2 * SSLv3/TLSv1 shared functions
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
7 * This file is provided under the Apache License 2.0, or the
8 * GNU General Public License v2.0 or later.
13 * Licensed under the Apache License, Version 2.0 (the "License"); you may
14 * not use this file except in compliance with the License.
15 * You may obtain a copy of the License at
17 * http://www.apache.org/licenses/LICENSE-2.0
19 * Unless required by applicable law or agreed to in writing, software
20 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
21 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
22 * See the License for the specific language governing permissions and
23 * limitations under the License.
28 * GNU General Public License v2.0 or later:
30 * This program is free software; you can redistribute it and/or modify
31 * it under the terms of the GNU General Public License as published by
32 * the Free Software Foundation; either version 2 of the License, or
33 * (at your option) any later version.
35 * This program is distributed in the hope that it will be useful,
36 * but WITHOUT ANY WARRANTY; without even the implied warranty of
37 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
38 * GNU General Public License for more details.
40 * You should have received a copy of the GNU General Public License along
41 * with this program; if not, write to the Free Software Foundation, Inc.,
42 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
47 * The SSL 3.0 specification was drafted by Netscape in 1996,
48 * and became an IETF standard in 1999.
50 * http://wp.netscape.com/eng/ssl3/
51 * http://www.ietf.org/rfc/rfc2246.txt
52 * http://www.ietf.org/rfc/rfc4346.txt
55 #if !defined(MBEDTLS_CONFIG_FILE)
56 #include "mbedtls/config.h"
58 #include MBEDTLS_CONFIG_FILE
61 #if defined(MBEDTLS_SSL_TLS_C)
63 #if defined(MBEDTLS_PLATFORM_C)
64 #include "mbedtls/platform.h"
67 #define mbedtls_calloc calloc
68 #define mbedtls_free free
71 #include "mbedtls/debug.h"
72 #include "mbedtls/ssl.h"
73 #include "mbedtls/ssl_internal.h"
74 #include "mbedtls/platform_util.h"
78 #if defined(MBEDTLS_X509_CRT_PARSE_C)
79 #include "mbedtls/oid.h"
82 static void ssl_reset_in_out_pointers( mbedtls_ssl_context
*ssl
);
83 static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context
const *ssl
);
85 /* Length of the "epoch" field in the record header */
86 static inline size_t ssl_ep_len( const mbedtls_ssl_context
*ssl
)
88 #if defined(MBEDTLS_SSL_PROTO_DTLS)
89 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
99 * Passing millisecs = 0 cancels a running timer.
101 static void ssl_set_timer( mbedtls_ssl_context
*ssl
, uint32_t millisecs
)
103 if( ssl
->f_set_timer
== NULL
)
106 MBEDTLS_SSL_DEBUG_MSG( 3, ( "set_timer to %d ms", (int) millisecs
) );
107 ssl
->f_set_timer( ssl
->p_timer
, millisecs
/ 4, millisecs
);
111 * Return -1 is timer is expired, 0 if it isn't.
113 static int ssl_check_timer( mbedtls_ssl_context
*ssl
)
115 if( ssl
->f_get_timer
== NULL
)
118 if( ssl
->f_get_timer( ssl
->p_timer
) == 2 )
120 MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) );
127 static void ssl_update_out_pointers( mbedtls_ssl_context
*ssl
,
128 mbedtls_ssl_transform
*transform
);
129 static void ssl_update_in_pointers( mbedtls_ssl_context
*ssl
,
130 mbedtls_ssl_transform
*transform
);
132 #define SSL_DONT_FORCE_FLUSH 0
133 #define SSL_FORCE_FLUSH 1
135 #if defined(MBEDTLS_SSL_PROTO_DTLS)
137 /* Forward declarations for functions related to message buffering. */
138 static void ssl_buffering_free( mbedtls_ssl_context
*ssl
);
139 static void ssl_buffering_free_slot( mbedtls_ssl_context
*ssl
,
141 static void ssl_free_buffered_record( mbedtls_ssl_context
*ssl
);
142 static int ssl_load_buffered_message( mbedtls_ssl_context
*ssl
);
143 static int ssl_load_buffered_record( mbedtls_ssl_context
*ssl
);
144 static int ssl_buffer_message( mbedtls_ssl_context
*ssl
);
145 static int ssl_buffer_future_record( mbedtls_ssl_context
*ssl
);
146 static int ssl_next_record_is_in_datagram( mbedtls_ssl_context
*ssl
);
148 static size_t ssl_get_current_mtu( const mbedtls_ssl_context
*ssl
);
149 static size_t ssl_get_maximum_datagram_size( mbedtls_ssl_context
const *ssl
)
151 size_t mtu
= ssl_get_current_mtu( ssl
);
153 if( mtu
!= 0 && mtu
< MBEDTLS_SSL_OUT_BUFFER_LEN
)
156 return( MBEDTLS_SSL_OUT_BUFFER_LEN
);
159 static int ssl_get_remaining_space_in_datagram( mbedtls_ssl_context
const *ssl
)
161 size_t const bytes_written
= ssl
->out_left
;
162 size_t const mtu
= ssl_get_maximum_datagram_size( ssl
);
164 /* Double-check that the write-index hasn't gone
165 * past what we can transmit in a single datagram. */
166 if( bytes_written
> mtu
)
168 /* Should never happen... */
169 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
172 return( (int) ( mtu
- bytes_written
) );
175 static int ssl_get_remaining_payload_in_datagram( mbedtls_ssl_context
const *ssl
)
178 size_t remaining
, expansion
;
179 size_t max_len
= MBEDTLS_SSL_OUT_CONTENT_LEN
;
181 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
182 const size_t mfl
= mbedtls_ssl_get_max_frag_len( ssl
);
187 /* By the standard (RFC 6066 Sect. 4), the MFL extension
188 * only limits the maximum record payload size, so in theory
189 * we would be allowed to pack multiple records of payload size
190 * MFL into a single datagram. However, this would mean that there's
191 * no way to explicitly communicate MTU restrictions to the peer.
193 * The following reduction of max_len makes sure that we never
194 * write datagrams larger than MFL + Record Expansion Overhead.
196 if( max_len
<= ssl
->out_left
)
199 max_len
-= ssl
->out_left
;
202 ret
= ssl_get_remaining_space_in_datagram( ssl
);
205 remaining
= (size_t) ret
;
207 ret
= mbedtls_ssl_get_record_expansion( ssl
);
210 expansion
= (size_t) ret
;
212 if( remaining
<= expansion
)
215 remaining
-= expansion
;
216 if( remaining
>= max_len
)
219 return( (int) remaining
);
223 * Double the retransmit timeout value, within the allowed range,
224 * returning -1 if the maximum value has already been reached.
226 static int ssl_double_retransmit_timeout( mbedtls_ssl_context
*ssl
)
228 uint32_t new_timeout
;
230 if( ssl
->handshake
->retransmit_timeout
>= ssl
->conf
->hs_timeout_max
)
233 /* Implement the final paragraph of RFC 6347 section 4.1.1.1
234 * in the following way: after the initial transmission and a first
235 * retransmission, back off to a temporary estimated MTU of 508 bytes.
236 * This value is guaranteed to be deliverable (if not guaranteed to be
237 * delivered) of any compliant IPv4 (and IPv6) network, and should work
238 * on most non-IP stacks too. */
239 if( ssl
->handshake
->retransmit_timeout
!= ssl
->conf
->hs_timeout_min
)
241 ssl
->handshake
->mtu
= 508;
242 MBEDTLS_SSL_DEBUG_MSG( 2, ( "mtu autoreduction to %d bytes", ssl
->handshake
->mtu
) );
245 new_timeout
= 2 * ssl
->handshake
->retransmit_timeout
;
247 /* Avoid arithmetic overflow and range overflow */
248 if( new_timeout
< ssl
->handshake
->retransmit_timeout
||
249 new_timeout
> ssl
->conf
->hs_timeout_max
)
251 new_timeout
= ssl
->conf
->hs_timeout_max
;
254 ssl
->handshake
->retransmit_timeout
= new_timeout
;
255 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
256 ssl
->handshake
->retransmit_timeout
) );
261 static void ssl_reset_retransmit_timeout( mbedtls_ssl_context
*ssl
)
263 ssl
->handshake
->retransmit_timeout
= ssl
->conf
->hs_timeout_min
;
264 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
265 ssl
->handshake
->retransmit_timeout
) );
267 #endif /* MBEDTLS_SSL_PROTO_DTLS */
269 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
271 * Convert max_fragment_length codes to length.
274 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
275 * } MaxFragmentLength;
276 * and we add 0 -> extension unused
278 static unsigned int ssl_mfl_code_to_length( int mfl
)
282 case MBEDTLS_SSL_MAX_FRAG_LEN_NONE
:
283 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN
);
284 case MBEDTLS_SSL_MAX_FRAG_LEN_512
:
286 case MBEDTLS_SSL_MAX_FRAG_LEN_1024
:
288 case MBEDTLS_SSL_MAX_FRAG_LEN_2048
:
290 case MBEDTLS_SSL_MAX_FRAG_LEN_4096
:
293 return ( MBEDTLS_TLS_EXT_ADV_CONTENT_LEN
);
296 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
298 #if defined(MBEDTLS_SSL_CLI_C)
299 static int ssl_session_copy( mbedtls_ssl_session
*dst
, const mbedtls_ssl_session
*src
)
301 mbedtls_ssl_session_free( dst
);
302 memcpy( dst
, src
, sizeof( mbedtls_ssl_session
) );
304 #if defined(MBEDTLS_X509_CRT_PARSE_C)
305 if( src
->peer_cert
!= NULL
)
309 dst
->peer_cert
= mbedtls_calloc( 1, sizeof(mbedtls_x509_crt
) );
310 if( dst
->peer_cert
== NULL
)
311 return( MBEDTLS_ERR_SSL_ALLOC_FAILED
);
313 mbedtls_x509_crt_init( dst
->peer_cert
);
315 if( ( ret
= mbedtls_x509_crt_parse_der( dst
->peer_cert
, src
->peer_cert
->raw
.p
,
316 src
->peer_cert
->raw
.len
) ) != 0 )
318 mbedtls_free( dst
->peer_cert
);
319 dst
->peer_cert
= NULL
;
323 #endif /* MBEDTLS_X509_CRT_PARSE_C */
325 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
326 if( src
->ticket
!= NULL
)
328 dst
->ticket
= mbedtls_calloc( 1, src
->ticket_len
);
329 if( dst
->ticket
== NULL
)
330 return( MBEDTLS_ERR_SSL_ALLOC_FAILED
);
332 memcpy( dst
->ticket
, src
->ticket
, src
->ticket_len
);
334 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
338 #endif /* MBEDTLS_SSL_CLI_C */
340 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
341 int (*mbedtls_ssl_hw_record_init
)( mbedtls_ssl_context
*ssl
,
342 const unsigned char *key_enc
, const unsigned char *key_dec
,
344 const unsigned char *iv_enc
, const unsigned char *iv_dec
,
346 const unsigned char *mac_enc
, const unsigned char *mac_dec
,
347 size_t maclen
) = NULL
;
348 int (*mbedtls_ssl_hw_record_activate
)( mbedtls_ssl_context
*ssl
, int direction
) = NULL
;
349 int (*mbedtls_ssl_hw_record_reset
)( mbedtls_ssl_context
*ssl
) = NULL
;
350 int (*mbedtls_ssl_hw_record_write
)( mbedtls_ssl_context
*ssl
) = NULL
;
351 int (*mbedtls_ssl_hw_record_read
)( mbedtls_ssl_context
*ssl
) = NULL
;
352 int (*mbedtls_ssl_hw_record_finish
)( mbedtls_ssl_context
*ssl
) = NULL
;
353 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
356 * Key material generation
358 #if defined(MBEDTLS_SSL_PROTO_SSL3)
359 static int ssl3_prf( const unsigned char *secret
, size_t slen
,
361 const unsigned char *random
, size_t rlen
,
362 unsigned char *dstbuf
, size_t dlen
)
366 mbedtls_md5_context md5
;
367 mbedtls_sha1_context sha1
;
368 unsigned char padding
[16];
369 unsigned char sha1sum
[20];
372 mbedtls_md5_init( &md5
);
373 mbedtls_sha1_init( &sha1
);
378 * MD5( secret + SHA1( 'A' + secret + random ) ) +
379 * MD5( secret + SHA1( 'BB' + secret + random ) ) +
380 * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
383 for( i
= 0; i
< dlen
/ 16; i
++ )
385 memset( padding
, (unsigned char) ('A' + i
), 1 + i
);
387 if( ( ret
= mbedtls_sha1_starts_ret( &sha1
) ) != 0 )
389 if( ( ret
= mbedtls_sha1_update_ret( &sha1
, padding
, 1 + i
) ) != 0 )
391 if( ( ret
= mbedtls_sha1_update_ret( &sha1
, secret
, slen
) ) != 0 )
393 if( ( ret
= mbedtls_sha1_update_ret( &sha1
, random
, rlen
) ) != 0 )
395 if( ( ret
= mbedtls_sha1_finish_ret( &sha1
, sha1sum
) ) != 0 )
398 if( ( ret
= mbedtls_md5_starts_ret( &md5
) ) != 0 )
400 if( ( ret
= mbedtls_md5_update_ret( &md5
, secret
, slen
) ) != 0 )
402 if( ( ret
= mbedtls_md5_update_ret( &md5
, sha1sum
, 20 ) ) != 0 )
404 if( ( ret
= mbedtls_md5_finish_ret( &md5
, dstbuf
+ i
* 16 ) ) != 0 )
409 mbedtls_md5_free( &md5
);
410 mbedtls_sha1_free( &sha1
);
412 mbedtls_platform_zeroize( padding
, sizeof( padding
) );
413 mbedtls_platform_zeroize( sha1sum
, sizeof( sha1sum
) );
417 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
419 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
420 static int tls1_prf( const unsigned char *secret
, size_t slen
,
422 const unsigned char *random
, size_t rlen
,
423 unsigned char *dstbuf
, size_t dlen
)
427 const unsigned char *S1
, *S2
;
428 unsigned char tmp
[128];
429 unsigned char h_i
[20];
430 const mbedtls_md_info_t
*md_info
;
431 mbedtls_md_context_t md_ctx
;
434 mbedtls_md_init( &md_ctx
);
436 if( sizeof( tmp
) < 20 + strlen( label
) + rlen
)
437 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
439 hs
= ( slen
+ 1 ) / 2;
441 S2
= secret
+ slen
- hs
;
443 nb
= strlen( label
);
444 memcpy( tmp
+ 20, label
, nb
);
445 memcpy( tmp
+ 20 + nb
, random
, rlen
);
449 * First compute P_md5(secret,label+random)[0..dlen]
451 if( ( md_info
= mbedtls_md_info_from_type( MBEDTLS_MD_MD5
) ) == NULL
)
452 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
454 if( ( ret
= mbedtls_md_setup( &md_ctx
, md_info
, 1 ) ) != 0 )
457 mbedtls_md_hmac_starts( &md_ctx
, S1
, hs
);
458 mbedtls_md_hmac_update( &md_ctx
, tmp
+ 20, nb
);
459 mbedtls_md_hmac_finish( &md_ctx
, 4 + tmp
);
461 for( i
= 0; i
< dlen
; i
+= 16 )
463 mbedtls_md_hmac_reset ( &md_ctx
);
464 mbedtls_md_hmac_update( &md_ctx
, 4 + tmp
, 16 + nb
);
465 mbedtls_md_hmac_finish( &md_ctx
, h_i
);
467 mbedtls_md_hmac_reset ( &md_ctx
);
468 mbedtls_md_hmac_update( &md_ctx
, 4 + tmp
, 16 );
469 mbedtls_md_hmac_finish( &md_ctx
, 4 + tmp
);
471 k
= ( i
+ 16 > dlen
) ? dlen
% 16 : 16;
473 for( j
= 0; j
< k
; j
++ )
474 dstbuf
[i
+ j
] = h_i
[j
];
477 mbedtls_md_free( &md_ctx
);
480 * XOR out with P_sha1(secret,label+random)[0..dlen]
482 if( ( md_info
= mbedtls_md_info_from_type( MBEDTLS_MD_SHA1
) ) == NULL
)
483 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
485 if( ( ret
= mbedtls_md_setup( &md_ctx
, md_info
, 1 ) ) != 0 )
488 mbedtls_md_hmac_starts( &md_ctx
, S2
, hs
);
489 mbedtls_md_hmac_update( &md_ctx
, tmp
+ 20, nb
);
490 mbedtls_md_hmac_finish( &md_ctx
, tmp
);
492 for( i
= 0; i
< dlen
; i
+= 20 )
494 mbedtls_md_hmac_reset ( &md_ctx
);
495 mbedtls_md_hmac_update( &md_ctx
, tmp
, 20 + nb
);
496 mbedtls_md_hmac_finish( &md_ctx
, h_i
);
498 mbedtls_md_hmac_reset ( &md_ctx
);
499 mbedtls_md_hmac_update( &md_ctx
, tmp
, 20 );
500 mbedtls_md_hmac_finish( &md_ctx
, tmp
);
502 k
= ( i
+ 20 > dlen
) ? dlen
% 20 : 20;
504 for( j
= 0; j
< k
; j
++ )
505 dstbuf
[i
+ j
] = (unsigned char)( dstbuf
[i
+ j
] ^ h_i
[j
] );
508 mbedtls_md_free( &md_ctx
);
510 mbedtls_platform_zeroize( tmp
, sizeof( tmp
) );
511 mbedtls_platform_zeroize( h_i
, sizeof( h_i
) );
515 #endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */
517 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
518 static int tls_prf_generic( mbedtls_md_type_t md_type
,
519 const unsigned char *secret
, size_t slen
,
521 const unsigned char *random
, size_t rlen
,
522 unsigned char *dstbuf
, size_t dlen
)
525 size_t i
, j
, k
, md_len
;
526 unsigned char tmp
[128];
527 unsigned char h_i
[MBEDTLS_MD_MAX_SIZE
];
528 const mbedtls_md_info_t
*md_info
;
529 mbedtls_md_context_t md_ctx
;
532 mbedtls_md_init( &md_ctx
);
534 if( ( md_info
= mbedtls_md_info_from_type( md_type
) ) == NULL
)
535 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
537 md_len
= mbedtls_md_get_size( md_info
);
539 if( sizeof( tmp
) < md_len
+ strlen( label
) + rlen
)
540 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
542 nb
= strlen( label
);
543 memcpy( tmp
+ md_len
, label
, nb
);
544 memcpy( tmp
+ md_len
+ nb
, random
, rlen
);
548 * Compute P_<hash>(secret, label + random)[0..dlen]
550 if ( ( ret
= mbedtls_md_setup( &md_ctx
, md_info
, 1 ) ) != 0 )
553 mbedtls_md_hmac_starts( &md_ctx
, secret
, slen
);
554 mbedtls_md_hmac_update( &md_ctx
, tmp
+ md_len
, nb
);
555 mbedtls_md_hmac_finish( &md_ctx
, tmp
);
557 for( i
= 0; i
< dlen
; i
+= md_len
)
559 mbedtls_md_hmac_reset ( &md_ctx
);
560 mbedtls_md_hmac_update( &md_ctx
, tmp
, md_len
+ nb
);
561 mbedtls_md_hmac_finish( &md_ctx
, h_i
);
563 mbedtls_md_hmac_reset ( &md_ctx
);
564 mbedtls_md_hmac_update( &md_ctx
, tmp
, md_len
);
565 mbedtls_md_hmac_finish( &md_ctx
, tmp
);
567 k
= ( i
+ md_len
> dlen
) ? dlen
% md_len
: md_len
;
569 for( j
= 0; j
< k
; j
++ )
570 dstbuf
[i
+ j
] = h_i
[j
];
573 mbedtls_md_free( &md_ctx
);
575 mbedtls_platform_zeroize( tmp
, sizeof( tmp
) );
576 mbedtls_platform_zeroize( h_i
, sizeof( h_i
) );
581 #if defined(MBEDTLS_SHA256_C)
582 static int tls_prf_sha256( const unsigned char *secret
, size_t slen
,
584 const unsigned char *random
, size_t rlen
,
585 unsigned char *dstbuf
, size_t dlen
)
587 return( tls_prf_generic( MBEDTLS_MD_SHA256
, secret
, slen
,
588 label
, random
, rlen
, dstbuf
, dlen
) );
590 #endif /* MBEDTLS_SHA256_C */
592 #if defined(MBEDTLS_SHA512_C)
593 static int tls_prf_sha384( const unsigned char *secret
, size_t slen
,
595 const unsigned char *random
, size_t rlen
,
596 unsigned char *dstbuf
, size_t dlen
)
598 return( tls_prf_generic( MBEDTLS_MD_SHA384
, secret
, slen
,
599 label
, random
, rlen
, dstbuf
, dlen
) );
601 #endif /* MBEDTLS_SHA512_C */
602 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
604 static void ssl_update_checksum_start( mbedtls_ssl_context
*, const unsigned char *, size_t );
606 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
607 defined(MBEDTLS_SSL_PROTO_TLS1_1)
608 static void ssl_update_checksum_md5sha1( mbedtls_ssl_context
*, const unsigned char *, size_t );
611 #if defined(MBEDTLS_SSL_PROTO_SSL3)
612 static void ssl_calc_verify_ssl( mbedtls_ssl_context
*, unsigned char * );
613 static void ssl_calc_finished_ssl( mbedtls_ssl_context
*, unsigned char *, int );
616 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
617 static void ssl_calc_verify_tls( mbedtls_ssl_context
*, unsigned char * );
618 static void ssl_calc_finished_tls( mbedtls_ssl_context
*, unsigned char *, int );
621 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
622 #if defined(MBEDTLS_SHA256_C)
623 static void ssl_update_checksum_sha256( mbedtls_ssl_context
*, const unsigned char *, size_t );
624 static void ssl_calc_verify_tls_sha256( mbedtls_ssl_context
*, unsigned char * );
625 static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context
*,unsigned char *, int );
628 #if defined(MBEDTLS_SHA512_C)
629 static void ssl_update_checksum_sha384( mbedtls_ssl_context
*, const unsigned char *, size_t );
630 static void ssl_calc_verify_tls_sha384( mbedtls_ssl_context
*, unsigned char * );
631 static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context
*, unsigned char *, int );
633 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
635 int mbedtls_ssl_derive_keys( mbedtls_ssl_context
*ssl
)
638 unsigned char tmp
[64];
639 unsigned char keyblk
[256];
642 unsigned char *mac_enc
;
643 unsigned char *mac_dec
;
646 const mbedtls_cipher_info_t
*cipher_info
;
647 const mbedtls_md_info_t
*md_info
;
649 mbedtls_ssl_session
*session
= ssl
->session_negotiate
;
650 mbedtls_ssl_transform
*transform
= ssl
->transform_negotiate
;
651 mbedtls_ssl_handshake_params
*handshake
= ssl
->handshake
;
653 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
655 cipher_info
= mbedtls_cipher_info_from_type( transform
->ciphersuite_info
->cipher
);
656 if( cipher_info
== NULL
)
658 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %d not found",
659 transform
->ciphersuite_info
->cipher
) );
660 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
663 md_info
= mbedtls_md_info_from_type( transform
->ciphersuite_info
->mac
);
664 if( md_info
== NULL
)
666 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %d not found",
667 transform
->ciphersuite_info
->mac
) );
668 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
672 * Set appropriate PRF function and other SSL / TLS / TLS1.2 functions
674 #if defined(MBEDTLS_SSL_PROTO_SSL3)
675 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
)
677 handshake
->tls_prf
= ssl3_prf
;
678 handshake
->calc_verify
= ssl_calc_verify_ssl
;
679 handshake
->calc_finished
= ssl_calc_finished_ssl
;
683 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
684 if( ssl
->minor_ver
< MBEDTLS_SSL_MINOR_VERSION_3
)
686 handshake
->tls_prf
= tls1_prf
;
687 handshake
->calc_verify
= ssl_calc_verify_tls
;
688 handshake
->calc_finished
= ssl_calc_finished_tls
;
692 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
693 #if defined(MBEDTLS_SHA512_C)
694 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_3
&&
695 transform
->ciphersuite_info
->mac
== MBEDTLS_MD_SHA384
)
697 handshake
->tls_prf
= tls_prf_sha384
;
698 handshake
->calc_verify
= ssl_calc_verify_tls_sha384
;
699 handshake
->calc_finished
= ssl_calc_finished_tls_sha384
;
703 #if defined(MBEDTLS_SHA256_C)
704 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_3
)
706 handshake
->tls_prf
= tls_prf_sha256
;
707 handshake
->calc_verify
= ssl_calc_verify_tls_sha256
;
708 handshake
->calc_finished
= ssl_calc_finished_tls_sha256
;
712 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
714 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
715 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
721 * MD5( premaster + SHA1( 'A' + premaster + randbytes ) ) +
722 * MD5( premaster + SHA1( 'BB' + premaster + randbytes ) ) +
723 * MD5( premaster + SHA1( 'CCC' + premaster + randbytes ) )
726 * master = PRF( premaster, "master secret", randbytes )[0..47]
728 if( handshake
->resume
== 0 )
730 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret", handshake
->premaster
,
733 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
734 if( ssl
->handshake
->extended_ms
== MBEDTLS_SSL_EXTENDED_MS_ENABLED
)
736 unsigned char session_hash
[48];
739 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using extended master secret" ) );
741 ssl
->handshake
->calc_verify( ssl
, session_hash
);
743 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
744 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_3
)
746 #if defined(MBEDTLS_SHA512_C)
747 if( ssl
->transform_negotiate
->ciphersuite_info
->mac
==
757 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
760 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash", session_hash
, hash_len
);
762 ret
= handshake
->tls_prf( handshake
->premaster
, handshake
->pmslen
,
763 "extended master secret",
764 session_hash
, hash_len
,
765 session
->master
, 48 );
768 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret
);
775 ret
= handshake
->tls_prf( handshake
->premaster
, handshake
->pmslen
,
777 handshake
->randbytes
, 64,
778 session
->master
, 48 );
781 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret
);
785 mbedtls_platform_zeroize( handshake
->premaster
,
786 sizeof(handshake
->premaster
) );
789 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
792 * Swap the client and server random values.
794 memcpy( tmp
, handshake
->randbytes
, 64 );
795 memcpy( handshake
->randbytes
, tmp
+ 32, 32 );
796 memcpy( handshake
->randbytes
+ 32, tmp
, 32 );
797 mbedtls_platform_zeroize( tmp
, sizeof( tmp
) );
802 * MD5( master + SHA1( 'A' + master + randbytes ) ) +
803 * MD5( master + SHA1( 'BB' + master + randbytes ) ) +
804 * MD5( master + SHA1( 'CCC' + master + randbytes ) ) +
805 * MD5( master + SHA1( 'DDDD' + master + randbytes ) ) +
809 * key block = PRF( master, "key expansion", randbytes )
811 ret
= handshake
->tls_prf( session
->master
, 48, "key expansion",
812 handshake
->randbytes
, 64, keyblk
, 256 );
815 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret
);
819 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
820 mbedtls_ssl_get_ciphersuite_name( session
->ciphersuite
) ) );
821 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", session
->master
, 48 );
822 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", handshake
->randbytes
, 64 );
823 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk
, 256 );
825 mbedtls_platform_zeroize( handshake
->randbytes
,
826 sizeof( handshake
->randbytes
) );
829 * Determine the appropriate key, IV and MAC length.
832 transform
->keylen
= cipher_info
->key_bitlen
/ 8;
834 if( cipher_info
->mode
== MBEDTLS_MODE_GCM
||
835 cipher_info
->mode
== MBEDTLS_MODE_CCM
||
836 cipher_info
->mode
== MBEDTLS_MODE_CHACHAPOLY
)
838 size_t taglen
, explicit_ivlen
;
840 transform
->maclen
= 0;
843 /* All modes haves 96-bit IVs;
844 * GCM and CCM has 4 implicit and 8 explicit bytes
845 * ChachaPoly has all 12 bytes implicit
847 transform
->ivlen
= 12;
848 if( cipher_info
->mode
== MBEDTLS_MODE_CHACHAPOLY
)
849 transform
->fixed_ivlen
= 12;
851 transform
->fixed_ivlen
= 4;
853 /* All modes have 128-bit tags, except CCM_8 (ciphersuite flag) */
854 taglen
= transform
->ciphersuite_info
->flags
&
855 MBEDTLS_CIPHERSUITE_SHORT_TAG
? 8 : 16;
858 /* Minimum length of encrypted record */
859 explicit_ivlen
= transform
->ivlen
- transform
->fixed_ivlen
;
860 transform
->minlen
= explicit_ivlen
+ taglen
;
864 /* Initialize HMAC contexts */
865 if( ( ret
= mbedtls_md_setup( &transform
->md_ctx_enc
, md_info
, 1 ) ) != 0 ||
866 ( ret
= mbedtls_md_setup( &transform
->md_ctx_dec
, md_info
, 1 ) ) != 0 )
868 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret
);
873 mac_key_len
= mbedtls_md_get_size( md_info
);
874 transform
->maclen
= mac_key_len
;
876 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
878 * If HMAC is to be truncated, we shall keep the leftmost bytes,
879 * (rfc 6066 page 13 or rfc 2104 section 4),
880 * so we only need to adjust the length here.
882 if( session
->trunc_hmac
== MBEDTLS_SSL_TRUNC_HMAC_ENABLED
)
884 transform
->maclen
= MBEDTLS_SSL_TRUNCATED_HMAC_LEN
;
886 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT)
887 /* Fall back to old, non-compliant version of the truncated
888 * HMAC implementation which also truncates the key
889 * (Mbed TLS versions from 1.3 to 2.6.0) */
890 mac_key_len
= transform
->maclen
;
893 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
896 transform
->ivlen
= cipher_info
->iv_size
;
899 if( cipher_info
->mode
== MBEDTLS_MODE_STREAM
)
900 transform
->minlen
= transform
->maclen
;
904 * GenericBlockCipher:
905 * 1. if EtM is in use: one block plus MAC
906 * otherwise: * first multiple of blocklen greater than maclen
907 * 2. IV except for SSL3 and TLS 1.0
909 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
910 if( session
->encrypt_then_mac
== MBEDTLS_SSL_ETM_ENABLED
)
912 transform
->minlen
= transform
->maclen
913 + cipher_info
->block_size
;
918 transform
->minlen
= transform
->maclen
919 + cipher_info
->block_size
920 - transform
->maclen
% cipher_info
->block_size
;
923 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
924 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
||
925 ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_1
)
926 ; /* No need to adjust minlen */
929 #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
930 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_2
||
931 ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_3
)
933 transform
->minlen
+= transform
->ivlen
;
938 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
939 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
944 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %d, minlen: %d, ivlen: %d, maclen: %d",
945 transform
->keylen
, transform
->minlen
, transform
->ivlen
,
946 transform
->maclen
) );
949 * Finally setup the cipher contexts, IVs and MAC secrets.
951 #if defined(MBEDTLS_SSL_CLI_C)
952 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_CLIENT
)
954 key1
= keyblk
+ mac_key_len
* 2;
955 key2
= keyblk
+ mac_key_len
* 2 + transform
->keylen
;
958 mac_dec
= keyblk
+ mac_key_len
;
961 * This is not used in TLS v1.1.
963 iv_copy_len
= ( transform
->fixed_ivlen
) ?
964 transform
->fixed_ivlen
: transform
->ivlen
;
965 memcpy( transform
->iv_enc
, key2
+ transform
->keylen
, iv_copy_len
);
966 memcpy( transform
->iv_dec
, key2
+ transform
->keylen
+ iv_copy_len
,
970 #endif /* MBEDTLS_SSL_CLI_C */
971 #if defined(MBEDTLS_SSL_SRV_C)
972 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
)
974 key1
= keyblk
+ mac_key_len
* 2 + transform
->keylen
;
975 key2
= keyblk
+ mac_key_len
* 2;
977 mac_enc
= keyblk
+ mac_key_len
;
981 * This is not used in TLS v1.1.
983 iv_copy_len
= ( transform
->fixed_ivlen
) ?
984 transform
->fixed_ivlen
: transform
->ivlen
;
985 memcpy( transform
->iv_dec
, key1
+ transform
->keylen
, iv_copy_len
);
986 memcpy( transform
->iv_enc
, key1
+ transform
->keylen
+ iv_copy_len
,
990 #endif /* MBEDTLS_SSL_SRV_C */
992 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
993 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
996 #if defined(MBEDTLS_SSL_PROTO_SSL3)
997 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
)
999 if( mac_key_len
> sizeof transform
->mac_enc
)
1001 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1002 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1005 memcpy( transform
->mac_enc
, mac_enc
, mac_key_len
);
1006 memcpy( transform
->mac_dec
, mac_dec
, mac_key_len
);
1009 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
1010 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1011 defined(MBEDTLS_SSL_PROTO_TLS1_2)
1012 if( ssl
->minor_ver
>= MBEDTLS_SSL_MINOR_VERSION_1
)
1014 /* For HMAC-based ciphersuites, initialize the HMAC transforms.
1015 For AEAD-based ciphersuites, there is nothing to do here. */
1016 if( mac_key_len
!= 0 )
1018 mbedtls_md_hmac_starts( &transform
->md_ctx_enc
, mac_enc
, mac_key_len
);
1019 mbedtls_md_hmac_starts( &transform
->md_ctx_dec
, mac_dec
, mac_key_len
);
1025 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1026 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1029 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
1030 if( mbedtls_ssl_hw_record_init
!= NULL
)
1032 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) );
1034 if( ( ret
= mbedtls_ssl_hw_record_init( ssl
, key1
, key2
, transform
->keylen
,
1035 transform
->iv_enc
, transform
->iv_dec
,
1038 mac_key_len
) ) != 0 )
1040 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret
);
1041 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED
);
1044 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
1046 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
1047 if( ssl
->conf
->f_export_keys
!= NULL
)
1049 ssl
->conf
->f_export_keys( ssl
->conf
->p_export_keys
,
1050 session
->master
, keyblk
,
1051 mac_key_len
, transform
->keylen
,
1056 if( ( ret
= mbedtls_cipher_setup( &transform
->cipher_ctx_enc
,
1057 cipher_info
) ) != 0 )
1059 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret
);
1063 if( ( ret
= mbedtls_cipher_setup( &transform
->cipher_ctx_dec
,
1064 cipher_info
) ) != 0 )
1066 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret
);
1070 if( ( ret
= mbedtls_cipher_setkey( &transform
->cipher_ctx_enc
, key1
,
1071 cipher_info
->key_bitlen
,
1072 MBEDTLS_ENCRYPT
) ) != 0 )
1074 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret
);
1078 if( ( ret
= mbedtls_cipher_setkey( &transform
->cipher_ctx_dec
, key2
,
1079 cipher_info
->key_bitlen
,
1080 MBEDTLS_DECRYPT
) ) != 0 )
1082 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret
);
1086 #if defined(MBEDTLS_CIPHER_MODE_CBC)
1087 if( cipher_info
->mode
== MBEDTLS_MODE_CBC
)
1089 if( ( ret
= mbedtls_cipher_set_padding_mode( &transform
->cipher_ctx_enc
,
1090 MBEDTLS_PADDING_NONE
) ) != 0 )
1092 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret
);
1096 if( ( ret
= mbedtls_cipher_set_padding_mode( &transform
->cipher_ctx_dec
,
1097 MBEDTLS_PADDING_NONE
) ) != 0 )
1099 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret
);
1103 #endif /* MBEDTLS_CIPHER_MODE_CBC */
1105 mbedtls_platform_zeroize( keyblk
, sizeof( keyblk
) );
1107 #if defined(MBEDTLS_ZLIB_SUPPORT)
1108 // Initialize compression
1110 if( session
->compression
== MBEDTLS_SSL_COMPRESS_DEFLATE
)
1112 if( ssl
->compress_buf
== NULL
)
1114 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
1115 ssl
->compress_buf
= mbedtls_calloc( 1, MBEDTLS_SSL_COMPRESS_BUFFER_LEN
);
1116 if( ssl
->compress_buf
== NULL
)
1118 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
1119 MBEDTLS_SSL_COMPRESS_BUFFER_LEN
) );
1120 return( MBEDTLS_ERR_SSL_ALLOC_FAILED
);
1124 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
1126 memset( &transform
->ctx_deflate
, 0, sizeof( transform
->ctx_deflate
) );
1127 memset( &transform
->ctx_inflate
, 0, sizeof( transform
->ctx_inflate
) );
1129 if( deflateInit( &transform
->ctx_deflate
,
1130 Z_DEFAULT_COMPRESSION
) != Z_OK
||
1131 inflateInit( &transform
->ctx_inflate
) != Z_OK
)
1133 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
1134 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED
);
1137 #endif /* MBEDTLS_ZLIB_SUPPORT */
1139 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
1144 #if defined(MBEDTLS_SSL_PROTO_SSL3)
1145 void ssl_calc_verify_ssl( mbedtls_ssl_context
*ssl
, unsigned char *hash
)
1147 mbedtls_md5_context md5
;
1148 mbedtls_sha1_context sha1
;
1149 unsigned char pad_1
[48];
1150 unsigned char pad_2
[48];
1152 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
1154 mbedtls_md5_init( &md5
);
1155 mbedtls_sha1_init( &sha1
);
1157 mbedtls_md5_clone( &md5
, &ssl
->handshake
->fin_md5
);
1158 mbedtls_sha1_clone( &sha1
, &ssl
->handshake
->fin_sha1
);
1160 memset( pad_1
, 0x36, 48 );
1161 memset( pad_2
, 0x5C, 48 );
1163 mbedtls_md5_update_ret( &md5
, ssl
->session_negotiate
->master
, 48 );
1164 mbedtls_md5_update_ret( &md5
, pad_1
, 48 );
1165 mbedtls_md5_finish_ret( &md5
, hash
);
1167 mbedtls_md5_starts_ret( &md5
);
1168 mbedtls_md5_update_ret( &md5
, ssl
->session_negotiate
->master
, 48 );
1169 mbedtls_md5_update_ret( &md5
, pad_2
, 48 );
1170 mbedtls_md5_update_ret( &md5
, hash
, 16 );
1171 mbedtls_md5_finish_ret( &md5
, hash
);
1173 mbedtls_sha1_update_ret( &sha1
, ssl
->session_negotiate
->master
, 48 );
1174 mbedtls_sha1_update_ret( &sha1
, pad_1
, 40 );
1175 mbedtls_sha1_finish_ret( &sha1
, hash
+ 16 );
1177 mbedtls_sha1_starts_ret( &sha1
);
1178 mbedtls_sha1_update_ret( &sha1
, ssl
->session_negotiate
->master
, 48 );
1179 mbedtls_sha1_update_ret( &sha1
, pad_2
, 40 );
1180 mbedtls_sha1_update_ret( &sha1
, hash
+ 16, 20 );
1181 mbedtls_sha1_finish_ret( &sha1
, hash
+ 16 );
1183 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash
, 36 );
1184 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1186 mbedtls_md5_free( &md5
);
1187 mbedtls_sha1_free( &sha1
);
1191 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
1193 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
1194 void ssl_calc_verify_tls( mbedtls_ssl_context
*ssl
, unsigned char *hash
)
1196 mbedtls_md5_context md5
;
1197 mbedtls_sha1_context sha1
;
1199 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
1201 mbedtls_md5_init( &md5
);
1202 mbedtls_sha1_init( &sha1
);
1204 mbedtls_md5_clone( &md5
, &ssl
->handshake
->fin_md5
);
1205 mbedtls_sha1_clone( &sha1
, &ssl
->handshake
->fin_sha1
);
1207 mbedtls_md5_finish_ret( &md5
, hash
);
1208 mbedtls_sha1_finish_ret( &sha1
, hash
+ 16 );
1210 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash
, 36 );
1211 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1213 mbedtls_md5_free( &md5
);
1214 mbedtls_sha1_free( &sha1
);
1218 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
1220 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1221 #if defined(MBEDTLS_SHA256_C)
1222 void ssl_calc_verify_tls_sha256( mbedtls_ssl_context
*ssl
, unsigned char *hash
)
1224 mbedtls_sha256_context sha256
;
1226 mbedtls_sha256_init( &sha256
);
1228 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
1230 mbedtls_sha256_clone( &sha256
, &ssl
->handshake
->fin_sha256
);
1231 mbedtls_sha256_finish_ret( &sha256
, hash
);
1233 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash
, 32 );
1234 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1236 mbedtls_sha256_free( &sha256
);
1240 #endif /* MBEDTLS_SHA256_C */
1242 #if defined(MBEDTLS_SHA512_C)
1243 void ssl_calc_verify_tls_sha384( mbedtls_ssl_context
*ssl
, unsigned char *hash
)
1245 mbedtls_sha512_context sha512
;
1247 mbedtls_sha512_init( &sha512
);
1249 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
1251 mbedtls_sha512_clone( &sha512
, &ssl
->handshake
->fin_sha512
);
1252 mbedtls_sha512_finish_ret( &sha512
, hash
);
1254 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash
, 48 );
1255 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
1257 mbedtls_sha512_free( &sha512
);
1261 #endif /* MBEDTLS_SHA512_C */
1262 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1264 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
1265 int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context
*ssl
, mbedtls_key_exchange_type_t key_ex
)
1267 unsigned char *p
= ssl
->handshake
->premaster
;
1268 unsigned char *end
= p
+ sizeof( ssl
->handshake
->premaster
);
1269 const unsigned char *psk
= ssl
->conf
->psk
;
1270 size_t psk_len
= ssl
->conf
->psk_len
;
1272 /* If the psk callback was called, use its result */
1273 if( ssl
->handshake
->psk
!= NULL
)
1275 psk
= ssl
->handshake
->psk
;
1276 psk_len
= ssl
->handshake
->psk_len
;
1281 * opaque other_secret<0..2^16-1>;
1282 * opaque psk<0..2^16-1>;
1284 * with "other_secret" depending on the particular key exchange
1286 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
1287 if( key_ex
== MBEDTLS_KEY_EXCHANGE_PSK
)
1290 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
1292 *(p
++) = (unsigned char)( psk_len
>> 8 );
1293 *(p
++) = (unsigned char)( psk_len
);
1295 if( end
< p
|| (size_t)( end
- p
) < psk_len
)
1296 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
1298 memset( p
, 0, psk_len
);
1302 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
1303 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
1304 if( key_ex
== MBEDTLS_KEY_EXCHANGE_RSA_PSK
)
1307 * other_secret already set by the ClientKeyExchange message,
1308 * and is 48 bytes long
1311 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
1318 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
1319 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
1320 if( key_ex
== MBEDTLS_KEY_EXCHANGE_DHE_PSK
)
1325 /* Write length only when we know the actual value */
1326 if( ( ret
= mbedtls_dhm_calc_secret( &ssl
->handshake
->dhm_ctx
,
1327 p
+ 2, end
- ( p
+ 2 ), &len
,
1328 ssl
->conf
->f_rng
, ssl
->conf
->p_rng
) ) != 0 )
1330 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret
);
1333 *(p
++) = (unsigned char)( len
>> 8 );
1334 *(p
++) = (unsigned char)( len
);
1337 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl
->handshake
->dhm_ctx
.K
);
1340 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
1341 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
1342 if( key_ex
== MBEDTLS_KEY_EXCHANGE_ECDHE_PSK
)
1347 if( ( ret
= mbedtls_ecdh_calc_secret( &ssl
->handshake
->ecdh_ctx
, &zlen
,
1348 p
+ 2, end
- ( p
+ 2 ),
1349 ssl
->conf
->f_rng
, ssl
->conf
->p_rng
) ) != 0 )
1351 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret
);
1355 *(p
++) = (unsigned char)( zlen
>> 8 );
1356 *(p
++) = (unsigned char)( zlen
);
1359 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl
->handshake
->ecdh_ctx
,
1360 MBEDTLS_DEBUG_ECDH_Z
);
1363 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
1365 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1366 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1369 /* opaque psk<0..2^16-1>; */
1371 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
1373 *(p
++) = (unsigned char)( psk_len
>> 8 );
1374 *(p
++) = (unsigned char)( psk_len
);
1376 if( end
< p
|| (size_t)( end
- p
) < psk_len
)
1377 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
1379 memcpy( p
, psk
, psk_len
);
1382 ssl
->handshake
->pmslen
= p
- ssl
->handshake
->premaster
;
1386 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
1388 #if defined(MBEDTLS_SSL_PROTO_SSL3)
1390 * SSLv3.0 MAC functions
1392 #define SSL_MAC_MAX_BYTES 20 /* MD-5 or SHA-1 */
1393 static void ssl_mac( mbedtls_md_context_t
*md_ctx
,
1394 const unsigned char *secret
,
1395 const unsigned char *buf
, size_t len
,
1396 const unsigned char *ctr
, int type
,
1397 unsigned char out
[SSL_MAC_MAX_BYTES
] )
1399 unsigned char header
[11];
1400 unsigned char padding
[48];
1402 int md_size
= mbedtls_md_get_size( md_ctx
->md_info
);
1403 int md_type
= mbedtls_md_get_type( md_ctx
->md_info
);
1405 /* Only MD5 and SHA-1 supported */
1406 if( md_type
== MBEDTLS_MD_MD5
)
1411 memcpy( header
, ctr
, 8 );
1412 header
[ 8] = (unsigned char) type
;
1413 header
[ 9] = (unsigned char)( len
>> 8 );
1414 header
[10] = (unsigned char)( len
);
1416 memset( padding
, 0x36, padlen
);
1417 mbedtls_md_starts( md_ctx
);
1418 mbedtls_md_update( md_ctx
, secret
, md_size
);
1419 mbedtls_md_update( md_ctx
, padding
, padlen
);
1420 mbedtls_md_update( md_ctx
, header
, 11 );
1421 mbedtls_md_update( md_ctx
, buf
, len
);
1422 mbedtls_md_finish( md_ctx
, out
);
1424 memset( padding
, 0x5C, padlen
);
1425 mbedtls_md_starts( md_ctx
);
1426 mbedtls_md_update( md_ctx
, secret
, md_size
);
1427 mbedtls_md_update( md_ctx
, padding
, padlen
);
1428 mbedtls_md_update( md_ctx
, out
, md_size
);
1429 mbedtls_md_finish( md_ctx
, out
);
1431 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
1433 #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER) || \
1434 defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC)
1435 #define SSL_SOME_MODES_USE_MAC
1439 * Encryption/decryption functions
1441 static int ssl_encrypt_buf( mbedtls_ssl_context
*ssl
)
1443 mbedtls_cipher_mode_t mode
;
1446 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
1448 if( ssl
->session_out
== NULL
|| ssl
->transform_out
== NULL
)
1450 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1451 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1454 mode
= mbedtls_cipher_get_cipher_mode( &ssl
->transform_out
->cipher_ctx_enc
);
1456 MBEDTLS_SSL_DEBUG_BUF( 4, "before encrypt: output payload",
1457 ssl
->out_msg
, ssl
->out_msglen
);
1460 * Add MAC before if needed
1462 #if defined(SSL_SOME_MODES_USE_MAC)
1463 if( mode
== MBEDTLS_MODE_STREAM
||
1464 ( mode
== MBEDTLS_MODE_CBC
1465 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1466 && ssl
->session_out
->encrypt_then_mac
== MBEDTLS_SSL_ETM_DISABLED
1470 #if defined(MBEDTLS_SSL_PROTO_SSL3)
1471 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
)
1473 unsigned char mac
[SSL_MAC_MAX_BYTES
];
1475 ssl_mac( &ssl
->transform_out
->md_ctx_enc
,
1476 ssl
->transform_out
->mac_enc
,
1477 ssl
->out_msg
, ssl
->out_msglen
,
1478 ssl
->out_ctr
, ssl
->out_msgtype
,
1481 memcpy( ssl
->out_msg
+ ssl
->out_msglen
, mac
, ssl
->transform_out
->maclen
);
1485 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
1486 defined(MBEDTLS_SSL_PROTO_TLS1_2)
1487 if( ssl
->minor_ver
>= MBEDTLS_SSL_MINOR_VERSION_1
)
1489 unsigned char mac
[MBEDTLS_SSL_MAC_ADD
];
1491 mbedtls_md_hmac_update( &ssl
->transform_out
->md_ctx_enc
, ssl
->out_ctr
, 8 );
1492 mbedtls_md_hmac_update( &ssl
->transform_out
->md_ctx_enc
, ssl
->out_hdr
, 3 );
1493 mbedtls_md_hmac_update( &ssl
->transform_out
->md_ctx_enc
, ssl
->out_len
, 2 );
1494 mbedtls_md_hmac_update( &ssl
->transform_out
->md_ctx_enc
,
1495 ssl
->out_msg
, ssl
->out_msglen
);
1496 mbedtls_md_hmac_finish( &ssl
->transform_out
->md_ctx_enc
, mac
);
1497 mbedtls_md_hmac_reset( &ssl
->transform_out
->md_ctx_enc
);
1499 memcpy( ssl
->out_msg
+ ssl
->out_msglen
, mac
, ssl
->transform_out
->maclen
);
1504 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1505 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1508 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac",
1509 ssl
->out_msg
+ ssl
->out_msglen
,
1510 ssl
->transform_out
->maclen
);
1512 ssl
->out_msglen
+= ssl
->transform_out
->maclen
;
1515 #endif /* AEAD not the only option */
1520 #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
1521 if( mode
== MBEDTLS_MODE_STREAM
)
1526 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
1527 "including %d bytes of padding",
1528 ssl
->out_msglen
, 0 ) );
1530 if( ( ret
= mbedtls_cipher_crypt( &ssl
->transform_out
->cipher_ctx_enc
,
1531 ssl
->transform_out
->iv_enc
,
1532 ssl
->transform_out
->ivlen
,
1533 ssl
->out_msg
, ssl
->out_msglen
,
1534 ssl
->out_msg
, &olen
) ) != 0 )
1536 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret
);
1540 if( ssl
->out_msglen
!= olen
)
1542 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1543 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1547 #endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
1548 #if defined(MBEDTLS_GCM_C) || \
1549 defined(MBEDTLS_CCM_C) || \
1550 defined(MBEDTLS_CHACHAPOLY_C)
1551 if( mode
== MBEDTLS_MODE_GCM
||
1552 mode
== MBEDTLS_MODE_CCM
||
1553 mode
== MBEDTLS_MODE_CHACHAPOLY
)
1556 size_t enc_msglen
, olen
;
1557 unsigned char *enc_msg
;
1558 unsigned char add_data
[13];
1559 unsigned char iv
[12];
1560 mbedtls_ssl_transform
*transform
= ssl
->transform_out
;
1561 unsigned char taglen
= transform
->ciphersuite_info
->flags
&
1562 MBEDTLS_CIPHERSUITE_SHORT_TAG
? 8 : 16;
1563 size_t explicit_ivlen
= transform
->ivlen
- transform
->fixed_ivlen
;
1566 * Prepare additional authenticated data
1568 memcpy( add_data
, ssl
->out_ctr
, 8 );
1569 add_data
[8] = ssl
->out_msgtype
;
1570 mbedtls_ssl_write_version( ssl
->major_ver
, ssl
->minor_ver
,
1571 ssl
->conf
->transport
, add_data
+ 9 );
1572 add_data
[11] = ( ssl
->out_msglen
>> 8 ) & 0xFF;
1573 add_data
[12] = ssl
->out_msglen
& 0xFF;
1575 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data for AEAD", add_data
, 13 );
1580 if( transform
->ivlen
== 12 && transform
->fixed_ivlen
== 4 )
1582 /* GCM and CCM: fixed || explicit (=seqnum) */
1583 memcpy( iv
, transform
->iv_enc
, transform
->fixed_ivlen
);
1584 memcpy( iv
+ transform
->fixed_ivlen
, ssl
->out_ctr
, 8 );
1585 memcpy( ssl
->out_iv
, ssl
->out_ctr
, 8 );
1588 else if( transform
->ivlen
== 12 && transform
->fixed_ivlen
== 12 )
1590 /* ChachaPoly: fixed XOR sequence number */
1593 memcpy( iv
, transform
->iv_enc
, transform
->fixed_ivlen
);
1595 for( i
= 0; i
< 8; i
++ )
1596 iv
[i
+4] ^= ssl
->out_ctr
[i
];
1600 /* Reminder if we ever add an AEAD mode with a different size */
1601 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1602 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1605 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (internal)",
1606 iv
, transform
->ivlen
);
1607 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used (transmitted)",
1608 ssl
->out_iv
, explicit_ivlen
);
1611 * Fix message length with added IV
1613 enc_msg
= ssl
->out_msg
;
1614 enc_msglen
= ssl
->out_msglen
;
1615 ssl
->out_msglen
+= explicit_ivlen
;
1617 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
1618 "including 0 bytes of padding",
1619 ssl
->out_msglen
) );
1622 * Encrypt and authenticate
1624 if( ( ret
= mbedtls_cipher_auth_encrypt( &transform
->cipher_ctx_enc
,
1625 iv
, transform
->ivlen
,
1627 enc_msg
, enc_msglen
,
1629 enc_msg
+ enc_msglen
, taglen
) ) != 0 )
1631 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret
);
1635 if( olen
!= enc_msglen
)
1637 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1638 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1641 ssl
->out_msglen
+= taglen
;
1644 MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag", enc_msg
+ enc_msglen
, taglen
);
1647 #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
1648 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC)
1649 if( mode
== MBEDTLS_MODE_CBC
)
1652 unsigned char *enc_msg
;
1653 size_t enc_msglen
, padlen
, olen
= 0, i
;
1655 padlen
= ssl
->transform_out
->ivlen
- ( ssl
->out_msglen
+ 1 ) %
1656 ssl
->transform_out
->ivlen
;
1657 if( padlen
== ssl
->transform_out
->ivlen
)
1660 for( i
= 0; i
<= padlen
; i
++ )
1661 ssl
->out_msg
[ssl
->out_msglen
+ i
] = (unsigned char) padlen
;
1663 ssl
->out_msglen
+= padlen
+ 1;
1665 enc_msglen
= ssl
->out_msglen
;
1666 enc_msg
= ssl
->out_msg
;
1668 #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
1670 * Prepend per-record IV for block cipher in TLS v1.1 and up as per
1671 * Method 1 (6.2.3.2. in RFC4346 and RFC5246)
1673 if( ssl
->minor_ver
>= MBEDTLS_SSL_MINOR_VERSION_2
)
1678 ret
= ssl
->conf
->f_rng( ssl
->conf
->p_rng
, ssl
->transform_out
->iv_enc
,
1679 ssl
->transform_out
->ivlen
);
1683 memcpy( ssl
->out_iv
, ssl
->transform_out
->iv_enc
,
1684 ssl
->transform_out
->ivlen
);
1687 * Fix pointer positions and message length with added IV
1689 enc_msg
= ssl
->out_msg
;
1690 enc_msglen
= ssl
->out_msglen
;
1691 ssl
->out_msglen
+= ssl
->transform_out
->ivlen
;
1693 #endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
1695 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
1696 "including %d bytes of IV and %d bytes of padding",
1697 ssl
->out_msglen
, ssl
->transform_out
->ivlen
,
1700 if( ( ret
= mbedtls_cipher_crypt( &ssl
->transform_out
->cipher_ctx_enc
,
1701 ssl
->transform_out
->iv_enc
,
1702 ssl
->transform_out
->ivlen
,
1703 enc_msg
, enc_msglen
,
1704 enc_msg
, &olen
) ) != 0 )
1706 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret
);
1710 if( enc_msglen
!= olen
)
1712 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1713 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1716 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
1717 if( ssl
->minor_ver
< MBEDTLS_SSL_MINOR_VERSION_2
)
1720 * Save IV in SSL3 and TLS1
1722 memcpy( ssl
->transform_out
->iv_enc
,
1723 ssl
->transform_out
->cipher_ctx_enc
.iv
,
1724 ssl
->transform_out
->ivlen
);
1728 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1729 if( auth_done
== 0 )
1731 unsigned char mac
[MBEDTLS_SSL_MAC_ADD
];
1734 * MAC(MAC_write_key, seq_num +
1735 * TLSCipherText.type +
1736 * TLSCipherText.version +
1737 * length_of( (IV +) ENC(...) ) +
1738 * IV + // except for TLS 1.0
1739 * ENC(content + padding + padding_length));
1741 unsigned char pseudo_hdr
[13];
1743 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
1745 memcpy( pseudo_hdr
+ 0, ssl
->out_ctr
, 8 );
1746 memcpy( pseudo_hdr
+ 8, ssl
->out_hdr
, 3 );
1747 pseudo_hdr
[11] = (unsigned char)( ( ssl
->out_msglen
>> 8 ) & 0xFF );
1748 pseudo_hdr
[12] = (unsigned char)( ( ssl
->out_msglen
) & 0xFF );
1750 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", pseudo_hdr
, 13 );
1752 mbedtls_md_hmac_update( &ssl
->transform_out
->md_ctx_enc
, pseudo_hdr
, 13 );
1753 mbedtls_md_hmac_update( &ssl
->transform_out
->md_ctx_enc
,
1754 ssl
->out_iv
, ssl
->out_msglen
);
1755 mbedtls_md_hmac_finish( &ssl
->transform_out
->md_ctx_enc
, mac
);
1756 mbedtls_md_hmac_reset( &ssl
->transform_out
->md_ctx_enc
);
1758 memcpy( ssl
->out_iv
+ ssl
->out_msglen
, mac
,
1759 ssl
->transform_out
->maclen
);
1761 ssl
->out_msglen
+= ssl
->transform_out
->maclen
;
1764 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
1767 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC */
1769 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1770 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1773 /* Make extra sure authentication was performed, exactly once */
1774 if( auth_done
!= 1 )
1776 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1777 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1780 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
1785 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC)
1787 * Constant-flow conditional memcpy:
1788 * - if c1 == c2, equivalent to memcpy(dst, src, len),
1789 * - otherwise, a no-op,
1790 * but with execution flow independent of the values of c1 and c2.
1792 * Use only bit operations to avoid branches that could be used by some
1793 * compilers on some platforms to translate comparison operators.
1795 static void mbedtls_ssl_cf_memcpy_if_eq( unsigned char *dst
,
1796 const unsigned char *src
,
1798 size_t c1
, size_t c2
)
1800 /* diff = 0 if c1 == c2, non-zero otherwise */
1801 const size_t diff
= c1
^ c2
;
1803 /* MSVC has a warning about unary minus on unsigned integer types,
1804 * but this is well-defined and precisely what we want to do here. */
1805 #if defined(_MSC_VER)
1806 #pragma warning( push )
1807 #pragma warning( disable : 4146 )
1810 /* diff_msb's most significant bit is equal to c1 != c2 */
1811 const size_t diff_msb
= ( diff
| -diff
);
1813 /* diff1 = c1 != c2 */
1814 const size_t diff1
= diff_msb
>> ( sizeof( diff_msb
) * 8 - 1 );
1816 /* mask = c1 != c2 ? 0xff : 0x00 */
1817 const unsigned char mask
= (unsigned char) -diff1
;
1819 #if defined(_MSC_VER)
1820 #pragma warning( pop )
1823 /* dst[i] = c1 != c2 ? dst[i] : src[i] */
1825 for( i
= 0; i
< len
; i
++ )
1826 dst
[i
] = ( dst
[i
] & mask
) | ( src
[i
] & ~mask
);
1830 * Compute HMAC of variable-length data with constant flow.
1832 * Only works with MD-5, SHA-1, SHA-256 and SHA-384.
1833 * (Otherwise, computation of block_size needs to be adapted.)
1835 int mbedtls_ssl_cf_hmac(
1836 mbedtls_md_context_t
*ctx
,
1837 const unsigned char *add_data
, size_t add_data_len
,
1838 const unsigned char *data
, size_t data_len_secret
,
1839 size_t min_data_len
, size_t max_data_len
,
1840 unsigned char *output
)
1843 * This function breaks the HMAC abstraction and uses the md_clone()
1844 * extension to the MD API in order to get constant-flow behaviour.
1846 * HMAC(msg) is defined as HASH(okey + HASH(ikey + msg)) where + means
1847 * concatenation, and okey/ikey are the XOR of the key with some fixed bit
1848 * patterns (see RFC 2104, sec. 2), which are stored in ctx->hmac_ctx.
1850 * We'll first compute inner_hash = HASH(ikey + msg) by hashing up to
1851 * minlen, then cloning the context, and for each byte up to maxlen
1852 * finishing up the hash computation, keeping only the correct result.
1854 * Then we only need to compute HASH(okey + inner_hash) and we're done.
1856 const mbedtls_md_type_t md_alg
= mbedtls_md_get_type( ctx
->md_info
);
1857 /* TLS 1.0-1.2 only support SHA-384, SHA-256, SHA-1, MD-5,
1858 * all of which have the same block size except SHA-384. */
1859 const size_t block_size
= md_alg
== MBEDTLS_MD_SHA384
? 128 : 64;
1860 const unsigned char * const ikey
= ctx
->hmac_ctx
;
1861 const unsigned char * const okey
= ikey
+ block_size
;
1862 const size_t hash_size
= mbedtls_md_get_size( ctx
->md_info
);
1864 unsigned char aux_out
[MBEDTLS_MD_MAX_SIZE
];
1865 mbedtls_md_context_t aux
;
1869 mbedtls_md_init( &aux
);
1871 #define MD_CHK( func_call ) \
1873 ret = (func_call); \
1878 MD_CHK( mbedtls_md_setup( &aux
, ctx
->md_info
, 0 ) );
1880 /* After hmac_start() of hmac_reset(), ikey has already been hashed,
1881 * so we can start directly with the message */
1882 MD_CHK( mbedtls_md_update( ctx
, add_data
, add_data_len
) );
1883 MD_CHK( mbedtls_md_update( ctx
, data
, min_data_len
) );
1885 /* For each possible length, compute the hash up to that point */
1886 for( offset
= min_data_len
; offset
<= max_data_len
; offset
++ )
1888 MD_CHK( mbedtls_md_clone( &aux
, ctx
) );
1889 MD_CHK( mbedtls_md_finish( &aux
, aux_out
) );
1890 /* Keep only the correct inner_hash in the output buffer */
1891 mbedtls_ssl_cf_memcpy_if_eq( output
, aux_out
, hash_size
,
1892 offset
, data_len_secret
);
1894 if( offset
< max_data_len
)
1895 MD_CHK( mbedtls_md_update( ctx
, data
+ offset
, 1 ) );
1898 /* The context needs to finish() before it starts() again */
1899 MD_CHK( mbedtls_md_finish( ctx
, aux_out
) );
1901 /* Now compute HASH(okey + inner_hash) */
1902 MD_CHK( mbedtls_md_starts( ctx
) );
1903 MD_CHK( mbedtls_md_update( ctx
, okey
, block_size
) );
1904 MD_CHK( mbedtls_md_update( ctx
, output
, hash_size
) );
1905 MD_CHK( mbedtls_md_finish( ctx
, output
) );
1907 /* Done, get ready for next time */
1908 MD_CHK( mbedtls_md_hmac_reset( ctx
) );
1913 mbedtls_md_free( &aux
);
1918 * Constant-flow memcpy from variable position in buffer.
1919 * - functionally equivalent to memcpy(dst, src + offset_secret, len)
1920 * - but with execution flow independent from the value of offset_secret.
1922 void mbedtls_ssl_cf_memcpy_offset( unsigned char *dst
,
1923 const unsigned char *src_base
,
1924 size_t offset_secret
,
1925 size_t offset_min
, size_t offset_max
,
1930 for( offset
= offset_min
; offset
<= offset_max
; offset
++ )
1932 mbedtls_ssl_cf_memcpy_if_eq( dst
, src_base
+ offset
, len
,
1933 offset
, offset_secret
);
1936 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC */
1938 static int ssl_decrypt_buf( mbedtls_ssl_context
*ssl
)
1940 mbedtls_cipher_mode_t mode
;
1942 #if defined(SSL_SOME_MODES_USE_MAC)
1943 size_t padlen
= 0, correct
= 1;
1946 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
1948 if( ssl
->session_in
== NULL
|| ssl
->transform_in
== NULL
)
1950 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1951 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1954 mode
= mbedtls_cipher_get_cipher_mode( &ssl
->transform_in
->cipher_ctx_dec
);
1956 if( ssl
->in_msglen
< ssl
->transform_in
->minlen
)
1958 MBEDTLS_SSL_DEBUG_MSG( 1, ( "in_msglen (%d) < minlen (%d)",
1959 ssl
->in_msglen
, ssl
->transform_in
->minlen
) );
1960 return( MBEDTLS_ERR_SSL_INVALID_MAC
);
1963 #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
1964 if( mode
== MBEDTLS_MODE_STREAM
)
1971 if( ( ret
= mbedtls_cipher_crypt( &ssl
->transform_in
->cipher_ctx_dec
,
1972 ssl
->transform_in
->iv_dec
,
1973 ssl
->transform_in
->ivlen
,
1974 ssl
->in_msg
, ssl
->in_msglen
,
1975 ssl
->in_msg
, &olen
) ) != 0 )
1977 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret
);
1981 if( ssl
->in_msglen
!= olen
)
1983 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1984 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
1988 #endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
1989 #if defined(MBEDTLS_GCM_C) || \
1990 defined(MBEDTLS_CCM_C) || \
1991 defined(MBEDTLS_CHACHAPOLY_C)
1992 if( mode
== MBEDTLS_MODE_GCM
||
1993 mode
== MBEDTLS_MODE_CCM
||
1994 mode
== MBEDTLS_MODE_CHACHAPOLY
)
1997 size_t dec_msglen
, olen
;
1998 unsigned char *dec_msg
;
1999 unsigned char *dec_msg_result
;
2000 unsigned char add_data
[13];
2001 unsigned char iv
[12];
2002 mbedtls_ssl_transform
*transform
= ssl
->transform_in
;
2003 unsigned char taglen
= transform
->ciphersuite_info
->flags
&
2004 MBEDTLS_CIPHERSUITE_SHORT_TAG
? 8 : 16;
2005 size_t explicit_iv_len
= transform
->ivlen
- transform
->fixed_ivlen
;
2008 * Compute and update sizes
2010 if( ssl
->in_msglen
< explicit_iv_len
+ taglen
)
2012 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < explicit_iv_len (%d) "
2013 "+ taglen (%d)", ssl
->in_msglen
,
2014 explicit_iv_len
, taglen
) );
2015 return( MBEDTLS_ERR_SSL_INVALID_MAC
);
2017 dec_msglen
= ssl
->in_msglen
- explicit_iv_len
- taglen
;
2019 dec_msg
= ssl
->in_msg
;
2020 dec_msg_result
= ssl
->in_msg
;
2021 ssl
->in_msglen
= dec_msglen
;
2024 * Prepare additional authenticated data
2026 memcpy( add_data
, ssl
->in_ctr
, 8 );
2027 add_data
[8] = ssl
->in_msgtype
;
2028 mbedtls_ssl_write_version( ssl
->major_ver
, ssl
->minor_ver
,
2029 ssl
->conf
->transport
, add_data
+ 9 );
2030 add_data
[11] = ( ssl
->in_msglen
>> 8 ) & 0xFF;
2031 add_data
[12] = ssl
->in_msglen
& 0xFF;
2033 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data for AEAD", add_data
, 13 );
2038 if( transform
->ivlen
== 12 && transform
->fixed_ivlen
== 4 )
2040 /* GCM and CCM: fixed || explicit (transmitted) */
2041 memcpy( iv
, transform
->iv_dec
, transform
->fixed_ivlen
);
2042 memcpy( iv
+ transform
->fixed_ivlen
, ssl
->in_iv
, 8 );
2045 else if( transform
->ivlen
== 12 && transform
->fixed_ivlen
== 12 )
2047 /* ChachaPoly: fixed XOR sequence number */
2050 memcpy( iv
, transform
->iv_dec
, transform
->fixed_ivlen
);
2052 for( i
= 0; i
< 8; i
++ )
2053 iv
[i
+4] ^= ssl
->in_ctr
[i
];
2057 /* Reminder if we ever add an AEAD mode with a different size */
2058 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2059 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
2062 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", iv
, transform
->ivlen
);
2063 MBEDTLS_SSL_DEBUG_BUF( 4, "TAG used", dec_msg
+ dec_msglen
, taglen
);
2066 * Decrypt and authenticate
2068 if( ( ret
= mbedtls_cipher_auth_decrypt( &ssl
->transform_in
->cipher_ctx_dec
,
2069 iv
, transform
->ivlen
,
2071 dec_msg
, dec_msglen
,
2072 dec_msg_result
, &olen
,
2073 dec_msg
+ dec_msglen
, taglen
) ) != 0 )
2075 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret
);
2077 if( ret
== MBEDTLS_ERR_CIPHER_AUTH_FAILED
)
2078 return( MBEDTLS_ERR_SSL_INVALID_MAC
);
2084 if( olen
!= dec_msglen
)
2086 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2087 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
2091 #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
2092 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC)
2093 if( mode
== MBEDTLS_MODE_CBC
)
2096 * Decrypt and check the padding
2099 unsigned char *dec_msg
;
2100 unsigned char *dec_msg_result
;
2106 * Check immediate ciphertext sanity
2108 #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
2109 if( ssl
->minor_ver
>= MBEDTLS_SSL_MINOR_VERSION_2
)
2110 minlen
+= ssl
->transform_in
->ivlen
;
2113 if( ssl
->in_msglen
< minlen
+ ssl
->transform_in
->ivlen
||
2114 ssl
->in_msglen
< minlen
+ ssl
->transform_in
->maclen
+ 1 )
2116 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < max( ivlen(%d), maclen (%d) "
2117 "+ 1 ) ( + expl IV )", ssl
->in_msglen
,
2118 ssl
->transform_in
->ivlen
,
2119 ssl
->transform_in
->maclen
) );
2120 return( MBEDTLS_ERR_SSL_INVALID_MAC
);
2123 dec_msglen
= ssl
->in_msglen
;
2124 dec_msg
= ssl
->in_msg
;
2125 dec_msg_result
= ssl
->in_msg
;
2128 * Authenticate before decrypt if enabled
2130 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
2131 if( ssl
->session_in
->encrypt_then_mac
== MBEDTLS_SSL_ETM_ENABLED
)
2133 unsigned char mac_expect
[MBEDTLS_SSL_MAC_ADD
];
2134 unsigned char pseudo_hdr
[13];
2136 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
2138 dec_msglen
-= ssl
->transform_in
->maclen
;
2139 ssl
->in_msglen
-= ssl
->transform_in
->maclen
;
2141 memcpy( pseudo_hdr
+ 0, ssl
->in_ctr
, 8 );
2142 memcpy( pseudo_hdr
+ 8, ssl
->in_hdr
, 3 );
2143 pseudo_hdr
[11] = (unsigned char)( ( ssl
->in_msglen
>> 8 ) & 0xFF );
2144 pseudo_hdr
[12] = (unsigned char)( ( ssl
->in_msglen
) & 0xFF );
2146 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", pseudo_hdr
, 13 );
2148 mbedtls_md_hmac_update( &ssl
->transform_in
->md_ctx_dec
, pseudo_hdr
, 13 );
2149 mbedtls_md_hmac_update( &ssl
->transform_in
->md_ctx_dec
,
2150 ssl
->in_iv
, ssl
->in_msglen
);
2151 mbedtls_md_hmac_finish( &ssl
->transform_in
->md_ctx_dec
, mac_expect
);
2152 mbedtls_md_hmac_reset( &ssl
->transform_in
->md_ctx_dec
);
2154 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", ssl
->in_iv
+ ssl
->in_msglen
,
2155 ssl
->transform_in
->maclen
);
2156 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect
,
2157 ssl
->transform_in
->maclen
);
2159 if( mbedtls_ssl_safer_memcmp( ssl
->in_iv
+ ssl
->in_msglen
, mac_expect
,
2160 ssl
->transform_in
->maclen
) != 0 )
2162 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
2164 return( MBEDTLS_ERR_SSL_INVALID_MAC
);
2168 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
2171 * Check length sanity
2173 if( ssl
->in_msglen
% ssl
->transform_in
->ivlen
!= 0 )
2175 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0",
2176 ssl
->in_msglen
, ssl
->transform_in
->ivlen
) );
2177 return( MBEDTLS_ERR_SSL_INVALID_MAC
);
2180 #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
2182 * Initialize for prepended IV for block cipher in TLS v1.1 and up
2184 if( ssl
->minor_ver
>= MBEDTLS_SSL_MINOR_VERSION_2
)
2187 dec_msglen
-= ssl
->transform_in
->ivlen
;
2188 ssl
->in_msglen
-= ssl
->transform_in
->ivlen
;
2190 for( i
= 0; i
< ssl
->transform_in
->ivlen
; i
++ )
2191 ssl
->transform_in
->iv_dec
[i
] = ssl
->in_iv
[i
];
2193 #endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
2195 if( ( ret
= mbedtls_cipher_crypt( &ssl
->transform_in
->cipher_ctx_dec
,
2196 ssl
->transform_in
->iv_dec
,
2197 ssl
->transform_in
->ivlen
,
2198 dec_msg
, dec_msglen
,
2199 dec_msg_result
, &olen
) ) != 0 )
2201 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret
);
2205 if( dec_msglen
!= olen
)
2207 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2208 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
2211 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
2212 if( ssl
->minor_ver
< MBEDTLS_SSL_MINOR_VERSION_2
)
2215 * Save IV in SSL3 and TLS1
2217 memcpy( ssl
->transform_in
->iv_dec
,
2218 ssl
->transform_in
->cipher_ctx_dec
.iv
,
2219 ssl
->transform_in
->ivlen
);
2223 padlen
= 1 + ssl
->in_msg
[ssl
->in_msglen
- 1];
2225 if( ssl
->in_msglen
< ssl
->transform_in
->maclen
+ padlen
&&
2228 #if defined(MBEDTLS_SSL_DEBUG_ALL)
2229 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
2230 ssl
->in_msglen
, ssl
->transform_in
->maclen
, padlen
) );
2236 #if defined(MBEDTLS_SSL_PROTO_SSL3)
2237 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
)
2239 if( padlen
> ssl
->transform_in
->ivlen
)
2241 #if defined(MBEDTLS_SSL_DEBUG_ALL)
2242 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
2243 "should be no more than %d",
2244 padlen
, ssl
->transform_in
->ivlen
) );
2250 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
2251 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2252 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2253 if( ssl
->minor_ver
> MBEDTLS_SSL_MINOR_VERSION_0
)
2256 * TLSv1+: always check the padding up to the first failure
2257 * and fake check up to 256 bytes of padding
2259 size_t pad_count
= 0, real_count
= 1;
2260 size_t padding_idx
= ssl
->in_msglen
- padlen
;
2264 * Padding is guaranteed to be incorrect if:
2265 * 1. padlen > ssl->in_msglen
2267 * 2. padding_idx > MBEDTLS_SSL_IN_CONTENT_LEN +
2268 * ssl->transform_in->maclen
2270 * In both cases we reset padding_idx to a safe value (0) to
2271 * prevent out-of-buffer reads.
2273 correct
&= ( padlen
<= ssl
->in_msglen
);
2274 correct
&= ( padding_idx
<= MBEDTLS_SSL_IN_CONTENT_LEN
+
2275 ssl
->transform_in
->maclen
);
2277 padding_idx
*= correct
;
2279 for( i
= 0; i
< 256; i
++ )
2281 real_count
&= ( i
< padlen
);
2282 pad_count
+= real_count
*
2283 ( ssl
->in_msg
[padding_idx
+ i
] == padlen
- 1 );
2286 correct
&= ( pad_count
== padlen
); /* Only 1 on correct padding */
2288 #if defined(MBEDTLS_SSL_DEBUG_ALL)
2289 if( padlen
> 0 && correct
== 0 )
2290 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
2292 padlen
&= correct
* 0x1FF;
2295 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
2296 MBEDTLS_SSL_PROTO_TLS1_2 */
2298 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2299 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
2302 ssl
->in_msglen
-= padlen
;
2305 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC) */
2307 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2308 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
2311 #if defined(MBEDTLS_SSL_DEBUG_ALL)
2312 MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption",
2313 ssl
->in_msg
, ssl
->in_msglen
);
2317 * Authenticate if not done yet.
2318 * Compute the MAC regardless of the padding result (RFC4346, CBCTIME).
2320 #if defined(SSL_SOME_MODES_USE_MAC)
2321 if( auth_done
== 0 )
2323 unsigned char mac_expect
[MBEDTLS_SSL_MAC_ADD
];
2324 unsigned char mac_peer
[MBEDTLS_SSL_MAC_ADD
];
2326 ssl
->in_msglen
-= ssl
->transform_in
->maclen
;
2328 ssl
->in_len
[0] = (unsigned char)( ssl
->in_msglen
>> 8 );
2329 ssl
->in_len
[1] = (unsigned char)( ssl
->in_msglen
);
2331 #if defined(MBEDTLS_SSL_PROTO_SSL3)
2332 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
)
2334 ssl_mac( &ssl
->transform_in
->md_ctx_dec
,
2335 ssl
->transform_in
->mac_dec
,
2336 ssl
->in_msg
, ssl
->in_msglen
,
2337 ssl
->in_ctr
, ssl
->in_msgtype
,
2339 memcpy( mac_peer
, ssl
->in_msg
+ ssl
->in_msglen
,
2340 ssl
->transform_in
->maclen
);
2343 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
2344 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2345 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2346 if( ssl
->minor_ver
> MBEDTLS_SSL_MINOR_VERSION_0
)
2349 unsigned char add_data
[13];
2352 * The next two sizes are the minimum and maximum values of
2353 * in_msglen over all padlen values.
2355 * They're independent of padlen, since we previously did
2356 * in_msglen -= padlen.
2358 * Note that max_len + maclen is never more than the buffer
2359 * length, as we previously did in_msglen -= maclen too.
2361 const size_t max_len
= ssl
->in_msglen
+ padlen
;
2362 const size_t min_len
= ( max_len
> 256 ) ? max_len
- 256 : 0;
2364 memcpy( add_data
+ 0, ssl
->in_ctr
, 8 );
2365 memcpy( add_data
+ 8, ssl
->in_hdr
, 3 );
2366 memcpy( add_data
+ 11, ssl
->in_len
, 2 );
2368 ret
= mbedtls_ssl_cf_hmac( &ssl
->transform_in
->md_ctx_dec
,
2369 add_data
, sizeof( add_data
),
2370 ssl
->in_msg
, ssl
->in_msglen
,
2375 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_cf_hmac", ret
);
2379 mbedtls_ssl_cf_memcpy_offset( mac_peer
, ssl
->in_msg
,
2382 ssl
->transform_in
->maclen
);
2385 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
2386 MBEDTLS_SSL_PROTO_TLS1_2 */
2388 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2389 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
2392 #if defined(MBEDTLS_SSL_DEBUG_ALL)
2393 MBEDTLS_SSL_DEBUG_BUF( 4, "expected mac", mac_expect
, ssl
->transform_in
->maclen
);
2394 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", mac_peer
, ssl
->transform_in
->maclen
);
2397 if( mbedtls_ssl_safer_memcmp( mac_peer
, mac_expect
,
2398 ssl
->transform_in
->maclen
) != 0 )
2400 #if defined(MBEDTLS_SSL_DEBUG_ALL)
2401 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
2409 * Finally check the correct flag
2412 return( MBEDTLS_ERR_SSL_INVALID_MAC
);
2413 #endif /* SSL_SOME_MODES_USE_MAC */
2415 /* Make extra sure authentication was performed, exactly once */
2416 if( auth_done
!= 1 )
2418 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2419 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
2422 if( ssl
->in_msglen
== 0 )
2424 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2425 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_3
2426 && ssl
->in_msgtype
!= MBEDTLS_SSL_MSG_APPLICATION_DATA
)
2428 /* TLS v1.2 explicitly disallows zero-length messages which are not application data */
2429 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid zero-length message type: %d", ssl
->in_msgtype
) );
2430 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
2432 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2437 * Three or more empty messages may be a DoS attack
2438 * (excessive CPU consumption).
2440 if( ssl
->nb_zero
> 3 )
2442 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
2443 "messages, possible DoS attack" ) );
2444 return( MBEDTLS_ERR_SSL_INVALID_MAC
);
2450 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2451 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
2453 ; /* in_ctr read from peer, not maintained internally */
2459 for( i
= 8; i
> ssl_ep_len( ssl
); i
-- )
2460 if( ++ssl
->in_ctr
[i
- 1] != 0 )
2463 /* The loop goes to its end iff the counter is wrapping */
2464 if( i
== ssl_ep_len( ssl
) )
2466 MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
2467 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING
);
2471 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
2477 #undef MAC_PLAINTEXT
2478 #undef MAC_CIPHERTEXT
2480 #if defined(MBEDTLS_ZLIB_SUPPORT)
2482 * Compression/decompression functions
2484 static int ssl_compress_buf( mbedtls_ssl_context
*ssl
)
2487 unsigned char *msg_post
= ssl
->out_msg
;
2488 ptrdiff_t bytes_written
= ssl
->out_msg
- ssl
->out_buf
;
2489 size_t len_pre
= ssl
->out_msglen
;
2490 unsigned char *msg_pre
= ssl
->compress_buf
;
2492 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> compress buf" ) );
2497 memcpy( msg_pre
, ssl
->out_msg
, len_pre
);
2499 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before compression: msglen = %d, ",
2500 ssl
->out_msglen
) );
2502 MBEDTLS_SSL_DEBUG_BUF( 4, "before compression: output payload",
2503 ssl
->out_msg
, ssl
->out_msglen
);
2505 ssl
->transform_out
->ctx_deflate
.next_in
= msg_pre
;
2506 ssl
->transform_out
->ctx_deflate
.avail_in
= len_pre
;
2507 ssl
->transform_out
->ctx_deflate
.next_out
= msg_post
;
2508 ssl
->transform_out
->ctx_deflate
.avail_out
= MBEDTLS_SSL_OUT_BUFFER_LEN
- bytes_written
;
2510 ret
= deflate( &ssl
->transform_out
->ctx_deflate
, Z_SYNC_FLUSH
);
2513 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform compression (%d)", ret
) );
2514 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED
);
2517 ssl
->out_msglen
= MBEDTLS_SSL_OUT_BUFFER_LEN
-
2518 ssl
->transform_out
->ctx_deflate
.avail_out
- bytes_written
;
2520 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
2521 ssl
->out_msglen
) );
2523 MBEDTLS_SSL_DEBUG_BUF( 4, "after compression: output payload",
2524 ssl
->out_msg
, ssl
->out_msglen
);
2526 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= compress buf" ) );
2531 static int ssl_decompress_buf( mbedtls_ssl_context
*ssl
)
2534 unsigned char *msg_post
= ssl
->in_msg
;
2535 ptrdiff_t header_bytes
= ssl
->in_msg
- ssl
->in_buf
;
2536 size_t len_pre
= ssl
->in_msglen
;
2537 unsigned char *msg_pre
= ssl
->compress_buf
;
2539 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decompress buf" ) );
2544 memcpy( msg_pre
, ssl
->in_msg
, len_pre
);
2546 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before decompression: msglen = %d, ",
2549 MBEDTLS_SSL_DEBUG_BUF( 4, "before decompression: input payload",
2550 ssl
->in_msg
, ssl
->in_msglen
);
2552 ssl
->transform_in
->ctx_inflate
.next_in
= msg_pre
;
2553 ssl
->transform_in
->ctx_inflate
.avail_in
= len_pre
;
2554 ssl
->transform_in
->ctx_inflate
.next_out
= msg_post
;
2555 ssl
->transform_in
->ctx_inflate
.avail_out
= MBEDTLS_SSL_IN_BUFFER_LEN
-
2558 ret
= inflate( &ssl
->transform_in
->ctx_inflate
, Z_SYNC_FLUSH
);
2561 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform decompression (%d)", ret
) );
2562 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED
);
2565 ssl
->in_msglen
= MBEDTLS_SSL_IN_BUFFER_LEN
-
2566 ssl
->transform_in
->ctx_inflate
.avail_out
- header_bytes
;
2568 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
2571 MBEDTLS_SSL_DEBUG_BUF( 4, "after decompression: input payload",
2572 ssl
->in_msg
, ssl
->in_msglen
);
2574 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decompress buf" ) );
2578 #endif /* MBEDTLS_ZLIB_SUPPORT */
2580 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
2581 static int ssl_write_hello_request( mbedtls_ssl_context
*ssl
);
2583 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2584 static int ssl_resend_hello_request( mbedtls_ssl_context
*ssl
)
2586 /* If renegotiation is not enforced, retransmit until we would reach max
2587 * timeout if we were using the usual handshake doubling scheme */
2588 if( ssl
->conf
->renego_max_records
< 0 )
2590 uint32_t ratio
= ssl
->conf
->hs_timeout_max
/ ssl
->conf
->hs_timeout_min
+ 1;
2591 unsigned char doublings
= 1;
2599 if( ++ssl
->renego_records_seen
> doublings
)
2601 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
2606 return( ssl_write_hello_request( ssl
) );
2609 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
2612 * Fill the input message buffer by appending data to it.
2613 * The amount of data already fetched is in ssl->in_left.
2615 * If we return 0, is it guaranteed that (at least) nb_want bytes are
2616 * available (from this read and/or a previous one). Otherwise, an error code
2617 * is returned (possibly EOF or WANT_READ).
2619 * With stream transport (TLS) on success ssl->in_left == nb_want, but
2620 * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
2621 * since we always read a whole datagram at once.
2623 * For DTLS, it is up to the caller to set ssl->next_record_offset when
2624 * they're done reading a record.
2626 int mbedtls_ssl_fetch_input( mbedtls_ssl_context
*ssl
, size_t nb_want
)
2631 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
2633 if( ssl
->f_recv
== NULL
&& ssl
->f_recv_timeout
== NULL
)
2635 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
2636 "or mbedtls_ssl_set_bio()" ) );
2637 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
2640 if( nb_want
> MBEDTLS_SSL_IN_BUFFER_LEN
- (size_t)( ssl
->in_hdr
- ssl
->in_buf
) )
2642 MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
2643 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
2646 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2647 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
2651 /* Just to be sure */
2652 if( ssl
->f_set_timer
== NULL
|| ssl
->f_get_timer
== NULL
)
2654 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
2655 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
2656 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
2660 * The point is, we need to always read a full datagram at once, so we
2661 * sometimes read more then requested, and handle the additional data.
2662 * It could be the rest of the current record (while fetching the
2663 * header) and/or some other records in the same datagram.
2667 * Move to the next record in the already read datagram if applicable
2669 if( ssl
->next_record_offset
!= 0 )
2671 if( ssl
->in_left
< ssl
->next_record_offset
)
2673 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2674 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
2677 ssl
->in_left
-= ssl
->next_record_offset
;
2679 if( ssl
->in_left
!= 0 )
2681 MBEDTLS_SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %d",
2682 ssl
->next_record_offset
) );
2683 memmove( ssl
->in_hdr
,
2684 ssl
->in_hdr
+ ssl
->next_record_offset
,
2688 ssl
->next_record_offset
= 0;
2691 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
2692 ssl
->in_left
, nb_want
) );
2695 * Done if we already have enough data.
2697 if( nb_want
<= ssl
->in_left
)
2699 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
2704 * A record can't be split across datagrams. If we need to read but
2705 * are not at the beginning of a new record, the caller did something
2708 if( ssl
->in_left
!= 0 )
2710 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2711 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
2715 * Don't even try to read if time's out already.
2716 * This avoids by-passing the timer when repeatedly receiving messages
2717 * that will end up being dropped.
2719 if( ssl_check_timer( ssl
) != 0 )
2721 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timer has expired" ) );
2722 ret
= MBEDTLS_ERR_SSL_TIMEOUT
;
2726 len
= MBEDTLS_SSL_IN_BUFFER_LEN
- ( ssl
->in_hdr
- ssl
->in_buf
);
2728 if( ssl
->state
!= MBEDTLS_SSL_HANDSHAKE_OVER
)
2729 timeout
= ssl
->handshake
->retransmit_timeout
;
2731 timeout
= ssl
->conf
->read_timeout
;
2733 MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout
) );
2735 if( ssl
->f_recv_timeout
!= NULL
)
2736 ret
= ssl
->f_recv_timeout( ssl
->p_bio
, ssl
->in_hdr
, len
,
2739 ret
= ssl
->f_recv( ssl
->p_bio
, ssl
->in_hdr
, len
);
2741 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret
);
2744 return( MBEDTLS_ERR_SSL_CONN_EOF
);
2747 if( ret
== MBEDTLS_ERR_SSL_TIMEOUT
)
2749 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) );
2750 ssl_set_timer( ssl
, 0 );
2752 if( ssl
->state
!= MBEDTLS_SSL_HANDSHAKE_OVER
)
2754 if( ssl_double_retransmit_timeout( ssl
) != 0 )
2756 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
2757 return( MBEDTLS_ERR_SSL_TIMEOUT
);
2760 if( ( ret
= mbedtls_ssl_resend( ssl
) ) != 0 )
2762 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret
);
2766 return( MBEDTLS_ERR_SSL_WANT_READ
);
2768 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
2769 else if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
&&
2770 ssl
->renego_status
== MBEDTLS_SSL_RENEGOTIATION_PENDING
)
2772 if( ( ret
= ssl_resend_hello_request( ssl
) ) != 0 )
2774 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret
);
2778 return( MBEDTLS_ERR_SSL_WANT_READ
);
2780 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
2791 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
2792 ssl
->in_left
, nb_want
) );
2794 while( ssl
->in_left
< nb_want
)
2796 len
= nb_want
- ssl
->in_left
;
2798 if( ssl_check_timer( ssl
) != 0 )
2799 ret
= MBEDTLS_ERR_SSL_TIMEOUT
;
2802 if( ssl
->f_recv_timeout
!= NULL
)
2804 ret
= ssl
->f_recv_timeout( ssl
->p_bio
,
2805 ssl
->in_hdr
+ ssl
->in_left
, len
,
2806 ssl
->conf
->read_timeout
);
2810 ret
= ssl
->f_recv( ssl
->p_bio
,
2811 ssl
->in_hdr
+ ssl
->in_left
, len
);
2815 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
2816 ssl
->in_left
, nb_want
) );
2817 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret
);
2820 return( MBEDTLS_ERR_SSL_CONN_EOF
);
2825 if ( (size_t)ret
> len
|| ( INT_MAX
> SIZE_MAX
&& ret
> (int)SIZE_MAX
) )
2827 MBEDTLS_SSL_DEBUG_MSG( 1,
2828 ( "f_recv returned %d bytes but only %lu were requested",
2829 ret
, (unsigned long)len
) );
2830 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
2833 ssl
->in_left
+= ret
;
2837 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
2843 * Flush any data not yet written
2845 int mbedtls_ssl_flush_output( mbedtls_ssl_context
*ssl
)
2850 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
2852 if( ssl
->f_send
== NULL
)
2854 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
2855 "or mbedtls_ssl_set_bio()" ) );
2856 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
2859 /* Avoid incrementing counter if data is flushed */
2860 if( ssl
->out_left
== 0 )
2862 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
2866 while( ssl
->out_left
> 0 )
2868 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
2869 mbedtls_ssl_hdr_len( ssl
) + ssl
->out_msglen
, ssl
->out_left
) );
2871 buf
= ssl
->out_hdr
- ssl
->out_left
;
2872 ret
= ssl
->f_send( ssl
->p_bio
, buf
, ssl
->out_left
);
2874 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret
);
2879 if( (size_t)ret
> ssl
->out_left
|| ( INT_MAX
> SIZE_MAX
&& ret
> (int)SIZE_MAX
) )
2881 MBEDTLS_SSL_DEBUG_MSG( 1,
2882 ( "f_send returned %d bytes but only %lu bytes were sent",
2883 ret
, (unsigned long)ssl
->out_left
) );
2884 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
2887 ssl
->out_left
-= ret
;
2890 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2891 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
2893 ssl
->out_hdr
= ssl
->out_buf
;
2898 ssl
->out_hdr
= ssl
->out_buf
+ 8;
2900 ssl_update_out_pointers( ssl
, ssl
->transform_out
);
2902 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
2908 * Functions to handle the DTLS retransmission state machine
2910 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2912 * Append current handshake message to current outgoing flight
2914 static int ssl_flight_append( mbedtls_ssl_context
*ssl
)
2916 mbedtls_ssl_flight_item
*msg
;
2917 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_flight_append" ) );
2918 MBEDTLS_SSL_DEBUG_BUF( 4, "message appended to flight",
2919 ssl
->out_msg
, ssl
->out_msglen
);
2921 /* Allocate space for current message */
2922 if( ( msg
= mbedtls_calloc( 1, sizeof( mbedtls_ssl_flight_item
) ) ) == NULL
)
2924 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed",
2925 sizeof( mbedtls_ssl_flight_item
) ) );
2926 return( MBEDTLS_ERR_SSL_ALLOC_FAILED
);
2929 if( ( msg
->p
= mbedtls_calloc( 1, ssl
->out_msglen
) ) == NULL
)
2931 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl
->out_msglen
) );
2932 mbedtls_free( msg
);
2933 return( MBEDTLS_ERR_SSL_ALLOC_FAILED
);
2936 /* Copy current handshake message with headers */
2937 memcpy( msg
->p
, ssl
->out_msg
, ssl
->out_msglen
);
2938 msg
->len
= ssl
->out_msglen
;
2939 msg
->type
= ssl
->out_msgtype
;
2942 /* Append to the current flight */
2943 if( ssl
->handshake
->flight
== NULL
)
2944 ssl
->handshake
->flight
= msg
;
2947 mbedtls_ssl_flight_item
*cur
= ssl
->handshake
->flight
;
2948 while( cur
->next
!= NULL
)
2953 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_flight_append" ) );
2958 * Free the current flight of handshake messages
2960 static void ssl_flight_free( mbedtls_ssl_flight_item
*flight
)
2962 mbedtls_ssl_flight_item
*cur
= flight
;
2963 mbedtls_ssl_flight_item
*next
;
2965 while( cur
!= NULL
)
2969 mbedtls_free( cur
->p
);
2970 mbedtls_free( cur
);
2976 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
2977 static void ssl_dtls_replay_reset( mbedtls_ssl_context
*ssl
);
2981 * Swap transform_out and out_ctr with the alternative ones
2983 static int ssl_swap_epochs( mbedtls_ssl_context
*ssl
)
2985 mbedtls_ssl_transform
*tmp_transform
;
2986 unsigned char tmp_out_ctr
[8];
2987 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
2989 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
2991 if( ssl
->transform_out
== ssl
->handshake
->alt_transform_out
)
2993 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
2997 MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
2999 /* Swap transforms */
3000 tmp_transform
= ssl
->transform_out
;
3001 ssl
->transform_out
= ssl
->handshake
->alt_transform_out
;
3002 ssl
->handshake
->alt_transform_out
= tmp_transform
;
3004 /* Swap epoch + sequence_number */
3005 memcpy( tmp_out_ctr
, ssl
->cur_out_ctr
, 8 );
3006 memcpy( ssl
->cur_out_ctr
, ssl
->handshake
->alt_out_ctr
, 8 );
3007 memcpy( ssl
->handshake
->alt_out_ctr
, tmp_out_ctr
, 8 );
3009 /* Adjust to the newly activated transform */
3010 ssl_update_out_pointers( ssl
, ssl
->transform_out
);
3012 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
3013 if( mbedtls_ssl_hw_record_activate
!= NULL
)
3015 if( ( ret
= mbedtls_ssl_hw_record_activate( ssl
, MBEDTLS_SSL_CHANNEL_OUTBOUND
) ) != 0 )
3017 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret
);
3018 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED
);
3021 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
3027 * Retransmit the current flight of messages.
3029 int mbedtls_ssl_resend( mbedtls_ssl_context
*ssl
)
3033 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_resend" ) );
3035 ret
= mbedtls_ssl_flight_transmit( ssl
);
3037 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) );
3043 * Transmit or retransmit the current flight of messages.
3045 * Need to remember the current message in case flush_output returns
3046 * WANT_WRITE, causing us to exit this function and come back later.
3047 * This function must be called until state is no longer SENDING.
3049 int mbedtls_ssl_flight_transmit( mbedtls_ssl_context
*ssl
)
3052 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_flight_transmit" ) );
3054 if( ssl
->handshake
->retransmit_state
!= MBEDTLS_SSL_RETRANS_SENDING
)
3056 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialise flight transmission" ) );
3058 ssl
->handshake
->cur_msg
= ssl
->handshake
->flight
;
3059 ssl
->handshake
->cur_msg_p
= ssl
->handshake
->flight
->p
+ 12;
3060 if( ( ret
= ssl_swap_epochs( ssl
) ) != 0 )
3063 ssl
->handshake
->retransmit_state
= MBEDTLS_SSL_RETRANS_SENDING
;
3066 while( ssl
->handshake
->cur_msg
!= NULL
)
3068 size_t max_frag_len
;
3069 const mbedtls_ssl_flight_item
* const cur
= ssl
->handshake
->cur_msg
;
3071 int const is_finished
=
3072 ( cur
->type
== MBEDTLS_SSL_MSG_HANDSHAKE
&&
3073 cur
->p
[0] == MBEDTLS_SSL_HS_FINISHED
);
3075 uint8_t const force_flush
= ssl
->disable_datagram_packing
== 1 ?
3076 SSL_FORCE_FLUSH
: SSL_DONT_FORCE_FLUSH
;
3078 /* Swap epochs before sending Finished: we can't do it after
3079 * sending ChangeCipherSpec, in case write returns WANT_READ.
3080 * Must be done before copying, may change out_msg pointer */
3081 if( is_finished
&& ssl
->handshake
->cur_msg_p
== ( cur
->p
+ 12 ) )
3083 MBEDTLS_SSL_DEBUG_MSG( 2, ( "swap epochs to send finished message" ) );
3084 if( ( ret
= ssl_swap_epochs( ssl
) ) != 0 )
3088 ret
= ssl_get_remaining_payload_in_datagram( ssl
);
3091 max_frag_len
= (size_t) ret
;
3093 /* CCS is copied as is, while HS messages may need fragmentation */
3094 if( cur
->type
== MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC
)
3096 if( max_frag_len
== 0 )
3098 if( ( ret
= mbedtls_ssl_flush_output( ssl
) ) != 0 )
3104 memcpy( ssl
->out_msg
, cur
->p
, cur
->len
);
3105 ssl
->out_msglen
= cur
->len
;
3106 ssl
->out_msgtype
= cur
->type
;
3108 /* Update position inside current message */
3109 ssl
->handshake
->cur_msg_p
+= cur
->len
;
3113 const unsigned char * const p
= ssl
->handshake
->cur_msg_p
;
3114 const size_t hs_len
= cur
->len
- 12;
3115 const size_t frag_off
= p
- ( cur
->p
+ 12 );
3116 const size_t rem_len
= hs_len
- frag_off
;
3117 size_t cur_hs_frag_len
, max_hs_frag_len
;
3119 if( ( max_frag_len
< 12 ) || ( max_frag_len
== 12 && hs_len
!= 0 ) )
3123 if( ( ret
= ssl_swap_epochs( ssl
) ) != 0 )
3127 if( ( ret
= mbedtls_ssl_flush_output( ssl
) ) != 0 )
3132 max_hs_frag_len
= max_frag_len
- 12;
3134 cur_hs_frag_len
= rem_len
> max_hs_frag_len
?
3135 max_hs_frag_len
: rem_len
;
3137 if( frag_off
== 0 && cur_hs_frag_len
!= hs_len
)
3139 MBEDTLS_SSL_DEBUG_MSG( 2, ( "fragmenting handshake message (%u > %u)",
3140 (unsigned) cur_hs_frag_len
,
3141 (unsigned) max_hs_frag_len
) );
3144 /* Messages are stored with handshake headers as if not fragmented,
3145 * copy beginning of headers then fill fragmentation fields.
3146 * Handshake headers: type(1) len(3) seq(2) f_off(3) f_len(3) */
3147 memcpy( ssl
->out_msg
, cur
->p
, 6 );
3149 ssl
->out_msg
[6] = ( ( frag_off
>> 16 ) & 0xff );
3150 ssl
->out_msg
[7] = ( ( frag_off
>> 8 ) & 0xff );
3151 ssl
->out_msg
[8] = ( ( frag_off
) & 0xff );
3153 ssl
->out_msg
[ 9] = ( ( cur_hs_frag_len
>> 16 ) & 0xff );
3154 ssl
->out_msg
[10] = ( ( cur_hs_frag_len
>> 8 ) & 0xff );
3155 ssl
->out_msg
[11] = ( ( cur_hs_frag_len
) & 0xff );
3157 MBEDTLS_SSL_DEBUG_BUF( 3, "handshake header", ssl
->out_msg
, 12 );
3159 /* Copy the handshake message content and set records fields */
3160 memcpy( ssl
->out_msg
+ 12, p
, cur_hs_frag_len
);
3161 ssl
->out_msglen
= cur_hs_frag_len
+ 12;
3162 ssl
->out_msgtype
= cur
->type
;
3164 /* Update position inside current message */
3165 ssl
->handshake
->cur_msg_p
+= cur_hs_frag_len
;
3168 /* If done with the current message move to the next one if any */
3169 if( ssl
->handshake
->cur_msg_p
>= cur
->p
+ cur
->len
)
3171 if( cur
->next
!= NULL
)
3173 ssl
->handshake
->cur_msg
= cur
->next
;
3174 ssl
->handshake
->cur_msg_p
= cur
->next
->p
+ 12;
3178 ssl
->handshake
->cur_msg
= NULL
;
3179 ssl
->handshake
->cur_msg_p
= NULL
;
3183 /* Actually send the message out */
3184 if( ( ret
= mbedtls_ssl_write_record( ssl
, force_flush
) ) != 0 )
3186 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret
);
3191 if( ( ret
= mbedtls_ssl_flush_output( ssl
) ) != 0 )
3194 /* Update state and set timer */
3195 if( ssl
->state
== MBEDTLS_SSL_HANDSHAKE_OVER
)
3196 ssl
->handshake
->retransmit_state
= MBEDTLS_SSL_RETRANS_FINISHED
;
3199 ssl
->handshake
->retransmit_state
= MBEDTLS_SSL_RETRANS_WAITING
;
3200 ssl_set_timer( ssl
, ssl
->handshake
->retransmit_timeout
);
3203 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_flight_transmit" ) );
3209 * To be called when the last message of an incoming flight is received.
3211 void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context
*ssl
)
3213 /* We won't need to resend that one any more */
3214 ssl_flight_free( ssl
->handshake
->flight
);
3215 ssl
->handshake
->flight
= NULL
;
3216 ssl
->handshake
->cur_msg
= NULL
;
3218 /* The next incoming flight will start with this msg_seq */
3219 ssl
->handshake
->in_flight_start_seq
= ssl
->handshake
->in_msg_seq
;
3221 /* We don't want to remember CCS's across flight boundaries. */
3222 ssl
->handshake
->buffering
.seen_ccs
= 0;
3224 /* Clear future message buffering structure. */
3225 ssl_buffering_free( ssl
);
3228 ssl_set_timer( ssl
, 0 );
3230 if( ssl
->in_msgtype
== MBEDTLS_SSL_MSG_HANDSHAKE
&&
3231 ssl
->in_msg
[0] == MBEDTLS_SSL_HS_FINISHED
)
3233 ssl
->handshake
->retransmit_state
= MBEDTLS_SSL_RETRANS_FINISHED
;
3236 ssl
->handshake
->retransmit_state
= MBEDTLS_SSL_RETRANS_PREPARING
;
3240 * To be called when the last message of an outgoing flight is send.
3242 void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context
*ssl
)
3244 ssl_reset_retransmit_timeout( ssl
);
3245 ssl_set_timer( ssl
, ssl
->handshake
->retransmit_timeout
);
3247 if( ssl
->in_msgtype
== MBEDTLS_SSL_MSG_HANDSHAKE
&&
3248 ssl
->in_msg
[0] == MBEDTLS_SSL_HS_FINISHED
)
3250 ssl
->handshake
->retransmit_state
= MBEDTLS_SSL_RETRANS_FINISHED
;
3253 ssl
->handshake
->retransmit_state
= MBEDTLS_SSL_RETRANS_WAITING
;
3255 #endif /* MBEDTLS_SSL_PROTO_DTLS */
3258 * Handshake layer functions
3262 * Write (DTLS: or queue) current handshake (including CCS) message.
3264 * - fill in handshake headers
3265 * - update handshake checksum
3266 * - DTLS: save message for resending
3267 * - then pass to the record layer
3269 * DTLS: except for HelloRequest, messages are only queued, and will only be
3270 * actually sent when calling flight_transmit() or resend().
3273 * - ssl->out_msglen: 4 + actual handshake message len
3274 * (4 is the size of handshake headers for TLS)
3275 * - ssl->out_msg[0]: the handshake type (ClientHello, ServerHello, etc)
3276 * - ssl->out_msg + 4: the handshake message body
3278 * Outputs, ie state before passing to flight_append() or write_record():
3279 * - ssl->out_msglen: the length of the record contents
3280 * (including handshake headers but excluding record headers)
3281 * - ssl->out_msg: the record contents (handshake headers + content)
3283 int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context
*ssl
)
3286 const size_t hs_len
= ssl
->out_msglen
- 4;
3287 const unsigned char hs_type
= ssl
->out_msg
[0];
3289 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write handshake message" ) );
3294 if( ssl
->out_msgtype
!= MBEDTLS_SSL_MSG_HANDSHAKE
&&
3295 ssl
->out_msgtype
!= MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC
)
3297 /* In SSLv3, the client might send a NoCertificate alert. */
3298 #if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
3299 if( ! ( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
&&
3300 ssl
->out_msgtype
== MBEDTLS_SSL_MSG_ALERT
&&
3301 ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_CLIENT
) )
3302 #endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
3304 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3305 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
3309 /* Whenever we send anything different from a
3310 * HelloRequest we should be in a handshake - double check. */
3311 if( ! ( ssl
->out_msgtype
== MBEDTLS_SSL_MSG_HANDSHAKE
&&
3312 hs_type
== MBEDTLS_SSL_HS_HELLO_REQUEST
) &&
3313 ssl
->handshake
== NULL
)
3315 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3316 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
3319 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3320 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
3321 ssl
->handshake
!= NULL
&&
3322 ssl
->handshake
->retransmit_state
== MBEDTLS_SSL_RETRANS_SENDING
)
3324 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3325 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
3329 /* Double-check that we did not exceed the bounds
3330 * of the outgoing record buffer.
3331 * This should never fail as the various message
3332 * writing functions must obey the bounds of the
3333 * outgoing record buffer, but better be safe.
3335 * Note: We deliberately do not check for the MTU or MFL here.
3337 if( ssl
->out_msglen
> MBEDTLS_SSL_OUT_CONTENT_LEN
)
3339 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Record too large: "
3340 "size %u, maximum %u",
3341 (unsigned) ssl
->out_msglen
,
3342 (unsigned) MBEDTLS_SSL_OUT_CONTENT_LEN
) );
3343 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
3347 * Fill handshake headers
3349 if( ssl
->out_msgtype
== MBEDTLS_SSL_MSG_HANDSHAKE
)
3351 ssl
->out_msg
[1] = (unsigned char)( hs_len
>> 16 );
3352 ssl
->out_msg
[2] = (unsigned char)( hs_len
>> 8 );
3353 ssl
->out_msg
[3] = (unsigned char)( hs_len
);
3356 * DTLS has additional fields in the Handshake layer,
3357 * between the length field and the actual payload:
3358 * uint16 message_seq;
3359 * uint24 fragment_offset;
3360 * uint24 fragment_length;
3362 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3363 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
3365 /* Make room for the additional DTLS fields */
3366 if( MBEDTLS_SSL_OUT_CONTENT_LEN
- ssl
->out_msglen
< 8 )
3368 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS handshake message too large: "
3369 "size %u, maximum %u",
3370 (unsigned) ( hs_len
),
3371 (unsigned) ( MBEDTLS_SSL_OUT_CONTENT_LEN
- 12 ) ) );
3372 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
3375 memmove( ssl
->out_msg
+ 12, ssl
->out_msg
+ 4, hs_len
);
3376 ssl
->out_msglen
+= 8;
3378 /* Write message_seq and update it, except for HelloRequest */
3379 if( hs_type
!= MBEDTLS_SSL_HS_HELLO_REQUEST
)
3381 ssl
->out_msg
[4] = ( ssl
->handshake
->out_msg_seq
>> 8 ) & 0xFF;
3382 ssl
->out_msg
[5] = ( ssl
->handshake
->out_msg_seq
) & 0xFF;
3383 ++( ssl
->handshake
->out_msg_seq
);
3387 ssl
->out_msg
[4] = 0;
3388 ssl
->out_msg
[5] = 0;
3391 /* Handshake hashes are computed without fragmentation,
3392 * so set frag_offset = 0 and frag_len = hs_len for now */
3393 memset( ssl
->out_msg
+ 6, 0x00, 3 );
3394 memcpy( ssl
->out_msg
+ 9, ssl
->out_msg
+ 1, 3 );
3396 #endif /* MBEDTLS_SSL_PROTO_DTLS */
3398 /* Update running hashes of handshake messages seen */
3399 if( hs_type
!= MBEDTLS_SSL_HS_HELLO_REQUEST
)
3400 ssl
->handshake
->update_checksum( ssl
, ssl
->out_msg
, ssl
->out_msglen
);
3403 /* Either send now, or just save to be sent (and resent) later */
3404 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3405 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
3406 ! ( ssl
->out_msgtype
== MBEDTLS_SSL_MSG_HANDSHAKE
&&
3407 hs_type
== MBEDTLS_SSL_HS_HELLO_REQUEST
) )
3409 if( ( ret
= ssl_flight_append( ssl
) ) != 0 )
3411 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret
);
3418 if( ( ret
= mbedtls_ssl_write_record( ssl
, SSL_FORCE_FLUSH
) ) != 0 )
3420 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_record", ret
);
3425 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write handshake message" ) );
3431 * Record layer functions
3435 * Write current record.
3438 * - ssl->out_msgtype: type of the message (AppData, Handshake, Alert, CCS)
3439 * - ssl->out_msglen: length of the record content (excl headers)
3440 * - ssl->out_msg: record content
3442 int mbedtls_ssl_write_record( mbedtls_ssl_context
*ssl
, uint8_t force_flush
)
3445 size_t len
= ssl
->out_msglen
;
3446 uint8_t flush
= force_flush
;
3448 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) );
3450 #if defined(MBEDTLS_ZLIB_SUPPORT)
3451 if( ssl
->transform_out
!= NULL
&&
3452 ssl
->session_out
->compression
== MBEDTLS_SSL_COMPRESS_DEFLATE
)
3454 if( ( ret
= ssl_compress_buf( ssl
) ) != 0 )
3456 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compress_buf", ret
);
3460 len
= ssl
->out_msglen
;
3462 #endif /*MBEDTLS_ZLIB_SUPPORT */
3464 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
3465 if( mbedtls_ssl_hw_record_write
!= NULL
)
3467 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_write()" ) );
3469 ret
= mbedtls_ssl_hw_record_write( ssl
);
3470 if( ret
!= 0 && ret
!= MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH
)
3472 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_write", ret
);
3473 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED
);
3479 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
3483 size_t protected_record_size
;
3485 ssl
->out_hdr
[0] = (unsigned char) ssl
->out_msgtype
;
3486 mbedtls_ssl_write_version( ssl
->major_ver
, ssl
->minor_ver
,
3487 ssl
->conf
->transport
, ssl
->out_hdr
+ 1 );
3489 memcpy( ssl
->out_ctr
, ssl
->cur_out_ctr
, 8 );
3490 ssl
->out_len
[0] = (unsigned char)( len
>> 8 );
3491 ssl
->out_len
[1] = (unsigned char)( len
);
3493 if( ssl
->transform_out
!= NULL
)
3495 if( ( ret
= ssl_encrypt_buf( ssl
) ) != 0 )
3497 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret
);
3501 len
= ssl
->out_msglen
;
3502 ssl
->out_len
[0] = (unsigned char)( len
>> 8 );
3503 ssl
->out_len
[1] = (unsigned char)( len
);
3506 protected_record_size
= len
+ mbedtls_ssl_hdr_len( ssl
);
3508 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3509 /* In case of DTLS, double-check that we don't exceed
3510 * the remaining space in the datagram. */
3511 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
3513 ret
= ssl_get_remaining_space_in_datagram( ssl
);
3517 if( protected_record_size
> (size_t) ret
)
3519 /* Should never happen */
3520 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
3523 #endif /* MBEDTLS_SSL_PROTO_DTLS */
3525 MBEDTLS_SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
3526 "version = [%d:%d], msglen = %d",
3527 ssl
->out_hdr
[0], ssl
->out_hdr
[1],
3528 ssl
->out_hdr
[2], len
) );
3530 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
3531 ssl
->out_hdr
, protected_record_size
);
3533 ssl
->out_left
+= protected_record_size
;
3534 ssl
->out_hdr
+= protected_record_size
;
3535 ssl_update_out_pointers( ssl
, ssl
->transform_out
);
3537 for( i
= 8; i
> ssl_ep_len( ssl
); i
-- )
3538 if( ++ssl
->cur_out_ctr
[i
- 1] != 0 )
3541 /* The loop goes to its end iff the counter is wrapping */
3542 if( i
== ssl_ep_len( ssl
) )
3544 MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
3545 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING
);
3549 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3550 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
3551 flush
== SSL_DONT_FORCE_FLUSH
)
3554 ret
= ssl_get_remaining_payload_in_datagram( ssl
);
3557 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_remaining_payload_in_datagram",
3562 remaining
= (size_t) ret
;
3563 if( remaining
== 0 )
3565 flush
= SSL_FORCE_FLUSH
;
3569 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Still %u bytes available in current datagram", (unsigned) remaining
) );
3572 #endif /* MBEDTLS_SSL_PROTO_DTLS */
3574 if( ( flush
== SSL_FORCE_FLUSH
) &&
3575 ( ret
= mbedtls_ssl_flush_output( ssl
) ) != 0 )
3577 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret
);
3581 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) );
3586 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3588 static int ssl_hs_is_proper_fragment( mbedtls_ssl_context
*ssl
)
3590 if( ssl
->in_msglen
< ssl
->in_hslen
||
3591 memcmp( ssl
->in_msg
+ 6, "\0\0\0", 3 ) != 0 ||
3592 memcmp( ssl
->in_msg
+ 9, ssl
->in_msg
+ 1, 3 ) != 0 )
3599 static uint32_t ssl_get_hs_frag_len( mbedtls_ssl_context
const *ssl
)
3601 return( ( ssl
->in_msg
[9] << 16 ) |
3602 ( ssl
->in_msg
[10] << 8 ) |
3606 static uint32_t ssl_get_hs_frag_off( mbedtls_ssl_context
const *ssl
)
3608 return( ( ssl
->in_msg
[6] << 16 ) |
3609 ( ssl
->in_msg
[7] << 8 ) |
3613 static int ssl_check_hs_header( mbedtls_ssl_context
const *ssl
)
3615 uint32_t msg_len
, frag_off
, frag_len
;
3617 msg_len
= ssl_get_hs_total_len( ssl
);
3618 frag_off
= ssl_get_hs_frag_off( ssl
);
3619 frag_len
= ssl_get_hs_frag_len( ssl
);
3621 if( frag_off
> msg_len
)
3624 if( frag_len
> msg_len
- frag_off
)
3627 if( frag_len
+ 12 > ssl
->in_msglen
)
3634 * Mark bits in bitmask (used for DTLS HS reassembly)
3636 static void ssl_bitmask_set( unsigned char *mask
, size_t offset
, size_t len
)
3638 unsigned int start_bits
, end_bits
;
3640 start_bits
= 8 - ( offset
% 8 );
3641 if( start_bits
!= 8 )
3643 size_t first_byte_idx
= offset
/ 8;
3646 if( len
<= start_bits
)
3648 for( ; len
!= 0; len
-- )
3649 mask
[first_byte_idx
] |= 1 << ( start_bits
- len
);
3651 /* Avoid potential issues with offset or len becoming invalid */
3655 offset
+= start_bits
; /* Now offset % 8 == 0 */
3658 for( ; start_bits
!= 0; start_bits
-- )
3659 mask
[first_byte_idx
] |= 1 << ( start_bits
- 1 );
3665 size_t last_byte_idx
= ( offset
+ len
) / 8;
3667 len
-= end_bits
; /* Now len % 8 == 0 */
3669 for( ; end_bits
!= 0; end_bits
-- )
3670 mask
[last_byte_idx
] |= 1 << ( 8 - end_bits
);
3673 memset( mask
+ offset
/ 8, 0xFF, len
/ 8 );
3677 * Check that bitmask is full
3679 static int ssl_bitmask_check( unsigned char *mask
, size_t len
)
3683 for( i
= 0; i
< len
/ 8; i
++ )
3684 if( mask
[i
] != 0xFF )
3687 for( i
= 0; i
< len
% 8; i
++ )
3688 if( ( mask
[len
/ 8] & ( 1 << ( 7 - i
) ) ) == 0 )
3694 /* msg_len does not include the handshake header */
3695 static size_t ssl_get_reassembly_buffer_size( size_t msg_len
,
3696 unsigned add_bitmap
)
3700 alloc_len
= 12; /* Handshake header */
3701 alloc_len
+= msg_len
; /* Content buffer */
3704 alloc_len
+= msg_len
/ 8 + ( msg_len
% 8 != 0 ); /* Bitmap */
3706 return( alloc_len
);
3709 #endif /* MBEDTLS_SSL_PROTO_DTLS */
3711 static uint32_t ssl_get_hs_total_len( mbedtls_ssl_context
const *ssl
)
3713 return( ( ssl
->in_msg
[1] << 16 ) |
3714 ( ssl
->in_msg
[2] << 8 ) |
3718 int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context
*ssl
)
3720 if( ssl
->in_msglen
< mbedtls_ssl_hs_hdr_len( ssl
) )
3722 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %d",
3724 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
3727 ssl
->in_hslen
= mbedtls_ssl_hs_hdr_len( ssl
) + ssl_get_hs_total_len( ssl
);
3729 MBEDTLS_SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
3730 " %d, type = %d, hslen = %d",
3731 ssl
->in_msglen
, ssl
->in_msg
[0], ssl
->in_hslen
) );
3733 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3734 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
3737 unsigned int recv_msg_seq
= ( ssl
->in_msg
[4] << 8 ) | ssl
->in_msg
[5];
3739 if( ssl_check_hs_header( ssl
) != 0 )
3741 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid handshake header" ) );
3742 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
3745 if( ssl
->handshake
!= NULL
&&
3746 ( ( ssl
->state
!= MBEDTLS_SSL_HANDSHAKE_OVER
&&
3747 recv_msg_seq
!= ssl
->handshake
->in_msg_seq
) ||
3748 ( ssl
->state
== MBEDTLS_SSL_HANDSHAKE_OVER
&&
3749 ssl
->in_msg
[0] != MBEDTLS_SSL_HS_CLIENT_HELLO
) ) )
3751 if( recv_msg_seq
> ssl
->handshake
->in_msg_seq
)
3753 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received future handshake message of sequence number %u (next %u)",
3755 ssl
->handshake
->in_msg_seq
) );
3756 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE
);
3759 /* Retransmit only on last message from previous flight, to avoid
3760 * too many retransmissions.
3761 * Besides, No sane server ever retransmits HelloVerifyRequest */
3762 if( recv_msg_seq
== ssl
->handshake
->in_flight_start_seq
- 1 &&
3763 ssl
->in_msg
[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST
)
3765 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received message from last flight, "
3766 "message_seq = %d, start_of_flight = %d",
3768 ssl
->handshake
->in_flight_start_seq
) );
3770 if( ( ret
= mbedtls_ssl_resend( ssl
) ) != 0 )
3772 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret
);
3778 MBEDTLS_SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: "
3779 "message_seq = %d, expected = %d",
3781 ssl
->handshake
->in_msg_seq
) );
3784 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING
);
3786 /* Wait until message completion to increment in_msg_seq */
3788 /* Message reassembly is handled alongside buffering of future
3789 * messages; the commonality is that both handshake fragments and
3790 * future messages cannot be forwarded immediately to the
3791 * handshake logic layer. */
3792 if( ssl_hs_is_proper_fragment( ssl
) == 1 )
3794 MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
3795 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE
);
3799 #endif /* MBEDTLS_SSL_PROTO_DTLS */
3800 /* With TLS we don't handle fragmentation (for now) */
3801 if( ssl
->in_msglen
< ssl
->in_hslen
)
3803 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
3804 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE
);
3810 void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context
*ssl
)
3812 mbedtls_ssl_handshake_params
* const hs
= ssl
->handshake
;
3814 if( ssl
->state
!= MBEDTLS_SSL_HANDSHAKE_OVER
&& hs
!= NULL
)
3816 ssl
->handshake
->update_checksum( ssl
, ssl
->in_msg
, ssl
->in_hslen
);
3819 /* Handshake message is complete, increment counter */
3820 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3821 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
3822 ssl
->handshake
!= NULL
)
3825 mbedtls_ssl_hs_buffer
*hs_buf
;
3827 /* Increment handshake sequence number */
3831 * Clear up handshake buffering and reassembly structure.
3834 /* Free first entry */
3835 ssl_buffering_free_slot( ssl
, 0 );
3837 /* Shift all other entries */
3838 for( offset
= 0, hs_buf
= &hs
->buffering
.hs
[0];
3839 offset
+ 1 < MBEDTLS_SSL_MAX_BUFFERED_HS
;
3840 offset
++, hs_buf
++ )
3842 *hs_buf
= *(hs_buf
+ 1);
3845 /* Create a fresh last entry */
3846 memset( hs_buf
, 0, sizeof( mbedtls_ssl_hs_buffer
) );
3852 * DTLS anti-replay: RFC 6347 4.1.2.6
3854 * in_window is a field of bits numbered from 0 (lsb) to 63 (msb).
3855 * Bit n is set iff record number in_window_top - n has been seen.
3857 * Usually, in_window_top is the last record number seen and the lsb of
3858 * in_window is set. The only exception is the initial state (record number 0
3861 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
3862 static void ssl_dtls_replay_reset( mbedtls_ssl_context
*ssl
)
3864 ssl
->in_window_top
= 0;
3868 static inline uint64_t ssl_load_six_bytes( unsigned char *buf
)
3870 return( ( (uint64_t) buf
[0] << 40 ) |
3871 ( (uint64_t) buf
[1] << 32 ) |
3872 ( (uint64_t) buf
[2] << 24 ) |
3873 ( (uint64_t) buf
[3] << 16 ) |
3874 ( (uint64_t) buf
[4] << 8 ) |
3875 ( (uint64_t) buf
[5] ) );
3879 * Return 0 if sequence number is acceptable, -1 otherwise
3881 int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context
*ssl
)
3883 uint64_t rec_seqnum
= ssl_load_six_bytes( ssl
->in_ctr
+ 2 );
3886 if( ssl
->conf
->anti_replay
== MBEDTLS_SSL_ANTI_REPLAY_DISABLED
)
3889 if( rec_seqnum
> ssl
->in_window_top
)
3892 bit
= ssl
->in_window_top
- rec_seqnum
;
3897 if( ( ssl
->in_window
& ( (uint64_t) 1 << bit
) ) != 0 )
3904 * Update replay window on new validated record
3906 void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context
*ssl
)
3908 uint64_t rec_seqnum
= ssl_load_six_bytes( ssl
->in_ctr
+ 2 );
3910 if( ssl
->conf
->anti_replay
== MBEDTLS_SSL_ANTI_REPLAY_DISABLED
)
3913 if( rec_seqnum
> ssl
->in_window_top
)
3915 /* Update window_top and the contents of the window */
3916 uint64_t shift
= rec_seqnum
- ssl
->in_window_top
;
3922 ssl
->in_window
<<= shift
;
3923 ssl
->in_window
|= 1;
3926 ssl
->in_window_top
= rec_seqnum
;
3930 /* Mark that number as seen in the current window */
3931 uint64_t bit
= ssl
->in_window_top
- rec_seqnum
;
3933 if( bit
< 64 ) /* Always true, but be extra sure */
3934 ssl
->in_window
|= (uint64_t) 1 << bit
;
3937 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
3939 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
3940 /* Forward declaration */
3941 static int ssl_session_reset_int( mbedtls_ssl_context
*ssl
, int partial
);
3944 * Without any SSL context, check if a datagram looks like a ClientHello with
3945 * a valid cookie, and if it doesn't, generate a HelloVerifyRequest message.
3946 * Both input and output include full DTLS headers.
3948 * - if cookie is valid, return 0
3949 * - if ClientHello looks superficially valid but cookie is not,
3950 * fill obuf and set olen, then
3951 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
3952 * - otherwise return a specific error code
3954 static int ssl_check_dtls_clihlo_cookie(
3955 mbedtls_ssl_cookie_write_t
*f_cookie_write
,
3956 mbedtls_ssl_cookie_check_t
*f_cookie_check
,
3958 const unsigned char *cli_id
, size_t cli_id_len
,
3959 const unsigned char *in
, size_t in_len
,
3960 unsigned char *obuf
, size_t buf_len
, size_t *olen
)
3962 size_t sid_len
, cookie_len
;
3965 if( f_cookie_write
== NULL
|| f_cookie_check
== NULL
)
3966 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
3969 * Structure of ClientHello with record and handshake headers,
3970 * and expected values. We don't need to check a lot, more checks will be
3971 * done when actually parsing the ClientHello - skipping those checks
3972 * avoids code duplication and does not make cookie forging any easier.
3974 * 0-0 ContentType type; copied, must be handshake
3975 * 1-2 ProtocolVersion version; copied
3976 * 3-4 uint16 epoch; copied, must be 0
3977 * 5-10 uint48 sequence_number; copied
3978 * 11-12 uint16 length; (ignored)
3980 * 13-13 HandshakeType msg_type; (ignored)
3981 * 14-16 uint24 length; (ignored)
3982 * 17-18 uint16 message_seq; copied
3983 * 19-21 uint24 fragment_offset; copied, must be 0
3984 * 22-24 uint24 fragment_length; (ignored)
3986 * 25-26 ProtocolVersion client_version; (ignored)
3987 * 27-58 Random random; (ignored)
3988 * 59-xx SessionID session_id; 1 byte len + sid_len content
3989 * 60+ opaque cookie<0..2^8-1>; 1 byte len + content
3992 * Minimum length is 61 bytes.
3995 in
[0] != MBEDTLS_SSL_MSG_HANDSHAKE
||
3996 in
[3] != 0 || in
[4] != 0 ||
3997 in
[19] != 0 || in
[20] != 0 || in
[21] != 0 )
3999 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO
);
4003 if( sid_len
> in_len
- 61 )
4004 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO
);
4006 cookie_len
= in
[60 + sid_len
];
4007 if( cookie_len
> in_len
- 60 )
4008 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO
);
4010 if( f_cookie_check( p_cookie
, in
+ sid_len
+ 61, cookie_len
,
4011 cli_id
, cli_id_len
) == 0 )
4018 * If we get here, we've got an invalid cookie, let's prepare HVR.
4020 * 0-0 ContentType type; copied
4021 * 1-2 ProtocolVersion version; copied
4022 * 3-4 uint16 epoch; copied
4023 * 5-10 uint48 sequence_number; copied
4024 * 11-12 uint16 length; olen - 13
4026 * 13-13 HandshakeType msg_type; hello_verify_request
4027 * 14-16 uint24 length; olen - 25
4028 * 17-18 uint16 message_seq; copied
4029 * 19-21 uint24 fragment_offset; copied
4030 * 22-24 uint24 fragment_length; olen - 25
4032 * 25-26 ProtocolVersion server_version; 0xfe 0xff
4033 * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie
4035 * Minimum length is 28.
4038 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL
);
4040 /* Copy most fields and adapt others */
4041 memcpy( obuf
, in
, 25 );
4042 obuf
[13] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST
;
4046 /* Generate and write actual cookie */
4048 if( f_cookie_write( p_cookie
,
4049 &p
, obuf
+ buf_len
, cli_id
, cli_id_len
) != 0 )
4051 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
4056 /* Go back and fill length fields */
4057 obuf
[27] = (unsigned char)( *olen
- 28 );
4059 obuf
[14] = obuf
[22] = (unsigned char)( ( *olen
- 25 ) >> 16 );
4060 obuf
[15] = obuf
[23] = (unsigned char)( ( *olen
- 25 ) >> 8 );
4061 obuf
[16] = obuf
[24] = (unsigned char)( ( *olen
- 25 ) );
4063 obuf
[11] = (unsigned char)( ( *olen
- 13 ) >> 8 );
4064 obuf
[12] = (unsigned char)( ( *olen
- 13 ) );
4066 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
);
4070 * Handle possible client reconnect with the same UDP quadruplet
4071 * (RFC 6347 Section 4.2.8).
4073 * Called by ssl_parse_record_header() in case we receive an epoch 0 record
4074 * that looks like a ClientHello.
4076 * - if the input looks like a ClientHello without cookies,
4077 * send back HelloVerifyRequest, then
4078 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
4079 * - if the input looks like a ClientHello with a valid cookie,
4080 * reset the session of the current context, and
4081 * return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
4082 * - if anything goes wrong, return a specific error code
4084 * mbedtls_ssl_read_record() will ignore the record if anything else than
4085 * MBEDTLS_ERR_SSL_CLIENT_RECONNECT or 0 is returned, although this function
4086 * cannot not return 0.
4088 static int ssl_handle_possible_reconnect( mbedtls_ssl_context
*ssl
)
4093 ret
= ssl_check_dtls_clihlo_cookie(
4094 ssl
->conf
->f_cookie_write
,
4095 ssl
->conf
->f_cookie_check
,
4096 ssl
->conf
->p_cookie
,
4097 ssl
->cli_id
, ssl
->cli_id_len
,
4098 ssl
->in_buf
, ssl
->in_left
,
4099 ssl
->out_buf
, MBEDTLS_SSL_OUT_CONTENT_LEN
, &len
);
4101 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_dtls_clihlo_cookie", ret
);
4103 if( ret
== MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
)
4106 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sending HelloVerifyRequest" ) );
4107 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
4108 ssl
->out_buf
, len
);
4109 /* Don't check write errors as we can't do anything here.
4110 * If the error is permanent we'll catch it later,
4111 * if it's not, then hopefully it'll work next time. */
4112 send_ret
= ssl
->f_send( ssl
->p_bio
, ssl
->out_buf
, len
);
4113 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", send_ret
);
4116 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
);
4121 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cookie is valid, resetting context" ) );
4122 if( ( ret
= ssl_session_reset_int( ssl
, 1 ) ) != 0 )
4124 MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret
);
4128 return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT
);
4133 #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
4137 * ProtocolVersion version;
4138 * uint16 epoch; // DTLS only
4139 * uint48 sequence_number; // DTLS only
4142 * Return 0 if header looks sane (and, for DTLS, the record is expected)
4143 * MBEDTLS_ERR_SSL_INVALID_RECORD if the header looks bad,
4144 * MBEDTLS_ERR_SSL_UNEXPECTED_RECORD (DTLS only) if sane but unexpected.
4146 * With DTLS, mbedtls_ssl_read_record() will:
4147 * 1. proceed with the record if this function returns 0
4148 * 2. drop only the current record if this function returns UNEXPECTED_RECORD
4149 * 3. return CLIENT_RECONNECT if this function return that value
4150 * 4. drop the whole datagram if this function returns anything else.
4151 * Point 2 is needed when the peer is resending, and we have already received
4152 * the first record from a datagram but are still waiting for the others.
4154 static int ssl_parse_record_header( mbedtls_ssl_context
*ssl
)
4156 int major_ver
, minor_ver
;
4158 MBEDTLS_SSL_DEBUG_BUF( 4, "input record header", ssl
->in_hdr
, mbedtls_ssl_hdr_len( ssl
) );
4160 ssl
->in_msgtype
= ssl
->in_hdr
[0];
4161 ssl
->in_msglen
= ( ssl
->in_len
[0] << 8 ) | ssl
->in_len
[1];
4162 mbedtls_ssl_read_version( &major_ver
, &minor_ver
, ssl
->conf
->transport
, ssl
->in_hdr
+ 1 );
4164 MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
4165 "version = [%d:%d], msglen = %d",
4167 major_ver
, minor_ver
, ssl
->in_msglen
) );
4169 /* Check record type */
4170 if( ssl
->in_msgtype
!= MBEDTLS_SSL_MSG_HANDSHAKE
&&
4171 ssl
->in_msgtype
!= MBEDTLS_SSL_MSG_ALERT
&&
4172 ssl
->in_msgtype
!= MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC
&&
4173 ssl
->in_msgtype
!= MBEDTLS_SSL_MSG_APPLICATION_DATA
)
4175 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
4177 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4178 /* Silently ignore invalid DTLS records as recommended by RFC 6347
4179 * Section 4.1.2.7 */
4180 if( ssl
->conf
->transport
!= MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
4181 #endif /* MBEDTLS_SSL_PROTO_DTLS */
4182 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
4183 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE
);
4185 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
4189 if( major_ver
!= ssl
->major_ver
)
4191 MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
4192 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
4195 if( minor_ver
> ssl
->conf
->max_minor_ver
)
4197 MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
4198 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
4201 /* Check length against the size of our buffer */
4202 if( ssl
->in_msglen
> MBEDTLS_SSL_IN_BUFFER_LEN
4203 - (size_t)( ssl
->in_msg
- ssl
->in_buf
) )
4205 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4206 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
4210 * DTLS-related tests.
4211 * Check epoch before checking length constraint because
4212 * the latter varies with the epoch. E.g., if a ChangeCipherSpec
4213 * message gets duplicated before the corresponding Finished message,
4214 * the second ChangeCipherSpec should be discarded because it belongs
4215 * to an old epoch, but not because its length is shorter than
4216 * the minimum record length for packets using the new record transform.
4217 * Note that these two kinds of failures are handled differently,
4218 * as an unexpected record is silently skipped but an invalid
4219 * record leads to the entire datagram being dropped.
4221 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4222 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
4224 unsigned int rec_epoch
= ( ssl
->in_ctr
[0] << 8 ) | ssl
->in_ctr
[1];
4226 /* Check epoch (and sequence number) with DTLS */
4227 if( rec_epoch
!= ssl
->in_epoch
)
4229 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: "
4230 "expected %d, received %d",
4231 ssl
->in_epoch
, rec_epoch
) );
4233 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
4235 * Check for an epoch 0 ClientHello. We can't use in_msg here to
4236 * access the first byte of record content (handshake type), as we
4237 * have an active transform (possibly iv_len != 0), so use the
4238 * fact that the record header len is 13 instead.
4240 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
&&
4241 ssl
->state
== MBEDTLS_SSL_HANDSHAKE_OVER
&&
4243 ssl
->in_msgtype
== MBEDTLS_SSL_MSG_HANDSHAKE
&&
4244 ssl
->in_left
> 13 &&
4245 ssl
->in_buf
[13] == MBEDTLS_SSL_HS_CLIENT_HELLO
)
4247 MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect "
4248 "from the same port" ) );
4249 return( ssl_handle_possible_reconnect( ssl
) );
4252 #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
4254 /* Consider buffering the record. */
4255 if( rec_epoch
== (unsigned int) ssl
->in_epoch
+ 1 )
4257 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Consider record for buffering" ) );
4258 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE
);
4261 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD
);
4265 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4266 /* Replay detection only works for the current epoch */
4267 if( rec_epoch
== ssl
->in_epoch
&&
4268 mbedtls_ssl_dtls_replay_check( ssl
) != 0 )
4270 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
4271 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD
);
4275 /* Drop unexpected ApplicationData records,
4276 * except at the beginning of renegotiations */
4277 if( ssl
->in_msgtype
== MBEDTLS_SSL_MSG_APPLICATION_DATA
&&
4278 ssl
->state
!= MBEDTLS_SSL_HANDSHAKE_OVER
4279 #if defined(MBEDTLS_SSL_RENEGOTIATION)
4280 && ! ( ssl
->renego_status
== MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS
&&
4281 ssl
->state
== MBEDTLS_SSL_SERVER_HELLO
)
4285 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
4286 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD
);
4289 #endif /* MBEDTLS_SSL_PROTO_DTLS */
4292 /* Check length against bounds of the current transform and version */
4293 if( ssl
->transform_in
== NULL
)
4295 if( ssl
->in_msglen
< 1 ||
4296 ssl
->in_msglen
> MBEDTLS_SSL_IN_CONTENT_LEN
)
4298 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4299 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
4304 if( ssl
->in_msglen
< ssl
->transform_in
->minlen
)
4306 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4307 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
4310 #if defined(MBEDTLS_SSL_PROTO_SSL3)
4311 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
&&
4312 ssl
->in_msglen
> ssl
->transform_in
->minlen
+ MBEDTLS_SSL_IN_CONTENT_LEN
)
4314 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4315 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
4318 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
4319 defined(MBEDTLS_SSL_PROTO_TLS1_2)
4321 * TLS encrypted messages can have up to 256 bytes of padding
4323 if( ssl
->minor_ver
>= MBEDTLS_SSL_MINOR_VERSION_1
&&
4324 ssl
->in_msglen
> ssl
->transform_in
->minlen
+
4325 MBEDTLS_SSL_IN_CONTENT_LEN
+ 256 )
4327 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4328 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
4337 * If applicable, decrypt (and decompress) record content
4339 static int ssl_prepare_record_content( mbedtls_ssl_context
*ssl
)
4343 MBEDTLS_SSL_DEBUG_BUF( 4, "input record from network",
4344 ssl
->in_hdr
, mbedtls_ssl_hdr_len( ssl
) + ssl
->in_msglen
);
4346 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
4347 if( mbedtls_ssl_hw_record_read
!= NULL
)
4349 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_read()" ) );
4351 ret
= mbedtls_ssl_hw_record_read( ssl
);
4352 if( ret
!= 0 && ret
!= MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH
)
4354 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_read", ret
);
4355 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED
);
4361 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
4362 if( !done
&& ssl
->transform_in
!= NULL
)
4364 if( ( ret
= ssl_decrypt_buf( ssl
) ) != 0 )
4366 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret
);
4370 MBEDTLS_SSL_DEBUG_BUF( 4, "input payload after decrypt",
4371 ssl
->in_msg
, ssl
->in_msglen
);
4373 if( ssl
->in_msglen
> MBEDTLS_SSL_IN_CONTENT_LEN
)
4375 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
4376 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
4380 #if defined(MBEDTLS_ZLIB_SUPPORT)
4381 if( ssl
->transform_in
!= NULL
&&
4382 ssl
->session_in
->compression
== MBEDTLS_SSL_COMPRESS_DEFLATE
)
4384 if( ( ret
= ssl_decompress_buf( ssl
) ) != 0 )
4386 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret
);
4390 #endif /* MBEDTLS_ZLIB_SUPPORT */
4392 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
4393 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
4395 mbedtls_ssl_dtls_replay_update( ssl
);
4402 static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context
*ssl
);
4407 * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
4408 * RFC 6347 4.1.2.7) and continue reading until a valid record is found.
4412 /* Helper functions for mbedtls_ssl_read_record(). */
4413 static int ssl_consume_current_message( mbedtls_ssl_context
*ssl
);
4414 static int ssl_get_next_record( mbedtls_ssl_context
*ssl
);
4415 static int ssl_record_is_in_progress( mbedtls_ssl_context
*ssl
);
4417 int mbedtls_ssl_read_record( mbedtls_ssl_context
*ssl
,
4418 unsigned update_hs_digest
)
4422 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read record" ) );
4424 if( ssl
->keep_current_message
== 0 )
4428 ret
= ssl_consume_current_message( ssl
);
4432 if( ssl_record_is_in_progress( ssl
) == 0 )
4434 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4435 int have_buffered
= 0;
4437 /* We only check for buffered messages if the
4438 * current datagram is fully consumed. */
4439 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
4440 ssl_next_record_is_in_datagram( ssl
) == 0 )
4442 if( ssl_load_buffered_message( ssl
) == 0 )
4446 if( have_buffered
== 0 )
4447 #endif /* MBEDTLS_SSL_PROTO_DTLS */
4449 ret
= ssl_get_next_record( ssl
);
4450 if( ret
== MBEDTLS_ERR_SSL_CONTINUE_PROCESSING
)
4455 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_get_next_record" ), ret
);
4461 ret
= mbedtls_ssl_handle_message_type( ssl
);
4463 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4464 if( ret
== MBEDTLS_ERR_SSL_EARLY_MESSAGE
)
4466 /* Buffer future message */
4467 ret
= ssl_buffer_message( ssl
);
4471 ret
= MBEDTLS_ERR_SSL_CONTINUE_PROCESSING
;
4473 #endif /* MBEDTLS_SSL_PROTO_DTLS */
4475 } while( MBEDTLS_ERR_SSL_NON_FATAL
== ret
||
4476 MBEDTLS_ERR_SSL_CONTINUE_PROCESSING
== ret
);
4480 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_handle_message_type" ), ret
);
4484 if( ssl
->in_msgtype
== MBEDTLS_SSL_MSG_HANDSHAKE
&&
4485 update_hs_digest
== 1 )
4487 mbedtls_ssl_update_handshake_status( ssl
);
4492 MBEDTLS_SSL_DEBUG_MSG( 2, ( "reuse previously read message" ) );
4493 ssl
->keep_current_message
= 0;
4496 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );
4501 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4502 static int ssl_next_record_is_in_datagram( mbedtls_ssl_context
*ssl
)
4504 if( ssl
->in_left
> ssl
->next_record_offset
)
4510 static int ssl_load_buffered_message( mbedtls_ssl_context
*ssl
)
4512 mbedtls_ssl_handshake_params
* const hs
= ssl
->handshake
;
4513 mbedtls_ssl_hs_buffer
* hs_buf
;
4519 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_messsage" ) );
4521 if( ssl
->state
== MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC
||
4522 ssl
->state
== MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC
)
4524 /* Check if we have seen a ChangeCipherSpec before.
4525 * If yes, synthesize a CCS record. */
4526 if( !hs
->buffering
.seen_ccs
)
4528 MBEDTLS_SSL_DEBUG_MSG( 2, ( "CCS not seen in the current flight" ) );
4533 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Injecting buffered CCS message" ) );
4534 ssl
->in_msgtype
= MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC
;
4538 /* As long as they are equal, the exact value doesn't matter. */
4540 ssl
->next_record_offset
= 0;
4542 hs
->buffering
.seen_ccs
= 0;
4546 #if defined(MBEDTLS_DEBUG_C)
4550 for( offset
= 1; offset
< MBEDTLS_SSL_MAX_BUFFERED_HS
; offset
++ )
4552 hs_buf
= &hs
->buffering
.hs
[offset
];
4553 if( hs_buf
->is_valid
== 1 )
4555 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Future message with sequence number %u %s buffered.",
4556 hs
->in_msg_seq
+ offset
,
4557 hs_buf
->is_complete
? "fully" : "partially" ) );
4561 #endif /* MBEDTLS_DEBUG_C */
4563 /* Check if we have buffered and/or fully reassembled the
4564 * next handshake message. */
4565 hs_buf
= &hs
->buffering
.hs
[0];
4566 if( ( hs_buf
->is_valid
== 1 ) && ( hs_buf
->is_complete
== 1 ) )
4568 /* Synthesize a record containing the buffered HS message. */
4569 size_t msg_len
= ( hs_buf
->data
[1] << 16 ) |
4570 ( hs_buf
->data
[2] << 8 ) |
4573 /* Double-check that we haven't accidentally buffered
4574 * a message that doesn't fit into the input buffer. */
4575 if( msg_len
+ 12 > MBEDTLS_SSL_IN_CONTENT_LEN
)
4577 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4578 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
4581 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message has been buffered - load" ) );
4582 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered handshake message (incl. header)",
4583 hs_buf
->data
, msg_len
+ 12 );
4585 ssl
->in_msgtype
= MBEDTLS_SSL_MSG_HANDSHAKE
;
4586 ssl
->in_hslen
= msg_len
+ 12;
4587 ssl
->in_msglen
= msg_len
+ 12;
4588 memcpy( ssl
->in_msg
, hs_buf
->data
, ssl
->in_hslen
);
4595 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Next handshake message %u not or only partially bufffered",
4603 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_message" ) );
4607 static int ssl_buffer_make_space( mbedtls_ssl_context
*ssl
,
4611 mbedtls_ssl_handshake_params
* const hs
= ssl
->handshake
;
4612 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Attempt to free buffered messages to have %u bytes available",
4613 (unsigned) desired
) );
4615 /* Get rid of future records epoch first, if such exist. */
4616 ssl_free_buffered_record( ssl
);
4618 /* Check if we have enough space available now. */
4619 if( desired
<= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING
-
4620 hs
->buffering
.total_bytes_buffered
) )
4622 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing future epoch record" ) );
4626 /* We don't have enough space to buffer the next expected handshake
4627 * message. Remove buffers used for future messages to gain space,
4628 * starting with the most distant one. */
4629 for( offset
= MBEDTLS_SSL_MAX_BUFFERED_HS
- 1;
4630 offset
>= 0; offset
-- )
4632 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Free buffering slot %d to make space for reassembly of next handshake message",
4635 ssl_buffering_free_slot( ssl
, (uint8_t) offset
);
4637 /* Check if we have enough space available now. */
4638 if( desired
<= ( MBEDTLS_SSL_DTLS_MAX_BUFFERING
-
4639 hs
->buffering
.total_bytes_buffered
) )
4641 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Enough space available after freeing buffered HS messages" ) );
4649 static int ssl_buffer_message( mbedtls_ssl_context
*ssl
)
4652 mbedtls_ssl_handshake_params
* const hs
= ssl
->handshake
;
4657 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_buffer_message" ) );
4659 switch( ssl
->in_msgtype
)
4661 case MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC
:
4662 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Remember CCS message" ) );
4664 hs
->buffering
.seen_ccs
= 1;
4667 case MBEDTLS_SSL_MSG_HANDSHAKE
:
4669 unsigned recv_msg_seq_offset
;
4670 unsigned recv_msg_seq
= ( ssl
->in_msg
[4] << 8 ) | ssl
->in_msg
[5];
4671 mbedtls_ssl_hs_buffer
*hs_buf
;
4672 size_t msg_len
= ssl
->in_hslen
- 12;
4674 /* We should never receive an old handshake
4675 * message - double-check nonetheless. */
4676 if( recv_msg_seq
< ssl
->handshake
->in_msg_seq
)
4678 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4679 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
4682 recv_msg_seq_offset
= recv_msg_seq
- ssl
->handshake
->in_msg_seq
;
4683 if( recv_msg_seq_offset
>= MBEDTLS_SSL_MAX_BUFFERED_HS
)
4685 /* Silently ignore -- message too far in the future */
4686 MBEDTLS_SSL_DEBUG_MSG( 2,
4687 ( "Ignore future HS message with sequence number %u, "
4688 "buffering window %u - %u",
4689 recv_msg_seq
, ssl
->handshake
->in_msg_seq
,
4690 ssl
->handshake
->in_msg_seq
+ MBEDTLS_SSL_MAX_BUFFERED_HS
- 1 ) );
4695 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering HS message with sequence number %u, offset %u ",
4696 recv_msg_seq
, recv_msg_seq_offset
) );
4698 hs_buf
= &hs
->buffering
.hs
[ recv_msg_seq_offset
];
4700 /* Check if the buffering for this seq nr has already commenced. */
4701 if( !hs_buf
->is_valid
)
4703 size_t reassembly_buf_sz
;
4705 hs_buf
->is_fragmented
=
4706 ( ssl_hs_is_proper_fragment( ssl
) == 1 );
4708 /* We copy the message back into the input buffer
4709 * after reassembly, so check that it's not too large.
4710 * This is an implementation-specific limitation
4711 * and not one from the standard, hence it is not
4712 * checked in ssl_check_hs_header(). */
4713 if( msg_len
+ 12 > MBEDTLS_SSL_IN_CONTENT_LEN
)
4715 /* Ignore message */
4719 /* Check if we have enough space to buffer the message. */
4720 if( hs
->buffering
.total_bytes_buffered
>
4721 MBEDTLS_SSL_DTLS_MAX_BUFFERING
)
4723 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4724 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
4727 reassembly_buf_sz
= ssl_get_reassembly_buffer_size( msg_len
,
4728 hs_buf
->is_fragmented
);
4730 if( reassembly_buf_sz
> ( MBEDTLS_SSL_DTLS_MAX_BUFFERING
-
4731 hs
->buffering
.total_bytes_buffered
) )
4733 if( recv_msg_seq_offset
> 0 )
4735 /* If we can't buffer a future message because
4736 * of space limitations -- ignore. */
4737 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
4738 (unsigned) msg_len
, MBEDTLS_SSL_DTLS_MAX_BUFFERING
,
4739 (unsigned) hs
->buffering
.total_bytes_buffered
) );
4744 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future message of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- attempt to make space by freeing buffered future messages\n",
4745 (unsigned) msg_len
, MBEDTLS_SSL_DTLS_MAX_BUFFERING
,
4746 (unsigned) hs
->buffering
.total_bytes_buffered
) );
4749 if( ssl_buffer_make_space( ssl
, reassembly_buf_sz
) != 0 )
4751 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Reassembly of next message of size %u (%u with bitmap) would exceed the compile-time limit %u (already %u bytes buffered) -- fail\n",
4753 (unsigned) reassembly_buf_sz
,
4754 MBEDTLS_SSL_DTLS_MAX_BUFFERING
,
4755 (unsigned) hs
->buffering
.total_bytes_buffered
) );
4756 ret
= MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL
;
4761 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %d",
4764 hs_buf
->data
= mbedtls_calloc( 1, reassembly_buf_sz
);
4765 if( hs_buf
->data
== NULL
)
4767 ret
= MBEDTLS_ERR_SSL_ALLOC_FAILED
;
4770 hs_buf
->data_len
= reassembly_buf_sz
;
4772 /* Prepare final header: copy msg_type, length and message_seq,
4773 * then add standardised fragment_offset and fragment_length */
4774 memcpy( hs_buf
->data
, ssl
->in_msg
, 6 );
4775 memset( hs_buf
->data
+ 6, 0, 3 );
4776 memcpy( hs_buf
->data
+ 9, hs_buf
->data
+ 1, 3 );
4778 hs_buf
->is_valid
= 1;
4780 hs
->buffering
.total_bytes_buffered
+= reassembly_buf_sz
;
4784 /* Make sure msg_type and length are consistent */
4785 if( memcmp( hs_buf
->data
, ssl
->in_msg
, 4 ) != 0 )
4787 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Fragment header mismatch - ignore" ) );
4793 if( !hs_buf
->is_complete
)
4795 size_t frag_len
, frag_off
;
4796 unsigned char * const msg
= hs_buf
->data
+ 12;
4799 * Check and copy current fragment
4802 /* Validation of header fields already done in
4803 * mbedtls_ssl_prepare_handshake_record(). */
4804 frag_off
= ssl_get_hs_frag_off( ssl
);
4805 frag_len
= ssl_get_hs_frag_len( ssl
);
4807 MBEDTLS_SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %d, length = %d",
4808 frag_off
, frag_len
) );
4809 memcpy( msg
+ frag_off
, ssl
->in_msg
+ 12, frag_len
);
4811 if( hs_buf
->is_fragmented
)
4813 unsigned char * const bitmask
= msg
+ msg_len
;
4814 ssl_bitmask_set( bitmask
, frag_off
, frag_len
);
4815 hs_buf
->is_complete
= ( ssl_bitmask_check( bitmask
,
4820 hs_buf
->is_complete
= 1;
4823 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message %scomplete",
4824 hs_buf
->is_complete
? "" : "not yet " ) );
4831 /* We don't buffer other types of messages. */
4837 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_buffer_message" ) );
4840 #endif /* MBEDTLS_SSL_PROTO_DTLS */
4842 static int ssl_consume_current_message( mbedtls_ssl_context
*ssl
)
4845 * Consume last content-layer message and potentially
4846 * update in_msglen which keeps track of the contents'
4847 * consumption state.
4849 * (1) Handshake messages:
4850 * Remove last handshake message, move content
4851 * and adapt in_msglen.
4853 * (2) Alert messages:
4854 * Consume whole record content, in_msglen = 0.
4856 * (3) Change cipher spec:
4857 * Consume whole record content, in_msglen = 0.
4859 * (4) Application data:
4860 * Don't do anything - the record layer provides
4861 * the application data as a stream transport
4862 * and consumes through mbedtls_ssl_read only.
4866 /* Case (1): Handshake messages */
4867 if( ssl
->in_hslen
!= 0 )
4869 /* Hard assertion to be sure that no application data
4870 * is in flight, as corrupting ssl->in_msglen during
4871 * ssl->in_offt != NULL is fatal. */
4872 if( ssl
->in_offt
!= NULL
)
4874 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4875 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
4879 * Get next Handshake message in the current record
4883 * (1) in_hslen is not necessarily the size of the
4884 * current handshake content: If DTLS handshake
4885 * fragmentation is used, that's the fragment
4886 * size instead. Using the total handshake message
4887 * size here is faulty and should be changed at
4889 * (2) While it doesn't seem to cause problems, one
4890 * has to be very careful not to assume that in_hslen
4891 * is always <= in_msglen in a sensible communication.
4892 * Again, it's wrong for DTLS handshake fragmentation.
4893 * The following check is therefore mandatory, and
4894 * should not be treated as a silently corrected assertion.
4895 * Additionally, ssl->in_hslen might be arbitrarily out of
4896 * bounds after handling a DTLS message with an unexpected
4897 * sequence number, see mbedtls_ssl_prepare_handshake_record.
4899 if( ssl
->in_hslen
< ssl
->in_msglen
)
4901 ssl
->in_msglen
-= ssl
->in_hslen
;
4902 memmove( ssl
->in_msg
, ssl
->in_msg
+ ssl
->in_hslen
,
4905 MBEDTLS_SSL_DEBUG_BUF( 4, "remaining content in record",
4906 ssl
->in_msg
, ssl
->in_msglen
);
4915 /* Case (4): Application data */
4916 else if( ssl
->in_offt
!= NULL
)
4920 /* Everything else (CCS & Alerts) */
4929 static int ssl_record_is_in_progress( mbedtls_ssl_context
*ssl
)
4931 if( ssl
->in_msglen
> 0 )
4937 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4939 static void ssl_free_buffered_record( mbedtls_ssl_context
*ssl
)
4941 mbedtls_ssl_handshake_params
* const hs
= ssl
->handshake
;
4945 if( hs
->buffering
.future_record
.data
!= NULL
)
4947 hs
->buffering
.total_bytes_buffered
-=
4948 hs
->buffering
.future_record
.len
;
4950 mbedtls_free( hs
->buffering
.future_record
.data
);
4951 hs
->buffering
.future_record
.data
= NULL
;
4955 static int ssl_load_buffered_record( mbedtls_ssl_context
*ssl
)
4957 mbedtls_ssl_handshake_params
* const hs
= ssl
->handshake
;
4958 unsigned char * rec
;
4962 if( ssl
->conf
->transport
!= MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
4968 rec
= hs
->buffering
.future_record
.data
;
4969 rec_len
= hs
->buffering
.future_record
.len
;
4970 rec_epoch
= hs
->buffering
.future_record
.epoch
;
4975 /* Only consider loading future records if the
4976 * input buffer is empty. */
4977 if( ssl_next_record_is_in_datagram( ssl
) == 1 )
4980 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_load_buffered_record" ) );
4982 if( rec_epoch
!= ssl
->in_epoch
)
4984 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffered record not from current epoch." ) );
4988 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Found buffered record from current epoch - load" ) );
4990 /* Double-check that the record is not too large */
4991 if( rec_len
> MBEDTLS_SSL_IN_BUFFER_LEN
-
4992 (size_t)( ssl
->in_hdr
- ssl
->in_buf
) )
4994 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4995 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
4998 memcpy( ssl
->in_hdr
, rec
, rec_len
);
4999 ssl
->in_left
= rec_len
;
5000 ssl
->next_record_offset
= 0;
5002 ssl_free_buffered_record( ssl
);
5005 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_load_buffered_record" ) );
5009 static int ssl_buffer_future_record( mbedtls_ssl_context
*ssl
)
5011 mbedtls_ssl_handshake_params
* const hs
= ssl
->handshake
;
5012 size_t const rec_hdr_len
= 13;
5013 size_t const total_buf_sz
= rec_hdr_len
+ ssl
->in_msglen
;
5015 /* Don't buffer future records outside handshakes. */
5019 /* Only buffer handshake records (we are only interested
5020 * in Finished messages). */
5021 if( ssl
->in_msgtype
!= MBEDTLS_SSL_MSG_HANDSHAKE
)
5024 /* Don't buffer more than one future epoch record. */
5025 if( hs
->buffering
.future_record
.data
!= NULL
)
5028 /* Don't buffer record if there's not enough buffering space remaining. */
5029 if( total_buf_sz
> ( MBEDTLS_SSL_DTLS_MAX_BUFFERING
-
5030 hs
->buffering
.total_bytes_buffered
) )
5032 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffering of future epoch record of size %u would exceed the compile-time limit %u (already %u bytes buffered) -- ignore\n",
5033 (unsigned) total_buf_sz
, MBEDTLS_SSL_DTLS_MAX_BUFFERING
,
5034 (unsigned) hs
->buffering
.total_bytes_buffered
) );
5039 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Buffer record from epoch %u",
5040 ssl
->in_epoch
+ 1 ) );
5041 MBEDTLS_SSL_DEBUG_BUF( 3, "Buffered record", ssl
->in_hdr
,
5042 rec_hdr_len
+ ssl
->in_msglen
);
5044 /* ssl_parse_record_header() only considers records
5045 * of the next epoch as candidates for buffering. */
5046 hs
->buffering
.future_record
.epoch
= ssl
->in_epoch
+ 1;
5047 hs
->buffering
.future_record
.len
= total_buf_sz
;
5049 hs
->buffering
.future_record
.data
=
5050 mbedtls_calloc( 1, hs
->buffering
.future_record
.len
);
5051 if( hs
->buffering
.future_record
.data
== NULL
)
5053 /* If we run out of RAM trying to buffer a
5054 * record from the next epoch, just ignore. */
5058 memcpy( hs
->buffering
.future_record
.data
, ssl
->in_hdr
, total_buf_sz
);
5060 hs
->buffering
.total_bytes_buffered
+= total_buf_sz
;
5064 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5066 static int ssl_get_next_record( mbedtls_ssl_context
*ssl
)
5070 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5071 /* We might have buffered a future record; if so,
5072 * and if the epoch matches now, load it.
5073 * On success, this call will set ssl->in_left to
5074 * the length of the buffered record, so that
5075 * the calls to ssl_fetch_input() below will
5076 * essentially be no-ops. */
5077 ret
= ssl_load_buffered_record( ssl
);
5080 #endif /* MBEDTLS_SSL_PROTO_DTLS */
5082 if( ( ret
= mbedtls_ssl_fetch_input( ssl
, mbedtls_ssl_hdr_len( ssl
) ) ) != 0 )
5084 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret
);
5088 if( ( ret
= ssl_parse_record_header( ssl
) ) != 0 )
5090 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5091 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
5092 ret
!= MBEDTLS_ERR_SSL_CLIENT_RECONNECT
)
5094 if( ret
== MBEDTLS_ERR_SSL_EARLY_MESSAGE
)
5096 ret
= ssl_buffer_future_record( ssl
);
5100 /* Fall through to handling of unexpected records */
5101 ret
= MBEDTLS_ERR_SSL_UNEXPECTED_RECORD
;
5104 if( ret
== MBEDTLS_ERR_SSL_UNEXPECTED_RECORD
)
5106 /* Skip unexpected record (but not whole datagram) */
5107 ssl
->next_record_offset
= ssl
->in_msglen
5108 + mbedtls_ssl_hdr_len( ssl
);
5110 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding unexpected record "
5115 /* Skip invalid record and the rest of the datagram */
5116 ssl
->next_record_offset
= 0;
5119 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record "
5123 /* Get next record */
5124 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING
);
5131 * Read and optionally decrypt the message contents
5133 if( ( ret
= mbedtls_ssl_fetch_input( ssl
,
5134 mbedtls_ssl_hdr_len( ssl
) + ssl
->in_msglen
) ) != 0 )
5136 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret
);
5140 /* Done reading this record, get ready for the next one */
5141 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5142 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
5144 ssl
->next_record_offset
= ssl
->in_msglen
+ mbedtls_ssl_hdr_len( ssl
);
5145 if( ssl
->next_record_offset
< ssl
->in_left
)
5147 MBEDTLS_SSL_DEBUG_MSG( 3, ( "more than one record within datagram" ) );
5154 if( ( ret
= ssl_prepare_record_content( ssl
) ) != 0 )
5156 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5157 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
5159 /* Silently discard invalid records */
5160 if( ret
== MBEDTLS_ERR_SSL_INVALID_RECORD
||
5161 ret
== MBEDTLS_ERR_SSL_INVALID_MAC
)
5163 /* Except when waiting for Finished as a bad mac here
5164 * probably means something went wrong in the handshake
5165 * (eg wrong psk used, mitm downgrade attempt, etc.) */
5166 if( ssl
->state
== MBEDTLS_SSL_CLIENT_FINISHED
||
5167 ssl
->state
== MBEDTLS_SSL_SERVER_FINISHED
)
5169 #if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
5170 if( ret
== MBEDTLS_ERR_SSL_INVALID_MAC
)
5172 mbedtls_ssl_send_alert_message( ssl
,
5173 MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5174 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC
);
5180 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
5181 if( ssl
->conf
->badmac_limit
!= 0 &&
5182 ++ssl
->badmac_seen
>= ssl
->conf
->badmac_limit
)
5184 MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
5185 return( MBEDTLS_ERR_SSL_INVALID_MAC
);
5189 /* As above, invalid records cause
5190 * dismissal of the whole datagram. */
5192 ssl
->next_record_offset
= 0;
5195 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
5196 return( MBEDTLS_ERR_SSL_CONTINUE_PROCESSING
);
5204 /* Error out (and send alert) on invalid records */
5205 #if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
5206 if( ret
== MBEDTLS_ERR_SSL_INVALID_MAC
)
5208 mbedtls_ssl_send_alert_message( ssl
,
5209 MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5210 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC
);
5220 int mbedtls_ssl_handle_message_type( mbedtls_ssl_context
*ssl
)
5225 * Handle particular types of records
5227 if( ssl
->in_msgtype
== MBEDTLS_SSL_MSG_HANDSHAKE
)
5229 if( ( ret
= mbedtls_ssl_prepare_handshake_record( ssl
) ) != 0 )
5235 if( ssl
->in_msgtype
== MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC
)
5237 if( ssl
->in_msglen
!= 1 )
5239 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, len: %d",
5241 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
5244 if( ssl
->in_msg
[0] != 1 )
5246 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid CCS message, content: %02x",
5248 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
5251 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5252 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
5253 ssl
->state
!= MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC
&&
5254 ssl
->state
!= MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC
)
5256 if( ssl
->handshake
== NULL
)
5258 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping ChangeCipherSpec outside handshake" ) );
5259 return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD
);
5262 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received out-of-order ChangeCipherSpec - remember" ) );
5263 return( MBEDTLS_ERR_SSL_EARLY_MESSAGE
);
5268 if( ssl
->in_msgtype
== MBEDTLS_SSL_MSG_ALERT
)
5270 if( ssl
->in_msglen
!= 2 )
5272 /* Note: Standard allows for more than one 2 byte alert
5273 to be packed in a single message, but Mbed TLS doesn't
5274 currently support this. */
5275 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid alert message, len: %d",
5277 return( MBEDTLS_ERR_SSL_INVALID_RECORD
);
5280 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]",
5281 ssl
->in_msg
[0], ssl
->in_msg
[1] ) );
5284 * Ignore non-fatal alerts, except close_notify and no_renegotiation
5286 if( ssl
->in_msg
[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL
)
5288 MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
5290 return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE
);
5293 if( ssl
->in_msg
[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING
&&
5294 ssl
->in_msg
[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY
)
5296 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
5297 return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY
);
5300 #if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
5301 if( ssl
->in_msg
[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING
&&
5302 ssl
->in_msg
[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION
)
5304 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no renegotiation alert" ) );
5305 /* Will be handled when trying to parse ServerHello */
5310 #if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_SRV_C)
5311 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
&&
5312 ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
&&
5313 ssl
->in_msg
[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING
&&
5314 ssl
->in_msg
[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT
)
5316 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
5317 /* Will be handled in mbedtls_ssl_parse_certificate() */
5320 #endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
5322 /* Silently ignore: fetch new message */
5323 return MBEDTLS_ERR_SSL_NON_FATAL
;
5326 #if defined(MBEDTLS_SSL_PROTO_DTLS)
5327 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
5328 ssl
->handshake
!= NULL
&&
5329 ssl
->state
== MBEDTLS_SSL_HANDSHAKE_OVER
)
5331 ssl_handshake_wrapup_free_hs_transform( ssl
);
5338 int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context
*ssl
)
5342 if( ( ret
= mbedtls_ssl_send_alert_message( ssl
,
5343 MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5344 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE
) ) != 0 )
5352 int mbedtls_ssl_send_alert_message( mbedtls_ssl_context
*ssl
,
5353 unsigned char level
,
5354 unsigned char message
)
5358 if( ssl
== NULL
|| ssl
->conf
== NULL
)
5359 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
5361 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
5362 MBEDTLS_SSL_DEBUG_MSG( 3, ( "send alert level=%u message=%u", level
, message
));
5364 ssl
->out_msgtype
= MBEDTLS_SSL_MSG_ALERT
;
5365 ssl
->out_msglen
= 2;
5366 ssl
->out_msg
[0] = level
;
5367 ssl
->out_msg
[1] = message
;
5369 if( ( ret
= mbedtls_ssl_write_record( ssl
, SSL_FORCE_FLUSH
) ) != 0 )
5371 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret
);
5374 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
5380 * Handshake functions
5382 #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
5383 !defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) && \
5384 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
5385 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
5386 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \
5387 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
5388 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
5389 /* No certificate support -> dummy functions */
5390 int mbedtls_ssl_write_certificate( mbedtls_ssl_context
*ssl
)
5392 const mbedtls_ssl_ciphersuite_t
*ciphersuite_info
= ssl
->transform_negotiate
->ciphersuite_info
;
5394 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
5396 if( ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_PSK
||
5397 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_DHE_PSK
||
5398 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_ECDHE_PSK
||
5399 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_ECJPAKE
)
5401 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
5406 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5407 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
5410 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context
*ssl
)
5412 const mbedtls_ssl_ciphersuite_t
*ciphersuite_info
= ssl
->transform_negotiate
->ciphersuite_info
;
5414 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
5416 if( ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_PSK
||
5417 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_DHE_PSK
||
5418 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_ECDHE_PSK
||
5419 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_ECJPAKE
)
5421 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
5426 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
5427 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
5431 /* Some certificate support -> implement write and parse */
5433 int mbedtls_ssl_write_certificate( mbedtls_ssl_context
*ssl
)
5435 int ret
= MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE
;
5437 const mbedtls_x509_crt
*crt
;
5438 const mbedtls_ssl_ciphersuite_t
*ciphersuite_info
= ssl
->transform_negotiate
->ciphersuite_info
;
5440 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
5442 if( ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_PSK
||
5443 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_DHE_PSK
||
5444 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_ECDHE_PSK
||
5445 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_ECJPAKE
)
5447 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
5452 #if defined(MBEDTLS_SSL_CLI_C)
5453 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_CLIENT
)
5455 if( ssl
->client_auth
== 0 )
5457 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
5462 #if defined(MBEDTLS_SSL_PROTO_SSL3)
5464 * If using SSLv3 and got no cert, send an Alert message
5465 * (otherwise an empty Certificate message will be sent).
5467 if( mbedtls_ssl_own_cert( ssl
) == NULL
&&
5468 ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
)
5470 ssl
->out_msglen
= 2;
5471 ssl
->out_msgtype
= MBEDTLS_SSL_MSG_ALERT
;
5472 ssl
->out_msg
[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING
;
5473 ssl
->out_msg
[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT
;
5475 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
5478 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
5480 #endif /* MBEDTLS_SSL_CLI_C */
5481 #if defined(MBEDTLS_SSL_SRV_C)
5482 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
)
5484 if( mbedtls_ssl_own_cert( ssl
) == NULL
)
5486 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
5487 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED
);
5492 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl
) );
5495 * 0 . 0 handshake type
5496 * 1 . 3 handshake length
5497 * 4 . 6 length of all certs
5498 * 7 . 9 length of cert. 1
5499 * 10 . n-1 peer certificate
5500 * n . n+2 length of cert. 2
5501 * n+3 . ... upper level cert, etc.
5504 crt
= mbedtls_ssl_own_cert( ssl
);
5506 while( crt
!= NULL
)
5509 if( n
> MBEDTLS_SSL_OUT_CONTENT_LEN
- 3 - i
)
5511 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
5512 i
+ 3 + n
, MBEDTLS_SSL_OUT_CONTENT_LEN
) );
5513 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE
);
5516 ssl
->out_msg
[i
] = (unsigned char)( n
>> 16 );
5517 ssl
->out_msg
[i
+ 1] = (unsigned char)( n
>> 8 );
5518 ssl
->out_msg
[i
+ 2] = (unsigned char)( n
);
5520 i
+= 3; memcpy( ssl
->out_msg
+ i
, crt
->raw
.p
, n
);
5521 i
+= n
; crt
= crt
->next
;
5524 ssl
->out_msg
[4] = (unsigned char)( ( i
- 7 ) >> 16 );
5525 ssl
->out_msg
[5] = (unsigned char)( ( i
- 7 ) >> 8 );
5526 ssl
->out_msg
[6] = (unsigned char)( ( i
- 7 ) );
5528 ssl
->out_msglen
= i
;
5529 ssl
->out_msgtype
= MBEDTLS_SSL_MSG_HANDSHAKE
;
5530 ssl
->out_msg
[0] = MBEDTLS_SSL_HS_CERTIFICATE
;
5532 #if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
5538 if( ( ret
= mbedtls_ssl_write_handshake_msg( ssl
) ) != 0 )
5540 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret
);
5544 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
5550 * Once the certificate message is read, parse it into a cert chain and
5551 * perform basic checks, but leave actual verification to the caller
5553 static int ssl_parse_certificate_chain( mbedtls_ssl_context
*ssl
)
5559 #if defined(MBEDTLS_SSL_SRV_C)
5560 #if defined(MBEDTLS_SSL_PROTO_SSL3)
5562 * Check if the client sent an empty certificate
5564 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
&&
5565 ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
)
5567 if( ssl
->in_msglen
== 2 &&
5568 ssl
->in_msgtype
== MBEDTLS_SSL_MSG_ALERT
&&
5569 ssl
->in_msg
[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING
&&
5570 ssl
->in_msg
[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT
)
5572 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
5574 /* The client was asked for a certificate but didn't send
5575 one. The client should know what's going on, so we
5576 don't send an alert. */
5577 ssl
->session_negotiate
->verify_result
= MBEDTLS_X509_BADCERT_MISSING
;
5578 return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE
);
5581 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
5583 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
5584 defined(MBEDTLS_SSL_PROTO_TLS1_2)
5585 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
&&
5586 ssl
->minor_ver
!= MBEDTLS_SSL_MINOR_VERSION_0
)
5588 if( ssl
->in_hslen
== 3 + mbedtls_ssl_hs_hdr_len( ssl
) &&
5589 ssl
->in_msgtype
== MBEDTLS_SSL_MSG_HANDSHAKE
&&
5590 ssl
->in_msg
[0] == MBEDTLS_SSL_HS_CERTIFICATE
&&
5591 memcmp( ssl
->in_msg
+ mbedtls_ssl_hs_hdr_len( ssl
), "\0\0\0", 3 ) == 0 )
5593 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
5595 /* The client was asked for a certificate but didn't send
5596 one. The client should know what's going on, so we
5597 don't send an alert. */
5598 ssl
->session_negotiate
->verify_result
= MBEDTLS_X509_BADCERT_MISSING
;
5599 return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE
);
5602 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
5603 MBEDTLS_SSL_PROTO_TLS1_2 */
5604 #endif /* MBEDTLS_SSL_SRV_C */
5606 if( ssl
->in_msgtype
!= MBEDTLS_SSL_MSG_HANDSHAKE
)
5608 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5609 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5610 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE
);
5611 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE
);
5614 if( ssl
->in_msg
[0] != MBEDTLS_SSL_HS_CERTIFICATE
||
5615 ssl
->in_hslen
< mbedtls_ssl_hs_hdr_len( ssl
) + 3 + 3 )
5617 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5618 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5619 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR
);
5620 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE
);
5623 i
= mbedtls_ssl_hs_hdr_len( ssl
);
5626 * Same message structure as in mbedtls_ssl_write_certificate()
5628 n
= ( ssl
->in_msg
[i
+1] << 8 ) | ssl
->in_msg
[i
+2];
5630 if( ssl
->in_msg
[i
] != 0 ||
5631 ssl
->in_hslen
!= n
+ 3 + mbedtls_ssl_hs_hdr_len( ssl
) )
5633 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5634 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5635 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR
);
5636 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE
);
5639 /* In case we tried to reuse a session but it failed */
5640 if( ssl
->session_negotiate
->peer_cert
!= NULL
)
5642 mbedtls_x509_crt_free( ssl
->session_negotiate
->peer_cert
);
5643 mbedtls_free( ssl
->session_negotiate
->peer_cert
);
5646 if( ( ssl
->session_negotiate
->peer_cert
= mbedtls_calloc( 1,
5647 sizeof( mbedtls_x509_crt
) ) ) == NULL
)
5649 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
5650 sizeof( mbedtls_x509_crt
) ) );
5651 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5652 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR
);
5653 return( MBEDTLS_ERR_SSL_ALLOC_FAILED
);
5656 mbedtls_x509_crt_init( ssl
->session_negotiate
->peer_cert
);
5660 while( i
< ssl
->in_hslen
)
5662 if ( i
+ 3 > ssl
->in_hslen
) {
5663 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5664 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5665 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR
);
5666 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE
);
5668 if( ssl
->in_msg
[i
] != 0 )
5670 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5671 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5672 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR
);
5673 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE
);
5676 n
= ( (unsigned int) ssl
->in_msg
[i
+ 1] << 8 )
5677 | (unsigned int) ssl
->in_msg
[i
+ 2];
5680 if( n
< 128 || i
+ n
> ssl
->in_hslen
)
5682 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
5683 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5684 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR
);
5685 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE
);
5688 ret
= mbedtls_x509_crt_parse_der( ssl
->session_negotiate
->peer_cert
,
5689 ssl
->in_msg
+ i
, n
);
5693 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG
+ MBEDTLS_ERR_OID_NOT_FOUND
:
5694 /* Ignore certificate with an unknown algorithm: maybe a
5695 prior certificate was already trusted. */
5698 case MBEDTLS_ERR_X509_ALLOC_FAILED
:
5699 alert
= MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR
;
5700 goto crt_parse_der_failed
;
5702 case MBEDTLS_ERR_X509_UNKNOWN_VERSION
:
5703 alert
= MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT
;
5704 goto crt_parse_der_failed
;
5707 alert
= MBEDTLS_SSL_ALERT_MSG_BAD_CERT
;
5708 crt_parse_der_failed
:
5709 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
, alert
);
5710 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret
);
5717 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", ssl
->session_negotiate
->peer_cert
);
5720 * On client, make sure the server cert doesn't change during renego to
5721 * avoid "triple handshake" attack: https://secure-resumption.com/
5723 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
5724 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_CLIENT
&&
5725 ssl
->renego_status
== MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS
)
5727 if( ssl
->session
->peer_cert
== NULL
)
5729 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
5730 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5731 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED
);
5732 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE
);
5735 if( ssl
->session
->peer_cert
->raw
.len
!=
5736 ssl
->session_negotiate
->peer_cert
->raw
.len
||
5737 memcmp( ssl
->session
->peer_cert
->raw
.p
,
5738 ssl
->session_negotiate
->peer_cert
->raw
.p
,
5739 ssl
->session
->peer_cert
->raw
.len
) != 0 )
5741 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server cert changed during renegotiation" ) );
5742 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5743 MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED
);
5744 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE
);
5747 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
5752 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context
*ssl
)
5755 const mbedtls_ssl_ciphersuite_t
* const ciphersuite_info
=
5756 ssl
->transform_negotiate
->ciphersuite_info
;
5757 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
5758 const int authmode
= ssl
->handshake
->sni_authmode
!= MBEDTLS_SSL_VERIFY_UNSET
5759 ? ssl
->handshake
->sni_authmode
5760 : ssl
->conf
->authmode
;
5762 const int authmode
= ssl
->conf
->authmode
;
5764 void *rs_ctx
= NULL
;
5766 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
5768 if( ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_PSK
||
5769 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_DHE_PSK
||
5770 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_ECDHE_PSK
||
5771 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_ECJPAKE
)
5773 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
5778 #if defined(MBEDTLS_SSL_SRV_C)
5779 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
&&
5780 ciphersuite_info
->key_exchange
== MBEDTLS_KEY_EXCHANGE_RSA_PSK
)
5782 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
5787 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
&&
5788 authmode
== MBEDTLS_SSL_VERIFY_NONE
)
5790 ssl
->session_negotiate
->verify_result
= MBEDTLS_X509_BADCERT_SKIP_VERIFY
;
5791 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
5798 #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
5799 if( ssl
->handshake
->ecrs_enabled
&&
5800 ssl
->handshake
->ecrs_state
== ssl_ecrs_crt_verify
)
5806 if( ( ret
= mbedtls_ssl_read_record( ssl
, 1 ) ) != 0 )
5808 /* mbedtls_ssl_read_record may have sent an alert already. We
5809 let it decide whether to alert. */
5810 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret
);
5814 if( ( ret
= ssl_parse_certificate_chain( ssl
) ) != 0 )
5816 #if defined(MBEDTLS_SSL_SRV_C)
5817 if( ret
== MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE
&&
5818 authmode
== MBEDTLS_SSL_VERIFY_OPTIONAL
)
5828 #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
5829 if( ssl
->handshake
->ecrs_enabled
)
5830 ssl
->handshake
->ecrs_state
= ssl_ecrs_crt_verify
;
5833 if( ssl
->handshake
->ecrs_enabled
)
5834 rs_ctx
= &ssl
->handshake
->ecrs_ctx
;
5837 if( authmode
!= MBEDTLS_SSL_VERIFY_NONE
)
5839 mbedtls_x509_crt
*ca_chain
;
5840 mbedtls_x509_crl
*ca_crl
;
5842 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
5843 if( ssl
->handshake
->sni_ca_chain
!= NULL
)
5845 ca_chain
= ssl
->handshake
->sni_ca_chain
;
5846 ca_crl
= ssl
->handshake
->sni_ca_crl
;
5851 ca_chain
= ssl
->conf
->ca_chain
;
5852 ca_crl
= ssl
->conf
->ca_crl
;
5856 * Main check: verify certificate
5858 ret
= mbedtls_x509_crt_verify_restartable(
5859 ssl
->session_negotiate
->peer_cert
,
5861 ssl
->conf
->cert_profile
,
5863 &ssl
->session_negotiate
->verify_result
,
5864 ssl
->conf
->f_vrfy
, ssl
->conf
->p_vrfy
, rs_ctx
);
5868 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret
);
5871 #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
5872 if( ret
== MBEDTLS_ERR_ECP_IN_PROGRESS
)
5873 return( MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS
);
5877 * Secondary checks: always done, but change 'ret' only if it was 0
5880 #if defined(MBEDTLS_ECP_C)
5882 const mbedtls_pk_context
*pk
= &ssl
->session_negotiate
->peer_cert
->pk
;
5884 /* If certificate uses an EC key, make sure the curve is OK */
5885 if( mbedtls_pk_can_do( pk
, MBEDTLS_PK_ECKEY
) &&
5886 mbedtls_ssl_check_curve( ssl
, mbedtls_pk_ec( *pk
)->grp
.id
) != 0 )
5888 ssl
->session_negotiate
->verify_result
|= MBEDTLS_X509_BADCERT_BAD_KEY
;
5890 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
5892 ret
= MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE
;
5895 #endif /* MBEDTLS_ECP_C */
5897 if( mbedtls_ssl_check_cert_usage( ssl
->session_negotiate
->peer_cert
,
5899 ! ssl
->conf
->endpoint
,
5900 &ssl
->session_negotiate
->verify_result
) != 0 )
5902 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
5904 ret
= MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE
;
5907 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
5908 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
5909 * with details encoded in the verification flags. All other kinds
5910 * of error codes, including those from the user provided f_vrfy
5911 * functions, are treated as fatal and lead to a failure of
5912 * ssl_parse_certificate even if verification was optional. */
5913 if( authmode
== MBEDTLS_SSL_VERIFY_OPTIONAL
&&
5914 ( ret
== MBEDTLS_ERR_X509_CERT_VERIFY_FAILED
||
5915 ret
== MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE
) )
5920 if( ca_chain
== NULL
&& authmode
== MBEDTLS_SSL_VERIFY_REQUIRED
)
5922 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
5923 ret
= MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED
;
5930 /* The certificate may have been rejected for several reasons.
5931 Pick one and send the corresponding alert. Which alert to send
5932 may be a subject of debate in some cases. */
5933 if( ssl
->session_negotiate
->verify_result
& MBEDTLS_X509_BADCERT_OTHER
)
5934 alert
= MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED
;
5935 else if( ssl
->session_negotiate
->verify_result
& MBEDTLS_X509_BADCERT_CN_MISMATCH
)
5936 alert
= MBEDTLS_SSL_ALERT_MSG_BAD_CERT
;
5937 else if( ssl
->session_negotiate
->verify_result
& MBEDTLS_X509_BADCERT_KEY_USAGE
)
5938 alert
= MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT
;
5939 else if( ssl
->session_negotiate
->verify_result
& MBEDTLS_X509_BADCERT_EXT_KEY_USAGE
)
5940 alert
= MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT
;
5941 else if( ssl
->session_negotiate
->verify_result
& MBEDTLS_X509_BADCERT_NS_CERT_TYPE
)
5942 alert
= MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT
;
5943 else if( ssl
->session_negotiate
->verify_result
& MBEDTLS_X509_BADCERT_BAD_PK
)
5944 alert
= MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT
;
5945 else if( ssl
->session_negotiate
->verify_result
& MBEDTLS_X509_BADCERT_BAD_KEY
)
5946 alert
= MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT
;
5947 else if( ssl
->session_negotiate
->verify_result
& MBEDTLS_X509_BADCERT_EXPIRED
)
5948 alert
= MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED
;
5949 else if( ssl
->session_negotiate
->verify_result
& MBEDTLS_X509_BADCERT_REVOKED
)
5950 alert
= MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED
;
5951 else if( ssl
->session_negotiate
->verify_result
& MBEDTLS_X509_BADCERT_NOT_TRUSTED
)
5952 alert
= MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA
;
5954 alert
= MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN
;
5955 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
5959 #if defined(MBEDTLS_DEBUG_C)
5960 if( ssl
->session_negotiate
->verify_result
!= 0 )
5962 MBEDTLS_SSL_DEBUG_MSG( 3, ( "! Certificate verification flags %x",
5963 ssl
->session_negotiate
->verify_result
) );
5967 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate verification flags clear" ) );
5969 #endif /* MBEDTLS_DEBUG_C */
5974 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
5978 #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
5979 !MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
5980 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
5981 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
5982 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
5983 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
5984 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
5986 int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context
*ssl
)
5990 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
5992 ssl
->out_msgtype
= MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC
;
5993 ssl
->out_msglen
= 1;
5994 ssl
->out_msg
[0] = 1;
5998 if( ( ret
= mbedtls_ssl_write_handshake_msg( ssl
) ) != 0 )
6000 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret
);
6004 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
6009 int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context
*ssl
)
6013 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
6015 if( ( ret
= mbedtls_ssl_read_record( ssl
, 1 ) ) != 0 )
6017 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret
);
6021 if( ssl
->in_msgtype
!= MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC
)
6023 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
6024 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
6025 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE
);
6026 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE
);
6029 /* CCS records are only accepted if they have length 1 and content '1',
6030 * so we don't need to check this here. */
6033 * Switch to our negotiated transform and session parameters for inbound
6036 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
6037 ssl
->transform_in
= ssl
->transform_negotiate
;
6038 ssl
->session_in
= ssl
->session_negotiate
;
6040 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6041 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
6043 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
6044 ssl_dtls_replay_reset( ssl
);
6047 /* Increment epoch */
6048 if( ++ssl
->in_epoch
== 0 )
6050 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
6051 /* This is highly unlikely to happen for legitimate reasons, so
6052 treat it as an attack and don't send an alert. */
6053 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING
);
6057 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6058 memset( ssl
->in_ctr
, 0, 8 );
6060 ssl_update_in_pointers( ssl
, ssl
->transform_negotiate
);
6062 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
6063 if( mbedtls_ssl_hw_record_activate
!= NULL
)
6065 if( ( ret
= mbedtls_ssl_hw_record_activate( ssl
, MBEDTLS_SSL_CHANNEL_INBOUND
) ) != 0 )
6067 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret
);
6068 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
6069 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR
);
6070 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED
);
6077 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
6082 void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context
*ssl
,
6083 const mbedtls_ssl_ciphersuite_t
*ciphersuite_info
)
6085 ((void) ciphersuite_info
);
6087 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6088 defined(MBEDTLS_SSL_PROTO_TLS1_1)
6089 if( ssl
->minor_ver
< MBEDTLS_SSL_MINOR_VERSION_3
)
6090 ssl
->handshake
->update_checksum
= ssl_update_checksum_md5sha1
;
6093 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6094 #if defined(MBEDTLS_SHA512_C)
6095 if( ciphersuite_info
->mac
== MBEDTLS_MD_SHA384
)
6096 ssl
->handshake
->update_checksum
= ssl_update_checksum_sha384
;
6099 #if defined(MBEDTLS_SHA256_C)
6100 if( ciphersuite_info
->mac
!= MBEDTLS_MD_SHA384
)
6101 ssl
->handshake
->update_checksum
= ssl_update_checksum_sha256
;
6104 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6106 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
6111 void mbedtls_ssl_reset_checksum( mbedtls_ssl_context
*ssl
)
6113 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6114 defined(MBEDTLS_SSL_PROTO_TLS1_1)
6115 mbedtls_md5_starts_ret( &ssl
->handshake
->fin_md5
);
6116 mbedtls_sha1_starts_ret( &ssl
->handshake
->fin_sha1
);
6118 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6119 #if defined(MBEDTLS_SHA256_C)
6120 mbedtls_sha256_starts_ret( &ssl
->handshake
->fin_sha256
, 0 );
6122 #if defined(MBEDTLS_SHA512_C)
6123 mbedtls_sha512_starts_ret( &ssl
->handshake
->fin_sha512
, 1 );
6125 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6128 static void ssl_update_checksum_start( mbedtls_ssl_context
*ssl
,
6129 const unsigned char *buf
, size_t len
)
6131 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6132 defined(MBEDTLS_SSL_PROTO_TLS1_1)
6133 mbedtls_md5_update_ret( &ssl
->handshake
->fin_md5
, buf
, len
);
6134 mbedtls_sha1_update_ret( &ssl
->handshake
->fin_sha1
, buf
, len
);
6136 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6137 #if defined(MBEDTLS_SHA256_C)
6138 mbedtls_sha256_update_ret( &ssl
->handshake
->fin_sha256
, buf
, len
);
6140 #if defined(MBEDTLS_SHA512_C)
6141 mbedtls_sha512_update_ret( &ssl
->handshake
->fin_sha512
, buf
, len
);
6143 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6146 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6147 defined(MBEDTLS_SSL_PROTO_TLS1_1)
6148 static void ssl_update_checksum_md5sha1( mbedtls_ssl_context
*ssl
,
6149 const unsigned char *buf
, size_t len
)
6151 mbedtls_md5_update_ret( &ssl
->handshake
->fin_md5
, buf
, len
);
6152 mbedtls_sha1_update_ret( &ssl
->handshake
->fin_sha1
, buf
, len
);
6156 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6157 #if defined(MBEDTLS_SHA256_C)
6158 static void ssl_update_checksum_sha256( mbedtls_ssl_context
*ssl
,
6159 const unsigned char *buf
, size_t len
)
6161 mbedtls_sha256_update_ret( &ssl
->handshake
->fin_sha256
, buf
, len
);
6165 #if defined(MBEDTLS_SHA512_C)
6166 static void ssl_update_checksum_sha384( mbedtls_ssl_context
*ssl
,
6167 const unsigned char *buf
, size_t len
)
6169 mbedtls_sha512_update_ret( &ssl
->handshake
->fin_sha512
, buf
, len
);
6172 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6174 #if defined(MBEDTLS_SSL_PROTO_SSL3)
6175 static void ssl_calc_finished_ssl(
6176 mbedtls_ssl_context
*ssl
, unsigned char *buf
, int from
)
6179 mbedtls_md5_context md5
;
6180 mbedtls_sha1_context sha1
;
6182 unsigned char padbuf
[48];
6183 unsigned char md5sum
[16];
6184 unsigned char sha1sum
[20];
6186 mbedtls_ssl_session
*session
= ssl
->session_negotiate
;
6188 session
= ssl
->session
;
6190 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
6192 mbedtls_md5_init( &md5
);
6193 mbedtls_sha1_init( &sha1
);
6195 mbedtls_md5_clone( &md5
, &ssl
->handshake
->fin_md5
);
6196 mbedtls_sha1_clone( &sha1
, &ssl
->handshake
->fin_sha1
);
6201 * MD5( master + pad2 +
6202 * MD5( handshake + sender + master + pad1 ) )
6203 * + SHA1( master + pad2 +
6204 * SHA1( handshake + sender + master + pad1 ) )
6207 #if !defined(MBEDTLS_MD5_ALT)
6208 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
6209 md5
.state
, sizeof( md5
.state
) );
6212 #if !defined(MBEDTLS_SHA1_ALT)
6213 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
6214 sha1
.state
, sizeof( sha1
.state
) );
6217 sender
= ( from
== MBEDTLS_SSL_IS_CLIENT
) ? "CLNT"
6220 memset( padbuf
, 0x36, 48 );
6222 mbedtls_md5_update_ret( &md5
, (const unsigned char *) sender
, 4 );
6223 mbedtls_md5_update_ret( &md5
, session
->master
, 48 );
6224 mbedtls_md5_update_ret( &md5
, padbuf
, 48 );
6225 mbedtls_md5_finish_ret( &md5
, md5sum
);
6227 mbedtls_sha1_update_ret( &sha1
, (const unsigned char *) sender
, 4 );
6228 mbedtls_sha1_update_ret( &sha1
, session
->master
, 48 );
6229 mbedtls_sha1_update_ret( &sha1
, padbuf
, 40 );
6230 mbedtls_sha1_finish_ret( &sha1
, sha1sum
);
6232 memset( padbuf
, 0x5C, 48 );
6234 mbedtls_md5_starts_ret( &md5
);
6235 mbedtls_md5_update_ret( &md5
, session
->master
, 48 );
6236 mbedtls_md5_update_ret( &md5
, padbuf
, 48 );
6237 mbedtls_md5_update_ret( &md5
, md5sum
, 16 );
6238 mbedtls_md5_finish_ret( &md5
, buf
);
6240 mbedtls_sha1_starts_ret( &sha1
);
6241 mbedtls_sha1_update_ret( &sha1
, session
->master
, 48 );
6242 mbedtls_sha1_update_ret( &sha1
, padbuf
, 40 );
6243 mbedtls_sha1_update_ret( &sha1
, sha1sum
, 20 );
6244 mbedtls_sha1_finish_ret( &sha1
, buf
+ 16 );
6246 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf
, 36 );
6248 mbedtls_md5_free( &md5
);
6249 mbedtls_sha1_free( &sha1
);
6251 mbedtls_platform_zeroize( padbuf
, sizeof( padbuf
) );
6252 mbedtls_platform_zeroize( md5sum
, sizeof( md5sum
) );
6253 mbedtls_platform_zeroize( sha1sum
, sizeof( sha1sum
) );
6255 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
6257 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
6259 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
6260 static void ssl_calc_finished_tls(
6261 mbedtls_ssl_context
*ssl
, unsigned char *buf
, int from
)
6265 mbedtls_md5_context md5
;
6266 mbedtls_sha1_context sha1
;
6267 unsigned char padbuf
[36];
6269 mbedtls_ssl_session
*session
= ssl
->session_negotiate
;
6271 session
= ssl
->session
;
6273 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
6275 mbedtls_md5_init( &md5
);
6276 mbedtls_sha1_init( &sha1
);
6278 mbedtls_md5_clone( &md5
, &ssl
->handshake
->fin_md5
);
6279 mbedtls_sha1_clone( &sha1
, &ssl
->handshake
->fin_sha1
);
6283 * hash = PRF( master, finished_label,
6284 * MD5( handshake ) + SHA1( handshake ) )[0..11]
6287 #if !defined(MBEDTLS_MD5_ALT)
6288 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
6289 md5
.state
, sizeof( md5
.state
) );
6292 #if !defined(MBEDTLS_SHA1_ALT)
6293 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
6294 sha1
.state
, sizeof( sha1
.state
) );
6297 sender
= ( from
== MBEDTLS_SSL_IS_CLIENT
)
6299 : "server finished";
6301 mbedtls_md5_finish_ret( &md5
, padbuf
);
6302 mbedtls_sha1_finish_ret( &sha1
, padbuf
+ 16 );
6304 ssl
->handshake
->tls_prf( session
->master
, 48, sender
,
6305 padbuf
, 36, buf
, len
);
6307 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf
, len
);
6309 mbedtls_md5_free( &md5
);
6310 mbedtls_sha1_free( &sha1
);
6312 mbedtls_platform_zeroize( padbuf
, sizeof( padbuf
) );
6314 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
6316 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
6318 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6319 #if defined(MBEDTLS_SHA256_C)
6320 static void ssl_calc_finished_tls_sha256(
6321 mbedtls_ssl_context
*ssl
, unsigned char *buf
, int from
)
6325 mbedtls_sha256_context sha256
;
6326 unsigned char padbuf
[32];
6328 mbedtls_ssl_session
*session
= ssl
->session_negotiate
;
6330 session
= ssl
->session
;
6332 mbedtls_sha256_init( &sha256
);
6334 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
6336 mbedtls_sha256_clone( &sha256
, &ssl
->handshake
->fin_sha256
);
6340 * hash = PRF( master, finished_label,
6341 * Hash( handshake ) )[0.11]
6344 #if !defined(MBEDTLS_SHA256_ALT)
6345 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
6346 sha256
.state
, sizeof( sha256
.state
) );
6349 sender
= ( from
== MBEDTLS_SSL_IS_CLIENT
)
6351 : "server finished";
6353 mbedtls_sha256_finish_ret( &sha256
, padbuf
);
6355 ssl
->handshake
->tls_prf( session
->master
, 48, sender
,
6356 padbuf
, 32, buf
, len
);
6358 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf
, len
);
6360 mbedtls_sha256_free( &sha256
);
6362 mbedtls_platform_zeroize( padbuf
, sizeof( padbuf
) );
6364 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
6366 #endif /* MBEDTLS_SHA256_C */
6368 #if defined(MBEDTLS_SHA512_C)
6370 static void ssl_calc_finished_tls_sha384(
6371 mbedtls_ssl_context
*ssl
, unsigned char *buf
, int from
)
6375 mbedtls_sha512_context sha512
;
6376 unsigned char padbuf
[48];
6378 mbedtls_ssl_session
*session
= ssl
->session_negotiate
;
6380 session
= ssl
->session
;
6382 mbedtls_sha512_init( &sha512
);
6384 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
6386 mbedtls_sha512_clone( &sha512
, &ssl
->handshake
->fin_sha512
);
6390 * hash = PRF( master, finished_label,
6391 * Hash( handshake ) )[0.11]
6394 #if !defined(MBEDTLS_SHA512_ALT)
6395 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
6396 sha512
.state
, sizeof( sha512
.state
) );
6399 sender
= ( from
== MBEDTLS_SSL_IS_CLIENT
)
6401 : "server finished";
6402 /* mbedtls_sha512_finish_ret's output parameter is declared as a
6403 * 64-byte buffer, but sice we're using SHA-384, we know that the
6404 * output fits in 48 bytes. This is correct C, but GCC 11.1 warns
6407 #if defined(__GNUC__) && __GNUC__ >= 11
6408 #pragma GCC diagnostic push
6409 #pragma GCC diagnostic ignored "-Wstringop-overflow"
6411 mbedtls_sha512_finish_ret( &sha512
, padbuf
);
6412 #if defined(__GNUC__) && __GNUC__ >= 11
6413 #pragma GCC diagnostic pop
6416 ssl
->handshake
->tls_prf( session
->master
, 48, sender
,
6417 padbuf
, 48, buf
, len
);
6419 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf
, len
);
6421 mbedtls_sha512_free( &sha512
);
6423 mbedtls_platform_zeroize( padbuf
, sizeof( padbuf
) );
6425 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
6427 #endif /* MBEDTLS_SHA512_C */
6428 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6430 static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context
*ssl
)
6432 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
6435 * Free our handshake params
6437 mbedtls_ssl_handshake_free( ssl
);
6438 mbedtls_free( ssl
->handshake
);
6439 ssl
->handshake
= NULL
;
6442 * Free the previous transform and swith in the current one
6444 if( ssl
->transform
)
6446 mbedtls_ssl_transform_free( ssl
->transform
);
6447 mbedtls_free( ssl
->transform
);
6449 ssl
->transform
= ssl
->transform_negotiate
;
6450 ssl
->transform_negotiate
= NULL
;
6452 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
6455 void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context
*ssl
)
6457 int resume
= ssl
->handshake
->resume
;
6459 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
6461 #if defined(MBEDTLS_SSL_RENEGOTIATION)
6462 if( ssl
->renego_status
== MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS
)
6464 ssl
->renego_status
= MBEDTLS_SSL_RENEGOTIATION_DONE
;
6465 ssl
->renego_records_seen
= 0;
6470 * Free the previous session and switch in the current one
6474 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
6475 /* RFC 7366 3.1: keep the EtM state */
6476 ssl
->session_negotiate
->encrypt_then_mac
=
6477 ssl
->session
->encrypt_then_mac
;
6480 mbedtls_ssl_session_free( ssl
->session
);
6481 mbedtls_free( ssl
->session
);
6483 ssl
->session
= ssl
->session_negotiate
;
6484 ssl
->session_negotiate
= NULL
;
6489 if( ssl
->conf
->f_set_cache
!= NULL
&&
6490 ssl
->session
->id_len
!= 0 &&
6493 if( ssl
->conf
->f_set_cache( ssl
->conf
->p_cache
, ssl
->session
) != 0 )
6494 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
6497 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6498 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
6499 ssl
->handshake
->flight
!= NULL
)
6501 /* Cancel handshake timer */
6502 ssl_set_timer( ssl
, 0 );
6504 /* Keep last flight around in case we need to resend it:
6505 * we need the handshake and transform structures for that */
6506 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
6510 ssl_handshake_wrapup_free_hs_transform( ssl
);
6514 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
6517 int mbedtls_ssl_write_finished( mbedtls_ssl_context
*ssl
)
6521 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
6523 ssl_update_out_pointers( ssl
, ssl
->transform_negotiate
);
6525 ssl
->handshake
->calc_finished( ssl
, ssl
->out_msg
+ 4, ssl
->conf
->endpoint
);
6528 * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites
6529 * may define some other value. Currently (early 2016), no defined
6530 * ciphersuite does this (and this is unlikely to change as activity has
6531 * moved to TLS 1.3 now) so we can keep the hardcoded 12 here.
6533 hash_len
= ( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
) ? 36 : 12;
6535 #if defined(MBEDTLS_SSL_RENEGOTIATION)
6536 ssl
->verify_data_len
= hash_len
;
6537 memcpy( ssl
->own_verify_data
, ssl
->out_msg
+ 4, hash_len
);
6540 ssl
->out_msglen
= 4 + hash_len
;
6541 ssl
->out_msgtype
= MBEDTLS_SSL_MSG_HANDSHAKE
;
6542 ssl
->out_msg
[0] = MBEDTLS_SSL_HS_FINISHED
;
6545 * In case of session resuming, invert the client and server
6546 * ChangeCipherSpec messages order.
6548 if( ssl
->handshake
->resume
!= 0 )
6550 #if defined(MBEDTLS_SSL_CLI_C)
6551 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_CLIENT
)
6552 ssl
->state
= MBEDTLS_SSL_HANDSHAKE_WRAPUP
;
6554 #if defined(MBEDTLS_SSL_SRV_C)
6555 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
)
6556 ssl
->state
= MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC
;
6563 * Switch to our negotiated transform and session parameters for outbound
6566 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
6568 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6569 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
6573 /* Remember current epoch settings for resending */
6574 ssl
->handshake
->alt_transform_out
= ssl
->transform_out
;
6575 memcpy( ssl
->handshake
->alt_out_ctr
, ssl
->cur_out_ctr
, 8 );
6577 /* Set sequence_number to zero */
6578 memset( ssl
->cur_out_ctr
+ 2, 0, 6 );
6580 /* Increment epoch */
6581 for( i
= 2; i
> 0; i
-- )
6582 if( ++ssl
->cur_out_ctr
[i
- 1] != 0 )
6585 /* The loop goes to its end iff the counter is wrapping */
6588 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
6589 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING
);
6593 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6594 memset( ssl
->cur_out_ctr
, 0, 8 );
6596 ssl
->transform_out
= ssl
->transform_negotiate
;
6597 ssl
->session_out
= ssl
->session_negotiate
;
6599 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
6600 if( mbedtls_ssl_hw_record_activate
!= NULL
)
6602 if( ( ret
= mbedtls_ssl_hw_record_activate( ssl
, MBEDTLS_SSL_CHANNEL_OUTBOUND
) ) != 0 )
6604 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret
);
6605 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED
);
6610 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6611 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
6612 mbedtls_ssl_send_flight_completed( ssl
);
6615 if( ( ret
= mbedtls_ssl_write_handshake_msg( ssl
) ) != 0 )
6617 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret
);
6621 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6622 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
6623 ( ret
= mbedtls_ssl_flight_transmit( ssl
) ) != 0 )
6625 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret
);
6630 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
6635 #if defined(MBEDTLS_SSL_PROTO_SSL3)
6636 #define SSL_MAX_HASH_LEN 36
6638 #define SSL_MAX_HASH_LEN 12
6641 int mbedtls_ssl_parse_finished( mbedtls_ssl_context
*ssl
)
6644 unsigned int hash_len
;
6645 unsigned char buf
[SSL_MAX_HASH_LEN
];
6647 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
6649 ssl
->handshake
->calc_finished( ssl
, buf
, ssl
->conf
->endpoint
^ 1 );
6651 if( ( ret
= mbedtls_ssl_read_record( ssl
, 1 ) ) != 0 )
6653 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret
);
6657 if( ssl
->in_msgtype
!= MBEDTLS_SSL_MSG_HANDSHAKE
)
6659 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
6660 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
6661 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE
);
6662 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE
);
6665 /* There is currently no ciphersuite using another length with TLS 1.2 */
6666 #if defined(MBEDTLS_SSL_PROTO_SSL3)
6667 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
)
6673 if( ssl
->in_msg
[0] != MBEDTLS_SSL_HS_FINISHED
||
6674 ssl
->in_hslen
!= mbedtls_ssl_hs_hdr_len( ssl
) + hash_len
)
6676 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
6677 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
6678 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR
);
6679 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED
);
6682 if( mbedtls_ssl_safer_memcmp( ssl
->in_msg
+ mbedtls_ssl_hs_hdr_len( ssl
),
6683 buf
, hash_len
) != 0 )
6685 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
6686 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
6687 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR
);
6688 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED
);
6691 #if defined(MBEDTLS_SSL_RENEGOTIATION)
6692 ssl
->verify_data_len
= hash_len
;
6693 memcpy( ssl
->peer_verify_data
, buf
, hash_len
);
6696 if( ssl
->handshake
->resume
!= 0 )
6698 #if defined(MBEDTLS_SSL_CLI_C)
6699 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_CLIENT
)
6700 ssl
->state
= MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC
;
6702 #if defined(MBEDTLS_SSL_SRV_C)
6703 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
)
6704 ssl
->state
= MBEDTLS_SSL_HANDSHAKE_WRAPUP
;
6710 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6711 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
6712 mbedtls_ssl_recv_flight_completed( ssl
);
6715 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
6720 static void ssl_handshake_params_init( mbedtls_ssl_handshake_params
*handshake
)
6722 memset( handshake
, 0, sizeof( mbedtls_ssl_handshake_params
) );
6724 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
6725 defined(MBEDTLS_SSL_PROTO_TLS1_1)
6726 mbedtls_md5_init( &handshake
->fin_md5
);
6727 mbedtls_sha1_init( &handshake
->fin_sha1
);
6728 mbedtls_md5_starts_ret( &handshake
->fin_md5
);
6729 mbedtls_sha1_starts_ret( &handshake
->fin_sha1
);
6731 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
6732 #if defined(MBEDTLS_SHA256_C)
6733 mbedtls_sha256_init( &handshake
->fin_sha256
);
6734 mbedtls_sha256_starts_ret( &handshake
->fin_sha256
, 0 );
6736 #if defined(MBEDTLS_SHA512_C)
6737 mbedtls_sha512_init( &handshake
->fin_sha512
);
6738 mbedtls_sha512_starts_ret( &handshake
->fin_sha512
, 1 );
6740 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
6742 handshake
->update_checksum
= ssl_update_checksum_start
;
6744 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
6745 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
6746 mbedtls_ssl_sig_hash_set_init( &handshake
->hash_algs
);
6749 #if defined(MBEDTLS_DHM_C)
6750 mbedtls_dhm_init( &handshake
->dhm_ctx
);
6752 #if defined(MBEDTLS_ECDH_C)
6753 mbedtls_ecdh_init( &handshake
->ecdh_ctx
);
6755 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
6756 mbedtls_ecjpake_init( &handshake
->ecjpake_ctx
);
6757 #if defined(MBEDTLS_SSL_CLI_C)
6758 handshake
->ecjpake_cache
= NULL
;
6759 handshake
->ecjpake_cache_len
= 0;
6763 #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
6764 mbedtls_x509_crt_restart_init( &handshake
->ecrs_ctx
);
6767 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
6768 handshake
->sni_authmode
= MBEDTLS_SSL_VERIFY_UNSET
;
6772 static void ssl_transform_init( mbedtls_ssl_transform
*transform
)
6774 memset( transform
, 0, sizeof(mbedtls_ssl_transform
) );
6776 mbedtls_cipher_init( &transform
->cipher_ctx_enc
);
6777 mbedtls_cipher_init( &transform
->cipher_ctx_dec
);
6779 mbedtls_md_init( &transform
->md_ctx_enc
);
6780 mbedtls_md_init( &transform
->md_ctx_dec
);
6783 void mbedtls_ssl_session_init( mbedtls_ssl_session
*session
)
6785 memset( session
, 0, sizeof(mbedtls_ssl_session
) );
6788 static int ssl_handshake_init( mbedtls_ssl_context
*ssl
)
6790 /* Clear old handshake information if present */
6791 if( ssl
->transform_negotiate
)
6792 mbedtls_ssl_transform_free( ssl
->transform_negotiate
);
6793 if( ssl
->session_negotiate
)
6794 mbedtls_ssl_session_free( ssl
->session_negotiate
);
6795 if( ssl
->handshake
)
6796 mbedtls_ssl_handshake_free( ssl
);
6799 * Either the pointers are now NULL or cleared properly and can be freed.
6800 * Now allocate missing structures.
6802 if( ssl
->transform_negotiate
== NULL
)
6804 ssl
->transform_negotiate
= mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform
) );
6807 if( ssl
->session_negotiate
== NULL
)
6809 ssl
->session_negotiate
= mbedtls_calloc( 1, sizeof(mbedtls_ssl_session
) );
6812 if( ssl
->handshake
== NULL
)
6814 ssl
->handshake
= mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params
) );
6817 /* All pointers should exist and can be directly freed without issue */
6818 if( ssl
->handshake
== NULL
||
6819 ssl
->transform_negotiate
== NULL
||
6820 ssl
->session_negotiate
== NULL
)
6822 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
6824 mbedtls_free( ssl
->handshake
);
6825 mbedtls_free( ssl
->transform_negotiate
);
6826 mbedtls_free( ssl
->session_negotiate
);
6828 ssl
->handshake
= NULL
;
6829 ssl
->transform_negotiate
= NULL
;
6830 ssl
->session_negotiate
= NULL
;
6832 return( MBEDTLS_ERR_SSL_ALLOC_FAILED
);
6835 /* Initialize structures */
6836 mbedtls_ssl_session_init( ssl
->session_negotiate
);
6837 ssl_transform_init( ssl
->transform_negotiate
);
6838 ssl_handshake_params_init( ssl
->handshake
);
6840 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6841 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
6843 ssl
->handshake
->alt_transform_out
= ssl
->transform_out
;
6845 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_CLIENT
)
6846 ssl
->handshake
->retransmit_state
= MBEDTLS_SSL_RETRANS_PREPARING
;
6848 ssl
->handshake
->retransmit_state
= MBEDTLS_SSL_RETRANS_WAITING
;
6850 ssl_set_timer( ssl
, 0 );
6857 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
6858 /* Dummy cookie callbacks for defaults */
6859 static int ssl_cookie_write_dummy( void *ctx
,
6860 unsigned char **p
, unsigned char *end
,
6861 const unsigned char *cli_id
, size_t cli_id_len
)
6867 ((void) cli_id_len
);
6869 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE
);
6872 static int ssl_cookie_check_dummy( void *ctx
,
6873 const unsigned char *cookie
, size_t cookie_len
,
6874 const unsigned char *cli_id
, size_t cli_id_len
)
6878 ((void) cookie_len
);
6880 ((void) cli_id_len
);
6882 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE
);
6884 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
6886 /* Once ssl->out_hdr as the address of the beginning of the
6887 * next outgoing record is set, deduce the other pointers.
6889 * Note: For TLS, we save the implicit record sequence number
6890 * (entering MAC computation) in the 8 bytes before ssl->out_hdr,
6891 * and the caller has to make sure there's space for this.
6894 static void ssl_update_out_pointers( mbedtls_ssl_context
*ssl
,
6895 mbedtls_ssl_transform
*transform
)
6897 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6898 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
6900 ssl
->out_ctr
= ssl
->out_hdr
+ 3;
6901 ssl
->out_len
= ssl
->out_hdr
+ 11;
6902 ssl
->out_iv
= ssl
->out_hdr
+ 13;
6907 ssl
->out_ctr
= ssl
->out_hdr
- 8;
6908 ssl
->out_len
= ssl
->out_hdr
+ 3;
6909 ssl
->out_iv
= ssl
->out_hdr
+ 5;
6912 /* Adjust out_msg to make space for explicit IV, if used. */
6913 if( transform
!= NULL
&&
6914 ssl
->minor_ver
>= MBEDTLS_SSL_MINOR_VERSION_2
)
6916 ssl
->out_msg
= ssl
->out_iv
+ transform
->ivlen
- transform
->fixed_ivlen
;
6919 ssl
->out_msg
= ssl
->out_iv
;
6922 /* Once ssl->in_hdr as the address of the beginning of the
6923 * next incoming record is set, deduce the other pointers.
6925 * Note: For TLS, we save the implicit record sequence number
6926 * (entering MAC computation) in the 8 bytes before ssl->in_hdr,
6927 * and the caller has to make sure there's space for this.
6930 static void ssl_update_in_pointers( mbedtls_ssl_context
*ssl
,
6931 mbedtls_ssl_transform
*transform
)
6933 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6934 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
6936 ssl
->in_ctr
= ssl
->in_hdr
+ 3;
6937 ssl
->in_len
= ssl
->in_hdr
+ 11;
6938 ssl
->in_iv
= ssl
->in_hdr
+ 13;
6943 ssl
->in_ctr
= ssl
->in_hdr
- 8;
6944 ssl
->in_len
= ssl
->in_hdr
+ 3;
6945 ssl
->in_iv
= ssl
->in_hdr
+ 5;
6948 /* Offset in_msg from in_iv to allow space for explicit IV, if used. */
6949 if( transform
!= NULL
&&
6950 ssl
->minor_ver
>= MBEDTLS_SSL_MINOR_VERSION_2
)
6952 ssl
->in_msg
= ssl
->in_iv
+ transform
->ivlen
- transform
->fixed_ivlen
;
6955 ssl
->in_msg
= ssl
->in_iv
;
6959 * Initialize an SSL context
6961 void mbedtls_ssl_init( mbedtls_ssl_context
*ssl
)
6963 memset( ssl
, 0, sizeof( mbedtls_ssl_context
) );
6967 * Setup an SSL context
6970 static void ssl_reset_in_out_pointers( mbedtls_ssl_context
*ssl
)
6972 /* Set the incoming and outgoing record pointers. */
6973 #if defined(MBEDTLS_SSL_PROTO_DTLS)
6974 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
6976 ssl
->out_hdr
= ssl
->out_buf
;
6977 ssl
->in_hdr
= ssl
->in_buf
;
6980 #endif /* MBEDTLS_SSL_PROTO_DTLS */
6982 ssl
->out_hdr
= ssl
->out_buf
+ 8;
6983 ssl
->in_hdr
= ssl
->in_buf
+ 8;
6986 /* Derive other internal pointers. */
6987 ssl_update_out_pointers( ssl
, NULL
/* no transform enabled */ );
6988 ssl_update_in_pointers ( ssl
, NULL
/* no transform enabled */ );
6991 int mbedtls_ssl_setup( mbedtls_ssl_context
*ssl
,
6992 const mbedtls_ssl_config
*conf
)
6999 * Prepare base structures
7002 /* Set to NULL in case of an error condition */
7003 ssl
->out_buf
= NULL
;
7005 ssl
->in_buf
= mbedtls_calloc( 1, MBEDTLS_SSL_IN_BUFFER_LEN
);
7006 if( ssl
->in_buf
== NULL
)
7008 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", MBEDTLS_SSL_IN_BUFFER_LEN
) );
7009 ret
= MBEDTLS_ERR_SSL_ALLOC_FAILED
;
7013 ssl
->out_buf
= mbedtls_calloc( 1, MBEDTLS_SSL_OUT_BUFFER_LEN
);
7014 if( ssl
->out_buf
== NULL
)
7016 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", MBEDTLS_SSL_OUT_BUFFER_LEN
) );
7017 ret
= MBEDTLS_ERR_SSL_ALLOC_FAILED
;
7021 ssl_reset_in_out_pointers( ssl
);
7023 if( ( ret
= ssl_handshake_init( ssl
) ) != 0 )
7029 mbedtls_free( ssl
->in_buf
);
7030 mbedtls_free( ssl
->out_buf
);
7035 ssl
->out_buf
= NULL
;
7043 ssl
->out_hdr
= NULL
;
7044 ssl
->out_ctr
= NULL
;
7045 ssl
->out_len
= NULL
;
7047 ssl
->out_msg
= NULL
;
7053 * Reset an initialized and used SSL context for re-use while retaining
7054 * all application-set variables, function pointers and data.
7056 * If partial is non-zero, keep data in the input buffer and client ID.
7057 * (Use when a DTLS client reconnects from the same port.)
7059 static int ssl_session_reset_int( mbedtls_ssl_context
*ssl
, int partial
)
7063 #if !defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) || \
7064 !defined(MBEDTLS_SSL_SRV_C)
7068 ssl
->state
= MBEDTLS_SSL_HELLO_REQUEST
;
7070 /* Cancel any possibly running timer */
7071 ssl_set_timer( ssl
, 0 );
7073 #if defined(MBEDTLS_SSL_RENEGOTIATION)
7074 ssl
->renego_status
= MBEDTLS_SSL_INITIAL_HANDSHAKE
;
7075 ssl
->renego_records_seen
= 0;
7077 ssl
->verify_data_len
= 0;
7078 memset( ssl
->own_verify_data
, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN
);
7079 memset( ssl
->peer_verify_data
, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN
);
7081 ssl
->secure_renegotiation
= MBEDTLS_SSL_LEGACY_RENEGOTIATION
;
7083 ssl
->in_offt
= NULL
;
7084 ssl_reset_in_out_pointers( ssl
);
7086 ssl
->in_msgtype
= 0;
7088 #if defined(MBEDTLS_SSL_PROTO_DTLS)
7089 ssl
->next_record_offset
= 0;
7092 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
7093 ssl_dtls_replay_reset( ssl
);
7099 ssl
->keep_current_message
= 0;
7101 ssl
->out_msgtype
= 0;
7102 ssl
->out_msglen
= 0;
7104 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
7105 if( ssl
->split_done
!= MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED
)
7106 ssl
->split_done
= 0;
7109 memset( ssl
->cur_out_ctr
, 0, sizeof( ssl
->cur_out_ctr
) );
7111 ssl
->transform_in
= NULL
;
7112 ssl
->transform_out
= NULL
;
7114 ssl
->session_in
= NULL
;
7115 ssl
->session_out
= NULL
;
7117 memset( ssl
->out_buf
, 0, MBEDTLS_SSL_OUT_BUFFER_LEN
);
7119 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
7121 #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
7124 memset( ssl
->in_buf
, 0, MBEDTLS_SSL_IN_BUFFER_LEN
);
7127 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
7128 if( mbedtls_ssl_hw_record_reset
!= NULL
)
7130 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) );
7131 if( ( ret
= mbedtls_ssl_hw_record_reset( ssl
) ) != 0 )
7133 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret
);
7134 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED
);
7139 if( ssl
->transform
)
7141 mbedtls_ssl_transform_free( ssl
->transform
);
7142 mbedtls_free( ssl
->transform
);
7143 ssl
->transform
= NULL
;
7148 mbedtls_ssl_session_free( ssl
->session
);
7149 mbedtls_free( ssl
->session
);
7150 ssl
->session
= NULL
;
7153 #if defined(MBEDTLS_SSL_ALPN)
7154 ssl
->alpn_chosen
= NULL
;
7157 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
7158 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
7162 mbedtls_free( ssl
->cli_id
);
7164 ssl
->cli_id_len
= 0;
7168 if( ( ret
= ssl_handshake_init( ssl
) ) != 0 )
7175 * Reset an initialized and used SSL context for re-use while retaining
7176 * all application-set variables, function pointers and data.
7178 int mbedtls_ssl_session_reset( mbedtls_ssl_context
*ssl
)
7180 return( ssl_session_reset_int( ssl
, 0 ) );
7186 void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config
*conf
, int endpoint
)
7188 conf
->endpoint
= endpoint
;
7191 void mbedtls_ssl_conf_transport( mbedtls_ssl_config
*conf
, int transport
)
7193 conf
->transport
= transport
;
7196 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
7197 void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config
*conf
, char mode
)
7199 conf
->anti_replay
= mode
;
7203 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
7204 void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config
*conf
, unsigned limit
)
7206 conf
->badmac_limit
= limit
;
7210 #if defined(MBEDTLS_SSL_PROTO_DTLS)
7212 void mbedtls_ssl_set_datagram_packing( mbedtls_ssl_context
*ssl
,
7213 unsigned allow_packing
)
7215 ssl
->disable_datagram_packing
= !allow_packing
;
7218 void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config
*conf
,
7219 uint32_t min
, uint32_t max
)
7221 conf
->hs_timeout_min
= min
;
7222 conf
->hs_timeout_max
= max
;
7226 void mbedtls_ssl_conf_authmode( mbedtls_ssl_config
*conf
, int authmode
)
7228 conf
->authmode
= authmode
;
7231 #if defined(MBEDTLS_X509_CRT_PARSE_C)
7232 void mbedtls_ssl_conf_verify( mbedtls_ssl_config
*conf
,
7233 int (*f_vrfy
)(void *, mbedtls_x509_crt
*, int, uint32_t *),
7236 conf
->f_vrfy
= f_vrfy
;
7237 conf
->p_vrfy
= p_vrfy
;
7239 #endif /* MBEDTLS_X509_CRT_PARSE_C */
7241 void mbedtls_ssl_conf_rng( mbedtls_ssl_config
*conf
,
7242 int (*f_rng
)(void *, unsigned char *, size_t),
7245 conf
->f_rng
= f_rng
;
7246 conf
->p_rng
= p_rng
;
7249 void mbedtls_ssl_conf_dbg( mbedtls_ssl_config
*conf
,
7250 void (*f_dbg
)(void *, int, const char *, int, const char *),
7253 conf
->f_dbg
= f_dbg
;
7254 conf
->p_dbg
= p_dbg
;
7257 void mbedtls_ssl_set_bio( mbedtls_ssl_context
*ssl
,
7259 mbedtls_ssl_send_t
*f_send
,
7260 mbedtls_ssl_recv_t
*f_recv
,
7261 mbedtls_ssl_recv_timeout_t
*f_recv_timeout
)
7264 ssl
->f_send
= f_send
;
7265 ssl
->f_recv
= f_recv
;
7266 ssl
->f_recv_timeout
= f_recv_timeout
;
7269 #if defined(MBEDTLS_SSL_PROTO_DTLS)
7270 void mbedtls_ssl_set_mtu( mbedtls_ssl_context
*ssl
, uint16_t mtu
)
7276 void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config
*conf
, uint32_t timeout
)
7278 conf
->read_timeout
= timeout
;
7281 void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context
*ssl
,
7283 mbedtls_ssl_set_timer_t
*f_set_timer
,
7284 mbedtls_ssl_get_timer_t
*f_get_timer
)
7286 ssl
->p_timer
= p_timer
;
7287 ssl
->f_set_timer
= f_set_timer
;
7288 ssl
->f_get_timer
= f_get_timer
;
7290 /* Make sure we start with no timer running */
7291 ssl_set_timer( ssl
, 0 );
7294 #if defined(MBEDTLS_SSL_SRV_C)
7295 void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config
*conf
,
7297 int (*f_get_cache
)(void *, mbedtls_ssl_session
*),
7298 int (*f_set_cache
)(void *, const mbedtls_ssl_session
*) )
7300 conf
->p_cache
= p_cache
;
7301 conf
->f_get_cache
= f_get_cache
;
7302 conf
->f_set_cache
= f_set_cache
;
7304 #endif /* MBEDTLS_SSL_SRV_C */
7306 #if defined(MBEDTLS_SSL_CLI_C)
7307 int mbedtls_ssl_set_session( mbedtls_ssl_context
*ssl
, const mbedtls_ssl_session
*session
)
7313 ssl
->session_negotiate
== NULL
||
7314 ssl
->conf
->endpoint
!= MBEDTLS_SSL_IS_CLIENT
)
7316 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
7319 if( ( ret
= ssl_session_copy( ssl
->session_negotiate
, session
) ) != 0 )
7322 ssl
->handshake
->resume
= 1;
7326 #endif /* MBEDTLS_SSL_CLI_C */
7328 void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config
*conf
,
7329 const int *ciphersuites
)
7331 conf
->ciphersuite_list
[MBEDTLS_SSL_MINOR_VERSION_0
] = ciphersuites
;
7332 conf
->ciphersuite_list
[MBEDTLS_SSL_MINOR_VERSION_1
] = ciphersuites
;
7333 conf
->ciphersuite_list
[MBEDTLS_SSL_MINOR_VERSION_2
] = ciphersuites
;
7334 conf
->ciphersuite_list
[MBEDTLS_SSL_MINOR_VERSION_3
] = ciphersuites
;
7337 void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config
*conf
,
7338 const int *ciphersuites
,
7339 int major
, int minor
)
7341 if( major
!= MBEDTLS_SSL_MAJOR_VERSION_3
)
7344 if( minor
< MBEDTLS_SSL_MINOR_VERSION_0
|| minor
> MBEDTLS_SSL_MINOR_VERSION_3
)
7347 conf
->ciphersuite_list
[minor
] = ciphersuites
;
7350 #if defined(MBEDTLS_X509_CRT_PARSE_C)
7351 void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config
*conf
,
7352 const mbedtls_x509_crt_profile
*profile
)
7354 conf
->cert_profile
= profile
;
7357 /* Append a new keycert entry to a (possibly empty) list */
7358 static int ssl_append_key_cert( mbedtls_ssl_key_cert
**head
,
7359 mbedtls_x509_crt
*cert
,
7360 mbedtls_pk_context
*key
)
7362 mbedtls_ssl_key_cert
*new_cert
;
7364 new_cert
= mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert
) );
7365 if( new_cert
== NULL
)
7366 return( MBEDTLS_ERR_SSL_ALLOC_FAILED
);
7368 new_cert
->cert
= cert
;
7369 new_cert
->key
= key
;
7370 new_cert
->next
= NULL
;
7372 /* Update head is the list was null, else add to the end */
7379 mbedtls_ssl_key_cert
*cur
= *head
;
7380 while( cur
->next
!= NULL
)
7382 cur
->next
= new_cert
;
7388 int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config
*conf
,
7389 mbedtls_x509_crt
*own_cert
,
7390 mbedtls_pk_context
*pk_key
)
7392 return( ssl_append_key_cert( &conf
->key_cert
, own_cert
, pk_key
) );
7395 void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config
*conf
,
7396 mbedtls_x509_crt
*ca_chain
,
7397 mbedtls_x509_crl
*ca_crl
)
7399 conf
->ca_chain
= ca_chain
;
7400 conf
->ca_crl
= ca_crl
;
7402 #endif /* MBEDTLS_X509_CRT_PARSE_C */
7404 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7405 int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context
*ssl
,
7406 mbedtls_x509_crt
*own_cert
,
7407 mbedtls_pk_context
*pk_key
)
7409 return( ssl_append_key_cert( &ssl
->handshake
->sni_key_cert
,
7410 own_cert
, pk_key
) );
7413 void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context
*ssl
,
7414 mbedtls_x509_crt
*ca_chain
,
7415 mbedtls_x509_crl
*ca_crl
)
7417 ssl
->handshake
->sni_ca_chain
= ca_chain
;
7418 ssl
->handshake
->sni_ca_crl
= ca_crl
;
7421 void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context
*ssl
,
7424 ssl
->handshake
->sni_authmode
= authmode
;
7426 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
7428 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
7430 * Set EC J-PAKE password for current handshake
7432 int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context
*ssl
,
7433 const unsigned char *pw
,
7436 mbedtls_ecjpake_role role
;
7438 if( ssl
->handshake
== NULL
|| ssl
->conf
== NULL
)
7439 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
7441 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
)
7442 role
= MBEDTLS_ECJPAKE_SERVER
;
7444 role
= MBEDTLS_ECJPAKE_CLIENT
;
7446 return( mbedtls_ecjpake_setup( &ssl
->handshake
->ecjpake_ctx
,
7449 MBEDTLS_ECP_DP_SECP256R1
,
7452 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
7454 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
7455 int mbedtls_ssl_conf_psk( mbedtls_ssl_config
*conf
,
7456 const unsigned char *psk
, size_t psk_len
,
7457 const unsigned char *psk_identity
, size_t psk_identity_len
)
7459 if( psk
== NULL
|| psk_identity
== NULL
)
7460 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
7462 if( psk_len
> MBEDTLS_PSK_MAX_LEN
)
7463 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
7465 /* Identity len will be encoded on two bytes */
7466 if( ( psk_identity_len
>> 16 ) != 0 ||
7467 psk_identity_len
> MBEDTLS_SSL_OUT_CONTENT_LEN
)
7469 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
7472 if( conf
->psk
!= NULL
)
7474 mbedtls_platform_zeroize( conf
->psk
, conf
->psk_len
);
7476 mbedtls_free( conf
->psk
);
7480 if( conf
->psk_identity
!= NULL
)
7482 mbedtls_free( conf
->psk_identity
);
7483 conf
->psk_identity
= NULL
;
7484 conf
->psk_identity_len
= 0;
7487 if( ( conf
->psk
= mbedtls_calloc( 1, psk_len
) ) == NULL
||
7488 ( conf
->psk_identity
= mbedtls_calloc( 1, psk_identity_len
) ) == NULL
)
7490 mbedtls_free( conf
->psk
);
7491 mbedtls_free( conf
->psk_identity
);
7493 conf
->psk_identity
= NULL
;
7494 return( MBEDTLS_ERR_SSL_ALLOC_FAILED
);
7497 conf
->psk_len
= psk_len
;
7498 conf
->psk_identity_len
= psk_identity_len
;
7500 memcpy( conf
->psk
, psk
, conf
->psk_len
);
7501 memcpy( conf
->psk_identity
, psk_identity
, conf
->psk_identity_len
);
7506 int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context
*ssl
,
7507 const unsigned char *psk
, size_t psk_len
)
7509 if( psk
== NULL
|| ssl
->handshake
== NULL
)
7510 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
7512 if( psk_len
> MBEDTLS_PSK_MAX_LEN
)
7513 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
7515 if( ssl
->handshake
->psk
!= NULL
)
7517 mbedtls_platform_zeroize( ssl
->handshake
->psk
,
7518 ssl
->handshake
->psk_len
);
7519 mbedtls_free( ssl
->handshake
->psk
);
7520 ssl
->handshake
->psk_len
= 0;
7523 if( ( ssl
->handshake
->psk
= mbedtls_calloc( 1, psk_len
) ) == NULL
)
7524 return( MBEDTLS_ERR_SSL_ALLOC_FAILED
);
7526 ssl
->handshake
->psk_len
= psk_len
;
7527 memcpy( ssl
->handshake
->psk
, psk
, ssl
->handshake
->psk_len
);
7532 void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config
*conf
,
7533 int (*f_psk
)(void *, mbedtls_ssl_context
*, const unsigned char *,
7537 conf
->f_psk
= f_psk
;
7538 conf
->p_psk
= p_psk
;
7540 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
7542 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
7544 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
7545 int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config
*conf
, const char *dhm_P
, const char *dhm_G
)
7549 if( ( ret
= mbedtls_mpi_read_string( &conf
->dhm_P
, 16, dhm_P
) ) != 0 ||
7550 ( ret
= mbedtls_mpi_read_string( &conf
->dhm_G
, 16, dhm_G
) ) != 0 )
7552 mbedtls_mpi_free( &conf
->dhm_P
);
7553 mbedtls_mpi_free( &conf
->dhm_G
);
7559 #endif /* MBEDTLS_DEPRECATED_REMOVED */
7561 int mbedtls_ssl_conf_dh_param_bin( mbedtls_ssl_config
*conf
,
7562 const unsigned char *dhm_P
, size_t P_len
,
7563 const unsigned char *dhm_G
, size_t G_len
)
7567 if( ( ret
= mbedtls_mpi_read_binary( &conf
->dhm_P
, dhm_P
, P_len
) ) != 0 ||
7568 ( ret
= mbedtls_mpi_read_binary( &conf
->dhm_G
, dhm_G
, G_len
) ) != 0 )
7570 mbedtls_mpi_free( &conf
->dhm_P
);
7571 mbedtls_mpi_free( &conf
->dhm_G
);
7578 int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config
*conf
, mbedtls_dhm_context
*dhm_ctx
)
7582 if( ( ret
= mbedtls_mpi_copy( &conf
->dhm_P
, &dhm_ctx
->P
) ) != 0 ||
7583 ( ret
= mbedtls_mpi_copy( &conf
->dhm_G
, &dhm_ctx
->G
) ) != 0 )
7585 mbedtls_mpi_free( &conf
->dhm_P
);
7586 mbedtls_mpi_free( &conf
->dhm_G
);
7592 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
7594 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
7596 * Set the minimum length for Diffie-Hellman parameters
7598 void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config
*conf
,
7599 unsigned int bitlen
)
7601 conf
->dhm_min_bitlen
= bitlen
;
7603 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
7605 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
7607 * Set allowed/preferred hashes for handshake signatures
7609 void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config
*conf
,
7612 conf
->sig_hashes
= hashes
;
7614 #endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
7616 #if defined(MBEDTLS_ECP_C)
7618 * Set the allowed elliptic curves
7620 void mbedtls_ssl_conf_curves( mbedtls_ssl_config
*conf
,
7621 const mbedtls_ecp_group_id
*curve_list
)
7623 conf
->curve_list
= curve_list
;
7625 #endif /* MBEDTLS_ECP_C */
7627 #if defined(MBEDTLS_X509_CRT_PARSE_C)
7628 int mbedtls_ssl_set_hostname( mbedtls_ssl_context
*ssl
, const char *hostname
)
7630 /* Initialize to suppress unnecessary compiler warning */
7631 size_t hostname_len
= 0;
7633 /* Check if new hostname is valid before
7634 * making any change to current one */
7635 if( hostname
!= NULL
)
7637 hostname_len
= strlen( hostname
);
7639 if( hostname_len
> MBEDTLS_SSL_MAX_HOST_NAME_LEN
)
7640 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
7643 /* Now it's clear that we will overwrite the old hostname,
7644 * so we can free it safely */
7646 if( ssl
->hostname
!= NULL
)
7648 mbedtls_platform_zeroize( ssl
->hostname
, strlen( ssl
->hostname
) );
7649 mbedtls_free( ssl
->hostname
);
7652 /* Passing NULL as hostname shall clear the old one */
7654 if( hostname
== NULL
)
7656 ssl
->hostname
= NULL
;
7660 ssl
->hostname
= mbedtls_calloc( 1, hostname_len
+ 1 );
7661 if( ssl
->hostname
== NULL
)
7662 return( MBEDTLS_ERR_SSL_ALLOC_FAILED
);
7664 memcpy( ssl
->hostname
, hostname
, hostname_len
);
7666 ssl
->hostname
[hostname_len
] = '\0';
7671 #endif /* MBEDTLS_X509_CRT_PARSE_C */
7673 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
7674 void mbedtls_ssl_conf_sni( mbedtls_ssl_config
*conf
,
7675 int (*f_sni
)(void *, mbedtls_ssl_context
*,
7676 const unsigned char *, size_t),
7679 conf
->f_sni
= f_sni
;
7680 conf
->p_sni
= p_sni
;
7682 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
7684 #if defined(MBEDTLS_SSL_ALPN)
7685 int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config
*conf
, const char **protos
)
7687 size_t cur_len
, tot_len
;
7691 * RFC 7301 3.1: "Empty strings MUST NOT be included and byte strings
7692 * MUST NOT be truncated."
7693 * We check lengths now rather than later.
7696 for( p
= protos
; *p
!= NULL
; p
++ )
7698 cur_len
= strlen( *p
);
7701 if( ( cur_len
== 0 ) ||
7702 ( cur_len
> MBEDTLS_SSL_MAX_ALPN_NAME_LEN
) ||
7703 ( tot_len
> MBEDTLS_SSL_MAX_ALPN_LIST_LEN
) )
7704 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
7707 conf
->alpn_list
= protos
;
7712 const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context
*ssl
)
7714 return( ssl
->alpn_chosen
);
7716 #endif /* MBEDTLS_SSL_ALPN */
7718 void mbedtls_ssl_conf_max_version( mbedtls_ssl_config
*conf
, int major
, int minor
)
7720 conf
->max_major_ver
= major
;
7721 conf
->max_minor_ver
= minor
;
7724 void mbedtls_ssl_conf_min_version( mbedtls_ssl_config
*conf
, int major
, int minor
)
7726 conf
->min_major_ver
= major
;
7727 conf
->min_minor_ver
= minor
;
7730 #if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
7731 void mbedtls_ssl_conf_fallback( mbedtls_ssl_config
*conf
, char fallback
)
7733 conf
->fallback
= fallback
;
7737 #if defined(MBEDTLS_SSL_SRV_C)
7738 void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config
*conf
,
7739 char cert_req_ca_list
)
7741 conf
->cert_req_ca_list
= cert_req_ca_list
;
7745 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
7746 void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config
*conf
, char etm
)
7748 conf
->encrypt_then_mac
= etm
;
7752 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
7753 void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config
*conf
, char ems
)
7755 conf
->extended_ms
= ems
;
7759 #if defined(MBEDTLS_ARC4_C)
7760 void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config
*conf
, char arc4
)
7762 conf
->arc4_disabled
= arc4
;
7766 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
7767 int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config
*conf
, unsigned char mfl_code
)
7769 if( mfl_code
>= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID
||
7770 ssl_mfl_code_to_length( mfl_code
) > MBEDTLS_TLS_EXT_ADV_CONTENT_LEN
)
7772 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
7775 conf
->mfl_code
= mfl_code
;
7779 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
7781 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
7782 void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config
*conf
, int truncate
)
7784 conf
->trunc_hmac
= truncate
;
7786 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
7788 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
7789 void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config
*conf
, char split
)
7791 conf
->cbc_record_splitting
= split
;
7795 void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config
*conf
, int allow_legacy
)
7797 conf
->allow_legacy_renegotiation
= allow_legacy
;
7800 #if defined(MBEDTLS_SSL_RENEGOTIATION)
7801 void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config
*conf
, int renegotiation
)
7803 conf
->disable_renegotiation
= renegotiation
;
7806 void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config
*conf
, int max_records
)
7808 conf
->renego_max_records
= max_records
;
7811 void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config
*conf
,
7812 const unsigned char period
[8] )
7814 memcpy( conf
->renego_period
, period
, 8 );
7816 #endif /* MBEDTLS_SSL_RENEGOTIATION */
7818 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
7819 #if defined(MBEDTLS_SSL_CLI_C)
7820 void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config
*conf
, int use_tickets
)
7822 conf
->session_tickets
= use_tickets
;
7826 #if defined(MBEDTLS_SSL_SRV_C)
7827 void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config
*conf
,
7828 mbedtls_ssl_ticket_write_t
*f_ticket_write
,
7829 mbedtls_ssl_ticket_parse_t
*f_ticket_parse
,
7832 conf
->f_ticket_write
= f_ticket_write
;
7833 conf
->f_ticket_parse
= f_ticket_parse
;
7834 conf
->p_ticket
= p_ticket
;
7837 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
7839 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
7840 void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config
*conf
,
7841 mbedtls_ssl_export_keys_t
*f_export_keys
,
7842 void *p_export_keys
)
7844 conf
->f_export_keys
= f_export_keys
;
7845 conf
->p_export_keys
= p_export_keys
;
7849 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
7850 void mbedtls_ssl_conf_async_private_cb(
7851 mbedtls_ssl_config
*conf
,
7852 mbedtls_ssl_async_sign_t
*f_async_sign
,
7853 mbedtls_ssl_async_decrypt_t
*f_async_decrypt
,
7854 mbedtls_ssl_async_resume_t
*f_async_resume
,
7855 mbedtls_ssl_async_cancel_t
*f_async_cancel
,
7856 void *async_config_data
)
7858 conf
->f_async_sign_start
= f_async_sign
;
7859 conf
->f_async_decrypt_start
= f_async_decrypt
;
7860 conf
->f_async_resume
= f_async_resume
;
7861 conf
->f_async_cancel
= f_async_cancel
;
7862 conf
->p_async_config_data
= async_config_data
;
7865 void *mbedtls_ssl_conf_get_async_config_data( const mbedtls_ssl_config
*conf
)
7867 return( conf
->p_async_config_data
);
7870 void *mbedtls_ssl_get_async_operation_data( const mbedtls_ssl_context
*ssl
)
7872 if( ssl
->handshake
== NULL
)
7875 return( ssl
->handshake
->user_async_ctx
);
7878 void mbedtls_ssl_set_async_operation_data( mbedtls_ssl_context
*ssl
,
7881 if( ssl
->handshake
!= NULL
)
7882 ssl
->handshake
->user_async_ctx
= ctx
;
7884 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
7889 size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context
*ssl
)
7891 return( ssl
->in_offt
== NULL
? 0 : ssl
->in_msglen
);
7894 int mbedtls_ssl_check_pending( const mbedtls_ssl_context
*ssl
)
7897 * Case A: We're currently holding back
7898 * a message for further processing.
7901 if( ssl
->keep_current_message
== 1 )
7903 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: record held back for processing" ) );
7908 * Case B: Further records are pending in the current datagram.
7911 #if defined(MBEDTLS_SSL_PROTO_DTLS)
7912 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
7913 ssl
->in_left
> ssl
->next_record_offset
)
7915 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more records within current datagram" ) );
7918 #endif /* MBEDTLS_SSL_PROTO_DTLS */
7921 * Case C: A handshake message is being processed.
7924 if( ssl
->in_hslen
> 0 && ssl
->in_hslen
< ssl
->in_msglen
)
7926 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: more handshake messages within current record" ) );
7931 * Case D: An application data message is being processed
7933 if( ssl
->in_offt
!= NULL
)
7935 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: application data record is being processed" ) );
7940 * In all other cases, the rest of the message can be dropped.
7941 * As in ssl_get_next_record, this needs to be adapted if
7942 * we implement support for multiple alerts in single records.
7945 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_check_pending: nothing pending" ) );
7949 uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context
*ssl
)
7951 if( ssl
->session
!= NULL
)
7952 return( ssl
->session
->verify_result
);
7954 if( ssl
->session_negotiate
!= NULL
)
7955 return( ssl
->session_negotiate
->verify_result
);
7957 return( 0xFFFFFFFF );
7960 const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context
*ssl
)
7962 if( ssl
== NULL
|| ssl
->session
== NULL
)
7965 return mbedtls_ssl_get_ciphersuite_name( ssl
->session
->ciphersuite
);
7968 const char *mbedtls_ssl_get_version( const mbedtls_ssl_context
*ssl
)
7970 #if defined(MBEDTLS_SSL_PROTO_DTLS)
7971 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
7973 switch( ssl
->minor_ver
)
7975 case MBEDTLS_SSL_MINOR_VERSION_2
:
7976 return( "DTLSv1.0" );
7978 case MBEDTLS_SSL_MINOR_VERSION_3
:
7979 return( "DTLSv1.2" );
7982 return( "unknown (DTLS)" );
7987 switch( ssl
->minor_ver
)
7989 case MBEDTLS_SSL_MINOR_VERSION_0
:
7990 return( "SSLv3.0" );
7992 case MBEDTLS_SSL_MINOR_VERSION_1
:
7993 return( "TLSv1.0" );
7995 case MBEDTLS_SSL_MINOR_VERSION_2
:
7996 return( "TLSv1.1" );
7998 case MBEDTLS_SSL_MINOR_VERSION_3
:
7999 return( "TLSv1.2" );
8002 return( "unknown" );
8006 int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context
*ssl
)
8008 size_t transform_expansion
= 0;
8009 const mbedtls_ssl_transform
*transform
= ssl
->transform_out
;
8010 unsigned block_size
;
8012 if( transform
== NULL
)
8013 return( (int) mbedtls_ssl_hdr_len( ssl
) );
8015 #if defined(MBEDTLS_ZLIB_SUPPORT)
8016 if( ssl
->session_out
->compression
!= MBEDTLS_SSL_COMPRESS_NULL
)
8017 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE
);
8020 switch( mbedtls_cipher_get_cipher_mode( &transform
->cipher_ctx_enc
) )
8022 case MBEDTLS_MODE_GCM
:
8023 case MBEDTLS_MODE_CCM
:
8024 case MBEDTLS_MODE_CHACHAPOLY
:
8025 case MBEDTLS_MODE_STREAM
:
8026 transform_expansion
= transform
->minlen
;
8029 case MBEDTLS_MODE_CBC
:
8031 block_size
= mbedtls_cipher_get_block_size(
8032 &transform
->cipher_ctx_enc
);
8034 /* Expansion due to the addition of the MAC. */
8035 transform_expansion
+= transform
->maclen
;
8037 /* Expansion due to the addition of CBC padding;
8038 * Theoretically up to 256 bytes, but we never use
8039 * more than the block size of the underlying cipher. */
8040 transform_expansion
+= block_size
;
8042 /* For TLS 1.1 or higher, an explicit IV is added
8043 * after the record header. */
8044 #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
8045 if( ssl
->minor_ver
>= MBEDTLS_SSL_MINOR_VERSION_2
)
8046 transform_expansion
+= block_size
;
8047 #endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
8052 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
8053 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
8056 return( (int)( mbedtls_ssl_hdr_len( ssl
) + transform_expansion
) );
8059 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8060 size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context
*ssl
)
8065 * Assume mfl_code is correct since it was checked when set
8067 max_len
= ssl_mfl_code_to_length( ssl
->conf
->mfl_code
);
8069 /* Check if a smaller max length was negotiated */
8070 if( ssl
->session_out
!= NULL
&&
8071 ssl_mfl_code_to_length( ssl
->session_out
->mfl_code
) < max_len
)
8073 max_len
= ssl_mfl_code_to_length( ssl
->session_out
->mfl_code
);
8076 /* During a handshake, use the value being negotiated */
8077 if( ssl
->session_negotiate
!= NULL
&&
8078 ssl_mfl_code_to_length( ssl
->session_negotiate
->mfl_code
) < max_len
)
8080 max_len
= ssl_mfl_code_to_length( ssl
->session_negotiate
->mfl_code
);
8085 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
8087 #if defined(MBEDTLS_SSL_PROTO_DTLS)
8088 static size_t ssl_get_current_mtu( const mbedtls_ssl_context
*ssl
)
8090 /* Return unlimited mtu for client hello messages to avoid fragmentation. */
8091 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_CLIENT
&&
8092 ( ssl
->state
== MBEDTLS_SSL_CLIENT_HELLO
||
8093 ssl
->state
== MBEDTLS_SSL_SERVER_HELLO
) )
8096 if( ssl
->handshake
== NULL
|| ssl
->handshake
->mtu
== 0 )
8100 return( ssl
->handshake
->mtu
);
8102 return( ssl
->mtu
< ssl
->handshake
->mtu
?
8103 ssl
->mtu
: ssl
->handshake
->mtu
);
8105 #endif /* MBEDTLS_SSL_PROTO_DTLS */
8107 int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context
*ssl
)
8109 size_t max_len
= MBEDTLS_SSL_OUT_CONTENT_LEN
;
8111 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
8112 !defined(MBEDTLS_SSL_PROTO_DTLS)
8116 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
8117 const size_t mfl
= mbedtls_ssl_get_max_frag_len( ssl
);
8123 #if defined(MBEDTLS_SSL_PROTO_DTLS)
8124 if( ssl_get_current_mtu( ssl
) != 0 )
8126 const size_t mtu
= ssl_get_current_mtu( ssl
);
8127 const int ret
= mbedtls_ssl_get_record_expansion( ssl
);
8128 const size_t overhead
= (size_t) ret
;
8133 if( mtu
<= overhead
)
8135 MBEDTLS_SSL_DEBUG_MSG( 1, ( "MTU too low for record expansion" ) );
8136 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE
);
8139 if( max_len
> mtu
- overhead
)
8140 max_len
= mtu
- overhead
;
8142 #endif /* MBEDTLS_SSL_PROTO_DTLS */
8144 #if !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && \
8145 !defined(MBEDTLS_SSL_PROTO_DTLS)
8149 return( (int) max_len
);
8152 #if defined(MBEDTLS_X509_CRT_PARSE_C)
8153 const mbedtls_x509_crt
*mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context
*ssl
)
8155 if( ssl
== NULL
|| ssl
->session
== NULL
)
8158 return( ssl
->session
->peer_cert
);
8160 #endif /* MBEDTLS_X509_CRT_PARSE_C */
8162 #if defined(MBEDTLS_SSL_CLI_C)
8163 int mbedtls_ssl_get_session( const mbedtls_ssl_context
*ssl
, mbedtls_ssl_session
*dst
)
8167 ssl
->session
== NULL
||
8168 ssl
->conf
->endpoint
!= MBEDTLS_SSL_IS_CLIENT
)
8170 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
8173 return( ssl_session_copy( dst
, ssl
->session
) );
8175 #endif /* MBEDTLS_SSL_CLI_C */
8178 * Perform a single step of the SSL handshake
8180 int mbedtls_ssl_handshake_step( mbedtls_ssl_context
*ssl
)
8182 int ret
= MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE
;
8184 if( ssl
== NULL
|| ssl
->conf
== NULL
)
8185 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
8187 #if defined(MBEDTLS_SSL_CLI_C)
8188 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_CLIENT
)
8189 ret
= mbedtls_ssl_handshake_client_step( ssl
);
8191 #if defined(MBEDTLS_SSL_SRV_C)
8192 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
)
8193 ret
= mbedtls_ssl_handshake_server_step( ssl
);
8200 * Perform the SSL handshake
8202 int mbedtls_ssl_handshake( mbedtls_ssl_context
*ssl
)
8206 if( ssl
== NULL
|| ssl
->conf
== NULL
)
8207 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
8209 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
8211 while( ssl
->state
!= MBEDTLS_SSL_HANDSHAKE_OVER
)
8213 ret
= mbedtls_ssl_handshake_step( ssl
);
8219 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
8224 #if defined(MBEDTLS_SSL_RENEGOTIATION)
8225 #if defined(MBEDTLS_SSL_SRV_C)
8227 * Write HelloRequest to request renegotiation on server
8229 static int ssl_write_hello_request( mbedtls_ssl_context
*ssl
)
8233 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
8235 ssl
->out_msglen
= 4;
8236 ssl
->out_msgtype
= MBEDTLS_SSL_MSG_HANDSHAKE
;
8237 ssl
->out_msg
[0] = MBEDTLS_SSL_HS_HELLO_REQUEST
;
8239 if( ( ret
= mbedtls_ssl_write_handshake_msg( ssl
) ) != 0 )
8241 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret
);
8245 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
8249 #endif /* MBEDTLS_SSL_SRV_C */
8252 * Actually renegotiate current connection, triggered by either:
8253 * - any side: calling mbedtls_ssl_renegotiate(),
8254 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
8255 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
8256 * the initial handshake is completed.
8257 * If the handshake doesn't complete due to waiting for I/O, it will continue
8258 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
8260 static int ssl_start_renegotiation( mbedtls_ssl_context
*ssl
)
8264 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
8266 if( ( ret
= ssl_handshake_init( ssl
) ) != 0 )
8269 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
8270 * the ServerHello will have message_seq = 1" */
8271 #if defined(MBEDTLS_SSL_PROTO_DTLS)
8272 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
8273 ssl
->renego_status
== MBEDTLS_SSL_RENEGOTIATION_PENDING
)
8275 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
)
8276 ssl
->handshake
->out_msg_seq
= 1;
8278 ssl
->handshake
->in_msg_seq
= 1;
8282 ssl
->state
= MBEDTLS_SSL_HELLO_REQUEST
;
8283 ssl
->renego_status
= MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS
;
8285 if( ( ret
= mbedtls_ssl_handshake( ssl
) ) != 0 )
8287 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret
);
8291 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
8297 * Renegotiate current connection on client,
8298 * or request renegotiation on server
8300 int mbedtls_ssl_renegotiate( mbedtls_ssl_context
*ssl
)
8302 int ret
= MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE
;
8304 if( ssl
== NULL
|| ssl
->conf
== NULL
)
8305 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
8307 #if defined(MBEDTLS_SSL_SRV_C)
8308 /* On server, just send the request */
8309 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
)
8311 if( ssl
->state
!= MBEDTLS_SSL_HANDSHAKE_OVER
)
8312 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
8314 ssl
->renego_status
= MBEDTLS_SSL_RENEGOTIATION_PENDING
;
8316 /* Did we already try/start sending HelloRequest? */
8317 if( ssl
->out_left
!= 0 )
8318 return( mbedtls_ssl_flush_output( ssl
) );
8320 return( ssl_write_hello_request( ssl
) );
8322 #endif /* MBEDTLS_SSL_SRV_C */
8324 #if defined(MBEDTLS_SSL_CLI_C)
8326 * On client, either start the renegotiation process or,
8327 * if already in progress, continue the handshake
8329 if( ssl
->renego_status
!= MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS
)
8331 if( ssl
->state
!= MBEDTLS_SSL_HANDSHAKE_OVER
)
8332 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
8334 if( ( ret
= ssl_start_renegotiation( ssl
) ) != 0 )
8336 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret
);
8342 if( ( ret
= mbedtls_ssl_handshake( ssl
) ) != 0 )
8344 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret
);
8348 #endif /* MBEDTLS_SSL_CLI_C */
8354 * Check record counters and renegotiate if they're above the limit.
8356 static int ssl_check_ctr_renegotiate( mbedtls_ssl_context
*ssl
)
8358 size_t ep_len
= ssl_ep_len( ssl
);
8362 if( ssl
->state
!= MBEDTLS_SSL_HANDSHAKE_OVER
||
8363 ssl
->renego_status
== MBEDTLS_SSL_RENEGOTIATION_PENDING
||
8364 ssl
->conf
->disable_renegotiation
== MBEDTLS_SSL_RENEGOTIATION_DISABLED
)
8369 in_ctr_cmp
= memcmp( ssl
->in_ctr
+ ep_len
,
8370 ssl
->conf
->renego_period
+ ep_len
, 8 - ep_len
);
8371 out_ctr_cmp
= memcmp( ssl
->cur_out_ctr
+ ep_len
,
8372 ssl
->conf
->renego_period
+ ep_len
, 8 - ep_len
);
8374 if( in_ctr_cmp
<= 0 && out_ctr_cmp
<= 0 )
8379 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) );
8380 return( mbedtls_ssl_renegotiate( ssl
) );
8382 #endif /* MBEDTLS_SSL_RENEGOTIATION */
8385 * Receive application data decrypted from the SSL layer
8387 int mbedtls_ssl_read( mbedtls_ssl_context
*ssl
, unsigned char *buf
, size_t len
)
8392 if( ssl
== NULL
|| ssl
->conf
== NULL
)
8393 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
8395 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
8397 #if defined(MBEDTLS_SSL_PROTO_DTLS)
8398 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
8400 if( ( ret
= mbedtls_ssl_flush_output( ssl
) ) != 0 )
8403 if( ssl
->handshake
!= NULL
&&
8404 ssl
->handshake
->retransmit_state
== MBEDTLS_SSL_RETRANS_SENDING
)
8406 if( ( ret
= mbedtls_ssl_flight_transmit( ssl
) ) != 0 )
8413 * Check if renegotiation is necessary and/or handshake is
8414 * in process. If yes, perform/continue, and fall through
8415 * if an unexpected packet is received while the client
8416 * is waiting for the ServerHello.
8418 * (There is no equivalent to the last condition on
8419 * the server-side as it is not treated as within
8420 * a handshake while waiting for the ClientHello
8421 * after a renegotiation request.)
8424 #if defined(MBEDTLS_SSL_RENEGOTIATION)
8425 ret
= ssl_check_ctr_renegotiate( ssl
);
8426 if( ret
!= MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO
&&
8429 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret
);
8434 if( ssl
->state
!= MBEDTLS_SSL_HANDSHAKE_OVER
)
8436 ret
= mbedtls_ssl_handshake( ssl
);
8437 if( ret
!= MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO
&&
8440 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret
);
8445 /* Loop as long as no application data record is available */
8446 while( ssl
->in_offt
== NULL
)
8448 /* Start timer if not already running */
8449 if( ssl
->f_get_timer
!= NULL
&&
8450 ssl
->f_get_timer( ssl
->p_timer
) == -1 )
8452 ssl_set_timer( ssl
, ssl
->conf
->read_timeout
);
8455 if( ( ret
= mbedtls_ssl_read_record( ssl
, 1 ) ) != 0 )
8457 if( ret
== MBEDTLS_ERR_SSL_CONN_EOF
)
8460 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret
);
8464 if( ssl
->in_msglen
== 0 &&
8465 ssl
->in_msgtype
== MBEDTLS_SSL_MSG_APPLICATION_DATA
)
8468 * OpenSSL sends empty messages to randomize the IV
8470 if( ( ret
= mbedtls_ssl_read_record( ssl
, 1 ) ) != 0 )
8472 if( ret
== MBEDTLS_ERR_SSL_CONN_EOF
)
8475 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret
);
8480 if( ssl
->in_msgtype
== MBEDTLS_SSL_MSG_HANDSHAKE
)
8482 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received handshake message" ) );
8485 * - For client-side, expect SERVER_HELLO_REQUEST.
8486 * - For server-side, expect CLIENT_HELLO.
8487 * - Fail (TLS) or silently drop record (DTLS) in other cases.
8490 #if defined(MBEDTLS_SSL_CLI_C)
8491 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_CLIENT
&&
8492 ( ssl
->in_msg
[0] != MBEDTLS_SSL_HS_HELLO_REQUEST
||
8493 ssl
->in_hslen
!= mbedtls_ssl_hs_hdr_len( ssl
) ) )
8495 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
8497 /* With DTLS, drop the packet (probably from last handshake) */
8498 #if defined(MBEDTLS_SSL_PROTO_DTLS)
8499 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
8504 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE
);
8506 #endif /* MBEDTLS_SSL_CLI_C */
8508 #if defined(MBEDTLS_SSL_SRV_C)
8509 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
&&
8510 ssl
->in_msg
[0] != MBEDTLS_SSL_HS_CLIENT_HELLO
)
8512 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
8514 /* With DTLS, drop the packet (probably from last handshake) */
8515 #if defined(MBEDTLS_SSL_PROTO_DTLS)
8516 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
8521 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE
);
8523 #endif /* MBEDTLS_SSL_SRV_C */
8525 #if defined(MBEDTLS_SSL_RENEGOTIATION)
8526 /* Determine whether renegotiation attempt should be accepted */
8527 if( ! ( ssl
->conf
->disable_renegotiation
== MBEDTLS_SSL_RENEGOTIATION_DISABLED
||
8528 ( ssl
->secure_renegotiation
== MBEDTLS_SSL_LEGACY_RENEGOTIATION
&&
8529 ssl
->conf
->allow_legacy_renegotiation
==
8530 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION
) ) )
8533 * Accept renegotiation request
8536 /* DTLS clients need to know renego is server-initiated */
8537 #if defined(MBEDTLS_SSL_PROTO_DTLS)
8538 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
&&
8539 ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_CLIENT
)
8541 ssl
->renego_status
= MBEDTLS_SSL_RENEGOTIATION_PENDING
;
8544 ret
= ssl_start_renegotiation( ssl
);
8545 if( ret
!= MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO
&&
8548 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret
);
8553 #endif /* MBEDTLS_SSL_RENEGOTIATION */
8556 * Refuse renegotiation
8559 MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
8561 #if defined(MBEDTLS_SSL_PROTO_SSL3)
8562 if( ssl
->minor_ver
== MBEDTLS_SSL_MINOR_VERSION_0
)
8564 /* SSLv3 does not have a "no_renegotiation" warning, so
8565 we send a fatal alert and abort the connection. */
8566 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
8567 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE
);
8568 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE
);
8571 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
8572 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
8573 defined(MBEDTLS_SSL_PROTO_TLS1_2)
8574 if( ssl
->minor_ver
>= MBEDTLS_SSL_MINOR_VERSION_1
)
8576 if( ( ret
= mbedtls_ssl_send_alert_message( ssl
,
8577 MBEDTLS_SSL_ALERT_LEVEL_WARNING
,
8578 MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION
) ) != 0 )
8584 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 ||
8585 MBEDTLS_SSL_PROTO_TLS1_2 */
8587 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
8588 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR
);
8592 /* At this point, we don't know whether the renegotiation has been
8593 * completed or not. The cases to consider are the following:
8594 * 1) The renegotiation is complete. In this case, no new record
8595 * has been read yet.
8596 * 2) The renegotiation is incomplete because the client received
8597 * an application data record while awaiting the ServerHello.
8598 * 3) The renegotiation is incomplete because the client received
8599 * a non-handshake, non-application data message while awaiting
8601 * In each of these case, looping will be the proper action:
8602 * - For 1), the next iteration will read a new record and check
8603 * if it's application data.
8604 * - For 2), the loop condition isn't satisfied as application data
8605 * is present, hence continue is the same as break
8606 * - For 3), the loop condition is satisfied and read_record
8607 * will re-deliver the message that was held back by the client
8608 * when expecting the ServerHello.
8612 #if defined(MBEDTLS_SSL_RENEGOTIATION)
8613 else if( ssl
->renego_status
== MBEDTLS_SSL_RENEGOTIATION_PENDING
)
8615 if( ssl
->conf
->renego_max_records
>= 0 )
8617 if( ++ssl
->renego_records_seen
> ssl
->conf
->renego_max_records
)
8619 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
8620 "but not honored by client" ) );
8621 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE
);
8625 #endif /* MBEDTLS_SSL_RENEGOTIATION */
8627 /* Fatal and closure alerts handled by mbedtls_ssl_read_record() */
8628 if( ssl
->in_msgtype
== MBEDTLS_SSL_MSG_ALERT
)
8630 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
8631 return( MBEDTLS_ERR_SSL_WANT_READ
);
8634 if( ssl
->in_msgtype
!= MBEDTLS_SSL_MSG_APPLICATION_DATA
)
8636 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
8637 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE
);
8640 ssl
->in_offt
= ssl
->in_msg
;
8642 /* We're going to return something now, cancel timer,
8643 * except if handshake (renegotiation) is in progress */
8644 if( ssl
->state
== MBEDTLS_SSL_HANDSHAKE_OVER
)
8645 ssl_set_timer( ssl
, 0 );
8647 #if defined(MBEDTLS_SSL_PROTO_DTLS)
8648 /* If we requested renego but received AppData, resend HelloRequest.
8649 * Do it now, after setting in_offt, to avoid taking this branch
8650 * again if ssl_write_hello_request() returns WANT_WRITE */
8651 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
8652 if( ssl
->conf
->endpoint
== MBEDTLS_SSL_IS_SERVER
&&
8653 ssl
->renego_status
== MBEDTLS_SSL_RENEGOTIATION_PENDING
)
8655 if( ( ret
= ssl_resend_hello_request( ssl
) ) != 0 )
8657 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret
);
8661 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
8662 #endif /* MBEDTLS_SSL_PROTO_DTLS */
8665 n
= ( len
< ssl
->in_msglen
)
8666 ? len
: ssl
->in_msglen
;
8668 memcpy( buf
, ssl
->in_offt
, n
);
8669 ssl
->in_msglen
-= n
;
8671 /* Zeroising the plaintext buffer to erase unused application data
8673 mbedtls_platform_zeroize( ssl
->in_offt
, n
);
8675 if( ssl
->in_msglen
== 0 )
8677 /* all bytes consumed */
8678 ssl
->in_offt
= NULL
;
8679 ssl
->keep_current_message
= 0;
8683 /* more data available */
8687 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) );
8693 * Send application data to be encrypted by the SSL layer, taking care of max
8694 * fragment length and buffer size.
8696 * According to RFC 5246 Section 6.2.1:
8698 * Zero-length fragments of Application data MAY be sent as they are
8699 * potentially useful as a traffic analysis countermeasure.
8701 * Therefore, it is possible that the input message length is 0 and the
8702 * corresponding return code is 0 on success.
8704 static int ssl_write_real( mbedtls_ssl_context
*ssl
,
8705 const unsigned char *buf
, size_t len
)
8707 int ret
= mbedtls_ssl_get_max_out_record_payload( ssl
);
8708 const size_t max_len
= (size_t) ret
;
8712 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_max_out_record_payload", ret
);
8718 #if defined(MBEDTLS_SSL_PROTO_DTLS)
8719 if( ssl
->conf
->transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
8721 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
8722 "maximum fragment length: %d > %d",
8724 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
8731 if( ssl
->out_left
!= 0 )
8734 * The user has previously tried to send the data and
8735 * MBEDTLS_ERR_SSL_WANT_WRITE or the message was only partially
8736 * written. In this case, we expect the high-level write function
8737 * (e.g. mbedtls_ssl_write()) to be called with the same parameters
8739 if( ( ret
= mbedtls_ssl_flush_output( ssl
) ) != 0 )
8741 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret
);
8748 * The user is trying to send a message the first time, so we need to
8749 * copy the data into the internal buffers and setup the data structure
8750 * to keep track of partial writes
8752 ssl
->out_msglen
= len
;
8753 ssl
->out_msgtype
= MBEDTLS_SSL_MSG_APPLICATION_DATA
;
8754 memcpy( ssl
->out_msg
, buf
, len
);
8756 if( ( ret
= mbedtls_ssl_write_record( ssl
, SSL_FORCE_FLUSH
) ) != 0 )
8758 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret
);
8763 return( (int) len
);
8767 * Write application data, doing 1/n-1 splitting if necessary.
8769 * With non-blocking I/O, ssl_write_real() may return WANT_WRITE,
8770 * then the caller will call us again with the same arguments, so
8771 * remember whether we already did the split or not.
8773 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
8774 static int ssl_write_split( mbedtls_ssl_context
*ssl
,
8775 const unsigned char *buf
, size_t len
)
8779 if( ssl
->conf
->cbc_record_splitting
==
8780 MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED
||
8782 ssl
->minor_ver
> MBEDTLS_SSL_MINOR_VERSION_1
||
8783 mbedtls_cipher_get_cipher_mode( &ssl
->transform_out
->cipher_ctx_enc
)
8784 != MBEDTLS_MODE_CBC
)
8786 return( ssl_write_real( ssl
, buf
, len
) );
8789 if( ssl
->split_done
== 0 )
8791 if( ( ret
= ssl_write_real( ssl
, buf
, 1 ) ) <= 0 )
8793 ssl
->split_done
= 1;
8796 if( ( ret
= ssl_write_real( ssl
, buf
+ 1, len
- 1 ) ) <= 0 )
8798 ssl
->split_done
= 0;
8802 #endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */
8805 * Write application data (public-facing wrapper)
8807 int mbedtls_ssl_write( mbedtls_ssl_context
*ssl
, const unsigned char *buf
, size_t len
)
8811 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) );
8813 if( ssl
== NULL
|| ssl
->conf
== NULL
)
8814 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
8816 #if defined(MBEDTLS_SSL_RENEGOTIATION)
8817 if( ( ret
= ssl_check_ctr_renegotiate( ssl
) ) != 0 )
8819 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret
);
8824 if( ssl
->state
!= MBEDTLS_SSL_HANDSHAKE_OVER
)
8826 if( ( ret
= mbedtls_ssl_handshake( ssl
) ) != 0 )
8828 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret
);
8833 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
8834 ret
= ssl_write_split( ssl
, buf
, len
);
8836 ret
= ssl_write_real( ssl
, buf
, len
);
8839 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) );
8845 * Notify the peer that the connection is being closed
8847 int mbedtls_ssl_close_notify( mbedtls_ssl_context
*ssl
)
8851 if( ssl
== NULL
|| ssl
->conf
== NULL
)
8852 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA
);
8854 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
8856 if( ssl
->out_left
!= 0 )
8857 return( mbedtls_ssl_flush_output( ssl
) );
8859 if( ssl
->state
== MBEDTLS_SSL_HANDSHAKE_OVER
)
8861 if( ( ret
= mbedtls_ssl_send_alert_message( ssl
,
8862 MBEDTLS_SSL_ALERT_LEVEL_WARNING
,
8863 MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY
) ) != 0 )
8865 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret
);
8870 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
8875 void mbedtls_ssl_transform_free( mbedtls_ssl_transform
*transform
)
8877 if( transform
== NULL
)
8880 #if defined(MBEDTLS_ZLIB_SUPPORT)
8881 deflateEnd( &transform
->ctx_deflate
);
8882 inflateEnd( &transform
->ctx_inflate
);
8885 mbedtls_cipher_free( &transform
->cipher_ctx_enc
);
8886 mbedtls_cipher_free( &transform
->cipher_ctx_dec
);
8888 mbedtls_md_free( &transform
->md_ctx_enc
);
8889 mbedtls_md_free( &transform
->md_ctx_dec
);
8891 mbedtls_platform_zeroize( transform
, sizeof( mbedtls_ssl_transform
) );
8894 #if defined(MBEDTLS_X509_CRT_PARSE_C)
8895 static void ssl_key_cert_free( mbedtls_ssl_key_cert
*key_cert
)
8897 mbedtls_ssl_key_cert
*cur
= key_cert
, *next
;
8899 while( cur
!= NULL
)
8902 mbedtls_free( cur
);
8906 #endif /* MBEDTLS_X509_CRT_PARSE_C */
8908 #if defined(MBEDTLS_SSL_PROTO_DTLS)
8910 static void ssl_buffering_free( mbedtls_ssl_context
*ssl
)
8913 mbedtls_ssl_handshake_params
* const hs
= ssl
->handshake
;
8918 ssl_free_buffered_record( ssl
);
8920 for( offset
= 0; offset
< MBEDTLS_SSL_MAX_BUFFERED_HS
; offset
++ )
8921 ssl_buffering_free_slot( ssl
, offset
);
8924 static void ssl_buffering_free_slot( mbedtls_ssl_context
*ssl
,
8927 mbedtls_ssl_handshake_params
* const hs
= ssl
->handshake
;
8928 mbedtls_ssl_hs_buffer
* const hs_buf
= &hs
->buffering
.hs
[slot
];
8930 if( slot
>= MBEDTLS_SSL_MAX_BUFFERED_HS
)
8933 if( hs_buf
->is_valid
== 1 )
8935 hs
->buffering
.total_bytes_buffered
-= hs_buf
->data_len
;
8936 mbedtls_platform_zeroize( hs_buf
->data
, hs_buf
->data_len
);
8937 mbedtls_free( hs_buf
->data
);
8938 memset( hs_buf
, 0, sizeof( mbedtls_ssl_hs_buffer
) );
8942 #endif /* MBEDTLS_SSL_PROTO_DTLS */
8944 void mbedtls_ssl_handshake_free( mbedtls_ssl_context
*ssl
)
8946 mbedtls_ssl_handshake_params
*handshake
= ssl
->handshake
;
8948 if( handshake
== NULL
)
8951 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
8952 if( ssl
->conf
->f_async_cancel
!= NULL
&& handshake
->async_in_progress
!= 0 )
8954 ssl
->conf
->f_async_cancel( ssl
);
8955 handshake
->async_in_progress
= 0;
8957 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
8959 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
8960 defined(MBEDTLS_SSL_PROTO_TLS1_1)
8961 mbedtls_md5_free( &handshake
->fin_md5
);
8962 mbedtls_sha1_free( &handshake
->fin_sha1
);
8964 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
8965 #if defined(MBEDTLS_SHA256_C)
8966 mbedtls_sha256_free( &handshake
->fin_sha256
);
8968 #if defined(MBEDTLS_SHA512_C)
8969 mbedtls_sha512_free( &handshake
->fin_sha512
);
8971 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
8973 #if defined(MBEDTLS_DHM_C)
8974 mbedtls_dhm_free( &handshake
->dhm_ctx
);
8976 #if defined(MBEDTLS_ECDH_C)
8977 mbedtls_ecdh_free( &handshake
->ecdh_ctx
);
8979 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
8980 mbedtls_ecjpake_free( &handshake
->ecjpake_ctx
);
8981 #if defined(MBEDTLS_SSL_CLI_C)
8982 mbedtls_free( handshake
->ecjpake_cache
);
8983 handshake
->ecjpake_cache
= NULL
;
8984 handshake
->ecjpake_cache_len
= 0;
8988 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
8989 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
8990 /* explicit void pointer cast for buggy MS compiler */
8991 mbedtls_free( (void *) handshake
->curves
);
8994 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
8995 if( handshake
->psk
!= NULL
)
8997 mbedtls_platform_zeroize( handshake
->psk
, handshake
->psk_len
);
8998 mbedtls_free( handshake
->psk
);
9002 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
9003 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
9005 * Free only the linked list wrapper, not the keys themselves
9006 * since the belong to the SNI callback
9008 if( handshake
->sni_key_cert
!= NULL
)
9010 mbedtls_ssl_key_cert
*cur
= handshake
->sni_key_cert
, *next
;
9012 while( cur
!= NULL
)
9015 mbedtls_free( cur
);
9019 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
9021 #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
9022 mbedtls_x509_crt_restart_free( &handshake
->ecrs_ctx
);
9025 #if defined(MBEDTLS_SSL_PROTO_DTLS)
9026 mbedtls_free( handshake
->verify_cookie
);
9027 ssl_flight_free( handshake
->flight
);
9028 ssl_buffering_free( ssl
);
9031 mbedtls_platform_zeroize( handshake
,
9032 sizeof( mbedtls_ssl_handshake_params
) );
9035 void mbedtls_ssl_session_free( mbedtls_ssl_session
*session
)
9037 if( session
== NULL
)
9040 #if defined(MBEDTLS_X509_CRT_PARSE_C)
9041 if( session
->peer_cert
!= NULL
)
9043 mbedtls_x509_crt_free( session
->peer_cert
);
9044 mbedtls_free( session
->peer_cert
);
9048 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
9049 mbedtls_free( session
->ticket
);
9052 mbedtls_platform_zeroize( session
, sizeof( mbedtls_ssl_session
) );
9056 * Free an SSL context
9058 void mbedtls_ssl_free( mbedtls_ssl_context
*ssl
)
9063 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
9065 if( ssl
->out_buf
!= NULL
)
9067 mbedtls_platform_zeroize( ssl
->out_buf
, MBEDTLS_SSL_OUT_BUFFER_LEN
);
9068 mbedtls_free( ssl
->out_buf
);
9071 if( ssl
->in_buf
!= NULL
)
9073 mbedtls_platform_zeroize( ssl
->in_buf
, MBEDTLS_SSL_IN_BUFFER_LEN
);
9074 mbedtls_free( ssl
->in_buf
);
9077 #if defined(MBEDTLS_ZLIB_SUPPORT)
9078 if( ssl
->compress_buf
!= NULL
)
9080 mbedtls_platform_zeroize( ssl
->compress_buf
, MBEDTLS_SSL_COMPRESS_BUFFER_LEN
);
9081 mbedtls_free( ssl
->compress_buf
);
9085 if( ssl
->transform
)
9087 mbedtls_ssl_transform_free( ssl
->transform
);
9088 mbedtls_free( ssl
->transform
);
9091 if( ssl
->handshake
)
9093 mbedtls_ssl_handshake_free( ssl
);
9094 mbedtls_ssl_transform_free( ssl
->transform_negotiate
);
9095 mbedtls_ssl_session_free( ssl
->session_negotiate
);
9097 mbedtls_free( ssl
->handshake
);
9098 mbedtls_free( ssl
->transform_negotiate
);
9099 mbedtls_free( ssl
->session_negotiate
);
9104 mbedtls_ssl_session_free( ssl
->session
);
9105 mbedtls_free( ssl
->session
);
9108 #if defined(MBEDTLS_X509_CRT_PARSE_C)
9109 if( ssl
->hostname
!= NULL
)
9111 mbedtls_platform_zeroize( ssl
->hostname
, strlen( ssl
->hostname
) );
9112 mbedtls_free( ssl
->hostname
);
9116 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
9117 if( mbedtls_ssl_hw_record_finish
!= NULL
)
9119 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) );
9120 mbedtls_ssl_hw_record_finish( ssl
);
9124 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
9125 mbedtls_free( ssl
->cli_id
);
9128 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
9130 /* Actually clear after last debug message */
9131 mbedtls_platform_zeroize( ssl
, sizeof( mbedtls_ssl_context
) );
9135 * Initialze mbedtls_ssl_config
9137 void mbedtls_ssl_config_init( mbedtls_ssl_config
*conf
)
9139 memset( conf
, 0, sizeof( mbedtls_ssl_config
) );
9142 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
9143 static int ssl_preset_default_hashes
[] = {
9144 #if defined(MBEDTLS_SHA512_C)
9148 #if defined(MBEDTLS_SHA256_C)
9152 #if defined(MBEDTLS_SHA1_C) && defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE)
9159 static int ssl_preset_suiteb_ciphersuites
[] = {
9160 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
,
9161 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
,
9165 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
9166 static int ssl_preset_suiteb_hashes
[] = {
9173 #if defined(MBEDTLS_ECP_C)
9174 static mbedtls_ecp_group_id ssl_preset_suiteb_curves
[] = {
9175 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
9176 MBEDTLS_ECP_DP_SECP256R1
,
9178 #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
9179 MBEDTLS_ECP_DP_SECP384R1
,
9186 * Load default in mbedtls_ssl_config
9188 int mbedtls_ssl_config_defaults( mbedtls_ssl_config
*conf
,
9189 int endpoint
, int transport
, int preset
)
9191 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
9195 /* Use the functions here so that they are covered in tests,
9196 * but otherwise access member directly for efficiency */
9197 mbedtls_ssl_conf_endpoint( conf
, endpoint
);
9198 mbedtls_ssl_conf_transport( conf
, transport
);
9201 * Things that are common to all presets
9203 #if defined(MBEDTLS_SSL_CLI_C)
9204 if( endpoint
== MBEDTLS_SSL_IS_CLIENT
)
9206 conf
->authmode
= MBEDTLS_SSL_VERIFY_REQUIRED
;
9207 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
9208 conf
->session_tickets
= MBEDTLS_SSL_SESSION_TICKETS_ENABLED
;
9213 #if defined(MBEDTLS_ARC4_C)
9214 conf
->arc4_disabled
= MBEDTLS_SSL_ARC4_DISABLED
;
9217 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
9218 conf
->encrypt_then_mac
= MBEDTLS_SSL_ETM_ENABLED
;
9221 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
9222 conf
->extended_ms
= MBEDTLS_SSL_EXTENDED_MS_ENABLED
;
9225 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
9226 conf
->cbc_record_splitting
= MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED
;
9229 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
9230 conf
->f_cookie_write
= ssl_cookie_write_dummy
;
9231 conf
->f_cookie_check
= ssl_cookie_check_dummy
;
9234 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
9235 conf
->anti_replay
= MBEDTLS_SSL_ANTI_REPLAY_ENABLED
;
9238 #if defined(MBEDTLS_SSL_SRV_C)
9239 conf
->cert_req_ca_list
= MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED
;
9242 #if defined(MBEDTLS_SSL_PROTO_DTLS)
9243 conf
->hs_timeout_min
= MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN
;
9244 conf
->hs_timeout_max
= MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX
;
9247 #if defined(MBEDTLS_SSL_RENEGOTIATION)
9248 conf
->renego_max_records
= MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT
;
9249 memset( conf
->renego_period
, 0x00, 2 );
9250 memset( conf
->renego_period
+ 2, 0xFF, 6 );
9253 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
9254 if( endpoint
== MBEDTLS_SSL_IS_SERVER
)
9256 const unsigned char dhm_p
[] =
9257 MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN
;
9258 const unsigned char dhm_g
[] =
9259 MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN
;
9261 if ( ( ret
= mbedtls_ssl_conf_dh_param_bin( conf
,
9262 dhm_p
, sizeof( dhm_p
),
9263 dhm_g
, sizeof( dhm_g
) ) ) != 0 )
9271 * Preset-specific defaults
9278 case MBEDTLS_SSL_PRESET_SUITEB
:
9279 conf
->min_major_ver
= MBEDTLS_SSL_MAJOR_VERSION_3
;
9280 conf
->min_minor_ver
= MBEDTLS_SSL_MINOR_VERSION_3
; /* TLS 1.2 */
9281 conf
->max_major_ver
= MBEDTLS_SSL_MAX_MAJOR_VERSION
;
9282 conf
->max_minor_ver
= MBEDTLS_SSL_MAX_MINOR_VERSION
;
9284 conf
->ciphersuite_list
[MBEDTLS_SSL_MINOR_VERSION_0
] =
9285 conf
->ciphersuite_list
[MBEDTLS_SSL_MINOR_VERSION_1
] =
9286 conf
->ciphersuite_list
[MBEDTLS_SSL_MINOR_VERSION_2
] =
9287 conf
->ciphersuite_list
[MBEDTLS_SSL_MINOR_VERSION_3
] =
9288 ssl_preset_suiteb_ciphersuites
;
9290 #if defined(MBEDTLS_X509_CRT_PARSE_C)
9291 conf
->cert_profile
= &mbedtls_x509_crt_profile_suiteb
;
9294 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
9295 conf
->sig_hashes
= ssl_preset_suiteb_hashes
;
9298 #if defined(MBEDTLS_ECP_C)
9299 conf
->curve_list
= ssl_preset_suiteb_curves
;
9307 conf
->min_major_ver
= ( MBEDTLS_SSL_MIN_MAJOR_VERSION
>
9308 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION
) ?
9309 MBEDTLS_SSL_MIN_MAJOR_VERSION
:
9310 MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION
;
9311 conf
->min_minor_ver
= ( MBEDTLS_SSL_MIN_MINOR_VERSION
>
9312 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION
) ?
9313 MBEDTLS_SSL_MIN_MINOR_VERSION
:
9314 MBEDTLS_SSL_MIN_VALID_MINOR_VERSION
;
9315 conf
->max_major_ver
= MBEDTLS_SSL_MAX_MAJOR_VERSION
;
9316 conf
->max_minor_ver
= MBEDTLS_SSL_MAX_MINOR_VERSION
;
9318 #if defined(MBEDTLS_SSL_PROTO_DTLS)
9319 if( transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
9320 conf
->min_minor_ver
= MBEDTLS_SSL_MINOR_VERSION_2
;
9323 conf
->ciphersuite_list
[MBEDTLS_SSL_MINOR_VERSION_0
] =
9324 conf
->ciphersuite_list
[MBEDTLS_SSL_MINOR_VERSION_1
] =
9325 conf
->ciphersuite_list
[MBEDTLS_SSL_MINOR_VERSION_2
] =
9326 conf
->ciphersuite_list
[MBEDTLS_SSL_MINOR_VERSION_3
] =
9327 mbedtls_ssl_list_ciphersuites();
9329 #if defined(MBEDTLS_X509_CRT_PARSE_C)
9330 conf
->cert_profile
= &mbedtls_x509_crt_profile_default
;
9333 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
9334 conf
->sig_hashes
= ssl_preset_default_hashes
;
9337 #if defined(MBEDTLS_ECP_C)
9338 conf
->curve_list
= mbedtls_ecp_grp_id_list();
9341 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
9342 conf
->dhm_min_bitlen
= 1024;
9350 * Free mbedtls_ssl_config
9352 void mbedtls_ssl_config_free( mbedtls_ssl_config
*conf
)
9354 #if defined(MBEDTLS_DHM_C)
9355 mbedtls_mpi_free( &conf
->dhm_P
);
9356 mbedtls_mpi_free( &conf
->dhm_G
);
9359 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
9360 if( conf
->psk
!= NULL
)
9362 mbedtls_platform_zeroize( conf
->psk
, conf
->psk_len
);
9363 mbedtls_free( conf
->psk
);
9368 if( conf
->psk_identity
!= NULL
)
9370 mbedtls_platform_zeroize( conf
->psk_identity
, conf
->psk_identity_len
);
9371 mbedtls_free( conf
->psk_identity
);
9372 conf
->psk_identity
= NULL
;
9373 conf
->psk_identity_len
= 0;
9377 #if defined(MBEDTLS_X509_CRT_PARSE_C)
9378 ssl_key_cert_free( conf
->key_cert
);
9381 mbedtls_platform_zeroize( conf
, sizeof( mbedtls_ssl_config
) );
9384 #if defined(MBEDTLS_PK_C) && \
9385 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
9387 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
9389 unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context
*pk
)
9391 #if defined(MBEDTLS_RSA_C)
9392 if( mbedtls_pk_can_do( pk
, MBEDTLS_PK_RSA
) )
9393 return( MBEDTLS_SSL_SIG_RSA
);
9395 #if defined(MBEDTLS_ECDSA_C)
9396 if( mbedtls_pk_can_do( pk
, MBEDTLS_PK_ECDSA
) )
9397 return( MBEDTLS_SSL_SIG_ECDSA
);
9399 return( MBEDTLS_SSL_SIG_ANON
);
9402 unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type
)
9405 case MBEDTLS_PK_RSA
:
9406 return( MBEDTLS_SSL_SIG_RSA
);
9407 case MBEDTLS_PK_ECDSA
:
9408 case MBEDTLS_PK_ECKEY
:
9409 return( MBEDTLS_SSL_SIG_ECDSA
);
9411 return( MBEDTLS_SSL_SIG_ANON
);
9415 mbedtls_pk_type_t
mbedtls_ssl_pk_alg_from_sig( unsigned char sig
)
9419 #if defined(MBEDTLS_RSA_C)
9420 case MBEDTLS_SSL_SIG_RSA
:
9421 return( MBEDTLS_PK_RSA
);
9423 #if defined(MBEDTLS_ECDSA_C)
9424 case MBEDTLS_SSL_SIG_ECDSA
:
9425 return( MBEDTLS_PK_ECDSA
);
9428 return( MBEDTLS_PK_NONE
);
9431 #endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
9433 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
9434 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
9436 /* Find an entry in a signature-hash set matching a given hash algorithm. */
9437 mbedtls_md_type_t
mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t
*set
,
9438 mbedtls_pk_type_t sig_alg
)
9442 case MBEDTLS_PK_RSA
:
9444 case MBEDTLS_PK_ECDSA
:
9445 return( set
->ecdsa
);
9447 return( MBEDTLS_MD_NONE
);
9451 /* Add a signature-hash-pair to a signature-hash set */
9452 void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t
*set
,
9453 mbedtls_pk_type_t sig_alg
,
9454 mbedtls_md_type_t md_alg
)
9458 case MBEDTLS_PK_RSA
:
9459 if( set
->rsa
== MBEDTLS_MD_NONE
)
9463 case MBEDTLS_PK_ECDSA
:
9464 if( set
->ecdsa
== MBEDTLS_MD_NONE
)
9465 set
->ecdsa
= md_alg
;
9473 /* Allow exactly one hash algorithm for each signature. */
9474 void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t
*set
,
9475 mbedtls_md_type_t md_alg
)
9478 set
->ecdsa
= md_alg
;
9481 #endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
9482 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
9485 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
9487 mbedtls_md_type_t
mbedtls_ssl_md_alg_from_hash( unsigned char hash
)
9491 #if defined(MBEDTLS_MD5_C)
9492 case MBEDTLS_SSL_HASH_MD5
:
9493 return( MBEDTLS_MD_MD5
);
9495 #if defined(MBEDTLS_SHA1_C)
9496 case MBEDTLS_SSL_HASH_SHA1
:
9497 return( MBEDTLS_MD_SHA1
);
9499 #if defined(MBEDTLS_SHA256_C)
9500 case MBEDTLS_SSL_HASH_SHA224
:
9501 return( MBEDTLS_MD_SHA224
);
9502 case MBEDTLS_SSL_HASH_SHA256
:
9503 return( MBEDTLS_MD_SHA256
);
9505 #if defined(MBEDTLS_SHA512_C)
9506 case MBEDTLS_SSL_HASH_SHA384
:
9507 return( MBEDTLS_MD_SHA384
);
9508 case MBEDTLS_SSL_HASH_SHA512
:
9509 return( MBEDTLS_MD_SHA512
);
9512 return( MBEDTLS_MD_NONE
);
9517 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
9519 unsigned char mbedtls_ssl_hash_from_md_alg( int md
)
9523 #if defined(MBEDTLS_MD5_C)
9524 case MBEDTLS_MD_MD5
:
9525 return( MBEDTLS_SSL_HASH_MD5
);
9527 #if defined(MBEDTLS_SHA1_C)
9528 case MBEDTLS_MD_SHA1
:
9529 return( MBEDTLS_SSL_HASH_SHA1
);
9531 #if defined(MBEDTLS_SHA256_C)
9532 case MBEDTLS_MD_SHA224
:
9533 return( MBEDTLS_SSL_HASH_SHA224
);
9534 case MBEDTLS_MD_SHA256
:
9535 return( MBEDTLS_SSL_HASH_SHA256
);
9537 #if defined(MBEDTLS_SHA512_C)
9538 case MBEDTLS_MD_SHA384
:
9539 return( MBEDTLS_SSL_HASH_SHA384
);
9540 case MBEDTLS_MD_SHA512
:
9541 return( MBEDTLS_SSL_HASH_SHA512
);
9544 return( MBEDTLS_SSL_HASH_NONE
);
9548 #if defined(MBEDTLS_ECP_C)
9550 * Check if a curve proposed by the peer is in our list.
9551 * Return 0 if we're willing to use it, -1 otherwise.
9553 int mbedtls_ssl_check_curve( const mbedtls_ssl_context
*ssl
, mbedtls_ecp_group_id grp_id
)
9555 const mbedtls_ecp_group_id
*gid
;
9557 if( ssl
->conf
->curve_list
== NULL
)
9560 for( gid
= ssl
->conf
->curve_list
; *gid
!= MBEDTLS_ECP_DP_NONE
; gid
++ )
9561 if( *gid
== grp_id
)
9566 #endif /* MBEDTLS_ECP_C */
9568 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
9570 * Check if a hash proposed by the peer is in our list.
9571 * Return 0 if we're willing to use it, -1 otherwise.
9573 int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context
*ssl
,
9574 mbedtls_md_type_t md
)
9578 if( ssl
->conf
->sig_hashes
== NULL
)
9581 for( cur
= ssl
->conf
->sig_hashes
; *cur
!= MBEDTLS_MD_NONE
; cur
++ )
9582 if( *cur
== (int) md
)
9587 #endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
9589 #if defined(MBEDTLS_X509_CRT_PARSE_C)
9590 int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt
*cert
,
9591 const mbedtls_ssl_ciphersuite_t
*ciphersuite
,
9596 #if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
9599 #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
9600 const char *ext_oid
;
9604 #if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \
9605 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
9607 ((void) cert_endpoint
);
9611 #if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
9612 if( cert_endpoint
== MBEDTLS_SSL_IS_SERVER
)
9614 /* Server part of the key exchange */
9615 switch( ciphersuite
->key_exchange
)
9617 case MBEDTLS_KEY_EXCHANGE_RSA
:
9618 case MBEDTLS_KEY_EXCHANGE_RSA_PSK
:
9619 usage
= MBEDTLS_X509_KU_KEY_ENCIPHERMENT
;
9622 case MBEDTLS_KEY_EXCHANGE_DHE_RSA
:
9623 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA
:
9624 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA
:
9625 usage
= MBEDTLS_X509_KU_DIGITAL_SIGNATURE
;
9628 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA
:
9629 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA
:
9630 usage
= MBEDTLS_X509_KU_KEY_AGREEMENT
;
9633 /* Don't use default: we want warnings when adding new values */
9634 case MBEDTLS_KEY_EXCHANGE_NONE
:
9635 case MBEDTLS_KEY_EXCHANGE_PSK
:
9636 case MBEDTLS_KEY_EXCHANGE_DHE_PSK
:
9637 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK
:
9638 case MBEDTLS_KEY_EXCHANGE_ECJPAKE
:
9644 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
9645 usage
= MBEDTLS_X509_KU_DIGITAL_SIGNATURE
;
9648 if( mbedtls_x509_crt_check_key_usage( cert
, usage
) != 0 )
9650 *flags
|= MBEDTLS_X509_BADCERT_KEY_USAGE
;
9654 ((void) ciphersuite
);
9655 #endif /* MBEDTLS_X509_CHECK_KEY_USAGE */
9657 #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
9658 if( cert_endpoint
== MBEDTLS_SSL_IS_SERVER
)
9660 ext_oid
= MBEDTLS_OID_SERVER_AUTH
;
9661 ext_len
= MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH
);
9665 ext_oid
= MBEDTLS_OID_CLIENT_AUTH
;
9666 ext_len
= MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH
);
9669 if( mbedtls_x509_crt_check_extended_key_usage( cert
, ext_oid
, ext_len
) != 0 )
9671 *flags
|= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE
;
9674 #endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
9678 #endif /* MBEDTLS_X509_CRT_PARSE_C */
9681 * Convert version numbers to/from wire format
9682 * and, for DTLS, to/from TLS equivalent.
9684 * For TLS this is the identity.
9685 * For DTLS, use 1's complement (v -> 255 - v, and then map as follows:
9686 * 1.0 <-> 3.2 (DTLS 1.0 is based on TLS 1.1)
9687 * 1.x <-> 3.x+1 for x != 0 (DTLS 1.2 based on TLS 1.2)
9689 void mbedtls_ssl_write_version( int major
, int minor
, int transport
,
9690 unsigned char ver
[2] )
9692 #if defined(MBEDTLS_SSL_PROTO_DTLS)
9693 if( transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
9695 if( minor
== MBEDTLS_SSL_MINOR_VERSION_2
)
9696 --minor
; /* DTLS 1.0 stored as TLS 1.1 internally */
9698 ver
[0] = (unsigned char)( 255 - ( major
- 2 ) );
9699 ver
[1] = (unsigned char)( 255 - ( minor
- 1 ) );
9706 ver
[0] = (unsigned char) major
;
9707 ver
[1] = (unsigned char) minor
;
9711 void mbedtls_ssl_read_version( int *major
, int *minor
, int transport
,
9712 const unsigned char ver
[2] )
9714 #if defined(MBEDTLS_SSL_PROTO_DTLS)
9715 if( transport
== MBEDTLS_SSL_TRANSPORT_DATAGRAM
)
9717 *major
= 255 - ver
[0] + 2;
9718 *minor
= 255 - ver
[1] + 1;
9720 if( *minor
== MBEDTLS_SSL_MINOR_VERSION_1
)
9721 ++*minor
; /* DTLS 1.0 stored as TLS 1.1 internally */
9733 int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context
*ssl
, int md
)
9735 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
9736 if( ssl
->minor_ver
!= MBEDTLS_SSL_MINOR_VERSION_3
)
9737 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH
;
9741 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
9742 #if defined(MBEDTLS_MD5_C)
9743 case MBEDTLS_SSL_HASH_MD5
:
9744 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH
;
9746 #if defined(MBEDTLS_SHA1_C)
9747 case MBEDTLS_SSL_HASH_SHA1
:
9748 ssl
->handshake
->calc_verify
= ssl_calc_verify_tls
;
9751 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
9752 #if defined(MBEDTLS_SHA512_C)
9753 case MBEDTLS_SSL_HASH_SHA384
:
9754 ssl
->handshake
->calc_verify
= ssl_calc_verify_tls_sha384
;
9757 #if defined(MBEDTLS_SHA256_C)
9758 case MBEDTLS_SSL_HASH_SHA256
:
9759 ssl
->handshake
->calc_verify
= ssl_calc_verify_tls_sha256
;
9763 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH
;
9767 #else /* !MBEDTLS_SSL_PROTO_TLS1_2 */
9771 return MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH
;
9772 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
9775 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
9776 defined(MBEDTLS_SSL_PROTO_TLS1_1)
9777 int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context
*ssl
,
9778 unsigned char *output
,
9779 unsigned char *data
, size_t data_len
)
9782 mbedtls_md5_context mbedtls_md5
;
9783 mbedtls_sha1_context mbedtls_sha1
;
9785 mbedtls_md5_init( &mbedtls_md5
);
9786 mbedtls_sha1_init( &mbedtls_sha1
);
9789 * digitally-signed struct {
9790 * opaque md5_hash[16];
9791 * opaque sha_hash[20];
9795 * MD5(ClientHello.random + ServerHello.random
9798 * SHA(ClientHello.random + ServerHello.random
9801 if( ( ret
= mbedtls_md5_starts_ret( &mbedtls_md5
) ) != 0 )
9803 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_starts_ret", ret
);
9806 if( ( ret
= mbedtls_md5_update_ret( &mbedtls_md5
,
9807 ssl
->handshake
->randbytes
, 64 ) ) != 0 )
9809 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret
);
9812 if( ( ret
= mbedtls_md5_update_ret( &mbedtls_md5
, data
, data_len
) ) != 0 )
9814 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_update_ret", ret
);
9817 if( ( ret
= mbedtls_md5_finish_ret( &mbedtls_md5
, output
) ) != 0 )
9819 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md5_finish_ret", ret
);
9823 if( ( ret
= mbedtls_sha1_starts_ret( &mbedtls_sha1
) ) != 0 )
9825 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_starts_ret", ret
);
9828 if( ( ret
= mbedtls_sha1_update_ret( &mbedtls_sha1
,
9829 ssl
->handshake
->randbytes
, 64 ) ) != 0 )
9831 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret
);
9834 if( ( ret
= mbedtls_sha1_update_ret( &mbedtls_sha1
, data
,
9837 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_update_ret", ret
);
9840 if( ( ret
= mbedtls_sha1_finish_ret( &mbedtls_sha1
,
9841 output
+ 16 ) ) != 0 )
9843 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_sha1_finish_ret", ret
);
9848 mbedtls_md5_free( &mbedtls_md5
);
9849 mbedtls_sha1_free( &mbedtls_sha1
);
9852 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
9853 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR
);
9858 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
9859 MBEDTLS_SSL_PROTO_TLS1_1 */
9861 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
9862 defined(MBEDTLS_SSL_PROTO_TLS1_2)
9863 int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context
*ssl
,
9864 unsigned char *hash
, size_t *hashlen
,
9865 unsigned char *data
, size_t data_len
,
9866 mbedtls_md_type_t md_alg
)
9869 mbedtls_md_context_t ctx
;
9870 const mbedtls_md_info_t
*md_info
= mbedtls_md_info_from_type( md_alg
);
9871 *hashlen
= mbedtls_md_get_size( md_info
);
9873 mbedtls_md_init( &ctx
);
9876 * digitally-signed struct {
9877 * opaque client_random[32];
9878 * opaque server_random[32];
9879 * ServerDHParams params;
9882 if( ( ret
= mbedtls_md_setup( &ctx
, md_info
, 0 ) ) != 0 )
9884 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret
);
9887 if( ( ret
= mbedtls_md_starts( &ctx
) ) != 0 )
9889 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_starts", ret
);
9892 if( ( ret
= mbedtls_md_update( &ctx
, ssl
->handshake
->randbytes
, 64 ) ) != 0 )
9894 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret
);
9897 if( ( ret
= mbedtls_md_update( &ctx
, data
, data_len
) ) != 0 )
9899 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_update", ret
);
9902 if( ( ret
= mbedtls_md_finish( &ctx
, hash
) ) != 0 )
9904 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_finish", ret
);
9909 mbedtls_md_free( &ctx
);
9912 mbedtls_ssl_send_alert_message( ssl
, MBEDTLS_SSL_ALERT_LEVEL_FATAL
,
9913 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR
);
9917 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
9918 MBEDTLS_SSL_PROTO_TLS1_2 */
9920 #endif /* MBEDTLS_SSL_TLS_C */