 4604 4605 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 4606 /* 4607 * Set allowed/preferred hashes for handshake signatures 4608 */ 4609 void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf, 4610 const int *hashes ) 4611 { 4612 conf->sig_hashes = hashes; 4613 } 4614 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 4615 4616 #if defined(MBEDTLS_ECP_C) 4617 /* 4618 * Set the allowed elliptic curves 4619 */ 4620 void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf, 4621 const mbedtls_ecp_group_id *curve_list ) 4622 { 4623 conf->curve_list = curve_list; 4624 } 4625 #endif /* MBEDTLS_ECP_C */ 4626 4627 #if defined(MBEDTLS_X509_CRT_PARSE_C) 4628 int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname ) 4629 { 4630 /* Initialize to suppress unnecessary compiler warning */ 4631 size_t hostname_len = 0; 4632 4633 /* Check if new hostname is valid before 4634 * making any change to current one */ 4635 if( hostname != NULL ) 4636 { 4637 hostname_len = strlen( hostname ); 4638 4639 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN ) 4640 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4641 } 4642 4643 /* Now it's clear that we will overwrite the old hostname, 4644 * so we can free it safely */ 4645 4646 if( ssl->hostname != NULL ) 4647 { 4648 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) ); 4649 mbedtls_free( ssl->hostname ); 4650 } 4651 4652 /* Passing NULL as hostname shall clear the old one */ 4653 4654 if( hostname == NULL ) 4655 { 4656 ssl->hostname = NULL; 4657 } 4658 else 4659 { 4660 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 ); 4661 if( ssl->hostname == NULL ) 4662 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 4663 4664 memcpy( ssl->hostname, hostname, hostname_len ); 4665 4666 ssl->hostname[hostname_len] = '\0'; 4667 } 4668 4669 return( 0 ); 4670 } 4671 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 4672 4673 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 4674 void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf, 4675 int (*f_sni)(void *, mbedtls_ssl_context *, 4676 const unsigned char *, size_t), 4677 void *p_sni ) 4678 { 4679 conf->f_sni = f_sni; 4680 conf->p_sni = p_sni; 4681 } 4682 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ 4683 4684 #if defined(MBEDTLS_SSL_ALPN) 4685 int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos ) 4686 { 4687 size_t cur_len, tot_len; 4688 const char **p; 4689 4690 /* 4691 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings 4692 * MUST NOT be truncated." 4693 * We check lengths now rather than later. 4694 */ 4695 tot_len = 0; 4696 for( p = protos; *p != NULL; p++ ) 4697 { 4698 cur_len = strlen( *p ); 4699 tot_len += cur_len; 4700 4701 if( ( cur_len == 0 ) || 4702 ( cur_len > MBEDTLS_SSL_MAX_ALPN_NAME_LEN ) || 4703 ( tot_len > MBEDTLS_SSL_MAX_ALPN_LIST_LEN ) ) 4704 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4705 } 4706 4707 conf->alpn_list = protos; 4708 4709 return( 0 ); 4710 } 4711 4712 const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl ) 4713 { 4714 return( ssl->alpn_chosen ); 4715 } 4716 #endif /* MBEDTLS_SSL_ALPN */ 4717 4718 #if defined(MBEDTLS_SSL_DTLS_SRTP) 4719 void mbedtls_ssl_conf_srtp_mki_value_supported( mbedtls_ssl_config *conf, 4720 int support_mki_value ) 4721 { 4722 conf->dtls_srtp_mki_support = support_mki_value; 4723 } 4724 4725 int mbedtls_ssl_dtls_srtp_set_mki_value( mbedtls_ssl_context *ssl, 4726 unsigned char *mki_value, 4727 uint16_t mki_len ) 4728 { 4729 if( mki_len > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH ) 4730 { 4731 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4732 } 4733 4734 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED ) 4735 { 4736 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); 4737 } 4738 4739 memcpy( ssl->dtls_srtp_info.mki_value, mki_value, mki_len ); 4740 ssl->dtls_srtp_info.mki_len = mki_len; 4741 return( 0 ); 4742 } 4743 4744 int mbedtls_ssl_conf_dtls_srtp_protection_profiles( mbedtls_ssl_config *conf, 4745 const mbedtls_ssl_srtp_profile *profiles ) 4746 { 4747 const mbedtls_ssl_srtp_profile *p; 4748 size_t list_size = 0; 4749 4750 /* check the profiles list: all entry must be valid, 4751 * its size cannot be more than the total number of supported profiles, currently 4 */ 4752 for( p = profiles; *p != MBEDTLS_TLS_SRTP_UNSET && 4753 list_size <= MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH; 4754 p++ ) 4755 { 4756 if( mbedtls_ssl_check_srtp_profile_value( *p ) != MBEDTLS_TLS_SRTP_UNSET ) 4757 { 4758 list_size++; 4759 } 4760 else 4761 { 4762 /* unsupported value, stop parsing and set the size to an error value */ 4763 list_size = MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH + 1; 4764 } 4765 } 4766 4767 if( list_size > MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH ) 4768 { 4769 conf->dtls_srtp_profile_list = NULL; 4770 conf->dtls_srtp_profile_list_len = 0; 4771 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4772 } 4773 4774 conf->dtls_srtp_profile_list = profiles; 4775 conf->dtls_srtp_profile_list_len = list_size; 4776 4777 return( 0 ); 4778 } 4779 4780 void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ssl, 4781 mbedtls_dtls_srtp_info *dtls_srtp_info ) 4782 { 4783 dtls_srtp_info->chosen_dtls_srtp_profile = ssl->dtls_srtp_info.chosen_dtls_srtp_profile; 4784 /* do not copy the mki value if there is no chosen profile */ 4785 if( dtls_srtp_info->chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET ) 4786 { 4787 dtls_srtp_info->mki_len = 0; 4788 } 4789 else 4790 { 4791 dtls_srtp_info->mki_len = ssl->dtls_srtp_info.mki_len; 4792 memcpy( dtls_srtp_info->mki_value, ssl->dtls_srtp_info.mki_value, 4793 ssl->dtls_srtp_info.mki_len ); 4794 } 4795 } 4796 #endif /* MBEDTLS_SSL_DTLS_SRTP */ 4797 4798 void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor ) 4799 { 4800 conf->max_major_ver = major; 4801 conf->max_minor_ver = minor; 4802 } 4803 4804 void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor ) 4805 { 4806 conf->min_major_ver = major; 4807 conf->min_minor_ver = minor; 4808 } 4809 4810 #if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C) 4811 void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback ) 4812 { 4813 conf->fallback = fallback; 4814 } 4815 #endif 4816 4817 #if defined(MBEDTLS_SSL_SRV_C) 4818 void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf, 4819 char cert_req_ca_list ) 4820 { 4821 conf->cert_req_ca_list = cert_req_ca_list; 4822 } 4823 #endif 4824 4825 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 4826 void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm ) 4827 { 4828 conf->encrypt_then_mac = etm; 4829 } 4830 #endif 4831 4832 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 4833 void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems ) 4834 { 4835 conf->extended_ms = ems; 4836 } 4837 #endif 4838 4839 #if defined(MBEDTLS_ARC4_C) 4840 void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 ) 4841 { 4842 conf->arc4_disabled = arc4; 4843 } 4844 #endif 4845 4846 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 4847 int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code ) 4848 { 4849 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID || 4850 ssl_mfl_code_to_length( mfl_code ) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN ) 4851 { 4852 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 4853 } 4854 4855 conf->mfl_code = mfl_code; 4856 4857 return( 0 ); 4858 } 4859 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 4860 4861 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) 4862 void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate ) 4863 { 4864 conf->trunc_hmac = truncate; 4865 } 4866 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ 4867 4868 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) 4869 void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split ) 4870 { 4871 conf->cbc_record_splitting = split; 4872 } 4873 #endif 4874 4875 void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy ) 4876 { 4877 conf->allow_legacy_renegotiation = allow_legacy; 4878 } 4879 4880 #if defined(MBEDTLS_SSL_RENEGOTIATION) 4881 void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation ) 4882 { 4883 conf->disable_renegotiation = renegotiation; 4884 } 4885 4886 void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records ) 4887 { 4888 conf->renego_max_records = max_records; 4889 } 4890 4891 void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf, 4892 const unsigned char period[8] ) 4893 { 4894 memcpy( conf->renego_period, period, 8 ); 4895 } 4896 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 4897 4898 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 4899 #if defined(MBEDTLS_SSL_CLI_C) 4900 void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets ) 4901 { 4902 conf->session_tickets = use_tickets; 4903 } 4904 #endif 4905 4906 #if defined(MBEDTLS_SSL_SRV_C) 4907 void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf, 4908 mbedtls_ssl_ticket_write_t *f_ticket_write, 4909 mbedtls_ssl_ticket_parse_t *f_ticket_parse, 4910 void *p_ticket ) 4911 { 4912 conf->f_ticket_write = f_ticket_write; 4913 conf->f_ticket_parse = f_ticket_parse; 4914 conf->p_ticket = p_ticket; 4915 } 4916 #endif 4917 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 4918 4919 #if defined(MBEDTLS_SSL_EXPORT_KEYS) 4920 void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf, 4921 mbedtls_ssl_export_keys_t *f_export_keys, 4922 void *p_export_keys ) 4923 { 4924 conf->f_export_keys = f_export_keys; 4925 conf->p_export_keys = p_export_keys; 4926 } 4927 4928 void mbedtls_ssl_conf_export_keys_ext_cb( mbedtls_ssl_config *conf, 4929 mbedtls_ssl_export_keys_ext_t *f_export_keys_ext, 4930 void *p_export_keys ) 4931 { 4932 conf->f_export_keys_ext = f_export_keys_ext; 4933 conf->p_export_keys = p_export_keys; 4934 } 4935 #endif 4936 4937 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 4938 void mbedtls_ssl_conf_async_private_cb( 4939 mbedtls_ssl_config *conf, 4940 mbedtls_ssl_async_sign_t *f_async_sign, 4941 mbedtls_ssl_async_decrypt_t *f_async_decrypt, 4942 mbedtls_ssl_async_resume_t *f_async_resume, 4943 mbedtls_ssl_async_cancel_t *f_async_cancel, 4944 void *async_config_data ) 4945 { 4946 conf->f_async_sign_start = f_async_sign; 4947 conf->f_async_decrypt_start = f_async_decrypt; 4948 conf->f_async_resume = f_async_resume; 4949 conf->f_async_cancel = f_async_cancel; 4950 conf->p_async_config_data = async_config_data; 4951 } 4952 4953 void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config *conf ) 4954 { 4955 return( conf->p_async_config_data ); 4956 } 4957 4958 void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context *ssl ) 4959 { 4960 if( ssl->handshake == NULL ) 4961 return( NULL ); 4962 else 4963 return( ssl->handshake->user_async_ctx ); 4964 } 4965 4966 void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context *ssl, 4967 void *ctx ) 4968 { 4969 if( ssl->handshake != NULL ) 4970 ssl->handshake->user_async_ctx = ctx; 4971 } 4972 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 4973 4974 /* 4975 * SSL get accessors 4976 */ 4977 uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl ) 4978 { 4979 if( ssl->session != NULL ) 4980 return( ssl->session->verify_result ); 4981 4982 if( ssl->session_negotiate != NULL ) 4983 return( ssl->session_negotiate->verify_result ); 4984 4985 return( 0xFFFFFFFF ); 4986 } 4987 4988 const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl ) 4989 { 4990 if( ssl == NULL || ssl->session == NULL ) 4991 return( NULL ); 4992 4993 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite ); 4994 } 4995 4996 const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl ) 4997 { 4998 #if defined(MBEDTLS_SSL_PROTO_DTLS) 4999 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 5000 { 5001 switch( ssl->minor_ver ) 5002 { 5003 case MBEDTLS_SSL_MINOR_VERSION_2: 5004 return( "DTLSv1.0" ); 5005 5006 case MBEDTLS_SSL_MINOR_VERSION_3: 5007 return( "DTLSv1.2" ); 5008 5009 default: 5010 return( "unknown (DTLS)" ); 5011 } 5012 } 5013 #endif 5014 5015 switch( ssl->minor_ver ) 5016 { 5017 case MBEDTLS_SSL_MINOR_VERSION_0: 5018 return( "SSLv3.0" ); 5019 5020 case MBEDTLS_SSL_MINOR_VERSION_1: 5021 return( "TLSv1.0" ); 5022 5023 case MBEDTLS_SSL_MINOR_VERSION_2: 5024 return( "TLSv1.1" ); 5025 5026 case MBEDTLS_SSL_MINOR_VERSION_3: 5027 return( "TLSv1.2" ); 5028 5029 default: 5030 return( "unknown" ); 5031 } 5032 } 5033 5034 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 5035 size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl ) 5036 { 5037 size_t max_len = MBEDTLS_SSL_MAX_CONTENT_LEN; 5038 size_t read_mfl; 5039 5040 /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */ 5041 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT && 5042 ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE ) 5043 { 5044 return ssl_mfl_code_to_length( ssl->conf->mfl_code ); 5045 } 5046 5047 /* Check if a smaller max length was negotiated */ 5048 if( ssl->session_out != NULL ) 5049 { 5050 read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code ); 5051 if( read_mfl < max_len ) 5052 { 5053 max_len = read_mfl; 5054 } 5055 } 5056 5057 // During a handshake, use the value being negotiated 5058 if( ssl->session_negotiate != NULL ) 5059 { 5060 read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ); 5061 if( read_mfl < max_len ) 5062 { 5063 max_len = read_mfl; 5064 } 5065 } 5066 5067 return( max_len ); 5068 } 5069 5070 size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl ) 5071 { 5072 size_t max_len; 5073 5074 /* 5075 * Assume mfl_code is correct since it was checked when set 5076 */ 5077 max_len = ssl_mfl_code_to_length( ssl->conf->mfl_code ); 5078 5079 /* Check if a smaller max length was negotiated */ 5080 if( ssl->session_out != NULL && 5081 ssl_mfl_code_to_length( ssl->session_out->mfl_code ) < max_len ) 5082 { 5083 max_len = ssl_mfl_code_to_length( ssl->session_out->mfl_code ); 5084 } 5085 5086 /* During a handshake, use the value being negotiated */ 5087 if( ssl->session_negotiate != NULL && 5088 ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ) < max_len ) 5089 { 5090 max_len = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code ); 5091 } 5092 5093 return( max_len ); 5094 } 5095 5096 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 5097 size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl ) 5098 { 5099 return mbedtls_ssl_get_output_max_frag_len( ssl ); 5100 } 5101 #endif /* !MBEDTLS_DEPRECATED_REMOVED */ 5102 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 5103 5104 #if defined(MBEDTLS_SSL_PROTO_DTLS) 5105 size_t mbedtls_ssl_get_current_mtu( const mbedtls_ssl_context *ssl ) 5106 { 5107 /* Return unlimited mtu for client hello messages to avoid fragmentation. */ 5108 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT && 5109 ( ssl->state == MBEDTLS_SSL_CLIENT_HELLO || 5110 ssl->state == MBEDTLS_SSL_SERVER_HELLO ) ) 5111 return ( 0 ); 5112 5113 if( ssl->handshake == NULL || ssl->handshake->mtu == 0 ) 5114 return( ssl->mtu ); 5115 5116 if( ssl->mtu == 0 ) 5117 return( ssl->handshake->mtu ); 5118 5119 return( ssl->mtu < ssl->handshake->mtu ? 5120 ssl->mtu : ssl->handshake->mtu ); 5121 } 5122 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 5123 5124 int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl ) 5125 { 5126 size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN; 5127 5128 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \ 5129 !defined(MBEDTLS_SSL_PROTO_DTLS) 5130 (void) ssl; 5131 #endif 5132 5133 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 5134 const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl ); 5135 5136 if( max_len > mfl ) 5137 max_len = mfl; 5138 #endif 5139 5140 #if defined(MBEDTLS_SSL_PROTO_DTLS) 5141 if( mbedtls_ssl_get_current_mtu( ssl ) != 0 ) 5142 { 5143 const size_t mtu = mbedtls_ssl_get_current_mtu( ssl ); 5144 const int ret = mbedtls_ssl_get_record_expansion( ssl ); 5145 const size_t overhead = (size_t) ret; 5146 5147 if( ret < 0 ) 5148 return( ret ); 5149 5150 if( mtu <= overhead ) 5151 { 5152 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) ); 5153 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); 5154 } 5155 5156 if( max_len > mtu - overhead ) 5157 max_len = mtu - overhead; 5158 } 5159 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 5160 5161 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \ 5162 !defined(MBEDTLS_SSL_PROTO_DTLS) 5163 ((void) ssl); 5164 #endif 5165 5166 return( (int) max_len ); 5167 } 5168 5169 #if defined(MBEDTLS_X509_CRT_PARSE_C) 5170 const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl ) 5171 { 5172 if( ssl == NULL || ssl->session == NULL ) 5173 return( NULL ); 5174 5175 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 5176 return( ssl->session->peer_cert ); 5177 #else 5178 return( NULL ); 5179 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 5180 } 5181 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 5182 5183 #if defined(MBEDTLS_SSL_CLI_C) 5184 int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl, 5185 mbedtls_ssl_session *dst ) 5186 { 5187 if( ssl == NULL || 5188 dst == NULL || 5189 ssl->session == NULL || 5190 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT ) 5191 { 5192 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5193 } 5194 5195 return( mbedtls_ssl_session_copy( dst, ssl->session ) ); 5196 } 5197 #endif /* MBEDTLS_SSL_CLI_C */ 5198 5199 const mbedtls_ssl_session *mbedtls_ssl_get_session_pointer( const mbedtls_ssl_context *ssl ) 5200 { 5201 if( ssl == NULL ) 5202 return( NULL ); 5203 5204 return( ssl->session ); 5205 } 5206 5207 /* 5208 * Define ticket header determining Mbed TLS version 5209 * and structure of the ticket. 5210 */ 5211 5212 /* 5213 * Define bitflag determining compile-time settings influencing 5214 * structure of serialized SSL sessions. 5215 */ 5216 5217 #if defined(MBEDTLS_HAVE_TIME) 5218 #define SSL_SERIALIZED_SESSION_CONFIG_TIME 1 5219 #else 5220 #define SSL_SERIALIZED_SESSION_CONFIG_TIME 0 5221 #endif /* MBEDTLS_HAVE_TIME */ 5222 5223 #if defined(MBEDTLS_X509_CRT_PARSE_C) 5224 #define SSL_SERIALIZED_SESSION_CONFIG_CRT 1 5225 #else 5226 #define SSL_SERIALIZED_SESSION_CONFIG_CRT 0 5227 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 5228 5229 #if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS) 5230 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 1 5231 #else 5232 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET 0 5233 #endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */ 5234 5235 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 5236 #define SSL_SERIALIZED_SESSION_CONFIG_MFL 1 5237 #else 5238 #define SSL_SERIALIZED_SESSION_CONFIG_MFL 0 5239 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 5240 5241 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) 5242 #define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 1 5243 #else 5244 #define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC 0 5245 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ 5246 5247 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 5248 #define SSL_SERIALIZED_SESSION_CONFIG_ETM 1 5249 #else 5250 #define SSL_SERIALIZED_SESSION_CONFIG_ETM 0 5251 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ 5252 5253 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 5254 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET 1 5255 #else 5256 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET 0 5257 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 5258 5259 #define SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT 0 5260 #define SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT 1 5261 #define SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT 2 5262 #define SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT 3 5263 #define SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT 4 5264 #define SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT 5 5265 #define SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT 6 5266 5267 #define SSL_SERIALIZED_SESSION_CONFIG_BITFLAG \ 5268 ( (uint16_t) ( \ 5269 ( SSL_SERIALIZED_SESSION_CONFIG_TIME << SSL_SERIALIZED_SESSION_CONFIG_TIME_BIT ) | \ 5270 ( SSL_SERIALIZED_SESSION_CONFIG_CRT << SSL_SERIALIZED_SESSION_CONFIG_CRT_BIT ) | \ 5271 ( SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET << SSL_SERIALIZED_SESSION_CONFIG_CLIENT_TICKET_BIT ) | \ 5272 ( SSL_SERIALIZED_SESSION_CONFIG_MFL << SSL_SERIALIZED_SESSION_CONFIG_MFL_BIT ) | \ 5273 ( SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC << SSL_SERIALIZED_SESSION_CONFIG_TRUNC_HMAC_BIT ) | \ 5274 ( SSL_SERIALIZED_SESSION_CONFIG_ETM << SSL_SERIALIZED_SESSION_CONFIG_ETM_BIT ) | \ 5275 ( SSL_SERIALIZED_SESSION_CONFIG_TICKET << SSL_SERIALIZED_SESSION_CONFIG_TICKET_BIT ) ) ) 5276 5277 static unsigned char ssl_serialized_session_header[] = { 5278 MBEDTLS_VERSION_MAJOR, 5279 MBEDTLS_VERSION_MINOR, 5280 MBEDTLS_VERSION_PATCH, 5281 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF, 5282 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF, 5283 }; 5284 5285 /* 5286 * Serialize a session in the following format: 5287 * (in the presentation language of TLS, RFC 8446 section 3) 5288 * 5289 * opaque mbedtls_version[3]; // major, minor, patch 5290 * opaque session_format[2]; // version-specific 16-bit field determining 5291 * // the format of the remaining 5292 * // serialized data. 5293 * 5294 * Note: When updating the format, remember to keep 5295 * these version+format bytes. 5296 * 5297 * // In this version, `session_format` determines 5298 * // the setting of those compile-time 5299 * // configuration options which influence 5300 * // the structure of mbedtls_ssl_session. 5301 * uint64 start_time; 5302 * uint8 ciphersuite[2]; // defined by the standard 5303 * uint8 compression; // 0 or 1 5304 * uint8 session_id_len; // at most 32 5305 * opaque session_id[32]; 5306 * opaque master[48]; // fixed length in the standard 5307 * uint32 verify_result; 5308 * opaque peer_cert<0..2^24-1>; // length 0 means no peer cert 5309 * opaque ticket<0..2^24-1>; // length 0 means no ticket 5310 * uint32 ticket_lifetime; 5311 * uint8 mfl_code; // up to 255 according to standard 5312 * uint8 trunc_hmac; // 0 or 1 5313 * uint8 encrypt_then_mac; // 0 or 1 5314 * 5315 * The order is the same as in the definition of the structure, except 5316 * verify_result is put before peer_cert so that all mandatory fields come 5317 * together in one block. 5318 */ 5319 static int ssl_session_save( const mbedtls_ssl_session *session, 5320 unsigned char omit_header, 5321 unsigned char *buf, 5322 size_t buf_len, 5323 size_t *olen ) 5324 { 5325 unsigned char *p = buf; 5326 size_t used = 0; 5327 #if defined(MBEDTLS_HAVE_TIME) 5328 uint64_t start; 5329 #endif 5330 #if defined(MBEDTLS_X509_CRT_PARSE_C) 5331 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 5332 size_t cert_len; 5333 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 5334 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 5335 5336 5337 if( !omit_header ) 5338 { 5339 /* 5340 * Add version identifier 5341 */ 5342 5343 used += sizeof( ssl_serialized_session_header ); 5344 5345 if( used <= buf_len ) 5346 { 5347 memcpy( p, ssl_serialized_session_header, 5348 sizeof( ssl_serialized_session_header ) ); 5349 p += sizeof( ssl_serialized_session_header ); 5350 } 5351 } 5352 5353 /* 5354 * Time 5355 */ 5356 #if defined(MBEDTLS_HAVE_TIME) 5357 used += 8; 5358 5359 if( used <= buf_len ) 5360 { 5361 start = (uint64_t) session->start; 5362 5363 *p++ = (unsigned char)( ( start >> 56 ) & 0xFF ); 5364 *p++ = (unsigned char)( ( start >> 48 ) & 0xFF ); 5365 *p++ = (unsigned char)( ( start >> 40 ) & 0xFF ); 5366 *p++ = (unsigned char)( ( start >> 32 ) & 0xFF ); 5367 *p++ = (unsigned char)( ( start >> 24 ) & 0xFF ); 5368 *p++ = (unsigned char)( ( start >> 16 ) & 0xFF ); 5369 *p++ = (unsigned char)( ( start >> 8 ) & 0xFF ); 5370 *p++ = (unsigned char)( ( start ) & 0xFF ); 5371 } 5372 #endif /* MBEDTLS_HAVE_TIME */ 5373 5374 /* 5375 * Basic mandatory fields 5376 */ 5377 used += 2 /* ciphersuite */ 5378 + 1 /* compression */ 5379 + 1 /* id_len */ 5380 + sizeof( session->id ) 5381 + sizeof( session->master ) 5382 + 4; /* verify_result */ 5383 5384 if( used <= buf_len ) 5385 { 5386 *p++ = (unsigned char)( ( session->ciphersuite >> 8 ) & 0xFF ); 5387 *p++ = (unsigned char)( ( session->ciphersuite ) & 0xFF ); 5388 5389 *p++ = (unsigned char)( session->compression & 0xFF ); 5390 5391 *p++ = (unsigned char)( session->id_len & 0xFF ); 5392 memcpy( p, session->id, 32 ); 5393 p += 32; 5394 5395 memcpy( p, session->master, 48 ); 5396 p += 48; 5397 5398 *p++ = (unsigned char)( ( session->verify_result >> 24 ) & 0xFF ); 5399 *p++ = (unsigned char)( ( session->verify_result >> 16 ) & 0xFF ); 5400 *p++ = (unsigned char)( ( session->verify_result >> 8 ) & 0xFF ); 5401 *p++ = (unsigned char)( ( session->verify_result ) & 0xFF ); 5402 } 5403 5404 /* 5405 * Peer's end-entity certificate 5406 */ 5407 #if defined(MBEDTLS_X509_CRT_PARSE_C) 5408 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 5409 if( session->peer_cert == NULL ) 5410 cert_len = 0; 5411 else 5412 cert_len = session->peer_cert->raw.len; 5413 5414 used += 3 + cert_len; 5415 5416 if( used <= buf_len ) 5417 { 5418 *p++ = (unsigned char)( ( cert_len >> 16 ) & 0xFF ); 5419 *p++ = (unsigned char)( ( cert_len >> 8 ) & 0xFF ); 5420 *p++ = (unsigned char)( ( cert_len ) & 0xFF ); 5421 5422 if( session->peer_cert != NULL ) 5423 { 5424 memcpy( p, session->peer_cert->raw.p, cert_len ); 5425 p += cert_len; 5426 } 5427 } 5428 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 5429 if( session->peer_cert_digest != NULL ) 5430 { 5431 used += 1 /* type */ + 1 /* length */ + session->peer_cert_digest_len; 5432 if( used <= buf_len ) 5433 { 5434 *p++ = (unsigned char) session->peer_cert_digest_type; 5435 *p++ = (unsigned char) session->peer_cert_digest_len; 5436 memcpy( p, session->peer_cert_digest, 5437 session->peer_cert_digest_len ); 5438 p += session->peer_cert_digest_len; 5439 } 5440 } 5441 else 5442 { 5443 used += 2; 5444 if( used <= buf_len ) 5445 { 5446 *p++ = (unsigned char) MBEDTLS_MD_NONE; 5447 *p++ = 0; 5448 } 5449 } 5450 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 5451 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 5452 5453 /* 5454 * Session ticket if any, plus associated data 5455 */ 5456 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) 5457 used += 3 + session->ticket_len + 4; /* len + ticket + lifetime */ 5458 5459 if( used <= buf_len ) 5460 { 5461 *p++ = (unsigned char)( ( session->ticket_len >> 16 ) & 0xFF ); 5462 *p++ = (unsigned char)( ( session->ticket_len >> 8 ) & 0xFF ); 5463 *p++ = (unsigned char)( ( session->ticket_len ) & 0xFF ); 5464 5465 if( session->ticket != NULL ) 5466 { 5467 memcpy( p, session->ticket, session->ticket_len ); 5468 p += session->ticket_len; 5469 } 5470 5471 *p++ = (unsigned char)( ( session->ticket_lifetime >> 24 ) & 0xFF ); 5472 *p++ = (unsigned char)( ( session->ticket_lifetime >> 16 ) & 0xFF ); 5473 *p++ = (unsigned char)( ( session->ticket_lifetime >> 8 ) & 0xFF ); 5474 *p++ = (unsigned char)( ( session->ticket_lifetime ) & 0xFF ); 5475 } 5476 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */ 5477 5478 /* 5479 * Misc extension-related info 5480 */ 5481 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 5482 used += 1; 5483 5484 if( used <= buf_len ) 5485 *p++ = session->mfl_code; 5486 #endif 5487 5488 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) 5489 used += 1; 5490 5491 if( used <= buf_len ) 5492 *p++ = (unsigned char)( ( session->trunc_hmac ) & 0xFF ); 5493 #endif 5494 5495 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 5496 used += 1; 5497 5498 if( used <= buf_len ) 5499 *p++ = (unsigned char)( ( session->encrypt_then_mac ) & 0xFF ); 5500 #endif 5501 5502 /* Done */ 5503 *olen = used; 5504 5505 if( used > buf_len ) 5506 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); 5507 5508 return( 0 ); 5509 } 5510 5511 /* 5512 * Public wrapper for ssl_session_save() 5513 */ 5514 int mbedtls_ssl_session_save( const mbedtls_ssl_session *session, 5515 unsigned char *buf, 5516 size_t buf_len, 5517 size_t *olen ) 5518 { 5519 return( ssl_session_save( session, 0, buf, buf_len, olen ) ); 5520 } 5521 5522 /* 5523 * Deserialize session, see mbedtls_ssl_session_save() for format. 5524 * 5525 * This internal version is wrapped by a public function that cleans up in 5526 * case of error, and has an extra option omit_header. 5527 */ 5528 static int ssl_session_load( mbedtls_ssl_session *session, 5529 unsigned char omit_header, 5530 const unsigned char *buf, 5531 size_t len ) 5532 { 5533 const unsigned char *p = buf; 5534 const unsigned char * const end = buf + len; 5535 #if defined(MBEDTLS_HAVE_TIME) 5536 uint64_t start; 5537 #endif 5538 #if defined(MBEDTLS_X509_CRT_PARSE_C) 5539 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 5540 size_t cert_len; 5541 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 5542 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 5543 5544 if( !omit_header ) 5545 { 5546 /* 5547 * Check version identifier 5548 */ 5549 5550 if( (size_t)( end - p ) < sizeof( ssl_serialized_session_header ) ) 5551 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5552 5553 if( memcmp( p, ssl_serialized_session_header, 5554 sizeof( ssl_serialized_session_header ) ) != 0 ) 5555 { 5556 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH ); 5557 } 5558 p += sizeof( ssl_serialized_session_header ); 5559 } 5560 5561 /* 5562 * Time 5563 */ 5564 #if defined(MBEDTLS_HAVE_TIME) 5565 if( 8 > (size_t)( end - p ) ) 5566 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5567 5568 start = ( (uint64_t) p[0] << 56 ) | 5569 ( (uint64_t) p[1] << 48 ) | 5570 ( (uint64_t) p[2] << 40 ) | 5571 ( (uint64_t) p[3] << 32 ) | 5572 ( (uint64_t) p[4] << 24 ) | 5573 ( (uint64_t) p[5] << 16 ) | 5574 ( (uint64_t) p[6] << 8 ) | 5575 ( (uint64_t) p[7] ); 5576 p += 8; 5577 5578 session->start = (time_t) start; 5579 #endif /* MBEDTLS_HAVE_TIME */ 5580 5581 /* 5582 * Basic mandatory fields 5583 */ 5584 if( 2 + 1 + 1 + 32 + 48 + 4 > (size_t)( end - p ) ) 5585 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5586 5587 session->ciphersuite = ( p[0] << 8 ) | p[1]; 5588 p += 2; 5589 5590 session->compression = *p++; 5591 5592 session->id_len = *p++; 5593 memcpy( session->id, p, 32 ); 5594 p += 32; 5595 5596 memcpy( session->master, p, 48 ); 5597 p += 48; 5598 5599 session->verify_result = ( (uint32_t) p[0] << 24 ) | 5600 ( (uint32_t) p[1] << 16 ) | 5601 ( (uint32_t) p[2] << 8 ) | 5602 ( (uint32_t) p[3] ); 5603 p += 4; 5604 5605 /* Immediately clear invalid pointer values that have been read, in case 5606 * we exit early before we replaced them with valid ones. */ 5607 #if defined(MBEDTLS_X509_CRT_PARSE_C) 5608 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 5609 session->peer_cert = NULL; 5610 #else 5611 session->peer_cert_digest = NULL; 5612 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 5613 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 5614 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) 5615 session->ticket = NULL; 5616 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */ 5617 5618 /* 5619 * Peer certificate 5620 */ 5621 #if defined(MBEDTLS_X509_CRT_PARSE_C) 5622 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 5623 /* Deserialize CRT from the end of the ticket. */ 5624 if( 3 > (size_t)( end - p ) ) 5625 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5626 5627 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2]; 5628 p += 3; 5629 5630 if( cert_len != 0 ) 5631 { 5632 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 5633 5634 if( cert_len > (size_t)( end - p ) ) 5635 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5636 5637 session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) ); 5638 5639 if( session->peer_cert == NULL ) 5640 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 5641 5642 mbedtls_x509_crt_init( session->peer_cert ); 5643 5644 if( ( ret = mbedtls_x509_crt_parse_der( session->peer_cert, 5645 p, cert_len ) ) != 0 ) 5646 { 5647 mbedtls_x509_crt_free( session->peer_cert ); 5648 mbedtls_free( session->peer_cert ); 5649 session->peer_cert = NULL; 5650 return( ret ); 5651 } 5652 5653 p += cert_len; 5654 } 5655 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 5656 /* Deserialize CRT digest from the end of the ticket. */ 5657 if( 2 > (size_t)( end - p ) ) 5658 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5659 5660 session->peer_cert_digest_type = (mbedtls_md_type_t) *p++; 5661 session->peer_cert_digest_len = (size_t) *p++; 5662 5663 if( session->peer_cert_digest_len != 0 ) 5664 { 5665 const mbedtls_md_info_t *md_info = 5666 mbedtls_md_info_from_type( session->peer_cert_digest_type ); 5667 if( md_info == NULL ) 5668 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5669 if( session->peer_cert_digest_len != mbedtls_md_get_size( md_info ) ) 5670 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5671 5672 if( session->peer_cert_digest_len > (size_t)( end - p ) ) 5673 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5674 5675 session->peer_cert_digest = 5676 mbedtls_calloc( 1, session->peer_cert_digest_len ); 5677 if( session->peer_cert_digest == NULL ) 5678 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 5679 5680 memcpy( session->peer_cert_digest, p, 5681 session->peer_cert_digest_len ); 5682 p += session->peer_cert_digest_len; 5683 } 5684 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 5685 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 5686 5687 /* 5688 * Session ticket and associated data 5689 */ 5690 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) 5691 if( 3 > (size_t)( end - p ) ) 5692 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5693 5694 session->ticket_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2]; 5695 p += 3; 5696 5697 if( session->ticket_len != 0 ) 5698 { 5699 if( session->ticket_len > (size_t)( end - p ) ) 5700 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5701 5702 session->ticket = mbedtls_calloc( 1, session->ticket_len ); 5703 if( session->ticket == NULL ) 5704 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 5705 5706 memcpy( session->ticket, p, session->ticket_len ); 5707 p += session->ticket_len; 5708 } 5709 5710 if( 4 > (size_t)( end - p ) ) 5711 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5712 5713 session->ticket_lifetime = ( (uint32_t) p[0] << 24 ) | 5714 ( (uint32_t) p[1] << 16 ) | 5715 ( (uint32_t) p[2] << 8 ) | 5716 ( (uint32_t) p[3] ); 5717 p += 4; 5718 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */ 5719 5720 /* 5721 * Misc extension-related info 5722 */ 5723 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 5724 if( 1 > (size_t)( end - p ) ) 5725 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5726 5727 session->mfl_code = *p++; 5728 #endif 5729 5730 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) 5731 if( 1 > (size_t)( end - p ) ) 5732 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5733 5734 session->trunc_hmac = *p++; 5735 #endif 5736 5737 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 5738 if( 1 > (size_t)( end - p ) ) 5739 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5740 5741 session->encrypt_then_mac = *p++; 5742 #endif 5743 5744 /* Done, should have consumed entire buffer */ 5745 if( p != end ) 5746 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5747 5748 return( 0 ); 5749 } 5750 5751 /* 5752 * Deserialize session: public wrapper for error cleaning 5753 */ 5754 int mbedtls_ssl_session_load( mbedtls_ssl_session *session, 5755 const unsigned char *buf, 5756 size_t len ) 5757 { 5758 int ret = ssl_session_load( session, 0, buf, len ); 5759 5760 if( ret != 0 ) 5761 mbedtls_ssl_session_free( session ); 5762 5763 return( ret ); 5764 } 5765 5766 /* 5767 * Perform a single step of the SSL handshake 5768 */ 5769 int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl ) 5770 { 5771 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 5772 5773 if( ssl == NULL || ssl->conf == NULL ) 5774 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5775 5776 #if defined(MBEDTLS_SSL_CLI_C) 5777 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) 5778 ret = mbedtls_ssl_handshake_client_step( ssl ); 5779 #endif 5780 #if defined(MBEDTLS_SSL_SRV_C) 5781 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) 5782 ret = mbedtls_ssl_handshake_server_step( ssl ); 5783 #endif 5784 5785 return( ret ); 5786 } 5787 5788 /* 5789 * Perform the SSL handshake 5790 */ 5791 int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl ) 5792 { 5793 int ret = 0; 5794 5795 /* Sanity checks */ 5796 5797 if( ssl == NULL || ssl->conf == NULL ) 5798 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5799 5800 #if defined(MBEDTLS_SSL_PROTO_DTLS) 5801 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 5802 ( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) ) 5803 { 5804 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use " 5805 "mbedtls_ssl_set_timer_cb() for DTLS" ) ); 5806 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5807 } 5808 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 5809 5810 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) ); 5811 5812 /* Main handshake loop */ 5813 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ) 5814 { 5815 ret = mbedtls_ssl_handshake_step( ssl ); 5816 5817 if( ret != 0 ) 5818 break; 5819 } 5820 5821 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) ); 5822 5823 return( ret ); 5824 } 5825 5826 #if defined(MBEDTLS_SSL_RENEGOTIATION) 5827 #if defined(MBEDTLS_SSL_SRV_C) 5828 /* 5829 * Write HelloRequest to request renegotiation on server 5830 */ 5831 static int ssl_write_hello_request( mbedtls_ssl_context *ssl ) 5832 { 5833 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 5834 5835 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) ); 5836 5837 ssl->out_msglen = 4; 5838 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 5839 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST; 5840 5841 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 ) 5842 { 5843 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret ); 5844 return( ret ); 5845 } 5846 5847 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) ); 5848 5849 return( 0 ); 5850 } 5851 #endif /* MBEDTLS_SSL_SRV_C */ 5852 5853 /* 5854 * Actually renegotiate current connection, triggered by either: 5855 * - any side: calling mbedtls_ssl_renegotiate(), 5856 * - client: receiving a HelloRequest during mbedtls_ssl_read(), 5857 * - server: receiving any handshake message on server during mbedtls_ssl_read() after 5858 * the initial handshake is completed. 5859 * If the handshake doesn't complete due to waiting for I/O, it will continue 5860 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively. 5861 */ 5862 int mbedtls_ssl_start_renegotiation( mbedtls_ssl_context *ssl ) 5863 { 5864 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 5865 5866 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) ); 5867 5868 if( ( ret = ssl_handshake_init( ssl ) ) != 0 ) 5869 return( ret ); 5870 5871 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and 5872 * the ServerHello will have message_seq = 1" */ 5873 #if defined(MBEDTLS_SSL_PROTO_DTLS) 5874 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 5875 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ) 5876 { 5877 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) 5878 ssl->handshake->out_msg_seq = 1; 5879 else 5880 ssl->handshake->in_msg_seq = 1; 5881 } 5882 #endif 5883 5884 ssl->state = MBEDTLS_SSL_HELLO_REQUEST; 5885 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS; 5886 5887 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 ) 5888 { 5889 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret ); 5890 return( ret ); 5891 } 5892 5893 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) ); 5894 5895 return( 0 ); 5896 } 5897 5898 /* 5899 * Renegotiate current connection on client, 5900 * or request renegotiation on server 5901 */ 5902 int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl ) 5903 { 5904 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 5905 5906 if( ssl == NULL || ssl->conf == NULL ) 5907 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5908 5909 #if defined(MBEDTLS_SSL_SRV_C) 5910 /* On server, just send the request */ 5911 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) 5912 { 5913 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ) 5914 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5915 5916 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING; 5917 5918 /* Did we already try/start sending HelloRequest? */ 5919 if( ssl->out_left != 0 ) 5920 return( mbedtls_ssl_flush_output( ssl ) ); 5921 5922 return( ssl_write_hello_request( ssl ) ); 5923 } 5924 #endif /* MBEDTLS_SSL_SRV_C */ 5925 5926 #if defined(MBEDTLS_SSL_CLI_C) 5927 /* 5928 * On client, either start the renegotiation process or, 5929 * if already in progress, continue the handshake 5930 */ 5931 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) 5932 { 5933 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ) 5934 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 5935 5936 if( ( ret = mbedtls_ssl_start_renegotiation( ssl ) ) != 0 ) 5937 { 5938 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_start_renegotiation", ret ); 5939 return( ret ); 5940 } 5941 } 5942 else 5943 { 5944 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 ) 5945 { 5946 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret ); 5947 return( ret ); 5948 } 5949 } 5950 #endif /* MBEDTLS_SSL_CLI_C */ 5951 5952 return( ret ); 5953 } 5954 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 5955 5956 #if defined(MBEDTLS_X509_CRT_PARSE_C) 5957 static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert ) 5958 { 5959 mbedtls_ssl_key_cert *cur = key_cert, *next; 5960 5961 while( cur != NULL ) 5962 { 5963 next = cur->next; 5964 mbedtls_free( cur ); 5965 cur = next; 5966 } 5967 } 5968 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 5969 5970 void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl ) 5971 { 5972 mbedtls_ssl_handshake_params *handshake = ssl->handshake; 5973 5974 if( handshake == NULL ) 5975 return; 5976 5977 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 5978 if( ssl->conf->f_async_cancel != NULL && handshake->async_in_progress != 0 ) 5979 { 5980 ssl->conf->f_async_cancel( ssl ); 5981 handshake->async_in_progress = 0; 5982 } 5983 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 5984 5985 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ 5986 defined(MBEDTLS_SSL_PROTO_TLS1_1) 5987 mbedtls_md5_free( &handshake->fin_md5 ); 5988 mbedtls_sha1_free( &handshake->fin_sha1 ); 5989 #endif 5990 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 5991 #if defined(MBEDTLS_SHA256_C) 5992 #if defined(MBEDTLS_USE_PSA_CRYPTO) 5993 psa_hash_abort( &handshake->fin_sha256_psa ); 5994 #else 5995 mbedtls_sha256_free( &handshake->fin_sha256 ); 5996 #endif 5997 #endif 5998 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 5999 #if defined(MBEDTLS_USE_PSA_CRYPTO) 6000 psa_hash_abort( &handshake->fin_sha384_psa ); 6001 #else 6002 mbedtls_sha512_free( &handshake->fin_sha512 ); 6003 #endif 6004 #endif 6005 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 6006 6007 #if defined(MBEDTLS_DHM_C) 6008 mbedtls_dhm_free( &handshake->dhm_ctx ); 6009 #endif 6010 #if defined(MBEDTLS_ECDH_C) 6011 mbedtls_ecdh_free( &handshake->ecdh_ctx ); 6012 #endif 6013 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 6014 mbedtls_ecjpake_free( &handshake->ecjpake_ctx ); 6015 #if defined(MBEDTLS_SSL_CLI_C) 6016 mbedtls_free( handshake->ecjpake_cache ); 6017 handshake->ecjpake_cache = NULL; 6018 handshake->ecjpake_cache_len = 0; 6019 #endif 6020 #endif 6021 6022 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ 6023 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 6024 /* explicit void pointer cast for buggy MS compiler */ 6025 mbedtls_free( (void *) handshake->curves ); 6026 #endif 6027 6028 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) 6029 if( handshake->psk != NULL ) 6030 { 6031 mbedtls_platform_zeroize( handshake->psk, handshake->psk_len ); 6032 mbedtls_free( handshake->psk ); 6033 } 6034 #endif 6035 6036 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ 6037 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 6038 /* 6039 * Free only the linked list wrapper, not the keys themselves 6040 * since the belong to the SNI callback 6041 */ 6042 if( handshake->sni_key_cert != NULL ) 6043 { 6044 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next; 6045 6046 while( cur != NULL ) 6047 { 6048 next = cur->next; 6049 mbedtls_free( cur ); 6050 cur = next; 6051 } 6052 } 6053 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */ 6054 6055 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) 6056 mbedtls_x509_crt_restart_free( &handshake->ecrs_ctx ); 6057 if( handshake->ecrs_peer_cert != NULL ) 6058 { 6059 mbedtls_x509_crt_free( handshake->ecrs_peer_cert ); 6060 mbedtls_free( handshake->ecrs_peer_cert ); 6061 } 6062 #endif 6063 6064 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ 6065 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 6066 mbedtls_pk_free( &handshake->peer_pubkey ); 6067 #endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 6068 6069 #if defined(MBEDTLS_SSL_PROTO_DTLS) 6070 mbedtls_free( handshake->verify_cookie ); 6071 mbedtls_ssl_flight_free( handshake->flight ); 6072 mbedtls_ssl_buffering_free( ssl ); 6073 #endif 6074 6075 #if defined(MBEDTLS_ECDH_C) && \ 6076 defined(MBEDTLS_USE_PSA_CRYPTO) 6077 psa_destroy_key( handshake->ecdh_psa_privkey ); 6078 #endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */ 6079 6080 mbedtls_platform_zeroize( handshake, 6081 sizeof( mbedtls_ssl_handshake_params ) ); 6082 6083 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) 6084 /* If the buffers are too big - reallocate. Because of the way Mbed TLS 6085 * processes datagrams and the fact that a datagram is allowed to have 6086 * several records in it, it is possible that the I/O buffers are not 6087 * empty at this stage */ 6088 handle_buffer_resizing( ssl, 1, mbedtls_ssl_get_input_buflen( ssl ), 6089 mbedtls_ssl_get_output_buflen( ssl ) ); 6090 #endif 6091 } 6092 6093 void mbedtls_ssl_session_free( mbedtls_ssl_session *session ) 6094 { 6095 if( session == NULL ) 6096 return; 6097 6098 #if defined(MBEDTLS_X509_CRT_PARSE_C) 6099 ssl_clear_peer_cert( session ); 6100 #endif 6101 6102 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) 6103 mbedtls_free( session->ticket ); 6104 #endif 6105 6106 mbedtls_platform_zeroize( session, sizeof( mbedtls_ssl_session ) ); 6107 } 6108 6109 #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) 6110 6111 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 6112 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 1u 6113 #else 6114 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID 0u 6115 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ 6116 6117 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) 6118 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 1u 6119 #else 6120 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT 0u 6121 #endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */ 6122 6123 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) 6124 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 1u 6125 #else 6126 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY 0u 6127 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */ 6128 6129 #if defined(MBEDTLS_SSL_ALPN) 6130 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 1u 6131 #else 6132 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN 0u 6133 #endif /* MBEDTLS_SSL_ALPN */ 6134 6135 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT 0 6136 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT 1 6137 #define SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT 2 6138 #define SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT 3 6139 6140 #define SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG \ 6141 ( (uint32_t) ( \ 6142 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_CONNECTION_ID_BIT ) | \ 6143 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_BADMAC_LIMIT_BIT ) | \ 6144 ( SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY << SSL_SERIALIZED_CONTEXT_CONFIG_DTLS_ANTI_REPLAY_BIT ) | \ 6145 ( SSL_SERIALIZED_CONTEXT_CONFIG_ALPN << SSL_SERIALIZED_CONTEXT_CONFIG_ALPN_BIT ) | \ 6146 0u ) ) 6147 6148 static unsigned char ssl_serialized_context_header[] = { 6149 MBEDTLS_VERSION_MAJOR, 6150 MBEDTLS_VERSION_MINOR, 6151 MBEDTLS_VERSION_PATCH, 6152 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 8 ) & 0xFF, 6153 ( SSL_SERIALIZED_SESSION_CONFIG_BITFLAG >> 0 ) & 0xFF, 6154 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 16 ) & 0xFF, 6155 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 8 ) & 0xFF, 6156 ( SSL_SERIALIZED_CONTEXT_CONFIG_BITFLAG >> 0 ) & 0xFF, 6157 }; 6158 6159 /* 6160 * Serialize a full SSL context 6161 * 6162 * The format of the serialized data is: 6163 * (in the presentation language of TLS, RFC 8446 section 3) 6164 * 6165 * // header 6166 * opaque mbedtls_version[3]; // major, minor, patch 6167 * opaque context_format[5]; // version-specific field determining 6168 * // the format of the remaining 6169 * // serialized data. 6170 * Note: When updating the format, remember to keep these 6171 * version+format bytes. (We may make their size part of the API.) 6172 * 6173 * // session sub-structure 6174 * opaque session<1..2^32-1>; // see mbedtls_ssl_session_save() 6175 * // transform sub-structure 6176 * uint8 random[64]; // ServerHello.random+ClientHello.random 6177 * uint8 in_cid<0..2^8-1> // Connection ID: expected incoming value 6178 * uint8 out_cid<0..2^8-1> // Connection ID: outgoing value to use 6179 * // fields from ssl_context 6180 * uint32 badmac_seen; // DTLS: number of records with failing MAC 6181 * uint64 in_window_top; // DTLS: last validated record seq_num 6182 * uint64 in_window; // DTLS: bitmask for replay protection 6183 * uint8 disable_datagram_packing; // DTLS: only one record per datagram 6184 * uint64 cur_out_ctr; // Record layer: outgoing sequence number 6185 * uint16 mtu; // DTLS: path mtu (max outgoing fragment size) 6186 * uint8 alpn_chosen<0..2^8-1> // ALPN: negotiated application protocol 6187 * 6188 * Note that many fields of the ssl_context or sub-structures are not 6189 * serialized, as they fall in one of the following categories: 6190 * 6191 * 1. forced value (eg in_left must be 0) 6192 * 2. pointer to dynamically-allocated memory (eg session, transform) 6193 * 3. value can be re-derived from other data (eg session keys from MS) 6194 * 4. value was temporary (eg content of input buffer) 6195 * 5. value will be provided by the user again (eg I/O callbacks and context) 6196 */ 6197 int mbedtls_ssl_context_save( mbedtls_ssl_context *ssl, 6198 unsigned char *buf, 6199 size_t buf_len, 6200 size_t *olen ) 6201 { 6202 unsigned char *p = buf; 6203 size_t used = 0; 6204 size_t session_len; 6205 int ret = 0; 6206 6207 /* 6208 * Enforce usage restrictions, see "return BAD_INPUT_DATA" in 6209 * this function's documentation. 6210 * 6211 * These are due to assumptions/limitations in the implementation. Some of 6212 * them are likely to stay (no handshake in progress) some might go away 6213 * (only DTLS) but are currently used to simplify the implementation. 6214 */ 6215 /* The initial handshake must be over */ 6216 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ) 6217 { 6218 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Initial handshake isn't over" ) ); 6219 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6220 } 6221 if( ssl->handshake != NULL ) 6222 { 6223 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Handshake isn't completed" ) ); 6224 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6225 } 6226 /* Double-check that sub-structures are indeed ready */ 6227 if( ssl->transform == NULL || ssl->session == NULL ) 6228 { 6229 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Serialised structures aren't ready" ) ); 6230 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6231 } 6232 /* There must be no pending incoming or outgoing data */ 6233 if( mbedtls_ssl_check_pending( ssl ) != 0 ) 6234 { 6235 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending incoming data" ) ); 6236 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6237 } 6238 if( ssl->out_left != 0 ) 6239 { 6240 MBEDTLS_SSL_DEBUG_MSG( 1, ( "There is pending outgoing data" ) ); 6241 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6242 } 6243 /* Protocol must be DLTS, not TLS */ 6244 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 6245 { 6246 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only DTLS is supported" ) ); 6247 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6248 } 6249 /* Version must be 1.2 */ 6250 if( ssl->major_ver != MBEDTLS_SSL_MAJOR_VERSION_3 ) 6251 { 6252 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) ); 6253 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6254 } 6255 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 ) 6256 { 6257 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only version 1.2 supported" ) ); 6258 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6259 } 6260 /* We must be using an AEAD ciphersuite */ 6261 if( mbedtls_ssl_transform_uses_aead( ssl->transform ) != 1 ) 6262 { 6263 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Only AEAD ciphersuites supported" ) ); 6264 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6265 } 6266 /* Renegotiation must not be enabled */ 6267 #if defined(MBEDTLS_SSL_RENEGOTIATION) 6268 if( ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED ) 6269 { 6270 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Renegotiation must not be enabled" ) ); 6271 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6272 } 6273 #endif 6274 6275 /* 6276 * Version and format identifier 6277 */ 6278 used += sizeof( ssl_serialized_context_header ); 6279 6280 if( used <= buf_len ) 6281 { 6282 memcpy( p, ssl_serialized_context_header, 6283 sizeof( ssl_serialized_context_header ) ); 6284 p += sizeof( ssl_serialized_context_header ); 6285 } 6286 6287 /* 6288 * Session (length + data) 6289 */ 6290 ret = ssl_session_save( ssl->session, 1, NULL, 0, &session_len ); 6291 if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ) 6292 return( ret ); 6293 6294 used += 4 + session_len; 6295 if( used <= buf_len ) 6296 { 6297 *p++ = (unsigned char)( ( session_len >> 24 ) & 0xFF ); 6298 *p++ = (unsigned char)( ( session_len >> 16 ) & 0xFF ); 6299 *p++ = (unsigned char)( ( session_len >> 8 ) & 0xFF ); 6300 *p++ = (unsigned char)( ( session_len ) & 0xFF ); 6301 6302 ret = ssl_session_save( ssl->session, 1, 6303 p, session_len, &session_len ); 6304 if( ret != 0 ) 6305 return( ret ); 6306 6307 p += session_len; 6308 } 6309 6310 /* 6311 * Transform 6312 */ 6313 used += sizeof( ssl->transform->randbytes ); 6314 if( used <= buf_len ) 6315 { 6316 memcpy( p, ssl->transform->randbytes, 6317 sizeof( ssl->transform->randbytes ) ); 6318 p += sizeof( ssl->transform->randbytes ); 6319 } 6320 6321 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 6322 used += 2 + ssl->transform->in_cid_len + ssl->transform->out_cid_len; 6323 if( used <= buf_len ) 6324 { 6325 *p++ = ssl->transform->in_cid_len; 6326 memcpy( p, ssl->transform->in_cid, ssl->transform->in_cid_len ); 6327 p += ssl->transform->in_cid_len; 6328 6329 *p++ = ssl->transform->out_cid_len; 6330 memcpy( p, ssl->transform->out_cid, ssl->transform->out_cid_len ); 6331 p += ssl->transform->out_cid_len; 6332 } 6333 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ 6334 6335 /* 6336 * Saved fields from top-level ssl_context structure 6337 */ 6338 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) 6339 used += 4; 6340 if( used <= buf_len ) 6341 { 6342 *p++ = (unsigned char)( ( ssl->badmac_seen >> 24 ) & 0xFF ); 6343 *p++ = (unsigned char)( ( ssl->badmac_seen >> 16 ) & 0xFF ); 6344 *p++ = (unsigned char)( ( ssl->badmac_seen >> 8 ) & 0xFF ); 6345 *p++ = (unsigned char)( ( ssl->badmac_seen ) & 0xFF ); 6346 } 6347 #endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */ 6348 6349 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) 6350 used += 16; 6351 if( used <= buf_len ) 6352 { 6353 *p++ = (unsigned char)( ( ssl->in_window_top >> 56 ) & 0xFF ); 6354 *p++ = (unsigned char)( ( ssl->in_window_top >> 48 ) & 0xFF ); 6355 *p++ = (unsigned char)( ( ssl->in_window_top >> 40 ) & 0xFF ); 6356 *p++ = (unsigned char)( ( ssl->in_window_top >> 32 ) & 0xFF ); 6357 *p++ = (unsigned char)( ( ssl->in_window_top >> 24 ) & 0xFF ); 6358 *p++ = (unsigned char)( ( ssl->in_window_top >> 16 ) & 0xFF ); 6359 *p++ = (unsigned char)( ( ssl->in_window_top >> 8 ) & 0xFF ); 6360 *p++ = (unsigned char)( ( ssl->in_window_top ) & 0xFF ); 6361 6362 *p++ = (unsigned char)( ( ssl->in_window >> 56 ) & 0xFF ); 6363 *p++ = (unsigned char)( ( ssl->in_window >> 48 ) & 0xFF ); 6364 *p++ = (unsigned char)( ( ssl->in_window >> 40 ) & 0xFF ); 6365 *p++ = (unsigned char)( ( ssl->in_window >> 32 ) & 0xFF ); 6366 *p++ = (unsigned char)( ( ssl->in_window >> 24 ) & 0xFF ); 6367 *p++ = (unsigned char)( ( ssl->in_window >> 16 ) & 0xFF ); 6368 *p++ = (unsigned char)( ( ssl->in_window >> 8 ) & 0xFF ); 6369 *p++ = (unsigned char)( ( ssl->in_window ) & 0xFF ); 6370 } 6371 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */ 6372 6373 #if defined(MBEDTLS_SSL_PROTO_DTLS) 6374 used += 1; 6375 if( used <= buf_len ) 6376 { 6377 *p++ = ssl->disable_datagram_packing; 6378 } 6379 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 6380 6381 used += 8; 6382 if( used <= buf_len ) 6383 { 6384 memcpy( p, ssl->cur_out_ctr, 8 ); 6385 p += 8; 6386 } 6387 6388 #if defined(MBEDTLS_SSL_PROTO_DTLS) 6389 used += 2; 6390 if( used <= buf_len ) 6391 { 6392 *p++ = (unsigned char)( ( ssl->mtu >> 8 ) & 0xFF ); 6393 *p++ = (unsigned char)( ( ssl->mtu ) & 0xFF ); 6394 } 6395 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 6396 6397 #if defined(MBEDTLS_SSL_ALPN) 6398 { 6399 const uint8_t alpn_len = ssl->alpn_chosen 6400 ? (uint8_t) strlen( ssl->alpn_chosen ) 6401 : 0; 6402 6403 used += 1 + alpn_len; 6404 if( used <= buf_len ) 6405 { 6406 *p++ = alpn_len; 6407 6408 if( ssl->alpn_chosen != NULL ) 6409 { 6410 memcpy( p, ssl->alpn_chosen, alpn_len ); 6411 p += alpn_len; 6412 } 6413 } 6414 } 6415 #endif /* MBEDTLS_SSL_ALPN */ 6416 6417 /* 6418 * Done 6419 */ 6420 *olen = used; 6421 6422 if( used > buf_len ) 6423 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); 6424 6425 MBEDTLS_SSL_DEBUG_BUF( 4, "saved context", buf, used ); 6426 6427 return( mbedtls_ssl_session_reset_int( ssl, 0 ) ); 6428 } 6429 6430 /* 6431 * Helper to get TLS 1.2 PRF from ciphersuite 6432 * (Duplicates bits of logic from ssl_set_handshake_prfs().) 6433 */ 6434 typedef int (*tls_prf_fn)( const unsigned char *secret, size_t slen, 6435 const char *label, 6436 const unsigned char *random, size_t rlen, 6437 unsigned char *dstbuf, size_t dlen ); 6438 static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id ) 6439 { 6440 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 6441 const mbedtls_ssl_ciphersuite_t * const ciphersuite_info = 6442 mbedtls_ssl_ciphersuite_from_id( ciphersuite_id ); 6443 6444 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 ) 6445 return( tls_prf_sha384 ); 6446 #else 6447 (void) ciphersuite_id; 6448 #endif 6449 return( tls_prf_sha256 ); 6450 } 6451 6452 /* 6453 * Deserialize context, see mbedtls_ssl_context_save() for format. 6454 * 6455 * This internal version is wrapped by a public function that cleans up in 6456 * case of error. 6457 */ 6458 static int ssl_context_load( mbedtls_ssl_context *ssl, 6459 const unsigned char *buf, 6460 size_t len ) 6461 { 6462 const unsigned char *p = buf; 6463 const unsigned char * const end = buf + len; 6464 size_t session_len; 6465 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 6466 6467 /* 6468 * The context should have been freshly setup or reset. 6469 * Give the user an error in case of obvious misuse. 6470 * (Checking session is useful because it won't be NULL if we're 6471 * renegotiating, or if the user mistakenly loaded a session first.) 6472 */ 6473 if( ssl->state != MBEDTLS_SSL_HELLO_REQUEST || 6474 ssl->session != NULL ) 6475 { 6476 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6477 } 6478 6479 /* 6480 * We can't check that the config matches the initial one, but we can at 6481 * least check it matches the requirements for serializing. 6482 */ 6483 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM || 6484 ssl->conf->max_major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 || 6485 ssl->conf->min_major_ver > MBEDTLS_SSL_MAJOR_VERSION_3 || 6486 ssl->conf->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 || 6487 ssl->conf->min_minor_ver > MBEDTLS_SSL_MINOR_VERSION_3 || 6488 #if defined(MBEDTLS_SSL_RENEGOTIATION) 6489 ssl->conf->disable_renegotiation != MBEDTLS_SSL_RENEGOTIATION_DISABLED || 6490 #endif 6491 0 ) 6492 { 6493 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6494 } 6495 6496 MBEDTLS_SSL_DEBUG_BUF( 4, "context to load", buf, len ); 6497 6498 /* 6499 * Check version identifier 6500 */ 6501 if( (size_t)( end - p ) < sizeof( ssl_serialized_context_header ) ) 6502 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6503 6504 if( memcmp( p, ssl_serialized_context_header, 6505 sizeof( ssl_serialized_context_header ) ) != 0 ) 6506 { 6507 return( MBEDTLS_ERR_SSL_VERSION_MISMATCH ); 6508 } 6509 p += sizeof( ssl_serialized_context_header ); 6510 6511 /* 6512 * Session 6513 */ 6514 if( (size_t)( end - p ) < 4 ) 6515 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6516 6517 session_len = ( (size_t) p[0] << 24 ) | 6518 ( (size_t) p[1] << 16 ) | 6519 ( (size_t) p[2] << 8 ) | 6520 ( (size_t) p[3] ); 6521 p += 4; 6522 6523 /* This has been allocated by ssl_handshake_init(), called by 6524 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */ 6525 ssl->session = ssl->session_negotiate; 6526 ssl->session_in = ssl->session; 6527 ssl->session_out = ssl->session; 6528 ssl->session_negotiate = NULL; 6529 6530 if( (size_t)( end - p ) < session_len ) 6531 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6532 6533 ret = ssl_session_load( ssl->session, 1, p, session_len ); 6534 if( ret != 0 ) 6535 { 6536 mbedtls_ssl_session_free( ssl->session ); 6537 return( ret ); 6538 } 6539 6540 p += session_len; 6541 6542 /* 6543 * Transform 6544 */ 6545 6546 /* This has been allocated by ssl_handshake_init(), called by 6547 * by either mbedtls_ssl_session_reset_int() or mbedtls_ssl_setup(). */ 6548 ssl->transform = ssl->transform_negotiate; 6549 ssl->transform_in = ssl->transform; 6550 ssl->transform_out = ssl->transform; 6551 ssl->transform_negotiate = NULL; 6552 6553 /* Read random bytes and populate structure */ 6554 if( (size_t)( end - p ) < sizeof( ssl->transform->randbytes ) ) 6555 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6556 6557 ret = ssl_populate_transform( ssl->transform, 6558 ssl->session->ciphersuite, 6559 ssl->session->master, 6560 #if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC) 6561 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 6562 ssl->session->encrypt_then_mac, 6563 #endif 6564 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) 6565 ssl->session->trunc_hmac, 6566 #endif 6567 #endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */ 6568 #if defined(MBEDTLS_ZLIB_SUPPORT) 6569 ssl->session->compression, 6570 #endif 6571 ssl_tls12prf_from_cs( ssl->session->ciphersuite ), 6572 p, /* currently pointing to randbytes */ 6573 MBEDTLS_SSL_MINOR_VERSION_3, /* (D)TLS 1.2 is forced */ 6574 ssl->conf->endpoint, 6575 ssl ); 6576 if( ret != 0 ) 6577 return( ret ); 6578 6579 p += sizeof( ssl->transform->randbytes ); 6580 6581 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 6582 /* Read connection IDs and store them */ 6583 if( (size_t)( end - p ) < 1 ) 6584 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6585 6586 ssl->transform->in_cid_len = *p++; 6587 6588 if( (size_t)( end - p ) < ssl->transform->in_cid_len + 1u ) 6589 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6590 6591 memcpy( ssl->transform->in_cid, p, ssl->transform->in_cid_len ); 6592 p += ssl->transform->in_cid_len; 6593 6594 ssl->transform->out_cid_len = *p++; 6595 6596 if( (size_t)( end - p ) < ssl->transform->out_cid_len ) 6597 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6598 6599 memcpy( ssl->transform->out_cid, p, ssl->transform->out_cid_len ); 6600 p += ssl->transform->out_cid_len; 6601 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ 6602 6603 /* 6604 * Saved fields from top-level ssl_context structure 6605 */ 6606 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) 6607 if( (size_t)( end - p ) < 4 ) 6608 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6609 6610 ssl->badmac_seen = ( (uint32_t) p[0] << 24 ) | 6611 ( (uint32_t) p[1] << 16 ) | 6612 ( (uint32_t) p[2] << 8 ) | 6613 ( (uint32_t) p[3] ); 6614 p += 4; 6615 #endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */ 6616 6617 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) 6618 if( (size_t)( end - p ) < 16 ) 6619 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6620 6621 ssl->in_window_top = ( (uint64_t) p[0] << 56 ) | 6622 ( (uint64_t) p[1] << 48 ) | 6623 ( (uint64_t) p[2] << 40 ) | 6624 ( (uint64_t) p[3] << 32 ) | 6625 ( (uint64_t) p[4] << 24 ) | 6626 ( (uint64_t) p[5] << 16 ) | 6627 ( (uint64_t) p[6] << 8 ) | 6628 ( (uint64_t) p[7] ); 6629 p += 8; 6630 6631 ssl->in_window = ( (uint64_t) p[0] << 56 ) | 6632 ( (uint64_t) p[1] << 48 ) | 6633 ( (uint64_t) p[2] << 40 ) | 6634 ( (uint64_t) p[3] << 32 ) | 6635 ( (uint64_t) p[4] << 24 ) | 6636 ( (uint64_t) p[5] << 16 ) | 6637 ( (uint64_t) p[6] << 8 ) | 6638 ( (uint64_t) p[7] ); 6639 p += 8; 6640 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */ 6641 6642 #if defined(MBEDTLS_SSL_PROTO_DTLS) 6643 if( (size_t)( end - p ) < 1 ) 6644 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6645 6646 ssl->disable_datagram_packing = *p++; 6647 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 6648 6649 if( (size_t)( end - p ) < 8 ) 6650 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6651 6652 memcpy( ssl->cur_out_ctr, p, 8 ); 6653 p += 8; 6654 6655 #if defined(MBEDTLS_SSL_PROTO_DTLS) 6656 if( (size_t)( end - p ) < 2 ) 6657 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6658 6659 ssl->mtu = ( p[0] << 8 ) | p[1]; 6660 p += 2; 6661 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 6662 6663 #if defined(MBEDTLS_SSL_ALPN) 6664 { 6665 uint8_t alpn_len; 6666 const char **cur; 6667 6668 if( (size_t)( end - p ) < 1 ) 6669 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6670 6671 alpn_len = *p++; 6672 6673 if( alpn_len != 0 && ssl->conf->alpn_list != NULL ) 6674 { 6675 /* alpn_chosen should point to an item in the configured list */ 6676 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ ) 6677 { 6678 if( strlen( *cur ) == alpn_len && 6679 memcmp( p, cur, alpn_len ) == 0 ) 6680 { 6681 ssl->alpn_chosen = *cur; 6682 break; 6683 } 6684 } 6685 } 6686 6687 /* can only happen on conf mismatch */ 6688 if( alpn_len != 0 && ssl->alpn_chosen == NULL ) 6689 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6690 6691 p += alpn_len; 6692 } 6693 #endif /* MBEDTLS_SSL_ALPN */ 6694 6695 /* 6696 * Forced fields from top-level ssl_context structure 6697 * 6698 * Most of them already set to the correct value by mbedtls_ssl_init() and 6699 * mbedtls_ssl_reset(), so we only need to set the remaining ones. 6700 */ 6701 ssl->state = MBEDTLS_SSL_HANDSHAKE_OVER; 6702 6703 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3; 6704 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; 6705 6706 /* Adjust pointers for header fields of outgoing records to 6707 * the given transform, accounting for explicit IV and CID. */ 6708 mbedtls_ssl_update_out_pointers( ssl, ssl->transform ); 6709 6710 #if defined(MBEDTLS_SSL_PROTO_DTLS) 6711 ssl->in_epoch = 1; 6712 #endif 6713 6714 /* mbedtls_ssl_reset() leaves the handshake sub-structure allocated, 6715 * which we don't want - otherwise we'd end up freeing the wrong transform 6716 * by calling mbedtls_ssl_handshake_wrapup_free_hs_transform() 6717 * inappropriately. */ 6718 if( ssl->handshake != NULL ) 6719 { 6720 mbedtls_ssl_handshake_free( ssl ); 6721 mbedtls_free( ssl->handshake ); 6722 ssl->handshake = NULL; 6723 } 6724 6725 /* 6726 * Done - should have consumed entire buffer 6727 */ 6728 if( p != end ) 6729 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 6730 6731 return( 0 ); 6732 } 6733 6734 /* 6735 * Deserialize context: public wrapper for error cleaning 6736 */ 6737 int mbedtls_ssl_context_load( mbedtls_ssl_context *context, 6738 const unsigned char *buf, 6739 size_t len ) 6740 { 6741 int ret = ssl_context_load( context, buf, len ); 6742 6743 if( ret != 0 ) 6744 mbedtls_ssl_free( context ); 6745 6746 return( ret ); 6747 } 6748 #endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */ 6749 6750 /* 6751 * Free an SSL context 6752 */ 6753 void mbedtls_ssl_free( mbedtls_ssl_context *ssl ) 6754 { 6755 if( ssl == NULL ) 6756 return; 6757 6758 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) ); 6759 6760 if( ssl->out_buf != NULL ) 6761 { 6762 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) 6763 size_t out_buf_len = ssl->out_buf_len; 6764 #else 6765 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN; 6766 #endif 6767 6768 mbedtls_platform_zeroize( ssl->out_buf, out_buf_len ); 6769 mbedtls_free( ssl->out_buf ); 6770 ssl->out_buf = NULL; 6771 } 6772 6773 if( ssl->in_buf != NULL ) 6774 { 6775 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) 6776 size_t in_buf_len = ssl->in_buf_len; 6777 #else 6778 size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN; 6779 #endif 6780 6781 mbedtls_platform_zeroize( ssl->in_buf, in_buf_len ); 6782 mbedtls_free( ssl->in_buf ); 6783 ssl->in_buf = NULL; 6784 } 6785 6786 #if defined(MBEDTLS_ZLIB_SUPPORT) 6787 if( ssl->compress_buf != NULL ) 6788 { 6789 mbedtls_platform_zeroize( ssl->compress_buf, MBEDTLS_SSL_COMPRESS_BUFFER_LEN ); 6790 mbedtls_free( ssl->compress_buf ); 6791 } 6792 #endif 6793 6794 if( ssl->transform ) 6795 { 6796 mbedtls_ssl_transform_free( ssl->transform ); 6797 mbedtls_free( ssl->transform ); 6798 } 6799 6800 if( ssl->handshake ) 6801 { 6802 mbedtls_ssl_handshake_free( ssl ); 6803 mbedtls_ssl_transform_free( ssl->transform_negotiate ); 6804 mbedtls_ssl_session_free( ssl->session_negotiate ); 6805 6806 mbedtls_free( ssl->handshake ); 6807 mbedtls_free( ssl->transform_negotiate ); 6808 mbedtls_free( ssl->session_negotiate ); 6809 } 6810 6811 if( ssl->session ) 6812 { 6813 mbedtls_ssl_session_free( ssl->session ); 6814 mbedtls_free( ssl->session ); 6815 } 6816 6817 #if defined(MBEDTLS_X509_CRT_PARSE_C) 6818 if( ssl->hostname != NULL ) 6819 { 6820 mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) ); 6821 mbedtls_free( ssl->hostname ); 6822 } 6823 #endif 6824 6825 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) 6826 if( mbedtls_ssl_hw_record_finish != NULL ) 6827 { 6828 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) ); 6829 mbedtls_ssl_hw_record_finish( ssl ); 6830 } 6831 #endif 6832 6833 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) 6834 mbedtls_free( ssl->cli_id ); 6835 #endif 6836 6837 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) ); 6838 6839 /* Actually clear after last debug message */ 6840 mbedtls_platform_zeroize( ssl, sizeof( mbedtls_ssl_context ) ); 6841 } 6842 6843 /* 6844 * Initialze mbedtls_ssl_config 6845 */ 6846 void mbedtls_ssl_config_init( mbedtls_ssl_config *conf ) 6847 { 6848 memset( conf, 0, sizeof( mbedtls_ssl_config ) ); 6849 } 6850 6851 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 6852 static int ssl_preset_default_hashes[] = { 6853 #if defined(MBEDTLS_SHA512_C) 6854 MBEDTLS_MD_SHA512, 6855 #endif 6856 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 6857 MBEDTLS_MD_SHA384, 6858 #endif 6859 #if defined(MBEDTLS_SHA256_C) 6860 MBEDTLS_MD_SHA256, 6861 MBEDTLS_MD_SHA224, 6862 #endif 6863 #if defined(MBEDTLS_SHA1_C) && defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE) 6864 MBEDTLS_MD_SHA1, 6865 #endif 6866 MBEDTLS_MD_NONE 6867 }; 6868 #endif 6869 6870 static int ssl_preset_suiteb_ciphersuites[] = { 6871 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 6872 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, 6873 0 6874 }; 6875 6876 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 6877 static int ssl_preset_suiteb_hashes[] = { 6878 MBEDTLS_MD_SHA256, 6879 MBEDTLS_MD_SHA384, 6880 MBEDTLS_MD_NONE 6881 }; 6882 #endif 6883 6884 #if defined(MBEDTLS_ECP_C) 6885 static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = { 6886 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) 6887 MBEDTLS_ECP_DP_SECP256R1, 6888 #endif 6889 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) 6890 MBEDTLS_ECP_DP_SECP384R1, 6891 #endif 6892 MBEDTLS_ECP_DP_NONE 6893 }; 6894 #endif 6895 6896 /* 6897 * Load default in mbedtls_ssl_config 6898 */ 6899 int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf, 6900 int endpoint, int transport, int preset ) 6901 { 6902 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C) 6903 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 6904 #endif 6905 6906 /* Use the functions here so that they are covered in tests, 6907 * but otherwise access member directly for efficiency */ 6908 mbedtls_ssl_conf_endpoint( conf, endpoint ); 6909 mbedtls_ssl_conf_transport( conf, transport ); 6910 6911 /* 6912 * Things that are common to all presets 6913 */ 6914 #if defined(MBEDTLS_SSL_CLI_C) 6915 if( endpoint == MBEDTLS_SSL_IS_CLIENT ) 6916 { 6917 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED; 6918 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 6919 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED; 6920 #endif 6921 } 6922 #endif 6923 6924 #if defined(MBEDTLS_ARC4_C) 6925 conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED; 6926 #endif 6927 6928 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 6929 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED; 6930 #endif 6931 6932 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 6933 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; 6934 #endif 6935 6936 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) 6937 conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED; 6938 #endif 6939 6940 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) 6941 conf->f_cookie_write = ssl_cookie_write_dummy; 6942 conf->f_cookie_check = ssl_cookie_check_dummy; 6943 #endif 6944 6945 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) 6946 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED; 6947 #endif 6948 6949 #if defined(MBEDTLS_SSL_SRV_C) 6950 conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED; 6951 #endif 6952 6953 #if defined(MBEDTLS_SSL_PROTO_DTLS) 6954 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN; 6955 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX; 6956 #endif 6957 6958 #if defined(MBEDTLS_SSL_RENEGOTIATION) 6959 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT; 6960 memset( conf->renego_period, 0x00, 2 ); 6961 memset( conf->renego_period + 2, 0xFF, 6 ); 6962 #endif 6963 6964 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C) 6965 if( endpoint == MBEDTLS_SSL_IS_SERVER ) 6966 { 6967 const unsigned char dhm_p[] = 6968 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN; 6969 const unsigned char dhm_g[] = 6970 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN; 6971 6972 if ( ( ret = mbedtls_ssl_conf_dh_param_bin( conf, 6973 dhm_p, sizeof( dhm_p ), 6974 dhm_g, sizeof( dhm_g ) ) ) != 0 ) 6975 { 6976 return( ret ); 6977 } 6978 } 6979 #endif 6980 6981 /* 6982 * Preset-specific defaults 6983 */ 6984 switch( preset ) 6985 { 6986 /* 6987 * NSA Suite B 6988 */ 6989 case MBEDTLS_SSL_PRESET_SUITEB: 6990 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3; 6991 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */ 6992 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION; 6993 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION; 6994 6995 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = 6996 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = 6997 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = 6998 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = 6999 ssl_preset_suiteb_ciphersuites; 7000 7001 #if defined(MBEDTLS_X509_CRT_PARSE_C) 7002 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb; 7003 #endif 7004 7005 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 7006 conf->sig_hashes = ssl_preset_suiteb_hashes; 7007 #endif 7008 7009 #if defined(MBEDTLS_ECP_C) 7010 conf->curve_list = ssl_preset_suiteb_curves; 7011 #endif 7012 break; 7013 7014 /* 7015 * Default 7016 */ 7017 default: 7018 conf->min_major_ver = ( MBEDTLS_SSL_MIN_MAJOR_VERSION > 7019 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION ) ? 7020 MBEDTLS_SSL_MIN_MAJOR_VERSION : 7021 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION; 7022 conf->min_minor_ver = ( MBEDTLS_SSL_MIN_MINOR_VERSION > 7023 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION ) ? 7024 MBEDTLS_SSL_MIN_MINOR_VERSION : 7025 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION; 7026 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION; 7027 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION; 7028 7029 #if defined(MBEDTLS_SSL_PROTO_DTLS) 7030 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 7031 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2; 7032 #endif 7033 7034 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = 7035 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = 7036 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = 7037 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = 7038 mbedtls_ssl_list_ciphersuites(); 7039 7040 #if defined(MBEDTLS_X509_CRT_PARSE_C) 7041 conf->cert_profile = &mbedtls_x509_crt_profile_default; 7042 #endif 7043 7044 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 7045 conf->sig_hashes = ssl_preset_default_hashes; 7046 #endif 7047 7048 #if defined(MBEDTLS_ECP_C) 7049 conf->curve_list = mbedtls_ecp_grp_id_list(); 7050 #endif 7051 7052 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C) 7053 conf->dhm_min_bitlen = 1024; 7054 #endif 7055 } 7056 7057 return( 0 ); 7058 } 7059 7060 /* 7061 * Free mbedtls_ssl_config 7062 */ 7063 void mbedtls_ssl_config_free( mbedtls_ssl_config *conf ) 7064 { 7065 #if defined(MBEDTLS_DHM_C) 7066 mbedtls_mpi_free( &conf->dhm_P ); 7067 mbedtls_mpi_free( &conf->dhm_G ); 7068 #endif 7069 7070 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) 7071 if( conf->psk != NULL ) 7072 { 7073 mbedtls_platform_zeroize( conf->psk, conf->psk_len ); 7074 mbedtls_free( conf->psk ); 7075 conf->psk = NULL; 7076 conf->psk_len = 0; 7077 } 7078 7079 if( conf->psk_identity != NULL ) 7080 { 7081 mbedtls_platform_zeroize( conf->psk_identity, conf->psk_identity_len ); 7082 mbedtls_free( conf->psk_identity ); 7083 conf->psk_identity = NULL; 7084 conf->psk_identity_len = 0; 7085 } 7086 #endif 7087 7088 #if defined(MBEDTLS_X509_CRT_PARSE_C) 7089 ssl_key_cert_free( conf->key_cert ); 7090 #endif 7091 7092 mbedtls_platform_zeroize( conf, sizeof( mbedtls_ssl_config ) ); 7093 } 7094 7095 #if defined(MBEDTLS_PK_C) && \ 7096 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) ) 7097 /* 7098 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX 7099 */ 7100 unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk ) 7101 { 7102 #if defined(MBEDTLS_RSA_C) 7103 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) ) 7104 return( MBEDTLS_SSL_SIG_RSA ); 7105 #endif 7106 #if defined(MBEDTLS_ECDSA_C) 7107 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) ) 7108 return( MBEDTLS_SSL_SIG_ECDSA ); 7109 #endif 7110 return( MBEDTLS_SSL_SIG_ANON ); 7111 } 7112 7113 unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type ) 7114 { 7115 switch( type ) { 7116 case MBEDTLS_PK_RSA: 7117 return( MBEDTLS_SSL_SIG_RSA ); 7118 case MBEDTLS_PK_ECDSA: 7119 case MBEDTLS_PK_ECKEY: 7120 return( MBEDTLS_SSL_SIG_ECDSA ); 7121 default: 7122 return( MBEDTLS_SSL_SIG_ANON ); 7123 } 7124 } 7125 7126 mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig ) 7127 { 7128 switch( sig ) 7129 { 7130 #if defined(MBEDTLS_RSA_C) 7131 case MBEDTLS_SSL_SIG_RSA: 7132 return( MBEDTLS_PK_RSA ); 7133 #endif 7134 #if defined(MBEDTLS_ECDSA_C) 7135 case MBEDTLS_SSL_SIG_ECDSA: 7136 return( MBEDTLS_PK_ECDSA ); 7137 #endif 7138 default: 7139 return( MBEDTLS_PK_NONE ); 7140 } 7141 } 7142 #endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */ 7143 7144 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ 7145 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 7146 7147 /* Find an entry in a signature-hash set matching a given hash algorithm. */ 7148 mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set, 7149 mbedtls_pk_type_t sig_alg ) 7150 { 7151 switch( sig_alg ) 7152 { 7153 case MBEDTLS_PK_RSA: 7154 return( set->rsa ); 7155 case MBEDTLS_PK_ECDSA: 7156 return( set->ecdsa ); 7157 default: 7158 return( MBEDTLS_MD_NONE ); 7159 } 7160 } 7161 7162 /* Add a signature-hash-pair to a signature-hash set */ 7163 void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set, 7164 mbedtls_pk_type_t sig_alg, 7165 mbedtls_md_type_t md_alg ) 7166 { 7167 switch( sig_alg ) 7168 { 7169 case MBEDTLS_PK_RSA: 7170 if( set->rsa == MBEDTLS_MD_NONE ) 7171 set->rsa = md_alg; 7172 break; 7173 7174 case MBEDTLS_PK_ECDSA: 7175 if( set->ecdsa == MBEDTLS_MD_NONE ) 7176 set->ecdsa = md_alg; 7177 break; 7178 7179 default: 7180 break; 7181 } 7182 } 7183 7184 /* Allow exactly one hash algorithm for each signature. */ 7185 void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set, 7186 mbedtls_md_type_t md_alg ) 7187 { 7188 set->rsa = md_alg; 7189 set->ecdsa = md_alg; 7190 } 7191 7192 #endif /* MBEDTLS_SSL_PROTO_TLS1_2) && 7193 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 7194 7195 /* 7196 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX 7197 */ 7198 mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash ) 7199 { 7200 switch( hash ) 7201 { 7202 #if defined(MBEDTLS_MD5_C) 7203 case MBEDTLS_SSL_HASH_MD5: 7204 return( MBEDTLS_MD_MD5 ); 7205 #endif 7206 #if defined(MBEDTLS_SHA1_C) 7207 case MBEDTLS_SSL_HASH_SHA1: 7208 return( MBEDTLS_MD_SHA1 ); 7209 #endif 7210 #if defined(MBEDTLS_SHA256_C) 7211 case MBEDTLS_SSL_HASH_SHA224: 7212 return( MBEDTLS_MD_SHA224 ); 7213 case MBEDTLS_SSL_HASH_SHA256: 7214 return( MBEDTLS_MD_SHA256 ); 7215 #endif 7216 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 7217 case MBEDTLS_SSL_HASH_SHA384: 7218 return( MBEDTLS_MD_SHA384 ); 7219 #endif 7220 #if defined(MBEDTLS_SHA512_C) 7221 case MBEDTLS_SSL_HASH_SHA512: 7222 return( MBEDTLS_MD_SHA512 ); 7223 #endif 7224 default: 7225 return( MBEDTLS_MD_NONE ); 7226 } 7227 } 7228 7229 /* 7230 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX 7231 */ 7232 unsigned char mbedtls_ssl_hash_from_md_alg( int md ) 7233 { 7234 switch( md ) 7235 { 7236 #if defined(MBEDTLS_MD5_C) 7237 case MBEDTLS_MD_MD5: 7238 return( MBEDTLS_SSL_HASH_MD5 ); 7239 #endif 7240 #if defined(MBEDTLS_SHA1_C) 7241 case MBEDTLS_MD_SHA1: 7242 return( MBEDTLS_SSL_HASH_SHA1 ); 7243 #endif 7244 #if defined(MBEDTLS_SHA256_C) 7245 case MBEDTLS_MD_SHA224: 7246 return( MBEDTLS_SSL_HASH_SHA224 ); 7247 case MBEDTLS_MD_SHA256: 7248 return( MBEDTLS_SSL_HASH_SHA256 ); 7249 #endif 7250 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 7251 case MBEDTLS_MD_SHA384: 7252 return( MBEDTLS_SSL_HASH_SHA384 ); 7253 #endif 7254 #if defined(MBEDTLS_SHA512_C) 7255 case MBEDTLS_MD_SHA512: 7256 return( MBEDTLS_SSL_HASH_SHA512 ); 7257 #endif 7258 default: 7259 return( MBEDTLS_SSL_HASH_NONE ); 7260 } 7261 } 7262 7263 #if defined(MBEDTLS_ECP_C) 7264 /* 7265 * Check if a curve proposed by the peer is in our list. 7266 * Return 0 if we're willing to use it, -1 otherwise. 7267 */ 7268 int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id ) 7269 { 7270 const mbedtls_ecp_group_id *gid; 7271 7272 if( ssl->conf->curve_list == NULL ) 7273 return( -1 ); 7274 7275 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ ) 7276 if( *gid == grp_id ) 7277 return( 0 ); 7278 7279 return( -1 ); 7280 } 7281 #endif /* MBEDTLS_ECP_C */ 7282 7283 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 7284 /* 7285 * Check if a hash proposed by the peer is in our list. 7286 * Return 0 if we're willing to use it, -1 otherwise. 7287 */ 7288 int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl, 7289 mbedtls_md_type_t md ) 7290 { 7291 const int *cur; 7292 7293 if( ssl->conf->sig_hashes == NULL ) 7294 return( -1 ); 7295 7296 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ ) 7297 if( *cur == (int) md ) 7298 return( 0 ); 7299 7300 return( -1 ); 7301 } 7302 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 7303 7304 #if defined(MBEDTLS_X509_CRT_PARSE_C) 7305 int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert, 7306 const mbedtls_ssl_ciphersuite_t *ciphersuite, 7307 int cert_endpoint, 7308 uint32_t *flags ) 7309 { 7310 int ret = 0; 7311 #if defined(MBEDTLS_X509_CHECK_KEY_USAGE) 7312 int usage = 0; 7313 #endif 7314 #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE) 7315 const char *ext_oid; 7316 size_t ext_len; 7317 #endif 7318 7319 #if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \ 7320 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE) 7321 ((void) cert); 7322 ((void) cert_endpoint); 7323 ((void) flags); 7324 #endif 7325 7326 #if defined(MBEDTLS_X509_CHECK_KEY_USAGE) 7327 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER ) 7328 { 7329 /* Server part of the key exchange */ 7330 switch( ciphersuite->key_exchange ) 7331 { 7332 case MBEDTLS_KEY_EXCHANGE_RSA: 7333 case MBEDTLS_KEY_EXCHANGE_RSA_PSK: 7334 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT; 7335 break; 7336 7337 case MBEDTLS_KEY_EXCHANGE_DHE_RSA: 7338 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: 7339 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: 7340 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE; 7341 break; 7342 7343 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: 7344 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: 7345 usage = MBEDTLS_X509_KU_KEY_AGREEMENT; 7346 break; 7347 7348 /* Don't use default: we want warnings when adding new values */ 7349 case MBEDTLS_KEY_EXCHANGE_NONE: 7350 case MBEDTLS_KEY_EXCHANGE_PSK: 7351 case MBEDTLS_KEY_EXCHANGE_DHE_PSK: 7352 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: 7353 case MBEDTLS_KEY_EXCHANGE_ECJPAKE: 7354 usage = 0; 7355 } 7356 } 7357 else 7358 { 7359 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */ 7360 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE; 7361 } 7362 7363 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 ) 7364 { 7365 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE; 7366 ret = -1; 7367 } 7368 #else 7369 ((void) ciphersuite); 7370 #endif /* MBEDTLS_X509_CHECK_KEY_USAGE */ 7371 7372 #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE) 7373 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER ) 7374 { 7375 ext_oid = MBEDTLS_OID_SERVER_AUTH; 7376 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH ); 7377 } 7378 else 7379 { 7380 ext_oid = MBEDTLS_OID_CLIENT_AUTH; 7381 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH ); 7382 } 7383 7384 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 ) 7385 { 7386 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE; 7387 ret = -1; 7388 } 7389 #endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */ 7390 7391 return( ret ); 7392 } 7393 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 7394 7395 int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md ) 7396 { 7397 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 7398 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 ) 7399 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH; 7400 7401 switch( md ) 7402 { 7403 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) 7404 #if defined(MBEDTLS_MD5_C) 7405 case MBEDTLS_SSL_HASH_MD5: 7406 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH; 7407 #endif 7408 #if defined(MBEDTLS_SHA1_C) 7409 case MBEDTLS_SSL_HASH_SHA1: 7410 ssl->handshake->calc_verify = ssl_calc_verify_tls; 7411 break; 7412 #endif 7413 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */ 7414 #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_SHA512_NO_SHA384) 7415 case MBEDTLS_SSL_HASH_SHA384: 7416 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384; 7417 break; 7418 #endif 7419 #if defined(MBEDTLS_SHA256_C) 7420 case MBEDTLS_SSL_HASH_SHA256: 7421 ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256; 7422 break; 7423 #endif 7424 default: 7425 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH; 7426 } 7427 7428 return 0; 7429 #else /* !MBEDTLS_SSL_PROTO_TLS1_2 */ 7430 (void) ssl; 7431 (void) md; 7432 7433 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH; 7434 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 7435 } 7436 7437 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ 7438 defined(MBEDTLS_SSL_PROTO_TLS1_1) 7439 int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl, 7440 unsigned char *output, 7441 unsigned char *data, size_t data_len ) 7442 { 7443 int ret = 0; 7444 mbedtls_md5_context mbedtls_md5; 7445 mbedtls_sha1_context mbedtls_sha1; 7446 7447 mbedtls_md5_init( &mbedtls_md5 ); 7448 mbedtls_sha1_init( &mbedtls_sha1 ); 7449 7450 /* 7451 * digitally-signed struct { 7452 * opaque md5_hash[16]; 7453 * opaque sha_hash[20]; 7454 * }; 7455 * 7456 * md5_hash 7457 * MD5(ClientHello.random + ServerHello.random 7458 * + ServerParams); 7459 * sha_hash 7460 * SHA(ClientHello.random + ServerHello.random 7461 * + ServerParams); 7462 */ 7463 if( ( ret = mbedtls_md5_starts_ret( &mbedtls_md5 ) ) != 0 ) 7464 { 7465 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_starts_ret", ret ); 7466 goto exit; 7467 } 7468 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5, 7469 ssl->handshake->randbytes, 64 ) ) != 0 ) 7470 { 7471 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret ); 7472 goto exit; 7473 } 7474 if( ( ret = mbedtls_md5_update_ret( &mbedtls_md5, data, data_len ) ) != 0 ) 7475 { 7476 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret ); 7477 goto exit; 7478 } 7479 if( ( ret = mbedtls_md5_finish_ret( &mbedtls_md5, output ) ) != 0 ) 7480 { 7481 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_finish_ret", ret ); 7482 goto exit; 7483 } 7484 7485 if( ( ret = mbedtls_sha1_starts_ret( &mbedtls_sha1 ) ) != 0 ) 7486 { 7487 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_starts_ret", ret ); 7488 goto exit; 7489 } 7490 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1, 7491 ssl->handshake->randbytes, 64 ) ) != 0 ) 7492 { 7493 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret ); 7494 goto exit; 7495 } 7496 if( ( ret = mbedtls_sha1_update_ret( &mbedtls_sha1, data, 7497 data_len ) ) != 0 ) 7498 { 7499 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret ); 7500 goto exit; 7501 } 7502 if( ( ret = mbedtls_sha1_finish_ret( &mbedtls_sha1, 7503 output + 16 ) ) != 0 ) 7504 { 7505 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_finish_ret", ret ); 7506 goto exit; 7507 } 7508 7509 exit: 7510 mbedtls_md5_free( &mbedtls_md5 ); 7511 mbedtls_sha1_free( &mbedtls_sha1 ); 7512 7513 if( ret != 0 ) 7514 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 7515 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR ); 7516 7517 return( ret ); 7518 7519 } 7520 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \ 7521 MBEDTLS_SSL_PROTO_TLS1_1 */ 7522 7523 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ 7524 defined(MBEDTLS_SSL_PROTO_TLS1_2) 7525 7526 #if defined(MBEDTLS_USE_PSA_CRYPTO) 7527 int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl, 7528 unsigned char *hash, size_t *hashlen, 7529 unsigned char *data, size_t data_len, 7530 mbedtls_md_type_t md_alg ) 7531 { 7532 psa_status_t status; 7533 psa_hash_operation_t hash_operation = PSA_HASH_OPERATION_INIT; 7534 psa_algorithm_t hash_alg = mbedtls_psa_translate_md( md_alg ); 7535 7536 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform PSA-based computation of digest of ServerKeyExchange" ) ); 7537 7538 if( ( status = psa_hash_setup( &hash_operation, 7539 hash_alg ) ) != PSA_SUCCESS ) 7540 { 7541 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_setup", status ); 7542 goto exit; 7543 } 7544 7545 if( ( status = psa_hash_update( &hash_operation, ssl->handshake->randbytes, 7546 64 ) ) != PSA_SUCCESS ) 7547 { 7548 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status ); 7549 goto exit; 7550 } 7551 7552 if( ( status = psa_hash_update( &hash_operation, 7553 data, data_len ) ) != PSA_SUCCESS ) 7554 { 7555 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_update", status ); 7556 goto exit; 7557 } 7558 7559 if( ( status = psa_hash_finish( &hash_operation, hash, MBEDTLS_MD_MAX_SIZE, 7560 hashlen ) ) != PSA_SUCCESS ) 7561 { 7562 MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status ); 7563 goto exit; 7564 } 7565 7566 exit: 7567 if( status != PSA_SUCCESS ) 7568 { 7569 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 7570 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR ); 7571 switch( status ) 7572 { 7573 case PSA_ERROR_NOT_SUPPORTED: 7574 return( MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE ); 7575 case PSA_ERROR_BAD_STATE: /* Intentional fallthrough */ 7576 case PSA_ERROR_BUFFER_TOO_SMALL: 7577 return( MBEDTLS_ERR_MD_BAD_INPUT_DATA ); 7578 case PSA_ERROR_INSUFFICIENT_MEMORY: 7579 return( MBEDTLS_ERR_MD_ALLOC_FAILED ); 7580 default: 7581 return( MBEDTLS_ERR_MD_HW_ACCEL_FAILED ); 7582 } 7583 } 7584 return( 0 ); 7585 } 7586 7587 #else 7588 7589 int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl, 7590 unsigned char *hash, size_t *hashlen, 7591 unsigned char *data, size_t data_len, 7592 mbedtls_md_type_t md_alg ) 7593 { 7594 int ret = 0; 7595 mbedtls_md_context_t ctx; 7596 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg ); 7597 *hashlen = mbedtls_md_get_size( md_info ); 7598 7599 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Perform mbedtls-based computation of digest of ServerKeyExchange" ) ); 7600 7601 mbedtls_md_init( &ctx ); 7602 7603 /* 7604 * digitally-signed struct { 7605 * opaque client_random[32]; 7606 * opaque server_random[32]; 7607 * ServerDHParams params; 7608 * }; 7609 */ 7610 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 ) 7611 { 7612 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret ); 7613 goto exit; 7614 } 7615 if( ( ret = mbedtls_md_starts( &ctx ) ) != 0 ) 7616 { 7617 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret ); 7618 goto exit; 7619 } 7620 if( ( ret = mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ) ) != 0 ) 7621 { 7622 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret ); 7623 goto exit; 7624 } 7625 if( ( ret = mbedtls_md_update( &ctx, data, data_len ) ) != 0 ) 7626 { 7627 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret ); 7628 goto exit; 7629 } 7630 if( ( ret = mbedtls_md_finish( &ctx, hash ) ) != 0 ) 7631 { 7632 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret ); 7633 goto exit; 7634 } 7635 7636 exit: 7637 mbedtls_md_free( &ctx ); 7638 7639 if( ret != 0 ) 7640 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 7641 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR ); 7642 7643 return( ret ); 7644 } 7645 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 7646 7647 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \ 7648 MBEDTLS_SSL_PROTO_TLS1_2 */ 7649 7650 #endif /* MBEDTLS_SSL_TLS_C */ 7651