I added functionality to get the RSSI, BER, and Cell Neighbor for reporting connection issues to M2X
Dependencies: WncControllerK64F
mbedtls/source/ssl_tls.c@18:198e9b0acf11, 2016-11-17 (annotated)
- Committer:
- JMF
- Date:
- Thu Nov 17 16:13:29 2016 +0000
- Revision:
- 18:198e9b0acf11
- Parent:
- 12:0071cb144c7a
Updates to mbed os resulted in mutex.h going away and rtos.h needed to be used; This fixes the Mutex typedef failure. Also cast data buffers from 'char *' to (const std::uint8_t*) to conform with Fred's changes in WncController
Who changed what in which revision?
User | Revision | Line number | New contents of line |
---|---|---|---|
JMF | 12:0071cb144c7a | 1 | /* |
JMF | 12:0071cb144c7a | 2 | * SSLv3/TLSv1 shared functions |
JMF | 12:0071cb144c7a | 3 | * |
JMF | 12:0071cb144c7a | 4 | * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved |
JMF | 12:0071cb144c7a | 5 | * SPDX-License-Identifier: Apache-2.0 |
JMF | 12:0071cb144c7a | 6 | * |
JMF | 12:0071cb144c7a | 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
JMF | 12:0071cb144c7a | 8 | * not use this file except in compliance with the License. |
JMF | 12:0071cb144c7a | 9 | * You may obtain a copy of the License at |
JMF | 12:0071cb144c7a | 10 | * |
JMF | 12:0071cb144c7a | 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
JMF | 12:0071cb144c7a | 12 | * |
JMF | 12:0071cb144c7a | 13 | * Unless required by applicable law or agreed to in writing, software |
JMF | 12:0071cb144c7a | 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
JMF | 12:0071cb144c7a | 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
JMF | 12:0071cb144c7a | 16 | * See the License for the specific language governing permissions and |
JMF | 12:0071cb144c7a | 17 | * limitations under the License. |
JMF | 12:0071cb144c7a | 18 | * |
JMF | 12:0071cb144c7a | 19 | * This file is part of mbed TLS (https://tls.mbed.org) |
JMF | 12:0071cb144c7a | 20 | */ |
JMF | 12:0071cb144c7a | 21 | /* |
JMF | 12:0071cb144c7a | 22 | * The SSL 3.0 specification was drafted by Netscape in 1996, |
JMF | 12:0071cb144c7a | 23 | * and became an IETF standard in 1999. |
JMF | 12:0071cb144c7a | 24 | * |
JMF | 12:0071cb144c7a | 25 | * http://wp.netscape.com/eng/ssl3/ |
JMF | 12:0071cb144c7a | 26 | * http://www.ietf.org/rfc/rfc2246.txt |
JMF | 12:0071cb144c7a | 27 | * http://www.ietf.org/rfc/rfc4346.txt |
JMF | 12:0071cb144c7a | 28 | */ |
JMF | 12:0071cb144c7a | 29 | |
JMF | 12:0071cb144c7a | 30 | #if !defined(MBEDTLS_CONFIG_FILE) |
JMF | 12:0071cb144c7a | 31 | #include "mbedtls/config.h" |
JMF | 12:0071cb144c7a | 32 | #else |
JMF | 12:0071cb144c7a | 33 | #include MBEDTLS_CONFIG_FILE |
JMF | 12:0071cb144c7a | 34 | #endif |
JMF | 12:0071cb144c7a | 35 | |
JMF | 12:0071cb144c7a | 36 | #if defined(MBEDTLS_SSL_TLS_C) |
JMF | 12:0071cb144c7a | 37 | |
JMF | 12:0071cb144c7a | 38 | #if defined(MBEDTLS_PLATFORM_C) |
JMF | 12:0071cb144c7a | 39 | #include "mbedtls/platform.h" |
JMF | 12:0071cb144c7a | 40 | #else |
JMF | 12:0071cb144c7a | 41 | #include <stdlib.h> |
JMF | 12:0071cb144c7a | 42 | #define mbedtls_calloc calloc |
JMF | 12:0071cb144c7a | 43 | #define mbedtls_free free |
JMF | 12:0071cb144c7a | 44 | #endif |
JMF | 12:0071cb144c7a | 45 | |
JMF | 12:0071cb144c7a | 46 | #include "mbedtls/debug.h" |
JMF | 12:0071cb144c7a | 47 | #include "mbedtls/ssl.h" |
JMF | 12:0071cb144c7a | 48 | #include "mbedtls/ssl_internal.h" |
JMF | 12:0071cb144c7a | 49 | |
JMF | 12:0071cb144c7a | 50 | #include <string.h> |
JMF | 12:0071cb144c7a | 51 | |
JMF | 12:0071cb144c7a | 52 | #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ |
JMF | 12:0071cb144c7a | 53 | defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE) |
JMF | 12:0071cb144c7a | 54 | #include "mbedtls/oid.h" |
JMF | 12:0071cb144c7a | 55 | #endif |
JMF | 12:0071cb144c7a | 56 | |
JMF | 12:0071cb144c7a | 57 | /* Implementation that should never be optimized out by the compiler */ |
JMF | 12:0071cb144c7a | 58 | static void mbedtls_zeroize( void *v, size_t n ) { |
JMF | 12:0071cb144c7a | 59 | volatile unsigned char *p = v; while( n-- ) *p++ = 0; |
JMF | 12:0071cb144c7a | 60 | } |
JMF | 12:0071cb144c7a | 61 | |
JMF | 12:0071cb144c7a | 62 | /* Length of the "epoch" field in the record header */ |
JMF | 12:0071cb144c7a | 63 | static inline size_t ssl_ep_len( const mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 64 | { |
JMF | 12:0071cb144c7a | 65 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 66 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 67 | return( 2 ); |
JMF | 12:0071cb144c7a | 68 | #else |
JMF | 12:0071cb144c7a | 69 | ((void) ssl); |
JMF | 12:0071cb144c7a | 70 | #endif |
JMF | 12:0071cb144c7a | 71 | return( 0 ); |
JMF | 12:0071cb144c7a | 72 | } |
JMF | 12:0071cb144c7a | 73 | |
JMF | 12:0071cb144c7a | 74 | /* |
JMF | 12:0071cb144c7a | 75 | * Start a timer. |
JMF | 12:0071cb144c7a | 76 | * Passing millisecs = 0 cancels a running timer. |
JMF | 12:0071cb144c7a | 77 | */ |
JMF | 12:0071cb144c7a | 78 | static void ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs ) |
JMF | 12:0071cb144c7a | 79 | { |
JMF | 12:0071cb144c7a | 80 | if( ssl->f_set_timer == NULL ) |
JMF | 12:0071cb144c7a | 81 | return; |
JMF | 12:0071cb144c7a | 82 | |
JMF | 12:0071cb144c7a | 83 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "set_timer to %d ms", (int) millisecs ) ); |
JMF | 12:0071cb144c7a | 84 | ssl->f_set_timer( ssl->p_timer, millisecs / 4, millisecs ); |
JMF | 12:0071cb144c7a | 85 | } |
JMF | 12:0071cb144c7a | 86 | |
JMF | 12:0071cb144c7a | 87 | /* |
JMF | 12:0071cb144c7a | 88 | * Return -1 is timer is expired, 0 if it isn't. |
JMF | 12:0071cb144c7a | 89 | */ |
JMF | 12:0071cb144c7a | 90 | static int ssl_check_timer( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 91 | { |
JMF | 12:0071cb144c7a | 92 | if( ssl->f_get_timer == NULL ) |
JMF | 12:0071cb144c7a | 93 | return( 0 ); |
JMF | 12:0071cb144c7a | 94 | |
JMF | 12:0071cb144c7a | 95 | if( ssl->f_get_timer( ssl->p_timer ) == 2 ) |
JMF | 12:0071cb144c7a | 96 | { |
JMF | 12:0071cb144c7a | 97 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) ); |
JMF | 12:0071cb144c7a | 98 | return( -1 ); |
JMF | 12:0071cb144c7a | 99 | } |
JMF | 12:0071cb144c7a | 100 | |
JMF | 12:0071cb144c7a | 101 | return( 0 ); |
JMF | 12:0071cb144c7a | 102 | } |
JMF | 12:0071cb144c7a | 103 | |
JMF | 12:0071cb144c7a | 104 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 105 | /* |
JMF | 12:0071cb144c7a | 106 | * Double the retransmit timeout value, within the allowed range, |
JMF | 12:0071cb144c7a | 107 | * returning -1 if the maximum value has already been reached. |
JMF | 12:0071cb144c7a | 108 | */ |
JMF | 12:0071cb144c7a | 109 | static int ssl_double_retransmit_timeout( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 110 | { |
JMF | 12:0071cb144c7a | 111 | uint32_t new_timeout; |
JMF | 12:0071cb144c7a | 112 | |
JMF | 12:0071cb144c7a | 113 | if( ssl->handshake->retransmit_timeout >= ssl->conf->hs_timeout_max ) |
JMF | 12:0071cb144c7a | 114 | return( -1 ); |
JMF | 12:0071cb144c7a | 115 | |
JMF | 12:0071cb144c7a | 116 | new_timeout = 2 * ssl->handshake->retransmit_timeout; |
JMF | 12:0071cb144c7a | 117 | |
JMF | 12:0071cb144c7a | 118 | /* Avoid arithmetic overflow and range overflow */ |
JMF | 12:0071cb144c7a | 119 | if( new_timeout < ssl->handshake->retransmit_timeout || |
JMF | 12:0071cb144c7a | 120 | new_timeout > ssl->conf->hs_timeout_max ) |
JMF | 12:0071cb144c7a | 121 | { |
JMF | 12:0071cb144c7a | 122 | new_timeout = ssl->conf->hs_timeout_max; |
JMF | 12:0071cb144c7a | 123 | } |
JMF | 12:0071cb144c7a | 124 | |
JMF | 12:0071cb144c7a | 125 | ssl->handshake->retransmit_timeout = new_timeout; |
JMF | 12:0071cb144c7a | 126 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs", |
JMF | 12:0071cb144c7a | 127 | ssl->handshake->retransmit_timeout ) ); |
JMF | 12:0071cb144c7a | 128 | |
JMF | 12:0071cb144c7a | 129 | return( 0 ); |
JMF | 12:0071cb144c7a | 130 | } |
JMF | 12:0071cb144c7a | 131 | |
JMF | 12:0071cb144c7a | 132 | static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 133 | { |
JMF | 12:0071cb144c7a | 134 | ssl->handshake->retransmit_timeout = ssl->conf->hs_timeout_min; |
JMF | 12:0071cb144c7a | 135 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs", |
JMF | 12:0071cb144c7a | 136 | ssl->handshake->retransmit_timeout ) ); |
JMF | 12:0071cb144c7a | 137 | } |
JMF | 12:0071cb144c7a | 138 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
JMF | 12:0071cb144c7a | 139 | |
JMF | 12:0071cb144c7a | 140 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
JMF | 12:0071cb144c7a | 141 | /* |
JMF | 12:0071cb144c7a | 142 | * Convert max_fragment_length codes to length. |
JMF | 12:0071cb144c7a | 143 | * RFC 6066 says: |
JMF | 12:0071cb144c7a | 144 | * enum{ |
JMF | 12:0071cb144c7a | 145 | * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255) |
JMF | 12:0071cb144c7a | 146 | * } MaxFragmentLength; |
JMF | 12:0071cb144c7a | 147 | * and we add 0 -> extension unused |
JMF | 12:0071cb144c7a | 148 | */ |
JMF | 12:0071cb144c7a | 149 | static unsigned int mfl_code_to_length[MBEDTLS_SSL_MAX_FRAG_LEN_INVALID] = |
JMF | 12:0071cb144c7a | 150 | { |
JMF | 12:0071cb144c7a | 151 | MBEDTLS_SSL_MAX_CONTENT_LEN, /* MBEDTLS_SSL_MAX_FRAG_LEN_NONE */ |
JMF | 12:0071cb144c7a | 152 | 512, /* MBEDTLS_SSL_MAX_FRAG_LEN_512 */ |
JMF | 12:0071cb144c7a | 153 | 1024, /* MBEDTLS_SSL_MAX_FRAG_LEN_1024 */ |
JMF | 12:0071cb144c7a | 154 | 2048, /* MBEDTLS_SSL_MAX_FRAG_LEN_2048 */ |
JMF | 12:0071cb144c7a | 155 | 4096, /* MBEDTLS_SSL_MAX_FRAG_LEN_4096 */ |
JMF | 12:0071cb144c7a | 156 | }; |
JMF | 12:0071cb144c7a | 157 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
JMF | 12:0071cb144c7a | 158 | |
JMF | 12:0071cb144c7a | 159 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 160 | static int ssl_session_copy( mbedtls_ssl_session *dst, const mbedtls_ssl_session *src ) |
JMF | 12:0071cb144c7a | 161 | { |
JMF | 12:0071cb144c7a | 162 | mbedtls_ssl_session_free( dst ); |
JMF | 12:0071cb144c7a | 163 | memcpy( dst, src, sizeof( mbedtls_ssl_session ) ); |
JMF | 12:0071cb144c7a | 164 | |
JMF | 12:0071cb144c7a | 165 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
JMF | 12:0071cb144c7a | 166 | if( src->peer_cert != NULL ) |
JMF | 12:0071cb144c7a | 167 | { |
JMF | 12:0071cb144c7a | 168 | int ret; |
JMF | 12:0071cb144c7a | 169 | |
JMF | 12:0071cb144c7a | 170 | dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) ); |
JMF | 12:0071cb144c7a | 171 | if( dst->peer_cert == NULL ) |
JMF | 12:0071cb144c7a | 172 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 173 | |
JMF | 12:0071cb144c7a | 174 | mbedtls_x509_crt_init( dst->peer_cert ); |
JMF | 12:0071cb144c7a | 175 | |
JMF | 12:0071cb144c7a | 176 | if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p, |
JMF | 12:0071cb144c7a | 177 | src->peer_cert->raw.len ) ) != 0 ) |
JMF | 12:0071cb144c7a | 178 | { |
JMF | 12:0071cb144c7a | 179 | mbedtls_free( dst->peer_cert ); |
JMF | 12:0071cb144c7a | 180 | dst->peer_cert = NULL; |
JMF | 12:0071cb144c7a | 181 | return( ret ); |
JMF | 12:0071cb144c7a | 182 | } |
JMF | 12:0071cb144c7a | 183 | } |
JMF | 12:0071cb144c7a | 184 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
JMF | 12:0071cb144c7a | 185 | |
JMF | 12:0071cb144c7a | 186 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 187 | if( src->ticket != NULL ) |
JMF | 12:0071cb144c7a | 188 | { |
JMF | 12:0071cb144c7a | 189 | dst->ticket = mbedtls_calloc( 1, src->ticket_len ); |
JMF | 12:0071cb144c7a | 190 | if( dst->ticket == NULL ) |
JMF | 12:0071cb144c7a | 191 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 192 | |
JMF | 12:0071cb144c7a | 193 | memcpy( dst->ticket, src->ticket, src->ticket_len ); |
JMF | 12:0071cb144c7a | 194 | } |
JMF | 12:0071cb144c7a | 195 | #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */ |
JMF | 12:0071cb144c7a | 196 | |
JMF | 12:0071cb144c7a | 197 | return( 0 ); |
JMF | 12:0071cb144c7a | 198 | } |
JMF | 12:0071cb144c7a | 199 | #endif /* MBEDTLS_SSL_CLI_C */ |
JMF | 12:0071cb144c7a | 200 | |
JMF | 12:0071cb144c7a | 201 | #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) |
JMF | 12:0071cb144c7a | 202 | int (*mbedtls_ssl_hw_record_init)( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 203 | const unsigned char *key_enc, const unsigned char *key_dec, |
JMF | 12:0071cb144c7a | 204 | size_t keylen, |
JMF | 12:0071cb144c7a | 205 | const unsigned char *iv_enc, const unsigned char *iv_dec, |
JMF | 12:0071cb144c7a | 206 | size_t ivlen, |
JMF | 12:0071cb144c7a | 207 | const unsigned char *mac_enc, const unsigned char *mac_dec, |
JMF | 12:0071cb144c7a | 208 | size_t maclen ) = NULL; |
JMF | 12:0071cb144c7a | 209 | int (*mbedtls_ssl_hw_record_activate)( mbedtls_ssl_context *ssl, int direction) = NULL; |
JMF | 12:0071cb144c7a | 210 | int (*mbedtls_ssl_hw_record_reset)( mbedtls_ssl_context *ssl ) = NULL; |
JMF | 12:0071cb144c7a | 211 | int (*mbedtls_ssl_hw_record_write)( mbedtls_ssl_context *ssl ) = NULL; |
JMF | 12:0071cb144c7a | 212 | int (*mbedtls_ssl_hw_record_read)( mbedtls_ssl_context *ssl ) = NULL; |
JMF | 12:0071cb144c7a | 213 | int (*mbedtls_ssl_hw_record_finish)( mbedtls_ssl_context *ssl ) = NULL; |
JMF | 12:0071cb144c7a | 214 | #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */ |
JMF | 12:0071cb144c7a | 215 | |
JMF | 12:0071cb144c7a | 216 | /* |
JMF | 12:0071cb144c7a | 217 | * Key material generation |
JMF | 12:0071cb144c7a | 218 | */ |
JMF | 12:0071cb144c7a | 219 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 220 | static int ssl3_prf( const unsigned char *secret, size_t slen, |
JMF | 12:0071cb144c7a | 221 | const char *label, |
JMF | 12:0071cb144c7a | 222 | const unsigned char *random, size_t rlen, |
JMF | 12:0071cb144c7a | 223 | unsigned char *dstbuf, size_t dlen ) |
JMF | 12:0071cb144c7a | 224 | { |
JMF | 12:0071cb144c7a | 225 | size_t i; |
JMF | 12:0071cb144c7a | 226 | mbedtls_md5_context md5; |
JMF | 12:0071cb144c7a | 227 | mbedtls_sha1_context sha1; |
JMF | 12:0071cb144c7a | 228 | unsigned char padding[16]; |
JMF | 12:0071cb144c7a | 229 | unsigned char sha1sum[20]; |
JMF | 12:0071cb144c7a | 230 | ((void)label); |
JMF | 12:0071cb144c7a | 231 | |
JMF | 12:0071cb144c7a | 232 | mbedtls_md5_init( &md5 ); |
JMF | 12:0071cb144c7a | 233 | mbedtls_sha1_init( &sha1 ); |
JMF | 12:0071cb144c7a | 234 | |
JMF | 12:0071cb144c7a | 235 | /* |
JMF | 12:0071cb144c7a | 236 | * SSLv3: |
JMF | 12:0071cb144c7a | 237 | * block = |
JMF | 12:0071cb144c7a | 238 | * MD5( secret + SHA1( 'A' + secret + random ) ) + |
JMF | 12:0071cb144c7a | 239 | * MD5( secret + SHA1( 'BB' + secret + random ) ) + |
JMF | 12:0071cb144c7a | 240 | * MD5( secret + SHA1( 'CCC' + secret + random ) ) + |
JMF | 12:0071cb144c7a | 241 | * ... |
JMF | 12:0071cb144c7a | 242 | */ |
JMF | 12:0071cb144c7a | 243 | for( i = 0; i < dlen / 16; i++ ) |
JMF | 12:0071cb144c7a | 244 | { |
JMF | 12:0071cb144c7a | 245 | memset( padding, (unsigned char) ('A' + i), 1 + i ); |
JMF | 12:0071cb144c7a | 246 | |
JMF | 12:0071cb144c7a | 247 | mbedtls_sha1_starts( &sha1 ); |
JMF | 12:0071cb144c7a | 248 | mbedtls_sha1_update( &sha1, padding, 1 + i ); |
JMF | 12:0071cb144c7a | 249 | mbedtls_sha1_update( &sha1, secret, slen ); |
JMF | 12:0071cb144c7a | 250 | mbedtls_sha1_update( &sha1, random, rlen ); |
JMF | 12:0071cb144c7a | 251 | mbedtls_sha1_finish( &sha1, sha1sum ); |
JMF | 12:0071cb144c7a | 252 | |
JMF | 12:0071cb144c7a | 253 | mbedtls_md5_starts( &md5 ); |
JMF | 12:0071cb144c7a | 254 | mbedtls_md5_update( &md5, secret, slen ); |
JMF | 12:0071cb144c7a | 255 | mbedtls_md5_update( &md5, sha1sum, 20 ); |
JMF | 12:0071cb144c7a | 256 | mbedtls_md5_finish( &md5, dstbuf + i * 16 ); |
JMF | 12:0071cb144c7a | 257 | } |
JMF | 12:0071cb144c7a | 258 | |
JMF | 12:0071cb144c7a | 259 | mbedtls_md5_free( &md5 ); |
JMF | 12:0071cb144c7a | 260 | mbedtls_sha1_free( &sha1 ); |
JMF | 12:0071cb144c7a | 261 | |
JMF | 12:0071cb144c7a | 262 | mbedtls_zeroize( padding, sizeof( padding ) ); |
JMF | 12:0071cb144c7a | 263 | mbedtls_zeroize( sha1sum, sizeof( sha1sum ) ); |
JMF | 12:0071cb144c7a | 264 | |
JMF | 12:0071cb144c7a | 265 | return( 0 ); |
JMF | 12:0071cb144c7a | 266 | } |
JMF | 12:0071cb144c7a | 267 | #endif /* MBEDTLS_SSL_PROTO_SSL3 */ |
JMF | 12:0071cb144c7a | 268 | |
JMF | 12:0071cb144c7a | 269 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) |
JMF | 12:0071cb144c7a | 270 | static int tls1_prf( const unsigned char *secret, size_t slen, |
JMF | 12:0071cb144c7a | 271 | const char *label, |
JMF | 12:0071cb144c7a | 272 | const unsigned char *random, size_t rlen, |
JMF | 12:0071cb144c7a | 273 | unsigned char *dstbuf, size_t dlen ) |
JMF | 12:0071cb144c7a | 274 | { |
JMF | 12:0071cb144c7a | 275 | size_t nb, hs; |
JMF | 12:0071cb144c7a | 276 | size_t i, j, k; |
JMF | 12:0071cb144c7a | 277 | const unsigned char *S1, *S2; |
JMF | 12:0071cb144c7a | 278 | unsigned char tmp[128]; |
JMF | 12:0071cb144c7a | 279 | unsigned char h_i[20]; |
JMF | 12:0071cb144c7a | 280 | const mbedtls_md_info_t *md_info; |
JMF | 12:0071cb144c7a | 281 | mbedtls_md_context_t md_ctx; |
JMF | 12:0071cb144c7a | 282 | int ret; |
JMF | 12:0071cb144c7a | 283 | |
JMF | 12:0071cb144c7a | 284 | mbedtls_md_init( &md_ctx ); |
JMF | 12:0071cb144c7a | 285 | |
JMF | 12:0071cb144c7a | 286 | if( sizeof( tmp ) < 20 + strlen( label ) + rlen ) |
JMF | 12:0071cb144c7a | 287 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 288 | |
JMF | 12:0071cb144c7a | 289 | hs = ( slen + 1 ) / 2; |
JMF | 12:0071cb144c7a | 290 | S1 = secret; |
JMF | 12:0071cb144c7a | 291 | S2 = secret + slen - hs; |
JMF | 12:0071cb144c7a | 292 | |
JMF | 12:0071cb144c7a | 293 | nb = strlen( label ); |
JMF | 12:0071cb144c7a | 294 | memcpy( tmp + 20, label, nb ); |
JMF | 12:0071cb144c7a | 295 | memcpy( tmp + 20 + nb, random, rlen ); |
JMF | 12:0071cb144c7a | 296 | nb += rlen; |
JMF | 12:0071cb144c7a | 297 | |
JMF | 12:0071cb144c7a | 298 | /* |
JMF | 12:0071cb144c7a | 299 | * First compute P_md5(secret,label+random)[0..dlen] |
JMF | 12:0071cb144c7a | 300 | */ |
JMF | 12:0071cb144c7a | 301 | if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) == NULL ) |
JMF | 12:0071cb144c7a | 302 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 303 | |
JMF | 12:0071cb144c7a | 304 | if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 ) |
JMF | 12:0071cb144c7a | 305 | return( ret ); |
JMF | 12:0071cb144c7a | 306 | |
JMF | 12:0071cb144c7a | 307 | mbedtls_md_hmac_starts( &md_ctx, S1, hs ); |
JMF | 12:0071cb144c7a | 308 | mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb ); |
JMF | 12:0071cb144c7a | 309 | mbedtls_md_hmac_finish( &md_ctx, 4 + tmp ); |
JMF | 12:0071cb144c7a | 310 | |
JMF | 12:0071cb144c7a | 311 | for( i = 0; i < dlen; i += 16 ) |
JMF | 12:0071cb144c7a | 312 | { |
JMF | 12:0071cb144c7a | 313 | mbedtls_md_hmac_reset ( &md_ctx ); |
JMF | 12:0071cb144c7a | 314 | mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb ); |
JMF | 12:0071cb144c7a | 315 | mbedtls_md_hmac_finish( &md_ctx, h_i ); |
JMF | 12:0071cb144c7a | 316 | |
JMF | 12:0071cb144c7a | 317 | mbedtls_md_hmac_reset ( &md_ctx ); |
JMF | 12:0071cb144c7a | 318 | mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 ); |
JMF | 12:0071cb144c7a | 319 | mbedtls_md_hmac_finish( &md_ctx, 4 + tmp ); |
JMF | 12:0071cb144c7a | 320 | |
JMF | 12:0071cb144c7a | 321 | k = ( i + 16 > dlen ) ? dlen % 16 : 16; |
JMF | 12:0071cb144c7a | 322 | |
JMF | 12:0071cb144c7a | 323 | for( j = 0; j < k; j++ ) |
JMF | 12:0071cb144c7a | 324 | dstbuf[i + j] = h_i[j]; |
JMF | 12:0071cb144c7a | 325 | } |
JMF | 12:0071cb144c7a | 326 | |
JMF | 12:0071cb144c7a | 327 | mbedtls_md_free( &md_ctx ); |
JMF | 12:0071cb144c7a | 328 | |
JMF | 12:0071cb144c7a | 329 | /* |
JMF | 12:0071cb144c7a | 330 | * XOR out with P_sha1(secret,label+random)[0..dlen] |
JMF | 12:0071cb144c7a | 331 | */ |
JMF | 12:0071cb144c7a | 332 | if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) == NULL ) |
JMF | 12:0071cb144c7a | 333 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 334 | |
JMF | 12:0071cb144c7a | 335 | if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 ) |
JMF | 12:0071cb144c7a | 336 | return( ret ); |
JMF | 12:0071cb144c7a | 337 | |
JMF | 12:0071cb144c7a | 338 | mbedtls_md_hmac_starts( &md_ctx, S2, hs ); |
JMF | 12:0071cb144c7a | 339 | mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb ); |
JMF | 12:0071cb144c7a | 340 | mbedtls_md_hmac_finish( &md_ctx, tmp ); |
JMF | 12:0071cb144c7a | 341 | |
JMF | 12:0071cb144c7a | 342 | for( i = 0; i < dlen; i += 20 ) |
JMF | 12:0071cb144c7a | 343 | { |
JMF | 12:0071cb144c7a | 344 | mbedtls_md_hmac_reset ( &md_ctx ); |
JMF | 12:0071cb144c7a | 345 | mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb ); |
JMF | 12:0071cb144c7a | 346 | mbedtls_md_hmac_finish( &md_ctx, h_i ); |
JMF | 12:0071cb144c7a | 347 | |
JMF | 12:0071cb144c7a | 348 | mbedtls_md_hmac_reset ( &md_ctx ); |
JMF | 12:0071cb144c7a | 349 | mbedtls_md_hmac_update( &md_ctx, tmp, 20 ); |
JMF | 12:0071cb144c7a | 350 | mbedtls_md_hmac_finish( &md_ctx, tmp ); |
JMF | 12:0071cb144c7a | 351 | |
JMF | 12:0071cb144c7a | 352 | k = ( i + 20 > dlen ) ? dlen % 20 : 20; |
JMF | 12:0071cb144c7a | 353 | |
JMF | 12:0071cb144c7a | 354 | for( j = 0; j < k; j++ ) |
JMF | 12:0071cb144c7a | 355 | dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] ); |
JMF | 12:0071cb144c7a | 356 | } |
JMF | 12:0071cb144c7a | 357 | |
JMF | 12:0071cb144c7a | 358 | mbedtls_md_free( &md_ctx ); |
JMF | 12:0071cb144c7a | 359 | |
JMF | 12:0071cb144c7a | 360 | mbedtls_zeroize( tmp, sizeof( tmp ) ); |
JMF | 12:0071cb144c7a | 361 | mbedtls_zeroize( h_i, sizeof( h_i ) ); |
JMF | 12:0071cb144c7a | 362 | |
JMF | 12:0071cb144c7a | 363 | return( 0 ); |
JMF | 12:0071cb144c7a | 364 | } |
JMF | 12:0071cb144c7a | 365 | #endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */ |
JMF | 12:0071cb144c7a | 366 | |
JMF | 12:0071cb144c7a | 367 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 368 | static int tls_prf_generic( mbedtls_md_type_t md_type, |
JMF | 12:0071cb144c7a | 369 | const unsigned char *secret, size_t slen, |
JMF | 12:0071cb144c7a | 370 | const char *label, |
JMF | 12:0071cb144c7a | 371 | const unsigned char *random, size_t rlen, |
JMF | 12:0071cb144c7a | 372 | unsigned char *dstbuf, size_t dlen ) |
JMF | 12:0071cb144c7a | 373 | { |
JMF | 12:0071cb144c7a | 374 | size_t nb; |
JMF | 12:0071cb144c7a | 375 | size_t i, j, k, md_len; |
JMF | 12:0071cb144c7a | 376 | unsigned char tmp[128]; |
JMF | 12:0071cb144c7a | 377 | unsigned char h_i[MBEDTLS_MD_MAX_SIZE]; |
JMF | 12:0071cb144c7a | 378 | const mbedtls_md_info_t *md_info; |
JMF | 12:0071cb144c7a | 379 | mbedtls_md_context_t md_ctx; |
JMF | 12:0071cb144c7a | 380 | int ret; |
JMF | 12:0071cb144c7a | 381 | |
JMF | 12:0071cb144c7a | 382 | mbedtls_md_init( &md_ctx ); |
JMF | 12:0071cb144c7a | 383 | |
JMF | 12:0071cb144c7a | 384 | if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL ) |
JMF | 12:0071cb144c7a | 385 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 386 | |
JMF | 12:0071cb144c7a | 387 | md_len = mbedtls_md_get_size( md_info ); |
JMF | 12:0071cb144c7a | 388 | |
JMF | 12:0071cb144c7a | 389 | if( sizeof( tmp ) < md_len + strlen( label ) + rlen ) |
JMF | 12:0071cb144c7a | 390 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 391 | |
JMF | 12:0071cb144c7a | 392 | nb = strlen( label ); |
JMF | 12:0071cb144c7a | 393 | memcpy( tmp + md_len, label, nb ); |
JMF | 12:0071cb144c7a | 394 | memcpy( tmp + md_len + nb, random, rlen ); |
JMF | 12:0071cb144c7a | 395 | nb += rlen; |
JMF | 12:0071cb144c7a | 396 | |
JMF | 12:0071cb144c7a | 397 | /* |
JMF | 12:0071cb144c7a | 398 | * Compute P_<hash>(secret, label + random)[0..dlen] |
JMF | 12:0071cb144c7a | 399 | */ |
JMF | 12:0071cb144c7a | 400 | if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 ) |
JMF | 12:0071cb144c7a | 401 | return( ret ); |
JMF | 12:0071cb144c7a | 402 | |
JMF | 12:0071cb144c7a | 403 | mbedtls_md_hmac_starts( &md_ctx, secret, slen ); |
JMF | 12:0071cb144c7a | 404 | mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb ); |
JMF | 12:0071cb144c7a | 405 | mbedtls_md_hmac_finish( &md_ctx, tmp ); |
JMF | 12:0071cb144c7a | 406 | |
JMF | 12:0071cb144c7a | 407 | for( i = 0; i < dlen; i += md_len ) |
JMF | 12:0071cb144c7a | 408 | { |
JMF | 12:0071cb144c7a | 409 | mbedtls_md_hmac_reset ( &md_ctx ); |
JMF | 12:0071cb144c7a | 410 | mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb ); |
JMF | 12:0071cb144c7a | 411 | mbedtls_md_hmac_finish( &md_ctx, h_i ); |
JMF | 12:0071cb144c7a | 412 | |
JMF | 12:0071cb144c7a | 413 | mbedtls_md_hmac_reset ( &md_ctx ); |
JMF | 12:0071cb144c7a | 414 | mbedtls_md_hmac_update( &md_ctx, tmp, md_len ); |
JMF | 12:0071cb144c7a | 415 | mbedtls_md_hmac_finish( &md_ctx, tmp ); |
JMF | 12:0071cb144c7a | 416 | |
JMF | 12:0071cb144c7a | 417 | k = ( i + md_len > dlen ) ? dlen % md_len : md_len; |
JMF | 12:0071cb144c7a | 418 | |
JMF | 12:0071cb144c7a | 419 | for( j = 0; j < k; j++ ) |
JMF | 12:0071cb144c7a | 420 | dstbuf[i + j] = h_i[j]; |
JMF | 12:0071cb144c7a | 421 | } |
JMF | 12:0071cb144c7a | 422 | |
JMF | 12:0071cb144c7a | 423 | mbedtls_md_free( &md_ctx ); |
JMF | 12:0071cb144c7a | 424 | |
JMF | 12:0071cb144c7a | 425 | mbedtls_zeroize( tmp, sizeof( tmp ) ); |
JMF | 12:0071cb144c7a | 426 | mbedtls_zeroize( h_i, sizeof( h_i ) ); |
JMF | 12:0071cb144c7a | 427 | |
JMF | 12:0071cb144c7a | 428 | return( 0 ); |
JMF | 12:0071cb144c7a | 429 | } |
JMF | 12:0071cb144c7a | 430 | |
JMF | 12:0071cb144c7a | 431 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 432 | static int tls_prf_sha256( const unsigned char *secret, size_t slen, |
JMF | 12:0071cb144c7a | 433 | const char *label, |
JMF | 12:0071cb144c7a | 434 | const unsigned char *random, size_t rlen, |
JMF | 12:0071cb144c7a | 435 | unsigned char *dstbuf, size_t dlen ) |
JMF | 12:0071cb144c7a | 436 | { |
JMF | 12:0071cb144c7a | 437 | return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen, |
JMF | 12:0071cb144c7a | 438 | label, random, rlen, dstbuf, dlen ) ); |
JMF | 12:0071cb144c7a | 439 | } |
JMF | 12:0071cb144c7a | 440 | #endif /* MBEDTLS_SHA256_C */ |
JMF | 12:0071cb144c7a | 441 | |
JMF | 12:0071cb144c7a | 442 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 443 | static int tls_prf_sha384( const unsigned char *secret, size_t slen, |
JMF | 12:0071cb144c7a | 444 | const char *label, |
JMF | 12:0071cb144c7a | 445 | const unsigned char *random, size_t rlen, |
JMF | 12:0071cb144c7a | 446 | unsigned char *dstbuf, size_t dlen ) |
JMF | 12:0071cb144c7a | 447 | { |
JMF | 12:0071cb144c7a | 448 | return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen, |
JMF | 12:0071cb144c7a | 449 | label, random, rlen, dstbuf, dlen ) ); |
JMF | 12:0071cb144c7a | 450 | } |
JMF | 12:0071cb144c7a | 451 | #endif /* MBEDTLS_SHA512_C */ |
JMF | 12:0071cb144c7a | 452 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 453 | |
JMF | 12:0071cb144c7a | 454 | static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t ); |
JMF | 12:0071cb144c7a | 455 | |
JMF | 12:0071cb144c7a | 456 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
JMF | 12:0071cb144c7a | 457 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
JMF | 12:0071cb144c7a | 458 | static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *, const unsigned char *, size_t ); |
JMF | 12:0071cb144c7a | 459 | #endif |
JMF | 12:0071cb144c7a | 460 | |
JMF | 12:0071cb144c7a | 461 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 462 | static void ssl_calc_verify_ssl( mbedtls_ssl_context *, unsigned char * ); |
JMF | 12:0071cb144c7a | 463 | static void ssl_calc_finished_ssl( mbedtls_ssl_context *, unsigned char *, int ); |
JMF | 12:0071cb144c7a | 464 | #endif |
JMF | 12:0071cb144c7a | 465 | |
JMF | 12:0071cb144c7a | 466 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) |
JMF | 12:0071cb144c7a | 467 | static void ssl_calc_verify_tls( mbedtls_ssl_context *, unsigned char * ); |
JMF | 12:0071cb144c7a | 468 | static void ssl_calc_finished_tls( mbedtls_ssl_context *, unsigned char *, int ); |
JMF | 12:0071cb144c7a | 469 | #endif |
JMF | 12:0071cb144c7a | 470 | |
JMF | 12:0071cb144c7a | 471 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 472 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 473 | static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t ); |
JMF | 12:0071cb144c7a | 474 | static void ssl_calc_verify_tls_sha256( mbedtls_ssl_context *,unsigned char * ); |
JMF | 12:0071cb144c7a | 475 | static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int ); |
JMF | 12:0071cb144c7a | 476 | #endif |
JMF | 12:0071cb144c7a | 477 | |
JMF | 12:0071cb144c7a | 478 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 479 | static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t ); |
JMF | 12:0071cb144c7a | 480 | static void ssl_calc_verify_tls_sha384( mbedtls_ssl_context *, unsigned char * ); |
JMF | 12:0071cb144c7a | 481 | static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int ); |
JMF | 12:0071cb144c7a | 482 | #endif |
JMF | 12:0071cb144c7a | 483 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 484 | |
JMF | 12:0071cb144c7a | 485 | int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 486 | { |
JMF | 12:0071cb144c7a | 487 | int ret = 0; |
JMF | 12:0071cb144c7a | 488 | unsigned char tmp[64]; |
JMF | 12:0071cb144c7a | 489 | unsigned char keyblk[256]; |
JMF | 12:0071cb144c7a | 490 | unsigned char *key1; |
JMF | 12:0071cb144c7a | 491 | unsigned char *key2; |
JMF | 12:0071cb144c7a | 492 | unsigned char *mac_enc; |
JMF | 12:0071cb144c7a | 493 | unsigned char *mac_dec; |
JMF | 12:0071cb144c7a | 494 | size_t iv_copy_len; |
JMF | 12:0071cb144c7a | 495 | const mbedtls_cipher_info_t *cipher_info; |
JMF | 12:0071cb144c7a | 496 | const mbedtls_md_info_t *md_info; |
JMF | 12:0071cb144c7a | 497 | |
JMF | 12:0071cb144c7a | 498 | mbedtls_ssl_session *session = ssl->session_negotiate; |
JMF | 12:0071cb144c7a | 499 | mbedtls_ssl_transform *transform = ssl->transform_negotiate; |
JMF | 12:0071cb144c7a | 500 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
JMF | 12:0071cb144c7a | 501 | |
JMF | 12:0071cb144c7a | 502 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) ); |
JMF | 12:0071cb144c7a | 503 | |
JMF | 12:0071cb144c7a | 504 | cipher_info = mbedtls_cipher_info_from_type( transform->ciphersuite_info->cipher ); |
JMF | 12:0071cb144c7a | 505 | if( cipher_info == NULL ) |
JMF | 12:0071cb144c7a | 506 | { |
JMF | 12:0071cb144c7a | 507 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %d not found", |
JMF | 12:0071cb144c7a | 508 | transform->ciphersuite_info->cipher ) ); |
JMF | 12:0071cb144c7a | 509 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 510 | } |
JMF | 12:0071cb144c7a | 511 | |
JMF | 12:0071cb144c7a | 512 | md_info = mbedtls_md_info_from_type( transform->ciphersuite_info->mac ); |
JMF | 12:0071cb144c7a | 513 | if( md_info == NULL ) |
JMF | 12:0071cb144c7a | 514 | { |
JMF | 12:0071cb144c7a | 515 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %d not found", |
JMF | 12:0071cb144c7a | 516 | transform->ciphersuite_info->mac ) ); |
JMF | 12:0071cb144c7a | 517 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 518 | } |
JMF | 12:0071cb144c7a | 519 | |
JMF | 12:0071cb144c7a | 520 | /* |
JMF | 12:0071cb144c7a | 521 | * Set appropriate PRF function and other SSL / TLS / TLS1.2 functions |
JMF | 12:0071cb144c7a | 522 | */ |
JMF | 12:0071cb144c7a | 523 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 524 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
JMF | 12:0071cb144c7a | 525 | { |
JMF | 12:0071cb144c7a | 526 | handshake->tls_prf = ssl3_prf; |
JMF | 12:0071cb144c7a | 527 | handshake->calc_verify = ssl_calc_verify_ssl; |
JMF | 12:0071cb144c7a | 528 | handshake->calc_finished = ssl_calc_finished_ssl; |
JMF | 12:0071cb144c7a | 529 | } |
JMF | 12:0071cb144c7a | 530 | else |
JMF | 12:0071cb144c7a | 531 | #endif |
JMF | 12:0071cb144c7a | 532 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) |
JMF | 12:0071cb144c7a | 533 | if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ) |
JMF | 12:0071cb144c7a | 534 | { |
JMF | 12:0071cb144c7a | 535 | handshake->tls_prf = tls1_prf; |
JMF | 12:0071cb144c7a | 536 | handshake->calc_verify = ssl_calc_verify_tls; |
JMF | 12:0071cb144c7a | 537 | handshake->calc_finished = ssl_calc_finished_tls; |
JMF | 12:0071cb144c7a | 538 | } |
JMF | 12:0071cb144c7a | 539 | else |
JMF | 12:0071cb144c7a | 540 | #endif |
JMF | 12:0071cb144c7a | 541 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 542 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 543 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 && |
JMF | 12:0071cb144c7a | 544 | transform->ciphersuite_info->mac == MBEDTLS_MD_SHA384 ) |
JMF | 12:0071cb144c7a | 545 | { |
JMF | 12:0071cb144c7a | 546 | handshake->tls_prf = tls_prf_sha384; |
JMF | 12:0071cb144c7a | 547 | handshake->calc_verify = ssl_calc_verify_tls_sha384; |
JMF | 12:0071cb144c7a | 548 | handshake->calc_finished = ssl_calc_finished_tls_sha384; |
JMF | 12:0071cb144c7a | 549 | } |
JMF | 12:0071cb144c7a | 550 | else |
JMF | 12:0071cb144c7a | 551 | #endif |
JMF | 12:0071cb144c7a | 552 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 553 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) |
JMF | 12:0071cb144c7a | 554 | { |
JMF | 12:0071cb144c7a | 555 | handshake->tls_prf = tls_prf_sha256; |
JMF | 12:0071cb144c7a | 556 | handshake->calc_verify = ssl_calc_verify_tls_sha256; |
JMF | 12:0071cb144c7a | 557 | handshake->calc_finished = ssl_calc_finished_tls_sha256; |
JMF | 12:0071cb144c7a | 558 | } |
JMF | 12:0071cb144c7a | 559 | else |
JMF | 12:0071cb144c7a | 560 | #endif |
JMF | 12:0071cb144c7a | 561 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 562 | { |
JMF | 12:0071cb144c7a | 563 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 564 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 565 | } |
JMF | 12:0071cb144c7a | 566 | |
JMF | 12:0071cb144c7a | 567 | /* |
JMF | 12:0071cb144c7a | 568 | * SSLv3: |
JMF | 12:0071cb144c7a | 569 | * master = |
JMF | 12:0071cb144c7a | 570 | * MD5( premaster + SHA1( 'A' + premaster + randbytes ) ) + |
JMF | 12:0071cb144c7a | 571 | * MD5( premaster + SHA1( 'BB' + premaster + randbytes ) ) + |
JMF | 12:0071cb144c7a | 572 | * MD5( premaster + SHA1( 'CCC' + premaster + randbytes ) ) |
JMF | 12:0071cb144c7a | 573 | * |
JMF | 12:0071cb144c7a | 574 | * TLSv1+: |
JMF | 12:0071cb144c7a | 575 | * master = PRF( premaster, "master secret", randbytes )[0..47] |
JMF | 12:0071cb144c7a | 576 | */ |
JMF | 12:0071cb144c7a | 577 | if( handshake->resume == 0 ) |
JMF | 12:0071cb144c7a | 578 | { |
JMF | 12:0071cb144c7a | 579 | MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret", handshake->premaster, |
JMF | 12:0071cb144c7a | 580 | handshake->pmslen ); |
JMF | 12:0071cb144c7a | 581 | |
JMF | 12:0071cb144c7a | 582 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
JMF | 12:0071cb144c7a | 583 | if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED ) |
JMF | 12:0071cb144c7a | 584 | { |
JMF | 12:0071cb144c7a | 585 | unsigned char session_hash[48]; |
JMF | 12:0071cb144c7a | 586 | size_t hash_len; |
JMF | 12:0071cb144c7a | 587 | |
JMF | 12:0071cb144c7a | 588 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "using extended master secret" ) ); |
JMF | 12:0071cb144c7a | 589 | |
JMF | 12:0071cb144c7a | 590 | ssl->handshake->calc_verify( ssl, session_hash ); |
JMF | 12:0071cb144c7a | 591 | |
JMF | 12:0071cb144c7a | 592 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 593 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) |
JMF | 12:0071cb144c7a | 594 | { |
JMF | 12:0071cb144c7a | 595 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 596 | if( ssl->transform_negotiate->ciphersuite_info->mac == |
JMF | 12:0071cb144c7a | 597 | MBEDTLS_MD_SHA384 ) |
JMF | 12:0071cb144c7a | 598 | { |
JMF | 12:0071cb144c7a | 599 | hash_len = 48; |
JMF | 12:0071cb144c7a | 600 | } |
JMF | 12:0071cb144c7a | 601 | else |
JMF | 12:0071cb144c7a | 602 | #endif |
JMF | 12:0071cb144c7a | 603 | hash_len = 32; |
JMF | 12:0071cb144c7a | 604 | } |
JMF | 12:0071cb144c7a | 605 | else |
JMF | 12:0071cb144c7a | 606 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 607 | hash_len = 36; |
JMF | 12:0071cb144c7a | 608 | |
JMF | 12:0071cb144c7a | 609 | MBEDTLS_SSL_DEBUG_BUF( 3, "session hash", session_hash, hash_len ); |
JMF | 12:0071cb144c7a | 610 | |
JMF | 12:0071cb144c7a | 611 | ret = handshake->tls_prf( handshake->premaster, handshake->pmslen, |
JMF | 12:0071cb144c7a | 612 | "extended master secret", |
JMF | 12:0071cb144c7a | 613 | session_hash, hash_len, |
JMF | 12:0071cb144c7a | 614 | session->master, 48 ); |
JMF | 12:0071cb144c7a | 615 | if( ret != 0 ) |
JMF | 12:0071cb144c7a | 616 | { |
JMF | 12:0071cb144c7a | 617 | MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret ); |
JMF | 12:0071cb144c7a | 618 | return( ret ); |
JMF | 12:0071cb144c7a | 619 | } |
JMF | 12:0071cb144c7a | 620 | |
JMF | 12:0071cb144c7a | 621 | } |
JMF | 12:0071cb144c7a | 622 | else |
JMF | 12:0071cb144c7a | 623 | #endif |
JMF | 12:0071cb144c7a | 624 | ret = handshake->tls_prf( handshake->premaster, handshake->pmslen, |
JMF | 12:0071cb144c7a | 625 | "master secret", |
JMF | 12:0071cb144c7a | 626 | handshake->randbytes, 64, |
JMF | 12:0071cb144c7a | 627 | session->master, 48 ); |
JMF | 12:0071cb144c7a | 628 | if( ret != 0 ) |
JMF | 12:0071cb144c7a | 629 | { |
JMF | 12:0071cb144c7a | 630 | MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret ); |
JMF | 12:0071cb144c7a | 631 | return( ret ); |
JMF | 12:0071cb144c7a | 632 | } |
JMF | 12:0071cb144c7a | 633 | |
JMF | 12:0071cb144c7a | 634 | mbedtls_zeroize( handshake->premaster, sizeof(handshake->premaster) ); |
JMF | 12:0071cb144c7a | 635 | } |
JMF | 12:0071cb144c7a | 636 | else |
JMF | 12:0071cb144c7a | 637 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) ); |
JMF | 12:0071cb144c7a | 638 | |
JMF | 12:0071cb144c7a | 639 | /* |
JMF | 12:0071cb144c7a | 640 | * Swap the client and server random values. |
JMF | 12:0071cb144c7a | 641 | */ |
JMF | 12:0071cb144c7a | 642 | memcpy( tmp, handshake->randbytes, 64 ); |
JMF | 12:0071cb144c7a | 643 | memcpy( handshake->randbytes, tmp + 32, 32 ); |
JMF | 12:0071cb144c7a | 644 | memcpy( handshake->randbytes + 32, tmp, 32 ); |
JMF | 12:0071cb144c7a | 645 | mbedtls_zeroize( tmp, sizeof( tmp ) ); |
JMF | 12:0071cb144c7a | 646 | |
JMF | 12:0071cb144c7a | 647 | /* |
JMF | 12:0071cb144c7a | 648 | * SSLv3: |
JMF | 12:0071cb144c7a | 649 | * key block = |
JMF | 12:0071cb144c7a | 650 | * MD5( master + SHA1( 'A' + master + randbytes ) ) + |
JMF | 12:0071cb144c7a | 651 | * MD5( master + SHA1( 'BB' + master + randbytes ) ) + |
JMF | 12:0071cb144c7a | 652 | * MD5( master + SHA1( 'CCC' + master + randbytes ) ) + |
JMF | 12:0071cb144c7a | 653 | * MD5( master + SHA1( 'DDDD' + master + randbytes ) ) + |
JMF | 12:0071cb144c7a | 654 | * ... |
JMF | 12:0071cb144c7a | 655 | * |
JMF | 12:0071cb144c7a | 656 | * TLSv1: |
JMF | 12:0071cb144c7a | 657 | * key block = PRF( master, "key expansion", randbytes ) |
JMF | 12:0071cb144c7a | 658 | */ |
JMF | 12:0071cb144c7a | 659 | ret = handshake->tls_prf( session->master, 48, "key expansion", |
JMF | 12:0071cb144c7a | 660 | handshake->randbytes, 64, keyblk, 256 ); |
JMF | 12:0071cb144c7a | 661 | if( ret != 0 ) |
JMF | 12:0071cb144c7a | 662 | { |
JMF | 12:0071cb144c7a | 663 | MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret ); |
JMF | 12:0071cb144c7a | 664 | return( ret ); |
JMF | 12:0071cb144c7a | 665 | } |
JMF | 12:0071cb144c7a | 666 | |
JMF | 12:0071cb144c7a | 667 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s", |
JMF | 12:0071cb144c7a | 668 | mbedtls_ssl_get_ciphersuite_name( session->ciphersuite ) ) ); |
JMF | 12:0071cb144c7a | 669 | MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", session->master, 48 ); |
JMF | 12:0071cb144c7a | 670 | MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", handshake->randbytes, 64 ); |
JMF | 12:0071cb144c7a | 671 | MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 ); |
JMF | 12:0071cb144c7a | 672 | |
JMF | 12:0071cb144c7a | 673 | mbedtls_zeroize( handshake->randbytes, sizeof( handshake->randbytes ) ); |
JMF | 12:0071cb144c7a | 674 | |
JMF | 12:0071cb144c7a | 675 | /* |
JMF | 12:0071cb144c7a | 676 | * Determine the appropriate key, IV and MAC length. |
JMF | 12:0071cb144c7a | 677 | */ |
JMF | 12:0071cb144c7a | 678 | |
JMF | 12:0071cb144c7a | 679 | transform->keylen = cipher_info->key_bitlen / 8; |
JMF | 12:0071cb144c7a | 680 | |
JMF | 12:0071cb144c7a | 681 | if( cipher_info->mode == MBEDTLS_MODE_GCM || |
JMF | 12:0071cb144c7a | 682 | cipher_info->mode == MBEDTLS_MODE_CCM ) |
JMF | 12:0071cb144c7a | 683 | { |
JMF | 12:0071cb144c7a | 684 | transform->maclen = 0; |
JMF | 12:0071cb144c7a | 685 | |
JMF | 12:0071cb144c7a | 686 | transform->ivlen = 12; |
JMF | 12:0071cb144c7a | 687 | transform->fixed_ivlen = 4; |
JMF | 12:0071cb144c7a | 688 | |
JMF | 12:0071cb144c7a | 689 | /* Minimum length is expicit IV + tag */ |
JMF | 12:0071cb144c7a | 690 | transform->minlen = transform->ivlen - transform->fixed_ivlen |
JMF | 12:0071cb144c7a | 691 | + ( transform->ciphersuite_info->flags & |
JMF | 12:0071cb144c7a | 692 | MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16 ); |
JMF | 12:0071cb144c7a | 693 | } |
JMF | 12:0071cb144c7a | 694 | else |
JMF | 12:0071cb144c7a | 695 | { |
JMF | 12:0071cb144c7a | 696 | /* Initialize HMAC contexts */ |
JMF | 12:0071cb144c7a | 697 | if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 || |
JMF | 12:0071cb144c7a | 698 | ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 ) |
JMF | 12:0071cb144c7a | 699 | { |
JMF | 12:0071cb144c7a | 700 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret ); |
JMF | 12:0071cb144c7a | 701 | return( ret ); |
JMF | 12:0071cb144c7a | 702 | } |
JMF | 12:0071cb144c7a | 703 | |
JMF | 12:0071cb144c7a | 704 | /* Get MAC length */ |
JMF | 12:0071cb144c7a | 705 | transform->maclen = mbedtls_md_get_size( md_info ); |
JMF | 12:0071cb144c7a | 706 | |
JMF | 12:0071cb144c7a | 707 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
JMF | 12:0071cb144c7a | 708 | /* |
JMF | 12:0071cb144c7a | 709 | * If HMAC is to be truncated, we shall keep the leftmost bytes, |
JMF | 12:0071cb144c7a | 710 | * (rfc 6066 page 13 or rfc 2104 section 4), |
JMF | 12:0071cb144c7a | 711 | * so we only need to adjust the length here. |
JMF | 12:0071cb144c7a | 712 | */ |
JMF | 12:0071cb144c7a | 713 | if( session->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED ) |
JMF | 12:0071cb144c7a | 714 | transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN; |
JMF | 12:0071cb144c7a | 715 | #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ |
JMF | 12:0071cb144c7a | 716 | |
JMF | 12:0071cb144c7a | 717 | /* IV length */ |
JMF | 12:0071cb144c7a | 718 | transform->ivlen = cipher_info->iv_size; |
JMF | 12:0071cb144c7a | 719 | |
JMF | 12:0071cb144c7a | 720 | /* Minimum length */ |
JMF | 12:0071cb144c7a | 721 | if( cipher_info->mode == MBEDTLS_MODE_STREAM ) |
JMF | 12:0071cb144c7a | 722 | transform->minlen = transform->maclen; |
JMF | 12:0071cb144c7a | 723 | else |
JMF | 12:0071cb144c7a | 724 | { |
JMF | 12:0071cb144c7a | 725 | /* |
JMF | 12:0071cb144c7a | 726 | * GenericBlockCipher: |
JMF | 12:0071cb144c7a | 727 | * 1. if EtM is in use: one block plus MAC |
JMF | 12:0071cb144c7a | 728 | * otherwise: * first multiple of blocklen greater than maclen |
JMF | 12:0071cb144c7a | 729 | * 2. IV except for SSL3 and TLS 1.0 |
JMF | 12:0071cb144c7a | 730 | */ |
JMF | 12:0071cb144c7a | 731 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
JMF | 12:0071cb144c7a | 732 | if( session->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED ) |
JMF | 12:0071cb144c7a | 733 | { |
JMF | 12:0071cb144c7a | 734 | transform->minlen = transform->maclen |
JMF | 12:0071cb144c7a | 735 | + cipher_info->block_size; |
JMF | 12:0071cb144c7a | 736 | } |
JMF | 12:0071cb144c7a | 737 | else |
JMF | 12:0071cb144c7a | 738 | #endif |
JMF | 12:0071cb144c7a | 739 | { |
JMF | 12:0071cb144c7a | 740 | transform->minlen = transform->maclen |
JMF | 12:0071cb144c7a | 741 | + cipher_info->block_size |
JMF | 12:0071cb144c7a | 742 | - transform->maclen % cipher_info->block_size; |
JMF | 12:0071cb144c7a | 743 | } |
JMF | 12:0071cb144c7a | 744 | |
JMF | 12:0071cb144c7a | 745 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) |
JMF | 12:0071cb144c7a | 746 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 || |
JMF | 12:0071cb144c7a | 747 | ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_1 ) |
JMF | 12:0071cb144c7a | 748 | ; /* No need to adjust minlen */ |
JMF | 12:0071cb144c7a | 749 | else |
JMF | 12:0071cb144c7a | 750 | #endif |
JMF | 12:0071cb144c7a | 751 | #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 752 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_2 || |
JMF | 12:0071cb144c7a | 753 | ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) |
JMF | 12:0071cb144c7a | 754 | { |
JMF | 12:0071cb144c7a | 755 | transform->minlen += transform->ivlen; |
JMF | 12:0071cb144c7a | 756 | } |
JMF | 12:0071cb144c7a | 757 | else |
JMF | 12:0071cb144c7a | 758 | #endif |
JMF | 12:0071cb144c7a | 759 | { |
JMF | 12:0071cb144c7a | 760 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 761 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 762 | } |
JMF | 12:0071cb144c7a | 763 | } |
JMF | 12:0071cb144c7a | 764 | } |
JMF | 12:0071cb144c7a | 765 | |
JMF | 12:0071cb144c7a | 766 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %d, minlen: %d, ivlen: %d, maclen: %d", |
JMF | 12:0071cb144c7a | 767 | transform->keylen, transform->minlen, transform->ivlen, |
JMF | 12:0071cb144c7a | 768 | transform->maclen ) ); |
JMF | 12:0071cb144c7a | 769 | |
JMF | 12:0071cb144c7a | 770 | /* |
JMF | 12:0071cb144c7a | 771 | * Finally setup the cipher contexts, IVs and MAC secrets. |
JMF | 12:0071cb144c7a | 772 | */ |
JMF | 12:0071cb144c7a | 773 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 774 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 775 | { |
JMF | 12:0071cb144c7a | 776 | key1 = keyblk + transform->maclen * 2; |
JMF | 12:0071cb144c7a | 777 | key2 = keyblk + transform->maclen * 2 + transform->keylen; |
JMF | 12:0071cb144c7a | 778 | |
JMF | 12:0071cb144c7a | 779 | mac_enc = keyblk; |
JMF | 12:0071cb144c7a | 780 | mac_dec = keyblk + transform->maclen; |
JMF | 12:0071cb144c7a | 781 | |
JMF | 12:0071cb144c7a | 782 | /* |
JMF | 12:0071cb144c7a | 783 | * This is not used in TLS v1.1. |
JMF | 12:0071cb144c7a | 784 | */ |
JMF | 12:0071cb144c7a | 785 | iv_copy_len = ( transform->fixed_ivlen ) ? |
JMF | 12:0071cb144c7a | 786 | transform->fixed_ivlen : transform->ivlen; |
JMF | 12:0071cb144c7a | 787 | memcpy( transform->iv_enc, key2 + transform->keylen, iv_copy_len ); |
JMF | 12:0071cb144c7a | 788 | memcpy( transform->iv_dec, key2 + transform->keylen + iv_copy_len, |
JMF | 12:0071cb144c7a | 789 | iv_copy_len ); |
JMF | 12:0071cb144c7a | 790 | } |
JMF | 12:0071cb144c7a | 791 | else |
JMF | 12:0071cb144c7a | 792 | #endif /* MBEDTLS_SSL_CLI_C */ |
JMF | 12:0071cb144c7a | 793 | #if defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 794 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) |
JMF | 12:0071cb144c7a | 795 | { |
JMF | 12:0071cb144c7a | 796 | key1 = keyblk + transform->maclen * 2 + transform->keylen; |
JMF | 12:0071cb144c7a | 797 | key2 = keyblk + transform->maclen * 2; |
JMF | 12:0071cb144c7a | 798 | |
JMF | 12:0071cb144c7a | 799 | mac_enc = keyblk + transform->maclen; |
JMF | 12:0071cb144c7a | 800 | mac_dec = keyblk; |
JMF | 12:0071cb144c7a | 801 | |
JMF | 12:0071cb144c7a | 802 | /* |
JMF | 12:0071cb144c7a | 803 | * This is not used in TLS v1.1. |
JMF | 12:0071cb144c7a | 804 | */ |
JMF | 12:0071cb144c7a | 805 | iv_copy_len = ( transform->fixed_ivlen ) ? |
JMF | 12:0071cb144c7a | 806 | transform->fixed_ivlen : transform->ivlen; |
JMF | 12:0071cb144c7a | 807 | memcpy( transform->iv_dec, key1 + transform->keylen, iv_copy_len ); |
JMF | 12:0071cb144c7a | 808 | memcpy( transform->iv_enc, key1 + transform->keylen + iv_copy_len, |
JMF | 12:0071cb144c7a | 809 | iv_copy_len ); |
JMF | 12:0071cb144c7a | 810 | } |
JMF | 12:0071cb144c7a | 811 | else |
JMF | 12:0071cb144c7a | 812 | #endif /* MBEDTLS_SSL_SRV_C */ |
JMF | 12:0071cb144c7a | 813 | { |
JMF | 12:0071cb144c7a | 814 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 815 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 816 | } |
JMF | 12:0071cb144c7a | 817 | |
JMF | 12:0071cb144c7a | 818 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 819 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
JMF | 12:0071cb144c7a | 820 | { |
JMF | 12:0071cb144c7a | 821 | if( transform->maclen > sizeof transform->mac_enc ) |
JMF | 12:0071cb144c7a | 822 | { |
JMF | 12:0071cb144c7a | 823 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 824 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 825 | } |
JMF | 12:0071cb144c7a | 826 | |
JMF | 12:0071cb144c7a | 827 | memcpy( transform->mac_enc, mac_enc, transform->maclen ); |
JMF | 12:0071cb144c7a | 828 | memcpy( transform->mac_dec, mac_dec, transform->maclen ); |
JMF | 12:0071cb144c7a | 829 | } |
JMF | 12:0071cb144c7a | 830 | else |
JMF | 12:0071cb144c7a | 831 | #endif /* MBEDTLS_SSL_PROTO_SSL3 */ |
JMF | 12:0071cb144c7a | 832 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
JMF | 12:0071cb144c7a | 833 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 834 | if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 ) |
JMF | 12:0071cb144c7a | 835 | { |
JMF | 12:0071cb144c7a | 836 | mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, transform->maclen ); |
JMF | 12:0071cb144c7a | 837 | mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, transform->maclen ); |
JMF | 12:0071cb144c7a | 838 | } |
JMF | 12:0071cb144c7a | 839 | else |
JMF | 12:0071cb144c7a | 840 | #endif |
JMF | 12:0071cb144c7a | 841 | { |
JMF | 12:0071cb144c7a | 842 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 843 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 844 | } |
JMF | 12:0071cb144c7a | 845 | |
JMF | 12:0071cb144c7a | 846 | #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) |
JMF | 12:0071cb144c7a | 847 | if( mbedtls_ssl_hw_record_init != NULL ) |
JMF | 12:0071cb144c7a | 848 | { |
JMF | 12:0071cb144c7a | 849 | int ret = 0; |
JMF | 12:0071cb144c7a | 850 | |
JMF | 12:0071cb144c7a | 851 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) ); |
JMF | 12:0071cb144c7a | 852 | |
JMF | 12:0071cb144c7a | 853 | if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, transform->keylen, |
JMF | 12:0071cb144c7a | 854 | transform->iv_enc, transform->iv_dec, |
JMF | 12:0071cb144c7a | 855 | iv_copy_len, |
JMF | 12:0071cb144c7a | 856 | mac_enc, mac_dec, |
JMF | 12:0071cb144c7a | 857 | transform->maclen ) ) != 0 ) |
JMF | 12:0071cb144c7a | 858 | { |
JMF | 12:0071cb144c7a | 859 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret ); |
JMF | 12:0071cb144c7a | 860 | return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); |
JMF | 12:0071cb144c7a | 861 | } |
JMF | 12:0071cb144c7a | 862 | } |
JMF | 12:0071cb144c7a | 863 | #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */ |
JMF | 12:0071cb144c7a | 864 | |
JMF | 12:0071cb144c7a | 865 | #if defined(MBEDTLS_SSL_EXPORT_KEYS) |
JMF | 12:0071cb144c7a | 866 | if( ssl->conf->f_export_keys != NULL ) |
JMF | 12:0071cb144c7a | 867 | { |
JMF | 12:0071cb144c7a | 868 | ssl->conf->f_export_keys( ssl->conf->p_export_keys, |
JMF | 12:0071cb144c7a | 869 | session->master, keyblk, |
JMF | 12:0071cb144c7a | 870 | transform->maclen, transform->keylen, |
JMF | 12:0071cb144c7a | 871 | iv_copy_len ); |
JMF | 12:0071cb144c7a | 872 | } |
JMF | 12:0071cb144c7a | 873 | #endif |
JMF | 12:0071cb144c7a | 874 | |
JMF | 12:0071cb144c7a | 875 | if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc, |
JMF | 12:0071cb144c7a | 876 | cipher_info ) ) != 0 ) |
JMF | 12:0071cb144c7a | 877 | { |
JMF | 12:0071cb144c7a | 878 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret ); |
JMF | 12:0071cb144c7a | 879 | return( ret ); |
JMF | 12:0071cb144c7a | 880 | } |
JMF | 12:0071cb144c7a | 881 | |
JMF | 12:0071cb144c7a | 882 | if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec, |
JMF | 12:0071cb144c7a | 883 | cipher_info ) ) != 0 ) |
JMF | 12:0071cb144c7a | 884 | { |
JMF | 12:0071cb144c7a | 885 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret ); |
JMF | 12:0071cb144c7a | 886 | return( ret ); |
JMF | 12:0071cb144c7a | 887 | } |
JMF | 12:0071cb144c7a | 888 | |
JMF | 12:0071cb144c7a | 889 | if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1, |
JMF | 12:0071cb144c7a | 890 | cipher_info->key_bitlen, |
JMF | 12:0071cb144c7a | 891 | MBEDTLS_ENCRYPT ) ) != 0 ) |
JMF | 12:0071cb144c7a | 892 | { |
JMF | 12:0071cb144c7a | 893 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret ); |
JMF | 12:0071cb144c7a | 894 | return( ret ); |
JMF | 12:0071cb144c7a | 895 | } |
JMF | 12:0071cb144c7a | 896 | |
JMF | 12:0071cb144c7a | 897 | if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2, |
JMF | 12:0071cb144c7a | 898 | cipher_info->key_bitlen, |
JMF | 12:0071cb144c7a | 899 | MBEDTLS_DECRYPT ) ) != 0 ) |
JMF | 12:0071cb144c7a | 900 | { |
JMF | 12:0071cb144c7a | 901 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret ); |
JMF | 12:0071cb144c7a | 902 | return( ret ); |
JMF | 12:0071cb144c7a | 903 | } |
JMF | 12:0071cb144c7a | 904 | |
JMF | 12:0071cb144c7a | 905 | #if defined(MBEDTLS_CIPHER_MODE_CBC) |
JMF | 12:0071cb144c7a | 906 | if( cipher_info->mode == MBEDTLS_MODE_CBC ) |
JMF | 12:0071cb144c7a | 907 | { |
JMF | 12:0071cb144c7a | 908 | if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc, |
JMF | 12:0071cb144c7a | 909 | MBEDTLS_PADDING_NONE ) ) != 0 ) |
JMF | 12:0071cb144c7a | 910 | { |
JMF | 12:0071cb144c7a | 911 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret ); |
JMF | 12:0071cb144c7a | 912 | return( ret ); |
JMF | 12:0071cb144c7a | 913 | } |
JMF | 12:0071cb144c7a | 914 | |
JMF | 12:0071cb144c7a | 915 | if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec, |
JMF | 12:0071cb144c7a | 916 | MBEDTLS_PADDING_NONE ) ) != 0 ) |
JMF | 12:0071cb144c7a | 917 | { |
JMF | 12:0071cb144c7a | 918 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret ); |
JMF | 12:0071cb144c7a | 919 | return( ret ); |
JMF | 12:0071cb144c7a | 920 | } |
JMF | 12:0071cb144c7a | 921 | } |
JMF | 12:0071cb144c7a | 922 | #endif /* MBEDTLS_CIPHER_MODE_CBC */ |
JMF | 12:0071cb144c7a | 923 | |
JMF | 12:0071cb144c7a | 924 | mbedtls_zeroize( keyblk, sizeof( keyblk ) ); |
JMF | 12:0071cb144c7a | 925 | |
JMF | 12:0071cb144c7a | 926 | #if defined(MBEDTLS_ZLIB_SUPPORT) |
JMF | 12:0071cb144c7a | 927 | // Initialize compression |
JMF | 12:0071cb144c7a | 928 | // |
JMF | 12:0071cb144c7a | 929 | if( session->compression == MBEDTLS_SSL_COMPRESS_DEFLATE ) |
JMF | 12:0071cb144c7a | 930 | { |
JMF | 12:0071cb144c7a | 931 | if( ssl->compress_buf == NULL ) |
JMF | 12:0071cb144c7a | 932 | { |
JMF | 12:0071cb144c7a | 933 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) ); |
JMF | 12:0071cb144c7a | 934 | ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_BUFFER_LEN ); |
JMF | 12:0071cb144c7a | 935 | if( ssl->compress_buf == NULL ) |
JMF | 12:0071cb144c7a | 936 | { |
JMF | 12:0071cb144c7a | 937 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", |
JMF | 12:0071cb144c7a | 938 | MBEDTLS_SSL_BUFFER_LEN ) ); |
JMF | 12:0071cb144c7a | 939 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 940 | } |
JMF | 12:0071cb144c7a | 941 | } |
JMF | 12:0071cb144c7a | 942 | |
JMF | 12:0071cb144c7a | 943 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) ); |
JMF | 12:0071cb144c7a | 944 | |
JMF | 12:0071cb144c7a | 945 | memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) ); |
JMF | 12:0071cb144c7a | 946 | memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) ); |
JMF | 12:0071cb144c7a | 947 | |
JMF | 12:0071cb144c7a | 948 | if( deflateInit( &transform->ctx_deflate, |
JMF | 12:0071cb144c7a | 949 | Z_DEFAULT_COMPRESSION ) != Z_OK || |
JMF | 12:0071cb144c7a | 950 | inflateInit( &transform->ctx_inflate ) != Z_OK ) |
JMF | 12:0071cb144c7a | 951 | { |
JMF | 12:0071cb144c7a | 952 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) ); |
JMF | 12:0071cb144c7a | 953 | return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED ); |
JMF | 12:0071cb144c7a | 954 | } |
JMF | 12:0071cb144c7a | 955 | } |
JMF | 12:0071cb144c7a | 956 | #endif /* MBEDTLS_ZLIB_SUPPORT */ |
JMF | 12:0071cb144c7a | 957 | |
JMF | 12:0071cb144c7a | 958 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) ); |
JMF | 12:0071cb144c7a | 959 | |
JMF | 12:0071cb144c7a | 960 | return( 0 ); |
JMF | 12:0071cb144c7a | 961 | } |
JMF | 12:0071cb144c7a | 962 | |
JMF | 12:0071cb144c7a | 963 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 964 | void ssl_calc_verify_ssl( mbedtls_ssl_context *ssl, unsigned char hash[36] ) |
JMF | 12:0071cb144c7a | 965 | { |
JMF | 12:0071cb144c7a | 966 | mbedtls_md5_context md5; |
JMF | 12:0071cb144c7a | 967 | mbedtls_sha1_context sha1; |
JMF | 12:0071cb144c7a | 968 | unsigned char pad_1[48]; |
JMF | 12:0071cb144c7a | 969 | unsigned char pad_2[48]; |
JMF | 12:0071cb144c7a | 970 | |
JMF | 12:0071cb144c7a | 971 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) ); |
JMF | 12:0071cb144c7a | 972 | |
JMF | 12:0071cb144c7a | 973 | mbedtls_md5_init( &md5 ); |
JMF | 12:0071cb144c7a | 974 | mbedtls_sha1_init( &sha1 ); |
JMF | 12:0071cb144c7a | 975 | |
JMF | 12:0071cb144c7a | 976 | mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 ); |
JMF | 12:0071cb144c7a | 977 | mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 ); |
JMF | 12:0071cb144c7a | 978 | |
JMF | 12:0071cb144c7a | 979 | memset( pad_1, 0x36, 48 ); |
JMF | 12:0071cb144c7a | 980 | memset( pad_2, 0x5C, 48 ); |
JMF | 12:0071cb144c7a | 981 | |
JMF | 12:0071cb144c7a | 982 | mbedtls_md5_update( &md5, ssl->session_negotiate->master, 48 ); |
JMF | 12:0071cb144c7a | 983 | mbedtls_md5_update( &md5, pad_1, 48 ); |
JMF | 12:0071cb144c7a | 984 | mbedtls_md5_finish( &md5, hash ); |
JMF | 12:0071cb144c7a | 985 | |
JMF | 12:0071cb144c7a | 986 | mbedtls_md5_starts( &md5 ); |
JMF | 12:0071cb144c7a | 987 | mbedtls_md5_update( &md5, ssl->session_negotiate->master, 48 ); |
JMF | 12:0071cb144c7a | 988 | mbedtls_md5_update( &md5, pad_2, 48 ); |
JMF | 12:0071cb144c7a | 989 | mbedtls_md5_update( &md5, hash, 16 ); |
JMF | 12:0071cb144c7a | 990 | mbedtls_md5_finish( &md5, hash ); |
JMF | 12:0071cb144c7a | 991 | |
JMF | 12:0071cb144c7a | 992 | mbedtls_sha1_update( &sha1, ssl->session_negotiate->master, 48 ); |
JMF | 12:0071cb144c7a | 993 | mbedtls_sha1_update( &sha1, pad_1, 40 ); |
JMF | 12:0071cb144c7a | 994 | mbedtls_sha1_finish( &sha1, hash + 16 ); |
JMF | 12:0071cb144c7a | 995 | |
JMF | 12:0071cb144c7a | 996 | mbedtls_sha1_starts( &sha1 ); |
JMF | 12:0071cb144c7a | 997 | mbedtls_sha1_update( &sha1, ssl->session_negotiate->master, 48 ); |
JMF | 12:0071cb144c7a | 998 | mbedtls_sha1_update( &sha1, pad_2, 40 ); |
JMF | 12:0071cb144c7a | 999 | mbedtls_sha1_update( &sha1, hash + 16, 20 ); |
JMF | 12:0071cb144c7a | 1000 | mbedtls_sha1_finish( &sha1, hash + 16 ); |
JMF | 12:0071cb144c7a | 1001 | |
JMF | 12:0071cb144c7a | 1002 | MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 ); |
JMF | 12:0071cb144c7a | 1003 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) ); |
JMF | 12:0071cb144c7a | 1004 | |
JMF | 12:0071cb144c7a | 1005 | mbedtls_md5_free( &md5 ); |
JMF | 12:0071cb144c7a | 1006 | mbedtls_sha1_free( &sha1 ); |
JMF | 12:0071cb144c7a | 1007 | |
JMF | 12:0071cb144c7a | 1008 | return; |
JMF | 12:0071cb144c7a | 1009 | } |
JMF | 12:0071cb144c7a | 1010 | #endif /* MBEDTLS_SSL_PROTO_SSL3 */ |
JMF | 12:0071cb144c7a | 1011 | |
JMF | 12:0071cb144c7a | 1012 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) |
JMF | 12:0071cb144c7a | 1013 | void ssl_calc_verify_tls( mbedtls_ssl_context *ssl, unsigned char hash[36] ) |
JMF | 12:0071cb144c7a | 1014 | { |
JMF | 12:0071cb144c7a | 1015 | mbedtls_md5_context md5; |
JMF | 12:0071cb144c7a | 1016 | mbedtls_sha1_context sha1; |
JMF | 12:0071cb144c7a | 1017 | |
JMF | 12:0071cb144c7a | 1018 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) ); |
JMF | 12:0071cb144c7a | 1019 | |
JMF | 12:0071cb144c7a | 1020 | mbedtls_md5_init( &md5 ); |
JMF | 12:0071cb144c7a | 1021 | mbedtls_sha1_init( &sha1 ); |
JMF | 12:0071cb144c7a | 1022 | |
JMF | 12:0071cb144c7a | 1023 | mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 ); |
JMF | 12:0071cb144c7a | 1024 | mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 ); |
JMF | 12:0071cb144c7a | 1025 | |
JMF | 12:0071cb144c7a | 1026 | mbedtls_md5_finish( &md5, hash ); |
JMF | 12:0071cb144c7a | 1027 | mbedtls_sha1_finish( &sha1, hash + 16 ); |
JMF | 12:0071cb144c7a | 1028 | |
JMF | 12:0071cb144c7a | 1029 | MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 ); |
JMF | 12:0071cb144c7a | 1030 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) ); |
JMF | 12:0071cb144c7a | 1031 | |
JMF | 12:0071cb144c7a | 1032 | mbedtls_md5_free( &md5 ); |
JMF | 12:0071cb144c7a | 1033 | mbedtls_sha1_free( &sha1 ); |
JMF | 12:0071cb144c7a | 1034 | |
JMF | 12:0071cb144c7a | 1035 | return; |
JMF | 12:0071cb144c7a | 1036 | } |
JMF | 12:0071cb144c7a | 1037 | #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */ |
JMF | 12:0071cb144c7a | 1038 | |
JMF | 12:0071cb144c7a | 1039 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 1040 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 1041 | void ssl_calc_verify_tls_sha256( mbedtls_ssl_context *ssl, unsigned char hash[32] ) |
JMF | 12:0071cb144c7a | 1042 | { |
JMF | 12:0071cb144c7a | 1043 | mbedtls_sha256_context sha256; |
JMF | 12:0071cb144c7a | 1044 | |
JMF | 12:0071cb144c7a | 1045 | mbedtls_sha256_init( &sha256 ); |
JMF | 12:0071cb144c7a | 1046 | |
JMF | 12:0071cb144c7a | 1047 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) ); |
JMF | 12:0071cb144c7a | 1048 | |
JMF | 12:0071cb144c7a | 1049 | mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 ); |
JMF | 12:0071cb144c7a | 1050 | mbedtls_sha256_finish( &sha256, hash ); |
JMF | 12:0071cb144c7a | 1051 | |
JMF | 12:0071cb144c7a | 1052 | MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 32 ); |
JMF | 12:0071cb144c7a | 1053 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) ); |
JMF | 12:0071cb144c7a | 1054 | |
JMF | 12:0071cb144c7a | 1055 | mbedtls_sha256_free( &sha256 ); |
JMF | 12:0071cb144c7a | 1056 | |
JMF | 12:0071cb144c7a | 1057 | return; |
JMF | 12:0071cb144c7a | 1058 | } |
JMF | 12:0071cb144c7a | 1059 | #endif /* MBEDTLS_SHA256_C */ |
JMF | 12:0071cb144c7a | 1060 | |
JMF | 12:0071cb144c7a | 1061 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 1062 | void ssl_calc_verify_tls_sha384( mbedtls_ssl_context *ssl, unsigned char hash[48] ) |
JMF | 12:0071cb144c7a | 1063 | { |
JMF | 12:0071cb144c7a | 1064 | mbedtls_sha512_context sha512; |
JMF | 12:0071cb144c7a | 1065 | |
JMF | 12:0071cb144c7a | 1066 | mbedtls_sha512_init( &sha512 ); |
JMF | 12:0071cb144c7a | 1067 | |
JMF | 12:0071cb144c7a | 1068 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) ); |
JMF | 12:0071cb144c7a | 1069 | |
JMF | 12:0071cb144c7a | 1070 | mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 ); |
JMF | 12:0071cb144c7a | 1071 | mbedtls_sha512_finish( &sha512, hash ); |
JMF | 12:0071cb144c7a | 1072 | |
JMF | 12:0071cb144c7a | 1073 | MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 48 ); |
JMF | 12:0071cb144c7a | 1074 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) ); |
JMF | 12:0071cb144c7a | 1075 | |
JMF | 12:0071cb144c7a | 1076 | mbedtls_sha512_free( &sha512 ); |
JMF | 12:0071cb144c7a | 1077 | |
JMF | 12:0071cb144c7a | 1078 | return; |
JMF | 12:0071cb144c7a | 1079 | } |
JMF | 12:0071cb144c7a | 1080 | #endif /* MBEDTLS_SHA512_C */ |
JMF | 12:0071cb144c7a | 1081 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 1082 | |
JMF | 12:0071cb144c7a | 1083 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
JMF | 12:0071cb144c7a | 1084 | int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex ) |
JMF | 12:0071cb144c7a | 1085 | { |
JMF | 12:0071cb144c7a | 1086 | unsigned char *p = ssl->handshake->premaster; |
JMF | 12:0071cb144c7a | 1087 | unsigned char *end = p + sizeof( ssl->handshake->premaster ); |
JMF | 12:0071cb144c7a | 1088 | const unsigned char *psk = ssl->conf->psk; |
JMF | 12:0071cb144c7a | 1089 | size_t psk_len = ssl->conf->psk_len; |
JMF | 12:0071cb144c7a | 1090 | |
JMF | 12:0071cb144c7a | 1091 | /* If the psk callback was called, use its result */ |
JMF | 12:0071cb144c7a | 1092 | if( ssl->handshake->psk != NULL ) |
JMF | 12:0071cb144c7a | 1093 | { |
JMF | 12:0071cb144c7a | 1094 | psk = ssl->handshake->psk; |
JMF | 12:0071cb144c7a | 1095 | psk_len = ssl->handshake->psk_len; |
JMF | 12:0071cb144c7a | 1096 | } |
JMF | 12:0071cb144c7a | 1097 | |
JMF | 12:0071cb144c7a | 1098 | /* |
JMF | 12:0071cb144c7a | 1099 | * PMS = struct { |
JMF | 12:0071cb144c7a | 1100 | * opaque other_secret<0..2^16-1>; |
JMF | 12:0071cb144c7a | 1101 | * opaque psk<0..2^16-1>; |
JMF | 12:0071cb144c7a | 1102 | * }; |
JMF | 12:0071cb144c7a | 1103 | * with "other_secret" depending on the particular key exchange |
JMF | 12:0071cb144c7a | 1104 | */ |
JMF | 12:0071cb144c7a | 1105 | #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) |
JMF | 12:0071cb144c7a | 1106 | if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK ) |
JMF | 12:0071cb144c7a | 1107 | { |
JMF | 12:0071cb144c7a | 1108 | if( end - p < 2 ) |
JMF | 12:0071cb144c7a | 1109 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 1110 | |
JMF | 12:0071cb144c7a | 1111 | *(p++) = (unsigned char)( psk_len >> 8 ); |
JMF | 12:0071cb144c7a | 1112 | *(p++) = (unsigned char)( psk_len ); |
JMF | 12:0071cb144c7a | 1113 | |
JMF | 12:0071cb144c7a | 1114 | if( end < p || (size_t)( end - p ) < psk_len ) |
JMF | 12:0071cb144c7a | 1115 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 1116 | |
JMF | 12:0071cb144c7a | 1117 | memset( p, 0, psk_len ); |
JMF | 12:0071cb144c7a | 1118 | p += psk_len; |
JMF | 12:0071cb144c7a | 1119 | } |
JMF | 12:0071cb144c7a | 1120 | else |
JMF | 12:0071cb144c7a | 1121 | #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */ |
JMF | 12:0071cb144c7a | 1122 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) |
JMF | 12:0071cb144c7a | 1123 | if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) |
JMF | 12:0071cb144c7a | 1124 | { |
JMF | 12:0071cb144c7a | 1125 | /* |
JMF | 12:0071cb144c7a | 1126 | * other_secret already set by the ClientKeyExchange message, |
JMF | 12:0071cb144c7a | 1127 | * and is 48 bytes long |
JMF | 12:0071cb144c7a | 1128 | */ |
JMF | 12:0071cb144c7a | 1129 | *p++ = 0; |
JMF | 12:0071cb144c7a | 1130 | *p++ = 48; |
JMF | 12:0071cb144c7a | 1131 | p += 48; |
JMF | 12:0071cb144c7a | 1132 | } |
JMF | 12:0071cb144c7a | 1133 | else |
JMF | 12:0071cb144c7a | 1134 | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ |
JMF | 12:0071cb144c7a | 1135 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) |
JMF | 12:0071cb144c7a | 1136 | if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK ) |
JMF | 12:0071cb144c7a | 1137 | { |
JMF | 12:0071cb144c7a | 1138 | int ret; |
JMF | 12:0071cb144c7a | 1139 | size_t len; |
JMF | 12:0071cb144c7a | 1140 | |
JMF | 12:0071cb144c7a | 1141 | /* Write length only when we know the actual value */ |
JMF | 12:0071cb144c7a | 1142 | if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx, |
JMF | 12:0071cb144c7a | 1143 | p + 2, end - ( p + 2 ), &len, |
JMF | 12:0071cb144c7a | 1144 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
JMF | 12:0071cb144c7a | 1145 | { |
JMF | 12:0071cb144c7a | 1146 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret ); |
JMF | 12:0071cb144c7a | 1147 | return( ret ); |
JMF | 12:0071cb144c7a | 1148 | } |
JMF | 12:0071cb144c7a | 1149 | *(p++) = (unsigned char)( len >> 8 ); |
JMF | 12:0071cb144c7a | 1150 | *(p++) = (unsigned char)( len ); |
JMF | 12:0071cb144c7a | 1151 | p += len; |
JMF | 12:0071cb144c7a | 1152 | |
JMF | 12:0071cb144c7a | 1153 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K ); |
JMF | 12:0071cb144c7a | 1154 | } |
JMF | 12:0071cb144c7a | 1155 | else |
JMF | 12:0071cb144c7a | 1156 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ |
JMF | 12:0071cb144c7a | 1157 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) |
JMF | 12:0071cb144c7a | 1158 | if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) |
JMF | 12:0071cb144c7a | 1159 | { |
JMF | 12:0071cb144c7a | 1160 | int ret; |
JMF | 12:0071cb144c7a | 1161 | size_t zlen; |
JMF | 12:0071cb144c7a | 1162 | |
JMF | 12:0071cb144c7a | 1163 | if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen, |
JMF | 12:0071cb144c7a | 1164 | p + 2, end - ( p + 2 ), |
JMF | 12:0071cb144c7a | 1165 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
JMF | 12:0071cb144c7a | 1166 | { |
JMF | 12:0071cb144c7a | 1167 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret ); |
JMF | 12:0071cb144c7a | 1168 | return( ret ); |
JMF | 12:0071cb144c7a | 1169 | } |
JMF | 12:0071cb144c7a | 1170 | |
JMF | 12:0071cb144c7a | 1171 | *(p++) = (unsigned char)( zlen >> 8 ); |
JMF | 12:0071cb144c7a | 1172 | *(p++) = (unsigned char)( zlen ); |
JMF | 12:0071cb144c7a | 1173 | p += zlen; |
JMF | 12:0071cb144c7a | 1174 | |
JMF | 12:0071cb144c7a | 1175 | MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z ); |
JMF | 12:0071cb144c7a | 1176 | } |
JMF | 12:0071cb144c7a | 1177 | else |
JMF | 12:0071cb144c7a | 1178 | #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ |
JMF | 12:0071cb144c7a | 1179 | { |
JMF | 12:0071cb144c7a | 1180 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1181 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1182 | } |
JMF | 12:0071cb144c7a | 1183 | |
JMF | 12:0071cb144c7a | 1184 | /* opaque psk<0..2^16-1>; */ |
JMF | 12:0071cb144c7a | 1185 | if( end - p < 2 ) |
JMF | 12:0071cb144c7a | 1186 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 1187 | |
JMF | 12:0071cb144c7a | 1188 | *(p++) = (unsigned char)( psk_len >> 8 ); |
JMF | 12:0071cb144c7a | 1189 | *(p++) = (unsigned char)( psk_len ); |
JMF | 12:0071cb144c7a | 1190 | |
JMF | 12:0071cb144c7a | 1191 | if( end < p || (size_t)( end - p ) < psk_len ) |
JMF | 12:0071cb144c7a | 1192 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 1193 | |
JMF | 12:0071cb144c7a | 1194 | memcpy( p, psk, psk_len ); |
JMF | 12:0071cb144c7a | 1195 | p += psk_len; |
JMF | 12:0071cb144c7a | 1196 | |
JMF | 12:0071cb144c7a | 1197 | ssl->handshake->pmslen = p - ssl->handshake->premaster; |
JMF | 12:0071cb144c7a | 1198 | |
JMF | 12:0071cb144c7a | 1199 | return( 0 ); |
JMF | 12:0071cb144c7a | 1200 | } |
JMF | 12:0071cb144c7a | 1201 | #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ |
JMF | 12:0071cb144c7a | 1202 | |
JMF | 12:0071cb144c7a | 1203 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 1204 | /* |
JMF | 12:0071cb144c7a | 1205 | * SSLv3.0 MAC functions |
JMF | 12:0071cb144c7a | 1206 | */ |
JMF | 12:0071cb144c7a | 1207 | static void ssl_mac( mbedtls_md_context_t *md_ctx, unsigned char *secret, |
JMF | 12:0071cb144c7a | 1208 | unsigned char *buf, size_t len, |
JMF | 12:0071cb144c7a | 1209 | unsigned char *ctr, int type ) |
JMF | 12:0071cb144c7a | 1210 | { |
JMF | 12:0071cb144c7a | 1211 | unsigned char header[11]; |
JMF | 12:0071cb144c7a | 1212 | unsigned char padding[48]; |
JMF | 12:0071cb144c7a | 1213 | int padlen; |
JMF | 12:0071cb144c7a | 1214 | int md_size = mbedtls_md_get_size( md_ctx->md_info ); |
JMF | 12:0071cb144c7a | 1215 | int md_type = mbedtls_md_get_type( md_ctx->md_info ); |
JMF | 12:0071cb144c7a | 1216 | |
JMF | 12:0071cb144c7a | 1217 | /* Only MD5 and SHA-1 supported */ |
JMF | 12:0071cb144c7a | 1218 | if( md_type == MBEDTLS_MD_MD5 ) |
JMF | 12:0071cb144c7a | 1219 | padlen = 48; |
JMF | 12:0071cb144c7a | 1220 | else |
JMF | 12:0071cb144c7a | 1221 | padlen = 40; |
JMF | 12:0071cb144c7a | 1222 | |
JMF | 12:0071cb144c7a | 1223 | memcpy( header, ctr, 8 ); |
JMF | 12:0071cb144c7a | 1224 | header[ 8] = (unsigned char) type; |
JMF | 12:0071cb144c7a | 1225 | header[ 9] = (unsigned char)( len >> 8 ); |
JMF | 12:0071cb144c7a | 1226 | header[10] = (unsigned char)( len ); |
JMF | 12:0071cb144c7a | 1227 | |
JMF | 12:0071cb144c7a | 1228 | memset( padding, 0x36, padlen ); |
JMF | 12:0071cb144c7a | 1229 | mbedtls_md_starts( md_ctx ); |
JMF | 12:0071cb144c7a | 1230 | mbedtls_md_update( md_ctx, secret, md_size ); |
JMF | 12:0071cb144c7a | 1231 | mbedtls_md_update( md_ctx, padding, padlen ); |
JMF | 12:0071cb144c7a | 1232 | mbedtls_md_update( md_ctx, header, 11 ); |
JMF | 12:0071cb144c7a | 1233 | mbedtls_md_update( md_ctx, buf, len ); |
JMF | 12:0071cb144c7a | 1234 | mbedtls_md_finish( md_ctx, buf + len ); |
JMF | 12:0071cb144c7a | 1235 | |
JMF | 12:0071cb144c7a | 1236 | memset( padding, 0x5C, padlen ); |
JMF | 12:0071cb144c7a | 1237 | mbedtls_md_starts( md_ctx ); |
JMF | 12:0071cb144c7a | 1238 | mbedtls_md_update( md_ctx, secret, md_size ); |
JMF | 12:0071cb144c7a | 1239 | mbedtls_md_update( md_ctx, padding, padlen ); |
JMF | 12:0071cb144c7a | 1240 | mbedtls_md_update( md_ctx, buf + len, md_size ); |
JMF | 12:0071cb144c7a | 1241 | mbedtls_md_finish( md_ctx, buf + len ); |
JMF | 12:0071cb144c7a | 1242 | } |
JMF | 12:0071cb144c7a | 1243 | #endif /* MBEDTLS_SSL_PROTO_SSL3 */ |
JMF | 12:0071cb144c7a | 1244 | |
JMF | 12:0071cb144c7a | 1245 | #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER) || \ |
JMF | 12:0071cb144c7a | 1246 | ( defined(MBEDTLS_CIPHER_MODE_CBC) && \ |
JMF | 12:0071cb144c7a | 1247 | ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) ) ) |
JMF | 12:0071cb144c7a | 1248 | #define SSL_SOME_MODES_USE_MAC |
JMF | 12:0071cb144c7a | 1249 | #endif |
JMF | 12:0071cb144c7a | 1250 | |
JMF | 12:0071cb144c7a | 1251 | /* |
JMF | 12:0071cb144c7a | 1252 | * Encryption/decryption functions |
JMF | 12:0071cb144c7a | 1253 | */ |
JMF | 12:0071cb144c7a | 1254 | static int ssl_encrypt_buf( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 1255 | { |
JMF | 12:0071cb144c7a | 1256 | mbedtls_cipher_mode_t mode; |
JMF | 12:0071cb144c7a | 1257 | int auth_done = 0; |
JMF | 12:0071cb144c7a | 1258 | |
JMF | 12:0071cb144c7a | 1259 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) ); |
JMF | 12:0071cb144c7a | 1260 | |
JMF | 12:0071cb144c7a | 1261 | if( ssl->session_out == NULL || ssl->transform_out == NULL ) |
JMF | 12:0071cb144c7a | 1262 | { |
JMF | 12:0071cb144c7a | 1263 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1264 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1265 | } |
JMF | 12:0071cb144c7a | 1266 | |
JMF | 12:0071cb144c7a | 1267 | mode = mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc ); |
JMF | 12:0071cb144c7a | 1268 | |
JMF | 12:0071cb144c7a | 1269 | MBEDTLS_SSL_DEBUG_BUF( 4, "before encrypt: output payload", |
JMF | 12:0071cb144c7a | 1270 | ssl->out_msg, ssl->out_msglen ); |
JMF | 12:0071cb144c7a | 1271 | |
JMF | 12:0071cb144c7a | 1272 | /* |
JMF | 12:0071cb144c7a | 1273 | * Add MAC before if needed |
JMF | 12:0071cb144c7a | 1274 | */ |
JMF | 12:0071cb144c7a | 1275 | #if defined(SSL_SOME_MODES_USE_MAC) |
JMF | 12:0071cb144c7a | 1276 | if( mode == MBEDTLS_MODE_STREAM || |
JMF | 12:0071cb144c7a | 1277 | ( mode == MBEDTLS_MODE_CBC |
JMF | 12:0071cb144c7a | 1278 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
JMF | 12:0071cb144c7a | 1279 | && ssl->session_out->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED |
JMF | 12:0071cb144c7a | 1280 | #endif |
JMF | 12:0071cb144c7a | 1281 | ) ) |
JMF | 12:0071cb144c7a | 1282 | { |
JMF | 12:0071cb144c7a | 1283 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 1284 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
JMF | 12:0071cb144c7a | 1285 | { |
JMF | 12:0071cb144c7a | 1286 | ssl_mac( &ssl->transform_out->md_ctx_enc, |
JMF | 12:0071cb144c7a | 1287 | ssl->transform_out->mac_enc, |
JMF | 12:0071cb144c7a | 1288 | ssl->out_msg, ssl->out_msglen, |
JMF | 12:0071cb144c7a | 1289 | ssl->out_ctr, ssl->out_msgtype ); |
JMF | 12:0071cb144c7a | 1290 | } |
JMF | 12:0071cb144c7a | 1291 | else |
JMF | 12:0071cb144c7a | 1292 | #endif |
JMF | 12:0071cb144c7a | 1293 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
JMF | 12:0071cb144c7a | 1294 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 1295 | if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 ) |
JMF | 12:0071cb144c7a | 1296 | { |
JMF | 12:0071cb144c7a | 1297 | mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_ctr, 8 ); |
JMF | 12:0071cb144c7a | 1298 | mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_hdr, 3 ); |
JMF | 12:0071cb144c7a | 1299 | mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_len, 2 ); |
JMF | 12:0071cb144c7a | 1300 | mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, |
JMF | 12:0071cb144c7a | 1301 | ssl->out_msg, ssl->out_msglen ); |
JMF | 12:0071cb144c7a | 1302 | mbedtls_md_hmac_finish( &ssl->transform_out->md_ctx_enc, |
JMF | 12:0071cb144c7a | 1303 | ssl->out_msg + ssl->out_msglen ); |
JMF | 12:0071cb144c7a | 1304 | mbedtls_md_hmac_reset( &ssl->transform_out->md_ctx_enc ); |
JMF | 12:0071cb144c7a | 1305 | } |
JMF | 12:0071cb144c7a | 1306 | else |
JMF | 12:0071cb144c7a | 1307 | #endif |
JMF | 12:0071cb144c7a | 1308 | { |
JMF | 12:0071cb144c7a | 1309 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1310 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1311 | } |
JMF | 12:0071cb144c7a | 1312 | |
JMF | 12:0071cb144c7a | 1313 | MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", |
JMF | 12:0071cb144c7a | 1314 | ssl->out_msg + ssl->out_msglen, |
JMF | 12:0071cb144c7a | 1315 | ssl->transform_out->maclen ); |
JMF | 12:0071cb144c7a | 1316 | |
JMF | 12:0071cb144c7a | 1317 | ssl->out_msglen += ssl->transform_out->maclen; |
JMF | 12:0071cb144c7a | 1318 | auth_done++; |
JMF | 12:0071cb144c7a | 1319 | } |
JMF | 12:0071cb144c7a | 1320 | #endif /* AEAD not the only option */ |
JMF | 12:0071cb144c7a | 1321 | |
JMF | 12:0071cb144c7a | 1322 | /* |
JMF | 12:0071cb144c7a | 1323 | * Encrypt |
JMF | 12:0071cb144c7a | 1324 | */ |
JMF | 12:0071cb144c7a | 1325 | #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER) |
JMF | 12:0071cb144c7a | 1326 | if( mode == MBEDTLS_MODE_STREAM ) |
JMF | 12:0071cb144c7a | 1327 | { |
JMF | 12:0071cb144c7a | 1328 | int ret; |
JMF | 12:0071cb144c7a | 1329 | size_t olen = 0; |
JMF | 12:0071cb144c7a | 1330 | |
JMF | 12:0071cb144c7a | 1331 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, " |
JMF | 12:0071cb144c7a | 1332 | "including %d bytes of padding", |
JMF | 12:0071cb144c7a | 1333 | ssl->out_msglen, 0 ) ); |
JMF | 12:0071cb144c7a | 1334 | |
JMF | 12:0071cb144c7a | 1335 | if( ( ret = mbedtls_cipher_crypt( &ssl->transform_out->cipher_ctx_enc, |
JMF | 12:0071cb144c7a | 1336 | ssl->transform_out->iv_enc, |
JMF | 12:0071cb144c7a | 1337 | ssl->transform_out->ivlen, |
JMF | 12:0071cb144c7a | 1338 | ssl->out_msg, ssl->out_msglen, |
JMF | 12:0071cb144c7a | 1339 | ssl->out_msg, &olen ) ) != 0 ) |
JMF | 12:0071cb144c7a | 1340 | { |
JMF | 12:0071cb144c7a | 1341 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret ); |
JMF | 12:0071cb144c7a | 1342 | return( ret ); |
JMF | 12:0071cb144c7a | 1343 | } |
JMF | 12:0071cb144c7a | 1344 | |
JMF | 12:0071cb144c7a | 1345 | if( ssl->out_msglen != olen ) |
JMF | 12:0071cb144c7a | 1346 | { |
JMF | 12:0071cb144c7a | 1347 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1348 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1349 | } |
JMF | 12:0071cb144c7a | 1350 | } |
JMF | 12:0071cb144c7a | 1351 | else |
JMF | 12:0071cb144c7a | 1352 | #endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */ |
JMF | 12:0071cb144c7a | 1353 | #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C) |
JMF | 12:0071cb144c7a | 1354 | if( mode == MBEDTLS_MODE_GCM || |
JMF | 12:0071cb144c7a | 1355 | mode == MBEDTLS_MODE_CCM ) |
JMF | 12:0071cb144c7a | 1356 | { |
JMF | 12:0071cb144c7a | 1357 | int ret; |
JMF | 12:0071cb144c7a | 1358 | size_t enc_msglen, olen; |
JMF | 12:0071cb144c7a | 1359 | unsigned char *enc_msg; |
JMF | 12:0071cb144c7a | 1360 | unsigned char add_data[13]; |
JMF | 12:0071cb144c7a | 1361 | unsigned char taglen = ssl->transform_out->ciphersuite_info->flags & |
JMF | 12:0071cb144c7a | 1362 | MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16; |
JMF | 12:0071cb144c7a | 1363 | |
JMF | 12:0071cb144c7a | 1364 | memcpy( add_data, ssl->out_ctr, 8 ); |
JMF | 12:0071cb144c7a | 1365 | add_data[8] = ssl->out_msgtype; |
JMF | 12:0071cb144c7a | 1366 | mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver, |
JMF | 12:0071cb144c7a | 1367 | ssl->conf->transport, add_data + 9 ); |
JMF | 12:0071cb144c7a | 1368 | add_data[11] = ( ssl->out_msglen >> 8 ) & 0xFF; |
JMF | 12:0071cb144c7a | 1369 | add_data[12] = ssl->out_msglen & 0xFF; |
JMF | 12:0071cb144c7a | 1370 | |
JMF | 12:0071cb144c7a | 1371 | MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD", |
JMF | 12:0071cb144c7a | 1372 | add_data, 13 ); |
JMF | 12:0071cb144c7a | 1373 | |
JMF | 12:0071cb144c7a | 1374 | /* |
JMF | 12:0071cb144c7a | 1375 | * Generate IV |
JMF | 12:0071cb144c7a | 1376 | */ |
JMF | 12:0071cb144c7a | 1377 | #if defined(MBEDTLS_SSL_AEAD_RANDOM_IV) |
JMF | 12:0071cb144c7a | 1378 | ret = ssl->conf->f_rng( ssl->conf->p_rng, |
JMF | 12:0071cb144c7a | 1379 | ssl->transform_out->iv_enc + ssl->transform_out->fixed_ivlen, |
JMF | 12:0071cb144c7a | 1380 | ssl->transform_out->ivlen - ssl->transform_out->fixed_ivlen ); |
JMF | 12:0071cb144c7a | 1381 | if( ret != 0 ) |
JMF | 12:0071cb144c7a | 1382 | return( ret ); |
JMF | 12:0071cb144c7a | 1383 | |
JMF | 12:0071cb144c7a | 1384 | memcpy( ssl->out_iv, |
JMF | 12:0071cb144c7a | 1385 | ssl->transform_out->iv_enc + ssl->transform_out->fixed_ivlen, |
JMF | 12:0071cb144c7a | 1386 | ssl->transform_out->ivlen - ssl->transform_out->fixed_ivlen ); |
JMF | 12:0071cb144c7a | 1387 | #else |
JMF | 12:0071cb144c7a | 1388 | if( ssl->transform_out->ivlen - ssl->transform_out->fixed_ivlen != 8 ) |
JMF | 12:0071cb144c7a | 1389 | { |
JMF | 12:0071cb144c7a | 1390 | /* Reminder if we ever add an AEAD mode with a different size */ |
JMF | 12:0071cb144c7a | 1391 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1392 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1393 | } |
JMF | 12:0071cb144c7a | 1394 | |
JMF | 12:0071cb144c7a | 1395 | memcpy( ssl->transform_out->iv_enc + ssl->transform_out->fixed_ivlen, |
JMF | 12:0071cb144c7a | 1396 | ssl->out_ctr, 8 ); |
JMF | 12:0071cb144c7a | 1397 | memcpy( ssl->out_iv, ssl->out_ctr, 8 ); |
JMF | 12:0071cb144c7a | 1398 | #endif |
JMF | 12:0071cb144c7a | 1399 | |
JMF | 12:0071cb144c7a | 1400 | MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", ssl->out_iv, |
JMF | 12:0071cb144c7a | 1401 | ssl->transform_out->ivlen - ssl->transform_out->fixed_ivlen ); |
JMF | 12:0071cb144c7a | 1402 | |
JMF | 12:0071cb144c7a | 1403 | /* |
JMF | 12:0071cb144c7a | 1404 | * Fix pointer positions and message length with added IV |
JMF | 12:0071cb144c7a | 1405 | */ |
JMF | 12:0071cb144c7a | 1406 | enc_msg = ssl->out_msg; |
JMF | 12:0071cb144c7a | 1407 | enc_msglen = ssl->out_msglen; |
JMF | 12:0071cb144c7a | 1408 | ssl->out_msglen += ssl->transform_out->ivlen - |
JMF | 12:0071cb144c7a | 1409 | ssl->transform_out->fixed_ivlen; |
JMF | 12:0071cb144c7a | 1410 | |
JMF | 12:0071cb144c7a | 1411 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, " |
JMF | 12:0071cb144c7a | 1412 | "including %d bytes of padding", |
JMF | 12:0071cb144c7a | 1413 | ssl->out_msglen, 0 ) ); |
JMF | 12:0071cb144c7a | 1414 | |
JMF | 12:0071cb144c7a | 1415 | /* |
JMF | 12:0071cb144c7a | 1416 | * Encrypt and authenticate |
JMF | 12:0071cb144c7a | 1417 | */ |
JMF | 12:0071cb144c7a | 1418 | if( ( ret = mbedtls_cipher_auth_encrypt( &ssl->transform_out->cipher_ctx_enc, |
JMF | 12:0071cb144c7a | 1419 | ssl->transform_out->iv_enc, |
JMF | 12:0071cb144c7a | 1420 | ssl->transform_out->ivlen, |
JMF | 12:0071cb144c7a | 1421 | add_data, 13, |
JMF | 12:0071cb144c7a | 1422 | enc_msg, enc_msglen, |
JMF | 12:0071cb144c7a | 1423 | enc_msg, &olen, |
JMF | 12:0071cb144c7a | 1424 | enc_msg + enc_msglen, taglen ) ) != 0 ) |
JMF | 12:0071cb144c7a | 1425 | { |
JMF | 12:0071cb144c7a | 1426 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret ); |
JMF | 12:0071cb144c7a | 1427 | return( ret ); |
JMF | 12:0071cb144c7a | 1428 | } |
JMF | 12:0071cb144c7a | 1429 | |
JMF | 12:0071cb144c7a | 1430 | if( olen != enc_msglen ) |
JMF | 12:0071cb144c7a | 1431 | { |
JMF | 12:0071cb144c7a | 1432 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1433 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1434 | } |
JMF | 12:0071cb144c7a | 1435 | |
JMF | 12:0071cb144c7a | 1436 | ssl->out_msglen += taglen; |
JMF | 12:0071cb144c7a | 1437 | auth_done++; |
JMF | 12:0071cb144c7a | 1438 | |
JMF | 12:0071cb144c7a | 1439 | MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag", enc_msg + enc_msglen, taglen ); |
JMF | 12:0071cb144c7a | 1440 | } |
JMF | 12:0071cb144c7a | 1441 | else |
JMF | 12:0071cb144c7a | 1442 | #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */ |
JMF | 12:0071cb144c7a | 1443 | #if defined(MBEDTLS_CIPHER_MODE_CBC) && \ |
JMF | 12:0071cb144c7a | 1444 | ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) ) |
JMF | 12:0071cb144c7a | 1445 | if( mode == MBEDTLS_MODE_CBC ) |
JMF | 12:0071cb144c7a | 1446 | { |
JMF | 12:0071cb144c7a | 1447 | int ret; |
JMF | 12:0071cb144c7a | 1448 | unsigned char *enc_msg; |
JMF | 12:0071cb144c7a | 1449 | size_t enc_msglen, padlen, olen = 0, i; |
JMF | 12:0071cb144c7a | 1450 | |
JMF | 12:0071cb144c7a | 1451 | padlen = ssl->transform_out->ivlen - ( ssl->out_msglen + 1 ) % |
JMF | 12:0071cb144c7a | 1452 | ssl->transform_out->ivlen; |
JMF | 12:0071cb144c7a | 1453 | if( padlen == ssl->transform_out->ivlen ) |
JMF | 12:0071cb144c7a | 1454 | padlen = 0; |
JMF | 12:0071cb144c7a | 1455 | |
JMF | 12:0071cb144c7a | 1456 | for( i = 0; i <= padlen; i++ ) |
JMF | 12:0071cb144c7a | 1457 | ssl->out_msg[ssl->out_msglen + i] = (unsigned char) padlen; |
JMF | 12:0071cb144c7a | 1458 | |
JMF | 12:0071cb144c7a | 1459 | ssl->out_msglen += padlen + 1; |
JMF | 12:0071cb144c7a | 1460 | |
JMF | 12:0071cb144c7a | 1461 | enc_msglen = ssl->out_msglen; |
JMF | 12:0071cb144c7a | 1462 | enc_msg = ssl->out_msg; |
JMF | 12:0071cb144c7a | 1463 | |
JMF | 12:0071cb144c7a | 1464 | #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 1465 | /* |
JMF | 12:0071cb144c7a | 1466 | * Prepend per-record IV for block cipher in TLS v1.1 and up as per |
JMF | 12:0071cb144c7a | 1467 | * Method 1 (6.2.3.2. in RFC4346 and RFC5246) |
JMF | 12:0071cb144c7a | 1468 | */ |
JMF | 12:0071cb144c7a | 1469 | if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 ) |
JMF | 12:0071cb144c7a | 1470 | { |
JMF | 12:0071cb144c7a | 1471 | /* |
JMF | 12:0071cb144c7a | 1472 | * Generate IV |
JMF | 12:0071cb144c7a | 1473 | */ |
JMF | 12:0071cb144c7a | 1474 | ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->transform_out->iv_enc, |
JMF | 12:0071cb144c7a | 1475 | ssl->transform_out->ivlen ); |
JMF | 12:0071cb144c7a | 1476 | if( ret != 0 ) |
JMF | 12:0071cb144c7a | 1477 | return( ret ); |
JMF | 12:0071cb144c7a | 1478 | |
JMF | 12:0071cb144c7a | 1479 | memcpy( ssl->out_iv, ssl->transform_out->iv_enc, |
JMF | 12:0071cb144c7a | 1480 | ssl->transform_out->ivlen ); |
JMF | 12:0071cb144c7a | 1481 | |
JMF | 12:0071cb144c7a | 1482 | /* |
JMF | 12:0071cb144c7a | 1483 | * Fix pointer positions and message length with added IV |
JMF | 12:0071cb144c7a | 1484 | */ |
JMF | 12:0071cb144c7a | 1485 | enc_msg = ssl->out_msg; |
JMF | 12:0071cb144c7a | 1486 | enc_msglen = ssl->out_msglen; |
JMF | 12:0071cb144c7a | 1487 | ssl->out_msglen += ssl->transform_out->ivlen; |
JMF | 12:0071cb144c7a | 1488 | } |
JMF | 12:0071cb144c7a | 1489 | #endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 1490 | |
JMF | 12:0071cb144c7a | 1491 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, " |
JMF | 12:0071cb144c7a | 1492 | "including %d bytes of IV and %d bytes of padding", |
JMF | 12:0071cb144c7a | 1493 | ssl->out_msglen, ssl->transform_out->ivlen, |
JMF | 12:0071cb144c7a | 1494 | padlen + 1 ) ); |
JMF | 12:0071cb144c7a | 1495 | |
JMF | 12:0071cb144c7a | 1496 | if( ( ret = mbedtls_cipher_crypt( &ssl->transform_out->cipher_ctx_enc, |
JMF | 12:0071cb144c7a | 1497 | ssl->transform_out->iv_enc, |
JMF | 12:0071cb144c7a | 1498 | ssl->transform_out->ivlen, |
JMF | 12:0071cb144c7a | 1499 | enc_msg, enc_msglen, |
JMF | 12:0071cb144c7a | 1500 | enc_msg, &olen ) ) != 0 ) |
JMF | 12:0071cb144c7a | 1501 | { |
JMF | 12:0071cb144c7a | 1502 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret ); |
JMF | 12:0071cb144c7a | 1503 | return( ret ); |
JMF | 12:0071cb144c7a | 1504 | } |
JMF | 12:0071cb144c7a | 1505 | |
JMF | 12:0071cb144c7a | 1506 | if( enc_msglen != olen ) |
JMF | 12:0071cb144c7a | 1507 | { |
JMF | 12:0071cb144c7a | 1508 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1509 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1510 | } |
JMF | 12:0071cb144c7a | 1511 | |
JMF | 12:0071cb144c7a | 1512 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) |
JMF | 12:0071cb144c7a | 1513 | if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 ) |
JMF | 12:0071cb144c7a | 1514 | { |
JMF | 12:0071cb144c7a | 1515 | /* |
JMF | 12:0071cb144c7a | 1516 | * Save IV in SSL3 and TLS1 |
JMF | 12:0071cb144c7a | 1517 | */ |
JMF | 12:0071cb144c7a | 1518 | memcpy( ssl->transform_out->iv_enc, |
JMF | 12:0071cb144c7a | 1519 | ssl->transform_out->cipher_ctx_enc.iv, |
JMF | 12:0071cb144c7a | 1520 | ssl->transform_out->ivlen ); |
JMF | 12:0071cb144c7a | 1521 | } |
JMF | 12:0071cb144c7a | 1522 | #endif |
JMF | 12:0071cb144c7a | 1523 | |
JMF | 12:0071cb144c7a | 1524 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
JMF | 12:0071cb144c7a | 1525 | if( auth_done == 0 ) |
JMF | 12:0071cb144c7a | 1526 | { |
JMF | 12:0071cb144c7a | 1527 | /* |
JMF | 12:0071cb144c7a | 1528 | * MAC(MAC_write_key, seq_num + |
JMF | 12:0071cb144c7a | 1529 | * TLSCipherText.type + |
JMF | 12:0071cb144c7a | 1530 | * TLSCipherText.version + |
JMF | 12:0071cb144c7a | 1531 | * length_of( (IV +) ENC(...) ) + |
JMF | 12:0071cb144c7a | 1532 | * IV + // except for TLS 1.0 |
JMF | 12:0071cb144c7a | 1533 | * ENC(content + padding + padding_length)); |
JMF | 12:0071cb144c7a | 1534 | */ |
JMF | 12:0071cb144c7a | 1535 | unsigned char pseudo_hdr[13]; |
JMF | 12:0071cb144c7a | 1536 | |
JMF | 12:0071cb144c7a | 1537 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) ); |
JMF | 12:0071cb144c7a | 1538 | |
JMF | 12:0071cb144c7a | 1539 | memcpy( pseudo_hdr + 0, ssl->out_ctr, 8 ); |
JMF | 12:0071cb144c7a | 1540 | memcpy( pseudo_hdr + 8, ssl->out_hdr, 3 ); |
JMF | 12:0071cb144c7a | 1541 | pseudo_hdr[11] = (unsigned char)( ( ssl->out_msglen >> 8 ) & 0xFF ); |
JMF | 12:0071cb144c7a | 1542 | pseudo_hdr[12] = (unsigned char)( ( ssl->out_msglen ) & 0xFF ); |
JMF | 12:0071cb144c7a | 1543 | |
JMF | 12:0071cb144c7a | 1544 | MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", pseudo_hdr, 13 ); |
JMF | 12:0071cb144c7a | 1545 | |
JMF | 12:0071cb144c7a | 1546 | mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, pseudo_hdr, 13 ); |
JMF | 12:0071cb144c7a | 1547 | mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, |
JMF | 12:0071cb144c7a | 1548 | ssl->out_iv, ssl->out_msglen ); |
JMF | 12:0071cb144c7a | 1549 | mbedtls_md_hmac_finish( &ssl->transform_out->md_ctx_enc, |
JMF | 12:0071cb144c7a | 1550 | ssl->out_iv + ssl->out_msglen ); |
JMF | 12:0071cb144c7a | 1551 | mbedtls_md_hmac_reset( &ssl->transform_out->md_ctx_enc ); |
JMF | 12:0071cb144c7a | 1552 | |
JMF | 12:0071cb144c7a | 1553 | ssl->out_msglen += ssl->transform_out->maclen; |
JMF | 12:0071cb144c7a | 1554 | auth_done++; |
JMF | 12:0071cb144c7a | 1555 | } |
JMF | 12:0071cb144c7a | 1556 | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
JMF | 12:0071cb144c7a | 1557 | } |
JMF | 12:0071cb144c7a | 1558 | else |
JMF | 12:0071cb144c7a | 1559 | #endif /* MBEDTLS_CIPHER_MODE_CBC && |
JMF | 12:0071cb144c7a | 1560 | ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C ) */ |
JMF | 12:0071cb144c7a | 1561 | { |
JMF | 12:0071cb144c7a | 1562 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1563 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1564 | } |
JMF | 12:0071cb144c7a | 1565 | |
JMF | 12:0071cb144c7a | 1566 | /* Make extra sure authentication was performed, exactly once */ |
JMF | 12:0071cb144c7a | 1567 | if( auth_done != 1 ) |
JMF | 12:0071cb144c7a | 1568 | { |
JMF | 12:0071cb144c7a | 1569 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1570 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1571 | } |
JMF | 12:0071cb144c7a | 1572 | |
JMF | 12:0071cb144c7a | 1573 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) ); |
JMF | 12:0071cb144c7a | 1574 | |
JMF | 12:0071cb144c7a | 1575 | return( 0 ); |
JMF | 12:0071cb144c7a | 1576 | } |
JMF | 12:0071cb144c7a | 1577 | |
JMF | 12:0071cb144c7a | 1578 | #define SSL_MAX_MAC_SIZE 48 |
JMF | 12:0071cb144c7a | 1579 | |
JMF | 12:0071cb144c7a | 1580 | static int ssl_decrypt_buf( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 1581 | { |
JMF | 12:0071cb144c7a | 1582 | size_t i; |
JMF | 12:0071cb144c7a | 1583 | mbedtls_cipher_mode_t mode; |
JMF | 12:0071cb144c7a | 1584 | int auth_done = 0; |
JMF | 12:0071cb144c7a | 1585 | #if defined(SSL_SOME_MODES_USE_MAC) |
JMF | 12:0071cb144c7a | 1586 | size_t padlen = 0, correct = 1; |
JMF | 12:0071cb144c7a | 1587 | #endif |
JMF | 12:0071cb144c7a | 1588 | |
JMF | 12:0071cb144c7a | 1589 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) ); |
JMF | 12:0071cb144c7a | 1590 | |
JMF | 12:0071cb144c7a | 1591 | if( ssl->session_in == NULL || ssl->transform_in == NULL ) |
JMF | 12:0071cb144c7a | 1592 | { |
JMF | 12:0071cb144c7a | 1593 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1594 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1595 | } |
JMF | 12:0071cb144c7a | 1596 | |
JMF | 12:0071cb144c7a | 1597 | mode = mbedtls_cipher_get_cipher_mode( &ssl->transform_in->cipher_ctx_dec ); |
JMF | 12:0071cb144c7a | 1598 | |
JMF | 12:0071cb144c7a | 1599 | if( ssl->in_msglen < ssl->transform_in->minlen ) |
JMF | 12:0071cb144c7a | 1600 | { |
JMF | 12:0071cb144c7a | 1601 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "in_msglen (%d) < minlen (%d)", |
JMF | 12:0071cb144c7a | 1602 | ssl->in_msglen, ssl->transform_in->minlen ) ); |
JMF | 12:0071cb144c7a | 1603 | return( MBEDTLS_ERR_SSL_INVALID_MAC ); |
JMF | 12:0071cb144c7a | 1604 | } |
JMF | 12:0071cb144c7a | 1605 | |
JMF | 12:0071cb144c7a | 1606 | #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER) |
JMF | 12:0071cb144c7a | 1607 | if( mode == MBEDTLS_MODE_STREAM ) |
JMF | 12:0071cb144c7a | 1608 | { |
JMF | 12:0071cb144c7a | 1609 | int ret; |
JMF | 12:0071cb144c7a | 1610 | size_t olen = 0; |
JMF | 12:0071cb144c7a | 1611 | |
JMF | 12:0071cb144c7a | 1612 | padlen = 0; |
JMF | 12:0071cb144c7a | 1613 | |
JMF | 12:0071cb144c7a | 1614 | if( ( ret = mbedtls_cipher_crypt( &ssl->transform_in->cipher_ctx_dec, |
JMF | 12:0071cb144c7a | 1615 | ssl->transform_in->iv_dec, |
JMF | 12:0071cb144c7a | 1616 | ssl->transform_in->ivlen, |
JMF | 12:0071cb144c7a | 1617 | ssl->in_msg, ssl->in_msglen, |
JMF | 12:0071cb144c7a | 1618 | ssl->in_msg, &olen ) ) != 0 ) |
JMF | 12:0071cb144c7a | 1619 | { |
JMF | 12:0071cb144c7a | 1620 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret ); |
JMF | 12:0071cb144c7a | 1621 | return( ret ); |
JMF | 12:0071cb144c7a | 1622 | } |
JMF | 12:0071cb144c7a | 1623 | |
JMF | 12:0071cb144c7a | 1624 | if( ssl->in_msglen != olen ) |
JMF | 12:0071cb144c7a | 1625 | { |
JMF | 12:0071cb144c7a | 1626 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1627 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1628 | } |
JMF | 12:0071cb144c7a | 1629 | } |
JMF | 12:0071cb144c7a | 1630 | else |
JMF | 12:0071cb144c7a | 1631 | #endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */ |
JMF | 12:0071cb144c7a | 1632 | #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C) |
JMF | 12:0071cb144c7a | 1633 | if( mode == MBEDTLS_MODE_GCM || |
JMF | 12:0071cb144c7a | 1634 | mode == MBEDTLS_MODE_CCM ) |
JMF | 12:0071cb144c7a | 1635 | { |
JMF | 12:0071cb144c7a | 1636 | int ret; |
JMF | 12:0071cb144c7a | 1637 | size_t dec_msglen, olen; |
JMF | 12:0071cb144c7a | 1638 | unsigned char *dec_msg; |
JMF | 12:0071cb144c7a | 1639 | unsigned char *dec_msg_result; |
JMF | 12:0071cb144c7a | 1640 | unsigned char add_data[13]; |
JMF | 12:0071cb144c7a | 1641 | unsigned char taglen = ssl->transform_in->ciphersuite_info->flags & |
JMF | 12:0071cb144c7a | 1642 | MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16; |
JMF | 12:0071cb144c7a | 1643 | size_t explicit_iv_len = ssl->transform_in->ivlen - |
JMF | 12:0071cb144c7a | 1644 | ssl->transform_in->fixed_ivlen; |
JMF | 12:0071cb144c7a | 1645 | |
JMF | 12:0071cb144c7a | 1646 | if( ssl->in_msglen < explicit_iv_len + taglen ) |
JMF | 12:0071cb144c7a | 1647 | { |
JMF | 12:0071cb144c7a | 1648 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < explicit_iv_len (%d) " |
JMF | 12:0071cb144c7a | 1649 | "+ taglen (%d)", ssl->in_msglen, |
JMF | 12:0071cb144c7a | 1650 | explicit_iv_len, taglen ) ); |
JMF | 12:0071cb144c7a | 1651 | return( MBEDTLS_ERR_SSL_INVALID_MAC ); |
JMF | 12:0071cb144c7a | 1652 | } |
JMF | 12:0071cb144c7a | 1653 | dec_msglen = ssl->in_msglen - explicit_iv_len - taglen; |
JMF | 12:0071cb144c7a | 1654 | |
JMF | 12:0071cb144c7a | 1655 | dec_msg = ssl->in_msg; |
JMF | 12:0071cb144c7a | 1656 | dec_msg_result = ssl->in_msg; |
JMF | 12:0071cb144c7a | 1657 | ssl->in_msglen = dec_msglen; |
JMF | 12:0071cb144c7a | 1658 | |
JMF | 12:0071cb144c7a | 1659 | memcpy( add_data, ssl->in_ctr, 8 ); |
JMF | 12:0071cb144c7a | 1660 | add_data[8] = ssl->in_msgtype; |
JMF | 12:0071cb144c7a | 1661 | mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver, |
JMF | 12:0071cb144c7a | 1662 | ssl->conf->transport, add_data + 9 ); |
JMF | 12:0071cb144c7a | 1663 | add_data[11] = ( ssl->in_msglen >> 8 ) & 0xFF; |
JMF | 12:0071cb144c7a | 1664 | add_data[12] = ssl->in_msglen & 0xFF; |
JMF | 12:0071cb144c7a | 1665 | |
JMF | 12:0071cb144c7a | 1666 | MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD", |
JMF | 12:0071cb144c7a | 1667 | add_data, 13 ); |
JMF | 12:0071cb144c7a | 1668 | |
JMF | 12:0071cb144c7a | 1669 | memcpy( ssl->transform_in->iv_dec + ssl->transform_in->fixed_ivlen, |
JMF | 12:0071cb144c7a | 1670 | ssl->in_iv, |
JMF | 12:0071cb144c7a | 1671 | ssl->transform_in->ivlen - ssl->transform_in->fixed_ivlen ); |
JMF | 12:0071cb144c7a | 1672 | |
JMF | 12:0071cb144c7a | 1673 | MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", ssl->transform_in->iv_dec, |
JMF | 12:0071cb144c7a | 1674 | ssl->transform_in->ivlen ); |
JMF | 12:0071cb144c7a | 1675 | MBEDTLS_SSL_DEBUG_BUF( 4, "TAG used", dec_msg + dec_msglen, taglen ); |
JMF | 12:0071cb144c7a | 1676 | |
JMF | 12:0071cb144c7a | 1677 | /* |
JMF | 12:0071cb144c7a | 1678 | * Decrypt and authenticate |
JMF | 12:0071cb144c7a | 1679 | */ |
JMF | 12:0071cb144c7a | 1680 | if( ( ret = mbedtls_cipher_auth_decrypt( &ssl->transform_in->cipher_ctx_dec, |
JMF | 12:0071cb144c7a | 1681 | ssl->transform_in->iv_dec, |
JMF | 12:0071cb144c7a | 1682 | ssl->transform_in->ivlen, |
JMF | 12:0071cb144c7a | 1683 | add_data, 13, |
JMF | 12:0071cb144c7a | 1684 | dec_msg, dec_msglen, |
JMF | 12:0071cb144c7a | 1685 | dec_msg_result, &olen, |
JMF | 12:0071cb144c7a | 1686 | dec_msg + dec_msglen, taglen ) ) != 0 ) |
JMF | 12:0071cb144c7a | 1687 | { |
JMF | 12:0071cb144c7a | 1688 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret ); |
JMF | 12:0071cb144c7a | 1689 | |
JMF | 12:0071cb144c7a | 1690 | if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED ) |
JMF | 12:0071cb144c7a | 1691 | return( MBEDTLS_ERR_SSL_INVALID_MAC ); |
JMF | 12:0071cb144c7a | 1692 | |
JMF | 12:0071cb144c7a | 1693 | return( ret ); |
JMF | 12:0071cb144c7a | 1694 | } |
JMF | 12:0071cb144c7a | 1695 | auth_done++; |
JMF | 12:0071cb144c7a | 1696 | |
JMF | 12:0071cb144c7a | 1697 | if( olen != dec_msglen ) |
JMF | 12:0071cb144c7a | 1698 | { |
JMF | 12:0071cb144c7a | 1699 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1700 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1701 | } |
JMF | 12:0071cb144c7a | 1702 | } |
JMF | 12:0071cb144c7a | 1703 | else |
JMF | 12:0071cb144c7a | 1704 | #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */ |
JMF | 12:0071cb144c7a | 1705 | #if defined(MBEDTLS_CIPHER_MODE_CBC) && \ |
JMF | 12:0071cb144c7a | 1706 | ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) ) |
JMF | 12:0071cb144c7a | 1707 | if( mode == MBEDTLS_MODE_CBC ) |
JMF | 12:0071cb144c7a | 1708 | { |
JMF | 12:0071cb144c7a | 1709 | /* |
JMF | 12:0071cb144c7a | 1710 | * Decrypt and check the padding |
JMF | 12:0071cb144c7a | 1711 | */ |
JMF | 12:0071cb144c7a | 1712 | int ret; |
JMF | 12:0071cb144c7a | 1713 | unsigned char *dec_msg; |
JMF | 12:0071cb144c7a | 1714 | unsigned char *dec_msg_result; |
JMF | 12:0071cb144c7a | 1715 | size_t dec_msglen; |
JMF | 12:0071cb144c7a | 1716 | size_t minlen = 0; |
JMF | 12:0071cb144c7a | 1717 | size_t olen = 0; |
JMF | 12:0071cb144c7a | 1718 | |
JMF | 12:0071cb144c7a | 1719 | /* |
JMF | 12:0071cb144c7a | 1720 | * Check immediate ciphertext sanity |
JMF | 12:0071cb144c7a | 1721 | */ |
JMF | 12:0071cb144c7a | 1722 | #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 1723 | if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 ) |
JMF | 12:0071cb144c7a | 1724 | minlen += ssl->transform_in->ivlen; |
JMF | 12:0071cb144c7a | 1725 | #endif |
JMF | 12:0071cb144c7a | 1726 | |
JMF | 12:0071cb144c7a | 1727 | if( ssl->in_msglen < minlen + ssl->transform_in->ivlen || |
JMF | 12:0071cb144c7a | 1728 | ssl->in_msglen < minlen + ssl->transform_in->maclen + 1 ) |
JMF | 12:0071cb144c7a | 1729 | { |
JMF | 12:0071cb144c7a | 1730 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < max( ivlen(%d), maclen (%d) " |
JMF | 12:0071cb144c7a | 1731 | "+ 1 ) ( + expl IV )", ssl->in_msglen, |
JMF | 12:0071cb144c7a | 1732 | ssl->transform_in->ivlen, |
JMF | 12:0071cb144c7a | 1733 | ssl->transform_in->maclen ) ); |
JMF | 12:0071cb144c7a | 1734 | return( MBEDTLS_ERR_SSL_INVALID_MAC ); |
JMF | 12:0071cb144c7a | 1735 | } |
JMF | 12:0071cb144c7a | 1736 | |
JMF | 12:0071cb144c7a | 1737 | dec_msglen = ssl->in_msglen; |
JMF | 12:0071cb144c7a | 1738 | dec_msg = ssl->in_msg; |
JMF | 12:0071cb144c7a | 1739 | dec_msg_result = ssl->in_msg; |
JMF | 12:0071cb144c7a | 1740 | |
JMF | 12:0071cb144c7a | 1741 | /* |
JMF | 12:0071cb144c7a | 1742 | * Authenticate before decrypt if enabled |
JMF | 12:0071cb144c7a | 1743 | */ |
JMF | 12:0071cb144c7a | 1744 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
JMF | 12:0071cb144c7a | 1745 | if( ssl->session_in->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED ) |
JMF | 12:0071cb144c7a | 1746 | { |
JMF | 12:0071cb144c7a | 1747 | unsigned char computed_mac[SSL_MAX_MAC_SIZE]; |
JMF | 12:0071cb144c7a | 1748 | unsigned char pseudo_hdr[13]; |
JMF | 12:0071cb144c7a | 1749 | |
JMF | 12:0071cb144c7a | 1750 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) ); |
JMF | 12:0071cb144c7a | 1751 | |
JMF | 12:0071cb144c7a | 1752 | dec_msglen -= ssl->transform_in->maclen; |
JMF | 12:0071cb144c7a | 1753 | ssl->in_msglen -= ssl->transform_in->maclen; |
JMF | 12:0071cb144c7a | 1754 | |
JMF | 12:0071cb144c7a | 1755 | memcpy( pseudo_hdr + 0, ssl->in_ctr, 8 ); |
JMF | 12:0071cb144c7a | 1756 | memcpy( pseudo_hdr + 8, ssl->in_hdr, 3 ); |
JMF | 12:0071cb144c7a | 1757 | pseudo_hdr[11] = (unsigned char)( ( ssl->in_msglen >> 8 ) & 0xFF ); |
JMF | 12:0071cb144c7a | 1758 | pseudo_hdr[12] = (unsigned char)( ( ssl->in_msglen ) & 0xFF ); |
JMF | 12:0071cb144c7a | 1759 | |
JMF | 12:0071cb144c7a | 1760 | MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", pseudo_hdr, 13 ); |
JMF | 12:0071cb144c7a | 1761 | |
JMF | 12:0071cb144c7a | 1762 | mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, pseudo_hdr, 13 ); |
JMF | 12:0071cb144c7a | 1763 | mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, |
JMF | 12:0071cb144c7a | 1764 | ssl->in_iv, ssl->in_msglen ); |
JMF | 12:0071cb144c7a | 1765 | mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, computed_mac ); |
JMF | 12:0071cb144c7a | 1766 | mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec ); |
JMF | 12:0071cb144c7a | 1767 | |
JMF | 12:0071cb144c7a | 1768 | MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", ssl->in_iv + ssl->in_msglen, |
JMF | 12:0071cb144c7a | 1769 | ssl->transform_in->maclen ); |
JMF | 12:0071cb144c7a | 1770 | MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", computed_mac, |
JMF | 12:0071cb144c7a | 1771 | ssl->transform_in->maclen ); |
JMF | 12:0071cb144c7a | 1772 | |
JMF | 12:0071cb144c7a | 1773 | if( mbedtls_ssl_safer_memcmp( ssl->in_iv + ssl->in_msglen, computed_mac, |
JMF | 12:0071cb144c7a | 1774 | ssl->transform_in->maclen ) != 0 ) |
JMF | 12:0071cb144c7a | 1775 | { |
JMF | 12:0071cb144c7a | 1776 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) ); |
JMF | 12:0071cb144c7a | 1777 | |
JMF | 12:0071cb144c7a | 1778 | return( MBEDTLS_ERR_SSL_INVALID_MAC ); |
JMF | 12:0071cb144c7a | 1779 | } |
JMF | 12:0071cb144c7a | 1780 | auth_done++; |
JMF | 12:0071cb144c7a | 1781 | } |
JMF | 12:0071cb144c7a | 1782 | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
JMF | 12:0071cb144c7a | 1783 | |
JMF | 12:0071cb144c7a | 1784 | /* |
JMF | 12:0071cb144c7a | 1785 | * Check length sanity |
JMF | 12:0071cb144c7a | 1786 | */ |
JMF | 12:0071cb144c7a | 1787 | if( ssl->in_msglen % ssl->transform_in->ivlen != 0 ) |
JMF | 12:0071cb144c7a | 1788 | { |
JMF | 12:0071cb144c7a | 1789 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0", |
JMF | 12:0071cb144c7a | 1790 | ssl->in_msglen, ssl->transform_in->ivlen ) ); |
JMF | 12:0071cb144c7a | 1791 | return( MBEDTLS_ERR_SSL_INVALID_MAC ); |
JMF | 12:0071cb144c7a | 1792 | } |
JMF | 12:0071cb144c7a | 1793 | |
JMF | 12:0071cb144c7a | 1794 | #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 1795 | /* |
JMF | 12:0071cb144c7a | 1796 | * Initialize for prepended IV for block cipher in TLS v1.1 and up |
JMF | 12:0071cb144c7a | 1797 | */ |
JMF | 12:0071cb144c7a | 1798 | if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 ) |
JMF | 12:0071cb144c7a | 1799 | { |
JMF | 12:0071cb144c7a | 1800 | dec_msglen -= ssl->transform_in->ivlen; |
JMF | 12:0071cb144c7a | 1801 | ssl->in_msglen -= ssl->transform_in->ivlen; |
JMF | 12:0071cb144c7a | 1802 | |
JMF | 12:0071cb144c7a | 1803 | for( i = 0; i < ssl->transform_in->ivlen; i++ ) |
JMF | 12:0071cb144c7a | 1804 | ssl->transform_in->iv_dec[i] = ssl->in_iv[i]; |
JMF | 12:0071cb144c7a | 1805 | } |
JMF | 12:0071cb144c7a | 1806 | #endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 1807 | |
JMF | 12:0071cb144c7a | 1808 | if( ( ret = mbedtls_cipher_crypt( &ssl->transform_in->cipher_ctx_dec, |
JMF | 12:0071cb144c7a | 1809 | ssl->transform_in->iv_dec, |
JMF | 12:0071cb144c7a | 1810 | ssl->transform_in->ivlen, |
JMF | 12:0071cb144c7a | 1811 | dec_msg, dec_msglen, |
JMF | 12:0071cb144c7a | 1812 | dec_msg_result, &olen ) ) != 0 ) |
JMF | 12:0071cb144c7a | 1813 | { |
JMF | 12:0071cb144c7a | 1814 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret ); |
JMF | 12:0071cb144c7a | 1815 | return( ret ); |
JMF | 12:0071cb144c7a | 1816 | } |
JMF | 12:0071cb144c7a | 1817 | |
JMF | 12:0071cb144c7a | 1818 | if( dec_msglen != olen ) |
JMF | 12:0071cb144c7a | 1819 | { |
JMF | 12:0071cb144c7a | 1820 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1821 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1822 | } |
JMF | 12:0071cb144c7a | 1823 | |
JMF | 12:0071cb144c7a | 1824 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) |
JMF | 12:0071cb144c7a | 1825 | if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 ) |
JMF | 12:0071cb144c7a | 1826 | { |
JMF | 12:0071cb144c7a | 1827 | /* |
JMF | 12:0071cb144c7a | 1828 | * Save IV in SSL3 and TLS1 |
JMF | 12:0071cb144c7a | 1829 | */ |
JMF | 12:0071cb144c7a | 1830 | memcpy( ssl->transform_in->iv_dec, |
JMF | 12:0071cb144c7a | 1831 | ssl->transform_in->cipher_ctx_dec.iv, |
JMF | 12:0071cb144c7a | 1832 | ssl->transform_in->ivlen ); |
JMF | 12:0071cb144c7a | 1833 | } |
JMF | 12:0071cb144c7a | 1834 | #endif |
JMF | 12:0071cb144c7a | 1835 | |
JMF | 12:0071cb144c7a | 1836 | padlen = 1 + ssl->in_msg[ssl->in_msglen - 1]; |
JMF | 12:0071cb144c7a | 1837 | |
JMF | 12:0071cb144c7a | 1838 | if( ssl->in_msglen < ssl->transform_in->maclen + padlen && |
JMF | 12:0071cb144c7a | 1839 | auth_done == 0 ) |
JMF | 12:0071cb144c7a | 1840 | { |
JMF | 12:0071cb144c7a | 1841 | #if defined(MBEDTLS_SSL_DEBUG_ALL) |
JMF | 12:0071cb144c7a | 1842 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)", |
JMF | 12:0071cb144c7a | 1843 | ssl->in_msglen, ssl->transform_in->maclen, padlen ) ); |
JMF | 12:0071cb144c7a | 1844 | #endif |
JMF | 12:0071cb144c7a | 1845 | padlen = 0; |
JMF | 12:0071cb144c7a | 1846 | correct = 0; |
JMF | 12:0071cb144c7a | 1847 | } |
JMF | 12:0071cb144c7a | 1848 | |
JMF | 12:0071cb144c7a | 1849 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 1850 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
JMF | 12:0071cb144c7a | 1851 | { |
JMF | 12:0071cb144c7a | 1852 | if( padlen > ssl->transform_in->ivlen ) |
JMF | 12:0071cb144c7a | 1853 | { |
JMF | 12:0071cb144c7a | 1854 | #if defined(MBEDTLS_SSL_DEBUG_ALL) |
JMF | 12:0071cb144c7a | 1855 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, " |
JMF | 12:0071cb144c7a | 1856 | "should be no more than %d", |
JMF | 12:0071cb144c7a | 1857 | padlen, ssl->transform_in->ivlen ) ); |
JMF | 12:0071cb144c7a | 1858 | #endif |
JMF | 12:0071cb144c7a | 1859 | correct = 0; |
JMF | 12:0071cb144c7a | 1860 | } |
JMF | 12:0071cb144c7a | 1861 | } |
JMF | 12:0071cb144c7a | 1862 | else |
JMF | 12:0071cb144c7a | 1863 | #endif /* MBEDTLS_SSL_PROTO_SSL3 */ |
JMF | 12:0071cb144c7a | 1864 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
JMF | 12:0071cb144c7a | 1865 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 1866 | if( ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_0 ) |
JMF | 12:0071cb144c7a | 1867 | { |
JMF | 12:0071cb144c7a | 1868 | /* |
JMF | 12:0071cb144c7a | 1869 | * TLSv1+: always check the padding up to the first failure |
JMF | 12:0071cb144c7a | 1870 | * and fake check up to 256 bytes of padding |
JMF | 12:0071cb144c7a | 1871 | */ |
JMF | 12:0071cb144c7a | 1872 | size_t pad_count = 0, real_count = 1; |
JMF | 12:0071cb144c7a | 1873 | size_t padding_idx = ssl->in_msglen - padlen - 1; |
JMF | 12:0071cb144c7a | 1874 | |
JMF | 12:0071cb144c7a | 1875 | /* |
JMF | 12:0071cb144c7a | 1876 | * Padding is guaranteed to be incorrect if: |
JMF | 12:0071cb144c7a | 1877 | * 1. padlen >= ssl->in_msglen |
JMF | 12:0071cb144c7a | 1878 | * |
JMF | 12:0071cb144c7a | 1879 | * 2. padding_idx >= MBEDTLS_SSL_MAX_CONTENT_LEN + |
JMF | 12:0071cb144c7a | 1880 | * ssl->transform_in->maclen |
JMF | 12:0071cb144c7a | 1881 | * |
JMF | 12:0071cb144c7a | 1882 | * In both cases we reset padding_idx to a safe value (0) to |
JMF | 12:0071cb144c7a | 1883 | * prevent out-of-buffer reads. |
JMF | 12:0071cb144c7a | 1884 | */ |
JMF | 12:0071cb144c7a | 1885 | correct &= ( ssl->in_msglen >= padlen + 1 ); |
JMF | 12:0071cb144c7a | 1886 | correct &= ( padding_idx < MBEDTLS_SSL_MAX_CONTENT_LEN + |
JMF | 12:0071cb144c7a | 1887 | ssl->transform_in->maclen ); |
JMF | 12:0071cb144c7a | 1888 | |
JMF | 12:0071cb144c7a | 1889 | padding_idx *= correct; |
JMF | 12:0071cb144c7a | 1890 | |
JMF | 12:0071cb144c7a | 1891 | for( i = 1; i <= 256; i++ ) |
JMF | 12:0071cb144c7a | 1892 | { |
JMF | 12:0071cb144c7a | 1893 | real_count &= ( i <= padlen ); |
JMF | 12:0071cb144c7a | 1894 | pad_count += real_count * |
JMF | 12:0071cb144c7a | 1895 | ( ssl->in_msg[padding_idx + i] == padlen - 1 ); |
JMF | 12:0071cb144c7a | 1896 | } |
JMF | 12:0071cb144c7a | 1897 | |
JMF | 12:0071cb144c7a | 1898 | correct &= ( pad_count == padlen ); /* Only 1 on correct padding */ |
JMF | 12:0071cb144c7a | 1899 | |
JMF | 12:0071cb144c7a | 1900 | #if defined(MBEDTLS_SSL_DEBUG_ALL) |
JMF | 12:0071cb144c7a | 1901 | if( padlen > 0 && correct == 0 ) |
JMF | 12:0071cb144c7a | 1902 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) ); |
JMF | 12:0071cb144c7a | 1903 | #endif |
JMF | 12:0071cb144c7a | 1904 | padlen &= correct * 0x1FF; |
JMF | 12:0071cb144c7a | 1905 | } |
JMF | 12:0071cb144c7a | 1906 | else |
JMF | 12:0071cb144c7a | 1907 | #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \ |
JMF | 12:0071cb144c7a | 1908 | MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 1909 | { |
JMF | 12:0071cb144c7a | 1910 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1911 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1912 | } |
JMF | 12:0071cb144c7a | 1913 | |
JMF | 12:0071cb144c7a | 1914 | ssl->in_msglen -= padlen; |
JMF | 12:0071cb144c7a | 1915 | } |
JMF | 12:0071cb144c7a | 1916 | else |
JMF | 12:0071cb144c7a | 1917 | #endif /* MBEDTLS_CIPHER_MODE_CBC && |
JMF | 12:0071cb144c7a | 1918 | ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C ) */ |
JMF | 12:0071cb144c7a | 1919 | { |
JMF | 12:0071cb144c7a | 1920 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1921 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1922 | } |
JMF | 12:0071cb144c7a | 1923 | |
JMF | 12:0071cb144c7a | 1924 | MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption", |
JMF | 12:0071cb144c7a | 1925 | ssl->in_msg, ssl->in_msglen ); |
JMF | 12:0071cb144c7a | 1926 | |
JMF | 12:0071cb144c7a | 1927 | /* |
JMF | 12:0071cb144c7a | 1928 | * Authenticate if not done yet. |
JMF | 12:0071cb144c7a | 1929 | * Compute the MAC regardless of the padding result (RFC4346, CBCTIME). |
JMF | 12:0071cb144c7a | 1930 | */ |
JMF | 12:0071cb144c7a | 1931 | #if defined(SSL_SOME_MODES_USE_MAC) |
JMF | 12:0071cb144c7a | 1932 | if( auth_done == 0 ) |
JMF | 12:0071cb144c7a | 1933 | { |
JMF | 12:0071cb144c7a | 1934 | unsigned char tmp[SSL_MAX_MAC_SIZE]; |
JMF | 12:0071cb144c7a | 1935 | |
JMF | 12:0071cb144c7a | 1936 | ssl->in_msglen -= ssl->transform_in->maclen; |
JMF | 12:0071cb144c7a | 1937 | |
JMF | 12:0071cb144c7a | 1938 | ssl->in_len[0] = (unsigned char)( ssl->in_msglen >> 8 ); |
JMF | 12:0071cb144c7a | 1939 | ssl->in_len[1] = (unsigned char)( ssl->in_msglen ); |
JMF | 12:0071cb144c7a | 1940 | |
JMF | 12:0071cb144c7a | 1941 | memcpy( tmp, ssl->in_msg + ssl->in_msglen, ssl->transform_in->maclen ); |
JMF | 12:0071cb144c7a | 1942 | |
JMF | 12:0071cb144c7a | 1943 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 1944 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
JMF | 12:0071cb144c7a | 1945 | { |
JMF | 12:0071cb144c7a | 1946 | ssl_mac( &ssl->transform_in->md_ctx_dec, |
JMF | 12:0071cb144c7a | 1947 | ssl->transform_in->mac_dec, |
JMF | 12:0071cb144c7a | 1948 | ssl->in_msg, ssl->in_msglen, |
JMF | 12:0071cb144c7a | 1949 | ssl->in_ctr, ssl->in_msgtype ); |
JMF | 12:0071cb144c7a | 1950 | } |
JMF | 12:0071cb144c7a | 1951 | else |
JMF | 12:0071cb144c7a | 1952 | #endif /* MBEDTLS_SSL_PROTO_SSL3 */ |
JMF | 12:0071cb144c7a | 1953 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
JMF | 12:0071cb144c7a | 1954 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 1955 | if( ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_0 ) |
JMF | 12:0071cb144c7a | 1956 | { |
JMF | 12:0071cb144c7a | 1957 | /* |
JMF | 12:0071cb144c7a | 1958 | * Process MAC and always update for padlen afterwards to make |
JMF | 12:0071cb144c7a | 1959 | * total time independent of padlen |
JMF | 12:0071cb144c7a | 1960 | * |
JMF | 12:0071cb144c7a | 1961 | * extra_run compensates MAC check for padlen |
JMF | 12:0071cb144c7a | 1962 | * |
JMF | 12:0071cb144c7a | 1963 | * Known timing attacks: |
JMF | 12:0071cb144c7a | 1964 | * - Lucky Thirteen (http://www.isg.rhul.ac.uk/tls/TLStiming.pdf) |
JMF | 12:0071cb144c7a | 1965 | * |
JMF | 12:0071cb144c7a | 1966 | * We use ( ( Lx + 8 ) / 64 ) to handle 'negative Lx' values |
JMF | 12:0071cb144c7a | 1967 | * correctly. (We round down instead of up, so -56 is the correct |
JMF | 12:0071cb144c7a | 1968 | * value for our calculations instead of -55) |
JMF | 12:0071cb144c7a | 1969 | */ |
JMF | 12:0071cb144c7a | 1970 | size_t j, extra_run = 0; |
JMF | 12:0071cb144c7a | 1971 | extra_run = ( 13 + ssl->in_msglen + padlen + 8 ) / 64 - |
JMF | 12:0071cb144c7a | 1972 | ( 13 + ssl->in_msglen + 8 ) / 64; |
JMF | 12:0071cb144c7a | 1973 | |
JMF | 12:0071cb144c7a | 1974 | extra_run &= correct * 0xFF; |
JMF | 12:0071cb144c7a | 1975 | |
JMF | 12:0071cb144c7a | 1976 | mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_ctr, 8 ); |
JMF | 12:0071cb144c7a | 1977 | mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_hdr, 3 ); |
JMF | 12:0071cb144c7a | 1978 | mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_len, 2 ); |
JMF | 12:0071cb144c7a | 1979 | mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_msg, |
JMF | 12:0071cb144c7a | 1980 | ssl->in_msglen ); |
JMF | 12:0071cb144c7a | 1981 | mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, |
JMF | 12:0071cb144c7a | 1982 | ssl->in_msg + ssl->in_msglen ); |
JMF | 12:0071cb144c7a | 1983 | /* Call mbedtls_md_process at least once due to cache attacks */ |
JMF | 12:0071cb144c7a | 1984 | for( j = 0; j < extra_run + 1; j++ ) |
JMF | 12:0071cb144c7a | 1985 | mbedtls_md_process( &ssl->transform_in->md_ctx_dec, ssl->in_msg ); |
JMF | 12:0071cb144c7a | 1986 | |
JMF | 12:0071cb144c7a | 1987 | mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec ); |
JMF | 12:0071cb144c7a | 1988 | } |
JMF | 12:0071cb144c7a | 1989 | else |
JMF | 12:0071cb144c7a | 1990 | #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \ |
JMF | 12:0071cb144c7a | 1991 | MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 1992 | { |
JMF | 12:0071cb144c7a | 1993 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 1994 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 1995 | } |
JMF | 12:0071cb144c7a | 1996 | |
JMF | 12:0071cb144c7a | 1997 | MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", tmp, ssl->transform_in->maclen ); |
JMF | 12:0071cb144c7a | 1998 | MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", ssl->in_msg + ssl->in_msglen, |
JMF | 12:0071cb144c7a | 1999 | ssl->transform_in->maclen ); |
JMF | 12:0071cb144c7a | 2000 | |
JMF | 12:0071cb144c7a | 2001 | if( mbedtls_ssl_safer_memcmp( tmp, ssl->in_msg + ssl->in_msglen, |
JMF | 12:0071cb144c7a | 2002 | ssl->transform_in->maclen ) != 0 ) |
JMF | 12:0071cb144c7a | 2003 | { |
JMF | 12:0071cb144c7a | 2004 | #if defined(MBEDTLS_SSL_DEBUG_ALL) |
JMF | 12:0071cb144c7a | 2005 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) ); |
JMF | 12:0071cb144c7a | 2006 | #endif |
JMF | 12:0071cb144c7a | 2007 | correct = 0; |
JMF | 12:0071cb144c7a | 2008 | } |
JMF | 12:0071cb144c7a | 2009 | auth_done++; |
JMF | 12:0071cb144c7a | 2010 | |
JMF | 12:0071cb144c7a | 2011 | /* |
JMF | 12:0071cb144c7a | 2012 | * Finally check the correct flag |
JMF | 12:0071cb144c7a | 2013 | */ |
JMF | 12:0071cb144c7a | 2014 | if( correct == 0 ) |
JMF | 12:0071cb144c7a | 2015 | return( MBEDTLS_ERR_SSL_INVALID_MAC ); |
JMF | 12:0071cb144c7a | 2016 | } |
JMF | 12:0071cb144c7a | 2017 | #endif /* SSL_SOME_MODES_USE_MAC */ |
JMF | 12:0071cb144c7a | 2018 | |
JMF | 12:0071cb144c7a | 2019 | /* Make extra sure authentication was performed, exactly once */ |
JMF | 12:0071cb144c7a | 2020 | if( auth_done != 1 ) |
JMF | 12:0071cb144c7a | 2021 | { |
JMF | 12:0071cb144c7a | 2022 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 2023 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 2024 | } |
JMF | 12:0071cb144c7a | 2025 | |
JMF | 12:0071cb144c7a | 2026 | if( ssl->in_msglen == 0 ) |
JMF | 12:0071cb144c7a | 2027 | { |
JMF | 12:0071cb144c7a | 2028 | ssl->nb_zero++; |
JMF | 12:0071cb144c7a | 2029 | |
JMF | 12:0071cb144c7a | 2030 | /* |
JMF | 12:0071cb144c7a | 2031 | * Three or more empty messages may be a DoS attack |
JMF | 12:0071cb144c7a | 2032 | * (excessive CPU consumption). |
JMF | 12:0071cb144c7a | 2033 | */ |
JMF | 12:0071cb144c7a | 2034 | if( ssl->nb_zero > 3 ) |
JMF | 12:0071cb144c7a | 2035 | { |
JMF | 12:0071cb144c7a | 2036 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty " |
JMF | 12:0071cb144c7a | 2037 | "messages, possible DoS attack" ) ); |
JMF | 12:0071cb144c7a | 2038 | return( MBEDTLS_ERR_SSL_INVALID_MAC ); |
JMF | 12:0071cb144c7a | 2039 | } |
JMF | 12:0071cb144c7a | 2040 | } |
JMF | 12:0071cb144c7a | 2041 | else |
JMF | 12:0071cb144c7a | 2042 | ssl->nb_zero = 0; |
JMF | 12:0071cb144c7a | 2043 | |
JMF | 12:0071cb144c7a | 2044 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 2045 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 2046 | { |
JMF | 12:0071cb144c7a | 2047 | ; /* in_ctr read from peer, not maintained internally */ |
JMF | 12:0071cb144c7a | 2048 | } |
JMF | 12:0071cb144c7a | 2049 | else |
JMF | 12:0071cb144c7a | 2050 | #endif |
JMF | 12:0071cb144c7a | 2051 | { |
JMF | 12:0071cb144c7a | 2052 | for( i = 8; i > ssl_ep_len( ssl ); i-- ) |
JMF | 12:0071cb144c7a | 2053 | if( ++ssl->in_ctr[i - 1] != 0 ) |
JMF | 12:0071cb144c7a | 2054 | break; |
JMF | 12:0071cb144c7a | 2055 | |
JMF | 12:0071cb144c7a | 2056 | /* The loop goes to its end iff the counter is wrapping */ |
JMF | 12:0071cb144c7a | 2057 | if( i == ssl_ep_len( ssl ) ) |
JMF | 12:0071cb144c7a | 2058 | { |
JMF | 12:0071cb144c7a | 2059 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) ); |
JMF | 12:0071cb144c7a | 2060 | return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING ); |
JMF | 12:0071cb144c7a | 2061 | } |
JMF | 12:0071cb144c7a | 2062 | } |
JMF | 12:0071cb144c7a | 2063 | |
JMF | 12:0071cb144c7a | 2064 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) ); |
JMF | 12:0071cb144c7a | 2065 | |
JMF | 12:0071cb144c7a | 2066 | return( 0 ); |
JMF | 12:0071cb144c7a | 2067 | } |
JMF | 12:0071cb144c7a | 2068 | |
JMF | 12:0071cb144c7a | 2069 | #undef MAC_NONE |
JMF | 12:0071cb144c7a | 2070 | #undef MAC_PLAINTEXT |
JMF | 12:0071cb144c7a | 2071 | #undef MAC_CIPHERTEXT |
JMF | 12:0071cb144c7a | 2072 | |
JMF | 12:0071cb144c7a | 2073 | #if defined(MBEDTLS_ZLIB_SUPPORT) |
JMF | 12:0071cb144c7a | 2074 | /* |
JMF | 12:0071cb144c7a | 2075 | * Compression/decompression functions |
JMF | 12:0071cb144c7a | 2076 | */ |
JMF | 12:0071cb144c7a | 2077 | static int ssl_compress_buf( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 2078 | { |
JMF | 12:0071cb144c7a | 2079 | int ret; |
JMF | 12:0071cb144c7a | 2080 | unsigned char *msg_post = ssl->out_msg; |
JMF | 12:0071cb144c7a | 2081 | size_t len_pre = ssl->out_msglen; |
JMF | 12:0071cb144c7a | 2082 | unsigned char *msg_pre = ssl->compress_buf; |
JMF | 12:0071cb144c7a | 2083 | |
JMF | 12:0071cb144c7a | 2084 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> compress buf" ) ); |
JMF | 12:0071cb144c7a | 2085 | |
JMF | 12:0071cb144c7a | 2086 | if( len_pre == 0 ) |
JMF | 12:0071cb144c7a | 2087 | return( 0 ); |
JMF | 12:0071cb144c7a | 2088 | |
JMF | 12:0071cb144c7a | 2089 | memcpy( msg_pre, ssl->out_msg, len_pre ); |
JMF | 12:0071cb144c7a | 2090 | |
JMF | 12:0071cb144c7a | 2091 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "before compression: msglen = %d, ", |
JMF | 12:0071cb144c7a | 2092 | ssl->out_msglen ) ); |
JMF | 12:0071cb144c7a | 2093 | |
JMF | 12:0071cb144c7a | 2094 | MBEDTLS_SSL_DEBUG_BUF( 4, "before compression: output payload", |
JMF | 12:0071cb144c7a | 2095 | ssl->out_msg, ssl->out_msglen ); |
JMF | 12:0071cb144c7a | 2096 | |
JMF | 12:0071cb144c7a | 2097 | ssl->transform_out->ctx_deflate.next_in = msg_pre; |
JMF | 12:0071cb144c7a | 2098 | ssl->transform_out->ctx_deflate.avail_in = len_pre; |
JMF | 12:0071cb144c7a | 2099 | ssl->transform_out->ctx_deflate.next_out = msg_post; |
JMF | 12:0071cb144c7a | 2100 | ssl->transform_out->ctx_deflate.avail_out = MBEDTLS_SSL_BUFFER_LEN; |
JMF | 12:0071cb144c7a | 2101 | |
JMF | 12:0071cb144c7a | 2102 | ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH ); |
JMF | 12:0071cb144c7a | 2103 | if( ret != Z_OK ) |
JMF | 12:0071cb144c7a | 2104 | { |
JMF | 12:0071cb144c7a | 2105 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform compression (%d)", ret ) ); |
JMF | 12:0071cb144c7a | 2106 | return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED ); |
JMF | 12:0071cb144c7a | 2107 | } |
JMF | 12:0071cb144c7a | 2108 | |
JMF | 12:0071cb144c7a | 2109 | ssl->out_msglen = MBEDTLS_SSL_BUFFER_LEN - |
JMF | 12:0071cb144c7a | 2110 | ssl->transform_out->ctx_deflate.avail_out; |
JMF | 12:0071cb144c7a | 2111 | |
JMF | 12:0071cb144c7a | 2112 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ", |
JMF | 12:0071cb144c7a | 2113 | ssl->out_msglen ) ); |
JMF | 12:0071cb144c7a | 2114 | |
JMF | 12:0071cb144c7a | 2115 | MBEDTLS_SSL_DEBUG_BUF( 4, "after compression: output payload", |
JMF | 12:0071cb144c7a | 2116 | ssl->out_msg, ssl->out_msglen ); |
JMF | 12:0071cb144c7a | 2117 | |
JMF | 12:0071cb144c7a | 2118 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= compress buf" ) ); |
JMF | 12:0071cb144c7a | 2119 | |
JMF | 12:0071cb144c7a | 2120 | return( 0 ); |
JMF | 12:0071cb144c7a | 2121 | } |
JMF | 12:0071cb144c7a | 2122 | |
JMF | 12:0071cb144c7a | 2123 | static int ssl_decompress_buf( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 2124 | { |
JMF | 12:0071cb144c7a | 2125 | int ret; |
JMF | 12:0071cb144c7a | 2126 | unsigned char *msg_post = ssl->in_msg; |
JMF | 12:0071cb144c7a | 2127 | size_t len_pre = ssl->in_msglen; |
JMF | 12:0071cb144c7a | 2128 | unsigned char *msg_pre = ssl->compress_buf; |
JMF | 12:0071cb144c7a | 2129 | |
JMF | 12:0071cb144c7a | 2130 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decompress buf" ) ); |
JMF | 12:0071cb144c7a | 2131 | |
JMF | 12:0071cb144c7a | 2132 | if( len_pre == 0 ) |
JMF | 12:0071cb144c7a | 2133 | return( 0 ); |
JMF | 12:0071cb144c7a | 2134 | |
JMF | 12:0071cb144c7a | 2135 | memcpy( msg_pre, ssl->in_msg, len_pre ); |
JMF | 12:0071cb144c7a | 2136 | |
JMF | 12:0071cb144c7a | 2137 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "before decompression: msglen = %d, ", |
JMF | 12:0071cb144c7a | 2138 | ssl->in_msglen ) ); |
JMF | 12:0071cb144c7a | 2139 | |
JMF | 12:0071cb144c7a | 2140 | MBEDTLS_SSL_DEBUG_BUF( 4, "before decompression: input payload", |
JMF | 12:0071cb144c7a | 2141 | ssl->in_msg, ssl->in_msglen ); |
JMF | 12:0071cb144c7a | 2142 | |
JMF | 12:0071cb144c7a | 2143 | ssl->transform_in->ctx_inflate.next_in = msg_pre; |
JMF | 12:0071cb144c7a | 2144 | ssl->transform_in->ctx_inflate.avail_in = len_pre; |
JMF | 12:0071cb144c7a | 2145 | ssl->transform_in->ctx_inflate.next_out = msg_post; |
JMF | 12:0071cb144c7a | 2146 | ssl->transform_in->ctx_inflate.avail_out = MBEDTLS_SSL_MAX_CONTENT_LEN; |
JMF | 12:0071cb144c7a | 2147 | |
JMF | 12:0071cb144c7a | 2148 | ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH ); |
JMF | 12:0071cb144c7a | 2149 | if( ret != Z_OK ) |
JMF | 12:0071cb144c7a | 2150 | { |
JMF | 12:0071cb144c7a | 2151 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform decompression (%d)", ret ) ); |
JMF | 12:0071cb144c7a | 2152 | return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED ); |
JMF | 12:0071cb144c7a | 2153 | } |
JMF | 12:0071cb144c7a | 2154 | |
JMF | 12:0071cb144c7a | 2155 | ssl->in_msglen = MBEDTLS_SSL_MAX_CONTENT_LEN - |
JMF | 12:0071cb144c7a | 2156 | ssl->transform_in->ctx_inflate.avail_out; |
JMF | 12:0071cb144c7a | 2157 | |
JMF | 12:0071cb144c7a | 2158 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ", |
JMF | 12:0071cb144c7a | 2159 | ssl->in_msglen ) ); |
JMF | 12:0071cb144c7a | 2160 | |
JMF | 12:0071cb144c7a | 2161 | MBEDTLS_SSL_DEBUG_BUF( 4, "after decompression: input payload", |
JMF | 12:0071cb144c7a | 2162 | ssl->in_msg, ssl->in_msglen ); |
JMF | 12:0071cb144c7a | 2163 | |
JMF | 12:0071cb144c7a | 2164 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decompress buf" ) ); |
JMF | 12:0071cb144c7a | 2165 | |
JMF | 12:0071cb144c7a | 2166 | return( 0 ); |
JMF | 12:0071cb144c7a | 2167 | } |
JMF | 12:0071cb144c7a | 2168 | #endif /* MBEDTLS_ZLIB_SUPPORT */ |
JMF | 12:0071cb144c7a | 2169 | |
JMF | 12:0071cb144c7a | 2170 | #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 2171 | static int ssl_write_hello_request( mbedtls_ssl_context *ssl ); |
JMF | 12:0071cb144c7a | 2172 | |
JMF | 12:0071cb144c7a | 2173 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 2174 | static int ssl_resend_hello_request( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 2175 | { |
JMF | 12:0071cb144c7a | 2176 | /* If renegotiation is not enforced, retransmit until we would reach max |
JMF | 12:0071cb144c7a | 2177 | * timeout if we were using the usual handshake doubling scheme */ |
JMF | 12:0071cb144c7a | 2178 | if( ssl->conf->renego_max_records < 0 ) |
JMF | 12:0071cb144c7a | 2179 | { |
JMF | 12:0071cb144c7a | 2180 | uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1; |
JMF | 12:0071cb144c7a | 2181 | unsigned char doublings = 1; |
JMF | 12:0071cb144c7a | 2182 | |
JMF | 12:0071cb144c7a | 2183 | while( ratio != 0 ) |
JMF | 12:0071cb144c7a | 2184 | { |
JMF | 12:0071cb144c7a | 2185 | ++doublings; |
JMF | 12:0071cb144c7a | 2186 | ratio >>= 1; |
JMF | 12:0071cb144c7a | 2187 | } |
JMF | 12:0071cb144c7a | 2188 | |
JMF | 12:0071cb144c7a | 2189 | if( ++ssl->renego_records_seen > doublings ) |
JMF | 12:0071cb144c7a | 2190 | { |
JMF | 12:0071cb144c7a | 2191 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) ); |
JMF | 12:0071cb144c7a | 2192 | return( 0 ); |
JMF | 12:0071cb144c7a | 2193 | } |
JMF | 12:0071cb144c7a | 2194 | } |
JMF | 12:0071cb144c7a | 2195 | |
JMF | 12:0071cb144c7a | 2196 | return( ssl_write_hello_request( ssl ) ); |
JMF | 12:0071cb144c7a | 2197 | } |
JMF | 12:0071cb144c7a | 2198 | #endif |
JMF | 12:0071cb144c7a | 2199 | #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */ |
JMF | 12:0071cb144c7a | 2200 | |
JMF | 12:0071cb144c7a | 2201 | /* |
JMF | 12:0071cb144c7a | 2202 | * Fill the input message buffer by appending data to it. |
JMF | 12:0071cb144c7a | 2203 | * The amount of data already fetched is in ssl->in_left. |
JMF | 12:0071cb144c7a | 2204 | * |
JMF | 12:0071cb144c7a | 2205 | * If we return 0, is it guaranteed that (at least) nb_want bytes are |
JMF | 12:0071cb144c7a | 2206 | * available (from this read and/or a previous one). Otherwise, an error code |
JMF | 12:0071cb144c7a | 2207 | * is returned (possibly EOF or WANT_READ). |
JMF | 12:0071cb144c7a | 2208 | * |
JMF | 12:0071cb144c7a | 2209 | * With stream transport (TLS) on success ssl->in_left == nb_want, but |
JMF | 12:0071cb144c7a | 2210 | * with datagram transport (DTLS) on success ssl->in_left >= nb_want, |
JMF | 12:0071cb144c7a | 2211 | * since we always read a whole datagram at once. |
JMF | 12:0071cb144c7a | 2212 | * |
JMF | 12:0071cb144c7a | 2213 | * For DTLS, it is up to the caller to set ssl->next_record_offset when |
JMF | 12:0071cb144c7a | 2214 | * they're done reading a record. |
JMF | 12:0071cb144c7a | 2215 | */ |
JMF | 12:0071cb144c7a | 2216 | int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want ) |
JMF | 12:0071cb144c7a | 2217 | { |
JMF | 12:0071cb144c7a | 2218 | int ret; |
JMF | 12:0071cb144c7a | 2219 | size_t len; |
JMF | 12:0071cb144c7a | 2220 | |
JMF | 12:0071cb144c7a | 2221 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> fetch input" ) ); |
JMF | 12:0071cb144c7a | 2222 | |
JMF | 12:0071cb144c7a | 2223 | if( ssl->f_recv == NULL && ssl->f_recv_timeout == NULL ) |
JMF | 12:0071cb144c7a | 2224 | { |
JMF | 12:0071cb144c7a | 2225 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() " |
JMF | 12:0071cb144c7a | 2226 | "or mbedtls_ssl_set_bio()" ) ); |
JMF | 12:0071cb144c7a | 2227 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 2228 | } |
JMF | 12:0071cb144c7a | 2229 | |
JMF | 12:0071cb144c7a | 2230 | if( nb_want > MBEDTLS_SSL_BUFFER_LEN - (size_t)( ssl->in_hdr - ssl->in_buf ) ) |
JMF | 12:0071cb144c7a | 2231 | { |
JMF | 12:0071cb144c7a | 2232 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) ); |
JMF | 12:0071cb144c7a | 2233 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 2234 | } |
JMF | 12:0071cb144c7a | 2235 | |
JMF | 12:0071cb144c7a | 2236 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 2237 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 2238 | { |
JMF | 12:0071cb144c7a | 2239 | uint32_t timeout; |
JMF | 12:0071cb144c7a | 2240 | |
JMF | 12:0071cb144c7a | 2241 | /* Just to be sure */ |
JMF | 12:0071cb144c7a | 2242 | if( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL ) |
JMF | 12:0071cb144c7a | 2243 | { |
JMF | 12:0071cb144c7a | 2244 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use " |
JMF | 12:0071cb144c7a | 2245 | "mbedtls_ssl_set_timer_cb() for DTLS" ) ); |
JMF | 12:0071cb144c7a | 2246 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 2247 | } |
JMF | 12:0071cb144c7a | 2248 | |
JMF | 12:0071cb144c7a | 2249 | /* |
JMF | 12:0071cb144c7a | 2250 | * The point is, we need to always read a full datagram at once, so we |
JMF | 12:0071cb144c7a | 2251 | * sometimes read more then requested, and handle the additional data. |
JMF | 12:0071cb144c7a | 2252 | * It could be the rest of the current record (while fetching the |
JMF | 12:0071cb144c7a | 2253 | * header) and/or some other records in the same datagram. |
JMF | 12:0071cb144c7a | 2254 | */ |
JMF | 12:0071cb144c7a | 2255 | |
JMF | 12:0071cb144c7a | 2256 | /* |
JMF | 12:0071cb144c7a | 2257 | * Move to the next record in the already read datagram if applicable |
JMF | 12:0071cb144c7a | 2258 | */ |
JMF | 12:0071cb144c7a | 2259 | if( ssl->next_record_offset != 0 ) |
JMF | 12:0071cb144c7a | 2260 | { |
JMF | 12:0071cb144c7a | 2261 | if( ssl->in_left < ssl->next_record_offset ) |
JMF | 12:0071cb144c7a | 2262 | { |
JMF | 12:0071cb144c7a | 2263 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 2264 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 2265 | } |
JMF | 12:0071cb144c7a | 2266 | |
JMF | 12:0071cb144c7a | 2267 | ssl->in_left -= ssl->next_record_offset; |
JMF | 12:0071cb144c7a | 2268 | |
JMF | 12:0071cb144c7a | 2269 | if( ssl->in_left != 0 ) |
JMF | 12:0071cb144c7a | 2270 | { |
JMF | 12:0071cb144c7a | 2271 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %d", |
JMF | 12:0071cb144c7a | 2272 | ssl->next_record_offset ) ); |
JMF | 12:0071cb144c7a | 2273 | memmove( ssl->in_hdr, |
JMF | 12:0071cb144c7a | 2274 | ssl->in_hdr + ssl->next_record_offset, |
JMF | 12:0071cb144c7a | 2275 | ssl->in_left ); |
JMF | 12:0071cb144c7a | 2276 | } |
JMF | 12:0071cb144c7a | 2277 | |
JMF | 12:0071cb144c7a | 2278 | ssl->next_record_offset = 0; |
JMF | 12:0071cb144c7a | 2279 | } |
JMF | 12:0071cb144c7a | 2280 | |
JMF | 12:0071cb144c7a | 2281 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d", |
JMF | 12:0071cb144c7a | 2282 | ssl->in_left, nb_want ) ); |
JMF | 12:0071cb144c7a | 2283 | |
JMF | 12:0071cb144c7a | 2284 | /* |
JMF | 12:0071cb144c7a | 2285 | * Done if we already have enough data. |
JMF | 12:0071cb144c7a | 2286 | */ |
JMF | 12:0071cb144c7a | 2287 | if( nb_want <= ssl->in_left) |
JMF | 12:0071cb144c7a | 2288 | { |
JMF | 12:0071cb144c7a | 2289 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) ); |
JMF | 12:0071cb144c7a | 2290 | return( 0 ); |
JMF | 12:0071cb144c7a | 2291 | } |
JMF | 12:0071cb144c7a | 2292 | |
JMF | 12:0071cb144c7a | 2293 | /* |
JMF | 12:0071cb144c7a | 2294 | * A record can't be split accross datagrams. If we need to read but |
JMF | 12:0071cb144c7a | 2295 | * are not at the beginning of a new record, the caller did something |
JMF | 12:0071cb144c7a | 2296 | * wrong. |
JMF | 12:0071cb144c7a | 2297 | */ |
JMF | 12:0071cb144c7a | 2298 | if( ssl->in_left != 0 ) |
JMF | 12:0071cb144c7a | 2299 | { |
JMF | 12:0071cb144c7a | 2300 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 2301 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 2302 | } |
JMF | 12:0071cb144c7a | 2303 | |
JMF | 12:0071cb144c7a | 2304 | /* |
JMF | 12:0071cb144c7a | 2305 | * Don't even try to read if time's out already. |
JMF | 12:0071cb144c7a | 2306 | * This avoids by-passing the timer when repeatedly receiving messages |
JMF | 12:0071cb144c7a | 2307 | * that will end up being dropped. |
JMF | 12:0071cb144c7a | 2308 | */ |
JMF | 12:0071cb144c7a | 2309 | if( ssl_check_timer( ssl ) != 0 ) |
JMF | 12:0071cb144c7a | 2310 | ret = MBEDTLS_ERR_SSL_TIMEOUT; |
JMF | 12:0071cb144c7a | 2311 | else |
JMF | 12:0071cb144c7a | 2312 | { |
JMF | 12:0071cb144c7a | 2313 | len = MBEDTLS_SSL_BUFFER_LEN - ( ssl->in_hdr - ssl->in_buf ); |
JMF | 12:0071cb144c7a | 2314 | |
JMF | 12:0071cb144c7a | 2315 | if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ) |
JMF | 12:0071cb144c7a | 2316 | timeout = ssl->handshake->retransmit_timeout; |
JMF | 12:0071cb144c7a | 2317 | else |
JMF | 12:0071cb144c7a | 2318 | timeout = ssl->conf->read_timeout; |
JMF | 12:0071cb144c7a | 2319 | |
JMF | 12:0071cb144c7a | 2320 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) ); |
JMF | 12:0071cb144c7a | 2321 | |
JMF | 12:0071cb144c7a | 2322 | if( ssl->f_recv_timeout != NULL ) |
JMF | 12:0071cb144c7a | 2323 | ret = ssl->f_recv_timeout( ssl->p_bio, ssl->in_hdr, len, |
JMF | 12:0071cb144c7a | 2324 | timeout ); |
JMF | 12:0071cb144c7a | 2325 | else |
JMF | 12:0071cb144c7a | 2326 | ret = ssl->f_recv( ssl->p_bio, ssl->in_hdr, len ); |
JMF | 12:0071cb144c7a | 2327 | |
JMF | 12:0071cb144c7a | 2328 | MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret ); |
JMF | 12:0071cb144c7a | 2329 | |
JMF | 12:0071cb144c7a | 2330 | if( ret == 0 ) |
JMF | 12:0071cb144c7a | 2331 | return( MBEDTLS_ERR_SSL_CONN_EOF ); |
JMF | 12:0071cb144c7a | 2332 | } |
JMF | 12:0071cb144c7a | 2333 | |
JMF | 12:0071cb144c7a | 2334 | if( ret == MBEDTLS_ERR_SSL_TIMEOUT ) |
JMF | 12:0071cb144c7a | 2335 | { |
JMF | 12:0071cb144c7a | 2336 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) ); |
JMF | 12:0071cb144c7a | 2337 | ssl_set_timer( ssl, 0 ); |
JMF | 12:0071cb144c7a | 2338 | |
JMF | 12:0071cb144c7a | 2339 | if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ) |
JMF | 12:0071cb144c7a | 2340 | { |
JMF | 12:0071cb144c7a | 2341 | if( ssl_double_retransmit_timeout( ssl ) != 0 ) |
JMF | 12:0071cb144c7a | 2342 | { |
JMF | 12:0071cb144c7a | 2343 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) ); |
JMF | 12:0071cb144c7a | 2344 | return( MBEDTLS_ERR_SSL_TIMEOUT ); |
JMF | 12:0071cb144c7a | 2345 | } |
JMF | 12:0071cb144c7a | 2346 | |
JMF | 12:0071cb144c7a | 2347 | if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 2348 | { |
JMF | 12:0071cb144c7a | 2349 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret ); |
JMF | 12:0071cb144c7a | 2350 | return( ret ); |
JMF | 12:0071cb144c7a | 2351 | } |
JMF | 12:0071cb144c7a | 2352 | |
JMF | 12:0071cb144c7a | 2353 | return( MBEDTLS_ERR_SSL_WANT_READ ); |
JMF | 12:0071cb144c7a | 2354 | } |
JMF | 12:0071cb144c7a | 2355 | #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 2356 | else if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && |
JMF | 12:0071cb144c7a | 2357 | ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ) |
JMF | 12:0071cb144c7a | 2358 | { |
JMF | 12:0071cb144c7a | 2359 | if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 2360 | { |
JMF | 12:0071cb144c7a | 2361 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret ); |
JMF | 12:0071cb144c7a | 2362 | return( ret ); |
JMF | 12:0071cb144c7a | 2363 | } |
JMF | 12:0071cb144c7a | 2364 | |
JMF | 12:0071cb144c7a | 2365 | return( MBEDTLS_ERR_SSL_WANT_READ ); |
JMF | 12:0071cb144c7a | 2366 | } |
JMF | 12:0071cb144c7a | 2367 | #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */ |
JMF | 12:0071cb144c7a | 2368 | } |
JMF | 12:0071cb144c7a | 2369 | |
JMF | 12:0071cb144c7a | 2370 | if( ret < 0 ) |
JMF | 12:0071cb144c7a | 2371 | return( ret ); |
JMF | 12:0071cb144c7a | 2372 | |
JMF | 12:0071cb144c7a | 2373 | ssl->in_left = ret; |
JMF | 12:0071cb144c7a | 2374 | } |
JMF | 12:0071cb144c7a | 2375 | else |
JMF | 12:0071cb144c7a | 2376 | #endif |
JMF | 12:0071cb144c7a | 2377 | { |
JMF | 12:0071cb144c7a | 2378 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d", |
JMF | 12:0071cb144c7a | 2379 | ssl->in_left, nb_want ) ); |
JMF | 12:0071cb144c7a | 2380 | |
JMF | 12:0071cb144c7a | 2381 | while( ssl->in_left < nb_want ) |
JMF | 12:0071cb144c7a | 2382 | { |
JMF | 12:0071cb144c7a | 2383 | len = nb_want - ssl->in_left; |
JMF | 12:0071cb144c7a | 2384 | |
JMF | 12:0071cb144c7a | 2385 | if( ssl_check_timer( ssl ) != 0 ) |
JMF | 12:0071cb144c7a | 2386 | ret = MBEDTLS_ERR_SSL_TIMEOUT; |
JMF | 12:0071cb144c7a | 2387 | else |
JMF | 12:0071cb144c7a | 2388 | { |
JMF | 12:0071cb144c7a | 2389 | if( ssl->f_recv_timeout != NULL ) |
JMF | 12:0071cb144c7a | 2390 | { |
JMF | 12:0071cb144c7a | 2391 | ret = ssl->f_recv_timeout( ssl->p_bio, |
JMF | 12:0071cb144c7a | 2392 | ssl->in_hdr + ssl->in_left, len, |
JMF | 12:0071cb144c7a | 2393 | ssl->conf->read_timeout ); |
JMF | 12:0071cb144c7a | 2394 | } |
JMF | 12:0071cb144c7a | 2395 | else |
JMF | 12:0071cb144c7a | 2396 | { |
JMF | 12:0071cb144c7a | 2397 | ret = ssl->f_recv( ssl->p_bio, |
JMF | 12:0071cb144c7a | 2398 | ssl->in_hdr + ssl->in_left, len ); |
JMF | 12:0071cb144c7a | 2399 | } |
JMF | 12:0071cb144c7a | 2400 | } |
JMF | 12:0071cb144c7a | 2401 | |
JMF | 12:0071cb144c7a | 2402 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d", |
JMF | 12:0071cb144c7a | 2403 | ssl->in_left, nb_want ) ); |
JMF | 12:0071cb144c7a | 2404 | MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret ); |
JMF | 12:0071cb144c7a | 2405 | |
JMF | 12:0071cb144c7a | 2406 | if( ret == 0 ) |
JMF | 12:0071cb144c7a | 2407 | return( MBEDTLS_ERR_SSL_CONN_EOF ); |
JMF | 12:0071cb144c7a | 2408 | |
JMF | 12:0071cb144c7a | 2409 | if( ret < 0 ) |
JMF | 12:0071cb144c7a | 2410 | return( ret ); |
JMF | 12:0071cb144c7a | 2411 | |
JMF | 12:0071cb144c7a | 2412 | ssl->in_left += ret; |
JMF | 12:0071cb144c7a | 2413 | } |
JMF | 12:0071cb144c7a | 2414 | } |
JMF | 12:0071cb144c7a | 2415 | |
JMF | 12:0071cb144c7a | 2416 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) ); |
JMF | 12:0071cb144c7a | 2417 | |
JMF | 12:0071cb144c7a | 2418 | return( 0 ); |
JMF | 12:0071cb144c7a | 2419 | } |
JMF | 12:0071cb144c7a | 2420 | |
JMF | 12:0071cb144c7a | 2421 | /* |
JMF | 12:0071cb144c7a | 2422 | * Flush any data not yet written |
JMF | 12:0071cb144c7a | 2423 | */ |
JMF | 12:0071cb144c7a | 2424 | int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 2425 | { |
JMF | 12:0071cb144c7a | 2426 | int ret; |
JMF | 12:0071cb144c7a | 2427 | unsigned char *buf, i; |
JMF | 12:0071cb144c7a | 2428 | |
JMF | 12:0071cb144c7a | 2429 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> flush output" ) ); |
JMF | 12:0071cb144c7a | 2430 | |
JMF | 12:0071cb144c7a | 2431 | if( ssl->f_send == NULL ) |
JMF | 12:0071cb144c7a | 2432 | { |
JMF | 12:0071cb144c7a | 2433 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() " |
JMF | 12:0071cb144c7a | 2434 | "or mbedtls_ssl_set_bio()" ) ); |
JMF | 12:0071cb144c7a | 2435 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 2436 | } |
JMF | 12:0071cb144c7a | 2437 | |
JMF | 12:0071cb144c7a | 2438 | /* Avoid incrementing counter if data is flushed */ |
JMF | 12:0071cb144c7a | 2439 | if( ssl->out_left == 0 ) |
JMF | 12:0071cb144c7a | 2440 | { |
JMF | 12:0071cb144c7a | 2441 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) ); |
JMF | 12:0071cb144c7a | 2442 | return( 0 ); |
JMF | 12:0071cb144c7a | 2443 | } |
JMF | 12:0071cb144c7a | 2444 | |
JMF | 12:0071cb144c7a | 2445 | while( ssl->out_left > 0 ) |
JMF | 12:0071cb144c7a | 2446 | { |
JMF | 12:0071cb144c7a | 2447 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d", |
JMF | 12:0071cb144c7a | 2448 | mbedtls_ssl_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) ); |
JMF | 12:0071cb144c7a | 2449 | |
JMF | 12:0071cb144c7a | 2450 | buf = ssl->out_hdr + mbedtls_ssl_hdr_len( ssl ) + |
JMF | 12:0071cb144c7a | 2451 | ssl->out_msglen - ssl->out_left; |
JMF | 12:0071cb144c7a | 2452 | ret = ssl->f_send( ssl->p_bio, buf, ssl->out_left ); |
JMF | 12:0071cb144c7a | 2453 | |
JMF | 12:0071cb144c7a | 2454 | MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret ); |
JMF | 12:0071cb144c7a | 2455 | |
JMF | 12:0071cb144c7a | 2456 | if( ret <= 0 ) |
JMF | 12:0071cb144c7a | 2457 | return( ret ); |
JMF | 12:0071cb144c7a | 2458 | |
JMF | 12:0071cb144c7a | 2459 | ssl->out_left -= ret; |
JMF | 12:0071cb144c7a | 2460 | } |
JMF | 12:0071cb144c7a | 2461 | |
JMF | 12:0071cb144c7a | 2462 | for( i = 8; i > ssl_ep_len( ssl ); i-- ) |
JMF | 12:0071cb144c7a | 2463 | if( ++ssl->out_ctr[i - 1] != 0 ) |
JMF | 12:0071cb144c7a | 2464 | break; |
JMF | 12:0071cb144c7a | 2465 | |
JMF | 12:0071cb144c7a | 2466 | /* The loop goes to its end iff the counter is wrapping */ |
JMF | 12:0071cb144c7a | 2467 | if( i == ssl_ep_len( ssl ) ) |
JMF | 12:0071cb144c7a | 2468 | { |
JMF | 12:0071cb144c7a | 2469 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) ); |
JMF | 12:0071cb144c7a | 2470 | return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING ); |
JMF | 12:0071cb144c7a | 2471 | } |
JMF | 12:0071cb144c7a | 2472 | |
JMF | 12:0071cb144c7a | 2473 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) ); |
JMF | 12:0071cb144c7a | 2474 | |
JMF | 12:0071cb144c7a | 2475 | return( 0 ); |
JMF | 12:0071cb144c7a | 2476 | } |
JMF | 12:0071cb144c7a | 2477 | |
JMF | 12:0071cb144c7a | 2478 | /* |
JMF | 12:0071cb144c7a | 2479 | * Functions to handle the DTLS retransmission state machine |
JMF | 12:0071cb144c7a | 2480 | */ |
JMF | 12:0071cb144c7a | 2481 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 2482 | /* |
JMF | 12:0071cb144c7a | 2483 | * Append current handshake message to current outgoing flight |
JMF | 12:0071cb144c7a | 2484 | */ |
JMF | 12:0071cb144c7a | 2485 | static int ssl_flight_append( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 2486 | { |
JMF | 12:0071cb144c7a | 2487 | mbedtls_ssl_flight_item *msg; |
JMF | 12:0071cb144c7a | 2488 | |
JMF | 12:0071cb144c7a | 2489 | /* Allocate space for current message */ |
JMF | 12:0071cb144c7a | 2490 | if( ( msg = mbedtls_calloc( 1, sizeof( mbedtls_ssl_flight_item ) ) ) == NULL ) |
JMF | 12:0071cb144c7a | 2491 | { |
JMF | 12:0071cb144c7a | 2492 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", |
JMF | 12:0071cb144c7a | 2493 | sizeof( mbedtls_ssl_flight_item ) ) ); |
JMF | 12:0071cb144c7a | 2494 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 2495 | } |
JMF | 12:0071cb144c7a | 2496 | |
JMF | 12:0071cb144c7a | 2497 | if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL ) |
JMF | 12:0071cb144c7a | 2498 | { |
JMF | 12:0071cb144c7a | 2499 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl->out_msglen ) ); |
JMF | 12:0071cb144c7a | 2500 | mbedtls_free( msg ); |
JMF | 12:0071cb144c7a | 2501 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 2502 | } |
JMF | 12:0071cb144c7a | 2503 | |
JMF | 12:0071cb144c7a | 2504 | /* Copy current handshake message with headers */ |
JMF | 12:0071cb144c7a | 2505 | memcpy( msg->p, ssl->out_msg, ssl->out_msglen ); |
JMF | 12:0071cb144c7a | 2506 | msg->len = ssl->out_msglen; |
JMF | 12:0071cb144c7a | 2507 | msg->type = ssl->out_msgtype; |
JMF | 12:0071cb144c7a | 2508 | msg->next = NULL; |
JMF | 12:0071cb144c7a | 2509 | |
JMF | 12:0071cb144c7a | 2510 | /* Append to the current flight */ |
JMF | 12:0071cb144c7a | 2511 | if( ssl->handshake->flight == NULL ) |
JMF | 12:0071cb144c7a | 2512 | ssl->handshake->flight = msg; |
JMF | 12:0071cb144c7a | 2513 | else |
JMF | 12:0071cb144c7a | 2514 | { |
JMF | 12:0071cb144c7a | 2515 | mbedtls_ssl_flight_item *cur = ssl->handshake->flight; |
JMF | 12:0071cb144c7a | 2516 | while( cur->next != NULL ) |
JMF | 12:0071cb144c7a | 2517 | cur = cur->next; |
JMF | 12:0071cb144c7a | 2518 | cur->next = msg; |
JMF | 12:0071cb144c7a | 2519 | } |
JMF | 12:0071cb144c7a | 2520 | |
JMF | 12:0071cb144c7a | 2521 | return( 0 ); |
JMF | 12:0071cb144c7a | 2522 | } |
JMF | 12:0071cb144c7a | 2523 | |
JMF | 12:0071cb144c7a | 2524 | /* |
JMF | 12:0071cb144c7a | 2525 | * Free the current flight of handshake messages |
JMF | 12:0071cb144c7a | 2526 | */ |
JMF | 12:0071cb144c7a | 2527 | static void ssl_flight_free( mbedtls_ssl_flight_item *flight ) |
JMF | 12:0071cb144c7a | 2528 | { |
JMF | 12:0071cb144c7a | 2529 | mbedtls_ssl_flight_item *cur = flight; |
JMF | 12:0071cb144c7a | 2530 | mbedtls_ssl_flight_item *next; |
JMF | 12:0071cb144c7a | 2531 | |
JMF | 12:0071cb144c7a | 2532 | while( cur != NULL ) |
JMF | 12:0071cb144c7a | 2533 | { |
JMF | 12:0071cb144c7a | 2534 | next = cur->next; |
JMF | 12:0071cb144c7a | 2535 | |
JMF | 12:0071cb144c7a | 2536 | mbedtls_free( cur->p ); |
JMF | 12:0071cb144c7a | 2537 | mbedtls_free( cur ); |
JMF | 12:0071cb144c7a | 2538 | |
JMF | 12:0071cb144c7a | 2539 | cur = next; |
JMF | 12:0071cb144c7a | 2540 | } |
JMF | 12:0071cb144c7a | 2541 | } |
JMF | 12:0071cb144c7a | 2542 | |
JMF | 12:0071cb144c7a | 2543 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
JMF | 12:0071cb144c7a | 2544 | static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl ); |
JMF | 12:0071cb144c7a | 2545 | #endif |
JMF | 12:0071cb144c7a | 2546 | |
JMF | 12:0071cb144c7a | 2547 | /* |
JMF | 12:0071cb144c7a | 2548 | * Swap transform_out and out_ctr with the alternative ones |
JMF | 12:0071cb144c7a | 2549 | */ |
JMF | 12:0071cb144c7a | 2550 | static void ssl_swap_epochs( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 2551 | { |
JMF | 12:0071cb144c7a | 2552 | mbedtls_ssl_transform *tmp_transform; |
JMF | 12:0071cb144c7a | 2553 | unsigned char tmp_out_ctr[8]; |
JMF | 12:0071cb144c7a | 2554 | |
JMF | 12:0071cb144c7a | 2555 | if( ssl->transform_out == ssl->handshake->alt_transform_out ) |
JMF | 12:0071cb144c7a | 2556 | { |
JMF | 12:0071cb144c7a | 2557 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) ); |
JMF | 12:0071cb144c7a | 2558 | return; |
JMF | 12:0071cb144c7a | 2559 | } |
JMF | 12:0071cb144c7a | 2560 | |
JMF | 12:0071cb144c7a | 2561 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) ); |
JMF | 12:0071cb144c7a | 2562 | |
JMF | 12:0071cb144c7a | 2563 | /* Swap transforms */ |
JMF | 12:0071cb144c7a | 2564 | tmp_transform = ssl->transform_out; |
JMF | 12:0071cb144c7a | 2565 | ssl->transform_out = ssl->handshake->alt_transform_out; |
JMF | 12:0071cb144c7a | 2566 | ssl->handshake->alt_transform_out = tmp_transform; |
JMF | 12:0071cb144c7a | 2567 | |
JMF | 12:0071cb144c7a | 2568 | /* Swap epoch + sequence_number */ |
JMF | 12:0071cb144c7a | 2569 | memcpy( tmp_out_ctr, ssl->out_ctr, 8 ); |
JMF | 12:0071cb144c7a | 2570 | memcpy( ssl->out_ctr, ssl->handshake->alt_out_ctr, 8 ); |
JMF | 12:0071cb144c7a | 2571 | memcpy( ssl->handshake->alt_out_ctr, tmp_out_ctr, 8 ); |
JMF | 12:0071cb144c7a | 2572 | |
JMF | 12:0071cb144c7a | 2573 | /* Adjust to the newly activated transform */ |
JMF | 12:0071cb144c7a | 2574 | if( ssl->transform_out != NULL && |
JMF | 12:0071cb144c7a | 2575 | ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 ) |
JMF | 12:0071cb144c7a | 2576 | { |
JMF | 12:0071cb144c7a | 2577 | ssl->out_msg = ssl->out_iv + ssl->transform_out->ivlen - |
JMF | 12:0071cb144c7a | 2578 | ssl->transform_out->fixed_ivlen; |
JMF | 12:0071cb144c7a | 2579 | } |
JMF | 12:0071cb144c7a | 2580 | else |
JMF | 12:0071cb144c7a | 2581 | ssl->out_msg = ssl->out_iv; |
JMF | 12:0071cb144c7a | 2582 | |
JMF | 12:0071cb144c7a | 2583 | #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) |
JMF | 12:0071cb144c7a | 2584 | if( mbedtls_ssl_hw_record_activate != NULL ) |
JMF | 12:0071cb144c7a | 2585 | { |
JMF | 12:0071cb144c7a | 2586 | if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 ) |
JMF | 12:0071cb144c7a | 2587 | { |
JMF | 12:0071cb144c7a | 2588 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret ); |
JMF | 12:0071cb144c7a | 2589 | return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); |
JMF | 12:0071cb144c7a | 2590 | } |
JMF | 12:0071cb144c7a | 2591 | } |
JMF | 12:0071cb144c7a | 2592 | #endif |
JMF | 12:0071cb144c7a | 2593 | } |
JMF | 12:0071cb144c7a | 2594 | |
JMF | 12:0071cb144c7a | 2595 | /* |
JMF | 12:0071cb144c7a | 2596 | * Retransmit the current flight of messages. |
JMF | 12:0071cb144c7a | 2597 | * |
JMF | 12:0071cb144c7a | 2598 | * Need to remember the current message in case flush_output returns |
JMF | 12:0071cb144c7a | 2599 | * WANT_WRITE, causing us to exit this function and come back later. |
JMF | 12:0071cb144c7a | 2600 | * This function must be called until state is no longer SENDING. |
JMF | 12:0071cb144c7a | 2601 | */ |
JMF | 12:0071cb144c7a | 2602 | int mbedtls_ssl_resend( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 2603 | { |
JMF | 12:0071cb144c7a | 2604 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_resend" ) ); |
JMF | 12:0071cb144c7a | 2605 | |
JMF | 12:0071cb144c7a | 2606 | if( ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING ) |
JMF | 12:0071cb144c7a | 2607 | { |
JMF | 12:0071cb144c7a | 2608 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialise resending" ) ); |
JMF | 12:0071cb144c7a | 2609 | |
JMF | 12:0071cb144c7a | 2610 | ssl->handshake->cur_msg = ssl->handshake->flight; |
JMF | 12:0071cb144c7a | 2611 | ssl_swap_epochs( ssl ); |
JMF | 12:0071cb144c7a | 2612 | |
JMF | 12:0071cb144c7a | 2613 | ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING; |
JMF | 12:0071cb144c7a | 2614 | } |
JMF | 12:0071cb144c7a | 2615 | |
JMF | 12:0071cb144c7a | 2616 | while( ssl->handshake->cur_msg != NULL ) |
JMF | 12:0071cb144c7a | 2617 | { |
JMF | 12:0071cb144c7a | 2618 | int ret; |
JMF | 12:0071cb144c7a | 2619 | mbedtls_ssl_flight_item *cur = ssl->handshake->cur_msg; |
JMF | 12:0071cb144c7a | 2620 | |
JMF | 12:0071cb144c7a | 2621 | /* Swap epochs before sending Finished: we can't do it after |
JMF | 12:0071cb144c7a | 2622 | * sending ChangeCipherSpec, in case write returns WANT_READ. |
JMF | 12:0071cb144c7a | 2623 | * Must be done before copying, may change out_msg pointer */ |
JMF | 12:0071cb144c7a | 2624 | if( cur->type == MBEDTLS_SSL_MSG_HANDSHAKE && |
JMF | 12:0071cb144c7a | 2625 | cur->p[0] == MBEDTLS_SSL_HS_FINISHED ) |
JMF | 12:0071cb144c7a | 2626 | { |
JMF | 12:0071cb144c7a | 2627 | ssl_swap_epochs( ssl ); |
JMF | 12:0071cb144c7a | 2628 | } |
JMF | 12:0071cb144c7a | 2629 | |
JMF | 12:0071cb144c7a | 2630 | memcpy( ssl->out_msg, cur->p, cur->len ); |
JMF | 12:0071cb144c7a | 2631 | ssl->out_msglen = cur->len; |
JMF | 12:0071cb144c7a | 2632 | ssl->out_msgtype = cur->type; |
JMF | 12:0071cb144c7a | 2633 | |
JMF | 12:0071cb144c7a | 2634 | ssl->handshake->cur_msg = cur->next; |
JMF | 12:0071cb144c7a | 2635 | |
JMF | 12:0071cb144c7a | 2636 | MBEDTLS_SSL_DEBUG_BUF( 3, "resent handshake message header", ssl->out_msg, 12 ); |
JMF | 12:0071cb144c7a | 2637 | |
JMF | 12:0071cb144c7a | 2638 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 2639 | { |
JMF | 12:0071cb144c7a | 2640 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
JMF | 12:0071cb144c7a | 2641 | return( ret ); |
JMF | 12:0071cb144c7a | 2642 | } |
JMF | 12:0071cb144c7a | 2643 | } |
JMF | 12:0071cb144c7a | 2644 | |
JMF | 12:0071cb144c7a | 2645 | if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER ) |
JMF | 12:0071cb144c7a | 2646 | ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED; |
JMF | 12:0071cb144c7a | 2647 | else |
JMF | 12:0071cb144c7a | 2648 | { |
JMF | 12:0071cb144c7a | 2649 | ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING; |
JMF | 12:0071cb144c7a | 2650 | ssl_set_timer( ssl, ssl->handshake->retransmit_timeout ); |
JMF | 12:0071cb144c7a | 2651 | } |
JMF | 12:0071cb144c7a | 2652 | |
JMF | 12:0071cb144c7a | 2653 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) ); |
JMF | 12:0071cb144c7a | 2654 | |
JMF | 12:0071cb144c7a | 2655 | return( 0 ); |
JMF | 12:0071cb144c7a | 2656 | } |
JMF | 12:0071cb144c7a | 2657 | |
JMF | 12:0071cb144c7a | 2658 | /* |
JMF | 12:0071cb144c7a | 2659 | * To be called when the last message of an incoming flight is received. |
JMF | 12:0071cb144c7a | 2660 | */ |
JMF | 12:0071cb144c7a | 2661 | void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 2662 | { |
JMF | 12:0071cb144c7a | 2663 | /* We won't need to resend that one any more */ |
JMF | 12:0071cb144c7a | 2664 | ssl_flight_free( ssl->handshake->flight ); |
JMF | 12:0071cb144c7a | 2665 | ssl->handshake->flight = NULL; |
JMF | 12:0071cb144c7a | 2666 | ssl->handshake->cur_msg = NULL; |
JMF | 12:0071cb144c7a | 2667 | |
JMF | 12:0071cb144c7a | 2668 | /* The next incoming flight will start with this msg_seq */ |
JMF | 12:0071cb144c7a | 2669 | ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq; |
JMF | 12:0071cb144c7a | 2670 | |
JMF | 12:0071cb144c7a | 2671 | /* Cancel timer */ |
JMF | 12:0071cb144c7a | 2672 | ssl_set_timer( ssl, 0 ); |
JMF | 12:0071cb144c7a | 2673 | |
JMF | 12:0071cb144c7a | 2674 | if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE && |
JMF | 12:0071cb144c7a | 2675 | ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED ) |
JMF | 12:0071cb144c7a | 2676 | { |
JMF | 12:0071cb144c7a | 2677 | ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED; |
JMF | 12:0071cb144c7a | 2678 | } |
JMF | 12:0071cb144c7a | 2679 | else |
JMF | 12:0071cb144c7a | 2680 | ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING; |
JMF | 12:0071cb144c7a | 2681 | } |
JMF | 12:0071cb144c7a | 2682 | |
JMF | 12:0071cb144c7a | 2683 | /* |
JMF | 12:0071cb144c7a | 2684 | * To be called when the last message of an outgoing flight is send. |
JMF | 12:0071cb144c7a | 2685 | */ |
JMF | 12:0071cb144c7a | 2686 | void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 2687 | { |
JMF | 12:0071cb144c7a | 2688 | ssl_reset_retransmit_timeout( ssl ); |
JMF | 12:0071cb144c7a | 2689 | ssl_set_timer( ssl, ssl->handshake->retransmit_timeout ); |
JMF | 12:0071cb144c7a | 2690 | |
JMF | 12:0071cb144c7a | 2691 | if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE && |
JMF | 12:0071cb144c7a | 2692 | ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED ) |
JMF | 12:0071cb144c7a | 2693 | { |
JMF | 12:0071cb144c7a | 2694 | ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED; |
JMF | 12:0071cb144c7a | 2695 | } |
JMF | 12:0071cb144c7a | 2696 | else |
JMF | 12:0071cb144c7a | 2697 | ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING; |
JMF | 12:0071cb144c7a | 2698 | } |
JMF | 12:0071cb144c7a | 2699 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
JMF | 12:0071cb144c7a | 2700 | |
JMF | 12:0071cb144c7a | 2701 | /* |
JMF | 12:0071cb144c7a | 2702 | * Record layer functions |
JMF | 12:0071cb144c7a | 2703 | */ |
JMF | 12:0071cb144c7a | 2704 | |
JMF | 12:0071cb144c7a | 2705 | /* |
JMF | 12:0071cb144c7a | 2706 | * Write current record. |
JMF | 12:0071cb144c7a | 2707 | * Uses ssl->out_msgtype, ssl->out_msglen and bytes at ssl->out_msg. |
JMF | 12:0071cb144c7a | 2708 | */ |
JMF | 12:0071cb144c7a | 2709 | int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 2710 | { |
JMF | 12:0071cb144c7a | 2711 | int ret, done = 0, out_msg_type; |
JMF | 12:0071cb144c7a | 2712 | size_t len = ssl->out_msglen; |
JMF | 12:0071cb144c7a | 2713 | |
JMF | 12:0071cb144c7a | 2714 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) ); |
JMF | 12:0071cb144c7a | 2715 | |
JMF | 12:0071cb144c7a | 2716 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 2717 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
JMF | 12:0071cb144c7a | 2718 | ssl->handshake != NULL && |
JMF | 12:0071cb144c7a | 2719 | ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING ) |
JMF | 12:0071cb144c7a | 2720 | { |
JMF | 12:0071cb144c7a | 2721 | ; /* Skip special handshake treatment when resending */ |
JMF | 12:0071cb144c7a | 2722 | } |
JMF | 12:0071cb144c7a | 2723 | else |
JMF | 12:0071cb144c7a | 2724 | #endif |
JMF | 12:0071cb144c7a | 2725 | if( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) |
JMF | 12:0071cb144c7a | 2726 | { |
JMF | 12:0071cb144c7a | 2727 | out_msg_type = ssl->out_msg[0]; |
JMF | 12:0071cb144c7a | 2728 | |
JMF | 12:0071cb144c7a | 2729 | if( out_msg_type != MBEDTLS_SSL_HS_HELLO_REQUEST && |
JMF | 12:0071cb144c7a | 2730 | ssl->handshake == NULL ) |
JMF | 12:0071cb144c7a | 2731 | { |
JMF | 12:0071cb144c7a | 2732 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 2733 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 2734 | } |
JMF | 12:0071cb144c7a | 2735 | |
JMF | 12:0071cb144c7a | 2736 | ssl->out_msg[1] = (unsigned char)( ( len - 4 ) >> 16 ); |
JMF | 12:0071cb144c7a | 2737 | ssl->out_msg[2] = (unsigned char)( ( len - 4 ) >> 8 ); |
JMF | 12:0071cb144c7a | 2738 | ssl->out_msg[3] = (unsigned char)( ( len - 4 ) ); |
JMF | 12:0071cb144c7a | 2739 | |
JMF | 12:0071cb144c7a | 2740 | /* |
JMF | 12:0071cb144c7a | 2741 | * DTLS has additional fields in the Handshake layer, |
JMF | 12:0071cb144c7a | 2742 | * between the length field and the actual payload: |
JMF | 12:0071cb144c7a | 2743 | * uint16 message_seq; |
JMF | 12:0071cb144c7a | 2744 | * uint24 fragment_offset; |
JMF | 12:0071cb144c7a | 2745 | * uint24 fragment_length; |
JMF | 12:0071cb144c7a | 2746 | */ |
JMF | 12:0071cb144c7a | 2747 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 2748 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 2749 | { |
JMF | 12:0071cb144c7a | 2750 | /* Make room for the additional DTLS fields */ |
JMF | 12:0071cb144c7a | 2751 | memmove( ssl->out_msg + 12, ssl->out_msg + 4, len - 4 ); |
JMF | 12:0071cb144c7a | 2752 | ssl->out_msglen += 8; |
JMF | 12:0071cb144c7a | 2753 | len += 8; |
JMF | 12:0071cb144c7a | 2754 | |
JMF | 12:0071cb144c7a | 2755 | /* Write message_seq and update it, except for HelloRequest */ |
JMF | 12:0071cb144c7a | 2756 | if( out_msg_type != MBEDTLS_SSL_HS_HELLO_REQUEST ) |
JMF | 12:0071cb144c7a | 2757 | { |
JMF | 12:0071cb144c7a | 2758 | ssl->out_msg[4] = ( ssl->handshake->out_msg_seq >> 8 ) & 0xFF; |
JMF | 12:0071cb144c7a | 2759 | ssl->out_msg[5] = ( ssl->handshake->out_msg_seq ) & 0xFF; |
JMF | 12:0071cb144c7a | 2760 | ++( ssl->handshake->out_msg_seq ); |
JMF | 12:0071cb144c7a | 2761 | } |
JMF | 12:0071cb144c7a | 2762 | else |
JMF | 12:0071cb144c7a | 2763 | { |
JMF | 12:0071cb144c7a | 2764 | ssl->out_msg[4] = 0; |
JMF | 12:0071cb144c7a | 2765 | ssl->out_msg[5] = 0; |
JMF | 12:0071cb144c7a | 2766 | } |
JMF | 12:0071cb144c7a | 2767 | |
JMF | 12:0071cb144c7a | 2768 | /* We don't fragment, so frag_offset = 0 and frag_len = len */ |
JMF | 12:0071cb144c7a | 2769 | memset( ssl->out_msg + 6, 0x00, 3 ); |
JMF | 12:0071cb144c7a | 2770 | memcpy( ssl->out_msg + 9, ssl->out_msg + 1, 3 ); |
JMF | 12:0071cb144c7a | 2771 | } |
JMF | 12:0071cb144c7a | 2772 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
JMF | 12:0071cb144c7a | 2773 | |
JMF | 12:0071cb144c7a | 2774 | if( out_msg_type != MBEDTLS_SSL_HS_HELLO_REQUEST ) |
JMF | 12:0071cb144c7a | 2775 | ssl->handshake->update_checksum( ssl, ssl->out_msg, len ); |
JMF | 12:0071cb144c7a | 2776 | } |
JMF | 12:0071cb144c7a | 2777 | |
JMF | 12:0071cb144c7a | 2778 | /* Save handshake and CCS messages for resending */ |
JMF | 12:0071cb144c7a | 2779 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 2780 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
JMF | 12:0071cb144c7a | 2781 | ssl->handshake != NULL && |
JMF | 12:0071cb144c7a | 2782 | ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING && |
JMF | 12:0071cb144c7a | 2783 | ( ssl->out_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC || |
JMF | 12:0071cb144c7a | 2784 | ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) ) |
JMF | 12:0071cb144c7a | 2785 | { |
JMF | 12:0071cb144c7a | 2786 | if( ( ret = ssl_flight_append( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 2787 | { |
JMF | 12:0071cb144c7a | 2788 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret ); |
JMF | 12:0071cb144c7a | 2789 | return( ret ); |
JMF | 12:0071cb144c7a | 2790 | } |
JMF | 12:0071cb144c7a | 2791 | } |
JMF | 12:0071cb144c7a | 2792 | #endif |
JMF | 12:0071cb144c7a | 2793 | |
JMF | 12:0071cb144c7a | 2794 | #if defined(MBEDTLS_ZLIB_SUPPORT) |
JMF | 12:0071cb144c7a | 2795 | if( ssl->transform_out != NULL && |
JMF | 12:0071cb144c7a | 2796 | ssl->session_out->compression == MBEDTLS_SSL_COMPRESS_DEFLATE ) |
JMF | 12:0071cb144c7a | 2797 | { |
JMF | 12:0071cb144c7a | 2798 | if( ( ret = ssl_compress_buf( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 2799 | { |
JMF | 12:0071cb144c7a | 2800 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compress_buf", ret ); |
JMF | 12:0071cb144c7a | 2801 | return( ret ); |
JMF | 12:0071cb144c7a | 2802 | } |
JMF | 12:0071cb144c7a | 2803 | |
JMF | 12:0071cb144c7a | 2804 | len = ssl->out_msglen; |
JMF | 12:0071cb144c7a | 2805 | } |
JMF | 12:0071cb144c7a | 2806 | #endif /*MBEDTLS_ZLIB_SUPPORT */ |
JMF | 12:0071cb144c7a | 2807 | |
JMF | 12:0071cb144c7a | 2808 | #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) |
JMF | 12:0071cb144c7a | 2809 | if( mbedtls_ssl_hw_record_write != NULL ) |
JMF | 12:0071cb144c7a | 2810 | { |
JMF | 12:0071cb144c7a | 2811 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_write()" ) ); |
JMF | 12:0071cb144c7a | 2812 | |
JMF | 12:0071cb144c7a | 2813 | ret = mbedtls_ssl_hw_record_write( ssl ); |
JMF | 12:0071cb144c7a | 2814 | if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH ) |
JMF | 12:0071cb144c7a | 2815 | { |
JMF | 12:0071cb144c7a | 2816 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_write", ret ); |
JMF | 12:0071cb144c7a | 2817 | return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); |
JMF | 12:0071cb144c7a | 2818 | } |
JMF | 12:0071cb144c7a | 2819 | |
JMF | 12:0071cb144c7a | 2820 | if( ret == 0 ) |
JMF | 12:0071cb144c7a | 2821 | done = 1; |
JMF | 12:0071cb144c7a | 2822 | } |
JMF | 12:0071cb144c7a | 2823 | #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */ |
JMF | 12:0071cb144c7a | 2824 | if( !done ) |
JMF | 12:0071cb144c7a | 2825 | { |
JMF | 12:0071cb144c7a | 2826 | ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype; |
JMF | 12:0071cb144c7a | 2827 | mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver, |
JMF | 12:0071cb144c7a | 2828 | ssl->conf->transport, ssl->out_hdr + 1 ); |
JMF | 12:0071cb144c7a | 2829 | |
JMF | 12:0071cb144c7a | 2830 | ssl->out_len[0] = (unsigned char)( len >> 8 ); |
JMF | 12:0071cb144c7a | 2831 | ssl->out_len[1] = (unsigned char)( len ); |
JMF | 12:0071cb144c7a | 2832 | |
JMF | 12:0071cb144c7a | 2833 | if( ssl->transform_out != NULL ) |
JMF | 12:0071cb144c7a | 2834 | { |
JMF | 12:0071cb144c7a | 2835 | if( ( ret = ssl_encrypt_buf( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 2836 | { |
JMF | 12:0071cb144c7a | 2837 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret ); |
JMF | 12:0071cb144c7a | 2838 | return( ret ); |
JMF | 12:0071cb144c7a | 2839 | } |
JMF | 12:0071cb144c7a | 2840 | |
JMF | 12:0071cb144c7a | 2841 | len = ssl->out_msglen; |
JMF | 12:0071cb144c7a | 2842 | ssl->out_len[0] = (unsigned char)( len >> 8 ); |
JMF | 12:0071cb144c7a | 2843 | ssl->out_len[1] = (unsigned char)( len ); |
JMF | 12:0071cb144c7a | 2844 | } |
JMF | 12:0071cb144c7a | 2845 | |
JMF | 12:0071cb144c7a | 2846 | ssl->out_left = mbedtls_ssl_hdr_len( ssl ) + ssl->out_msglen; |
JMF | 12:0071cb144c7a | 2847 | |
JMF | 12:0071cb144c7a | 2848 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, " |
JMF | 12:0071cb144c7a | 2849 | "version = [%d:%d], msglen = %d", |
JMF | 12:0071cb144c7a | 2850 | ssl->out_hdr[0], ssl->out_hdr[1], ssl->out_hdr[2], |
JMF | 12:0071cb144c7a | 2851 | ( ssl->out_len[0] << 8 ) | ssl->out_len[1] ) ); |
JMF | 12:0071cb144c7a | 2852 | |
JMF | 12:0071cb144c7a | 2853 | MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network", |
JMF | 12:0071cb144c7a | 2854 | ssl->out_hdr, mbedtls_ssl_hdr_len( ssl ) + ssl->out_msglen ); |
JMF | 12:0071cb144c7a | 2855 | } |
JMF | 12:0071cb144c7a | 2856 | |
JMF | 12:0071cb144c7a | 2857 | if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 2858 | { |
JMF | 12:0071cb144c7a | 2859 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret ); |
JMF | 12:0071cb144c7a | 2860 | return( ret ); |
JMF | 12:0071cb144c7a | 2861 | } |
JMF | 12:0071cb144c7a | 2862 | |
JMF | 12:0071cb144c7a | 2863 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) ); |
JMF | 12:0071cb144c7a | 2864 | |
JMF | 12:0071cb144c7a | 2865 | return( 0 ); |
JMF | 12:0071cb144c7a | 2866 | } |
JMF | 12:0071cb144c7a | 2867 | |
JMF | 12:0071cb144c7a | 2868 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 2869 | /* |
JMF | 12:0071cb144c7a | 2870 | * Mark bits in bitmask (used for DTLS HS reassembly) |
JMF | 12:0071cb144c7a | 2871 | */ |
JMF | 12:0071cb144c7a | 2872 | static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len ) |
JMF | 12:0071cb144c7a | 2873 | { |
JMF | 12:0071cb144c7a | 2874 | unsigned int start_bits, end_bits; |
JMF | 12:0071cb144c7a | 2875 | |
JMF | 12:0071cb144c7a | 2876 | start_bits = 8 - ( offset % 8 ); |
JMF | 12:0071cb144c7a | 2877 | if( start_bits != 8 ) |
JMF | 12:0071cb144c7a | 2878 | { |
JMF | 12:0071cb144c7a | 2879 | size_t first_byte_idx = offset / 8; |
JMF | 12:0071cb144c7a | 2880 | |
JMF | 12:0071cb144c7a | 2881 | /* Special case */ |
JMF | 12:0071cb144c7a | 2882 | if( len <= start_bits ) |
JMF | 12:0071cb144c7a | 2883 | { |
JMF | 12:0071cb144c7a | 2884 | for( ; len != 0; len-- ) |
JMF | 12:0071cb144c7a | 2885 | mask[first_byte_idx] |= 1 << ( start_bits - len ); |
JMF | 12:0071cb144c7a | 2886 | |
JMF | 12:0071cb144c7a | 2887 | /* Avoid potential issues with offset or len becoming invalid */ |
JMF | 12:0071cb144c7a | 2888 | return; |
JMF | 12:0071cb144c7a | 2889 | } |
JMF | 12:0071cb144c7a | 2890 | |
JMF | 12:0071cb144c7a | 2891 | offset += start_bits; /* Now offset % 8 == 0 */ |
JMF | 12:0071cb144c7a | 2892 | len -= start_bits; |
JMF | 12:0071cb144c7a | 2893 | |
JMF | 12:0071cb144c7a | 2894 | for( ; start_bits != 0; start_bits-- ) |
JMF | 12:0071cb144c7a | 2895 | mask[first_byte_idx] |= 1 << ( start_bits - 1 ); |
JMF | 12:0071cb144c7a | 2896 | } |
JMF | 12:0071cb144c7a | 2897 | |
JMF | 12:0071cb144c7a | 2898 | end_bits = len % 8; |
JMF | 12:0071cb144c7a | 2899 | if( end_bits != 0 ) |
JMF | 12:0071cb144c7a | 2900 | { |
JMF | 12:0071cb144c7a | 2901 | size_t last_byte_idx = ( offset + len ) / 8; |
JMF | 12:0071cb144c7a | 2902 | |
JMF | 12:0071cb144c7a | 2903 | len -= end_bits; /* Now len % 8 == 0 */ |
JMF | 12:0071cb144c7a | 2904 | |
JMF | 12:0071cb144c7a | 2905 | for( ; end_bits != 0; end_bits-- ) |
JMF | 12:0071cb144c7a | 2906 | mask[last_byte_idx] |= 1 << ( 8 - end_bits ); |
JMF | 12:0071cb144c7a | 2907 | } |
JMF | 12:0071cb144c7a | 2908 | |
JMF | 12:0071cb144c7a | 2909 | memset( mask + offset / 8, 0xFF, len / 8 ); |
JMF | 12:0071cb144c7a | 2910 | } |
JMF | 12:0071cb144c7a | 2911 | |
JMF | 12:0071cb144c7a | 2912 | /* |
JMF | 12:0071cb144c7a | 2913 | * Check that bitmask is full |
JMF | 12:0071cb144c7a | 2914 | */ |
JMF | 12:0071cb144c7a | 2915 | static int ssl_bitmask_check( unsigned char *mask, size_t len ) |
JMF | 12:0071cb144c7a | 2916 | { |
JMF | 12:0071cb144c7a | 2917 | size_t i; |
JMF | 12:0071cb144c7a | 2918 | |
JMF | 12:0071cb144c7a | 2919 | for( i = 0; i < len / 8; i++ ) |
JMF | 12:0071cb144c7a | 2920 | if( mask[i] != 0xFF ) |
JMF | 12:0071cb144c7a | 2921 | return( -1 ); |
JMF | 12:0071cb144c7a | 2922 | |
JMF | 12:0071cb144c7a | 2923 | for( i = 0; i < len % 8; i++ ) |
JMF | 12:0071cb144c7a | 2924 | if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 ) |
JMF | 12:0071cb144c7a | 2925 | return( -1 ); |
JMF | 12:0071cb144c7a | 2926 | |
JMF | 12:0071cb144c7a | 2927 | return( 0 ); |
JMF | 12:0071cb144c7a | 2928 | } |
JMF | 12:0071cb144c7a | 2929 | |
JMF | 12:0071cb144c7a | 2930 | /* |
JMF | 12:0071cb144c7a | 2931 | * Reassemble fragmented DTLS handshake messages. |
JMF | 12:0071cb144c7a | 2932 | * |
JMF | 12:0071cb144c7a | 2933 | * Use a temporary buffer for reassembly, divided in two parts: |
JMF | 12:0071cb144c7a | 2934 | * - the first holds the reassembled message (including handshake header), |
JMF | 12:0071cb144c7a | 2935 | * - the second holds a bitmask indicating which parts of the message |
JMF | 12:0071cb144c7a | 2936 | * (excluding headers) have been received so far. |
JMF | 12:0071cb144c7a | 2937 | */ |
JMF | 12:0071cb144c7a | 2938 | static int ssl_reassemble_dtls_handshake( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 2939 | { |
JMF | 12:0071cb144c7a | 2940 | unsigned char *msg, *bitmask; |
JMF | 12:0071cb144c7a | 2941 | size_t frag_len, frag_off; |
JMF | 12:0071cb144c7a | 2942 | size_t msg_len = ssl->in_hslen - 12; /* Without headers */ |
JMF | 12:0071cb144c7a | 2943 | |
JMF | 12:0071cb144c7a | 2944 | if( ssl->handshake == NULL ) |
JMF | 12:0071cb144c7a | 2945 | { |
JMF | 12:0071cb144c7a | 2946 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "not supported outside handshake (for now)" ) ); |
JMF | 12:0071cb144c7a | 2947 | return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); |
JMF | 12:0071cb144c7a | 2948 | } |
JMF | 12:0071cb144c7a | 2949 | |
JMF | 12:0071cb144c7a | 2950 | /* |
JMF | 12:0071cb144c7a | 2951 | * For first fragment, check size and allocate buffer |
JMF | 12:0071cb144c7a | 2952 | */ |
JMF | 12:0071cb144c7a | 2953 | if( ssl->handshake->hs_msg == NULL ) |
JMF | 12:0071cb144c7a | 2954 | { |
JMF | 12:0071cb144c7a | 2955 | size_t alloc_len; |
JMF | 12:0071cb144c7a | 2956 | |
JMF | 12:0071cb144c7a | 2957 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %d", |
JMF | 12:0071cb144c7a | 2958 | msg_len ) ); |
JMF | 12:0071cb144c7a | 2959 | |
JMF | 12:0071cb144c7a | 2960 | if( ssl->in_hslen > MBEDTLS_SSL_MAX_CONTENT_LEN ) |
JMF | 12:0071cb144c7a | 2961 | { |
JMF | 12:0071cb144c7a | 2962 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too large" ) ); |
JMF | 12:0071cb144c7a | 2963 | return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); |
JMF | 12:0071cb144c7a | 2964 | } |
JMF | 12:0071cb144c7a | 2965 | |
JMF | 12:0071cb144c7a | 2966 | /* The bitmask needs one bit per byte of message excluding header */ |
JMF | 12:0071cb144c7a | 2967 | alloc_len = 12 + msg_len + msg_len / 8 + ( msg_len % 8 != 0 ); |
JMF | 12:0071cb144c7a | 2968 | |
JMF | 12:0071cb144c7a | 2969 | ssl->handshake->hs_msg = mbedtls_calloc( 1, alloc_len ); |
JMF | 12:0071cb144c7a | 2970 | if( ssl->handshake->hs_msg == NULL ) |
JMF | 12:0071cb144c7a | 2971 | { |
JMF | 12:0071cb144c7a | 2972 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", alloc_len ) ); |
JMF | 12:0071cb144c7a | 2973 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 2974 | } |
JMF | 12:0071cb144c7a | 2975 | |
JMF | 12:0071cb144c7a | 2976 | /* Prepare final header: copy msg_type, length and message_seq, |
JMF | 12:0071cb144c7a | 2977 | * then add standardised fragment_offset and fragment_length */ |
JMF | 12:0071cb144c7a | 2978 | memcpy( ssl->handshake->hs_msg, ssl->in_msg, 6 ); |
JMF | 12:0071cb144c7a | 2979 | memset( ssl->handshake->hs_msg + 6, 0, 3 ); |
JMF | 12:0071cb144c7a | 2980 | memcpy( ssl->handshake->hs_msg + 9, |
JMF | 12:0071cb144c7a | 2981 | ssl->handshake->hs_msg + 1, 3 ); |
JMF | 12:0071cb144c7a | 2982 | } |
JMF | 12:0071cb144c7a | 2983 | else |
JMF | 12:0071cb144c7a | 2984 | { |
JMF | 12:0071cb144c7a | 2985 | /* Make sure msg_type and length are consistent */ |
JMF | 12:0071cb144c7a | 2986 | if( memcmp( ssl->handshake->hs_msg, ssl->in_msg, 4 ) != 0 ) |
JMF | 12:0071cb144c7a | 2987 | { |
JMF | 12:0071cb144c7a | 2988 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment header mismatch" ) ); |
JMF | 12:0071cb144c7a | 2989 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 2990 | } |
JMF | 12:0071cb144c7a | 2991 | } |
JMF | 12:0071cb144c7a | 2992 | |
JMF | 12:0071cb144c7a | 2993 | msg = ssl->handshake->hs_msg + 12; |
JMF | 12:0071cb144c7a | 2994 | bitmask = msg + msg_len; |
JMF | 12:0071cb144c7a | 2995 | |
JMF | 12:0071cb144c7a | 2996 | /* |
JMF | 12:0071cb144c7a | 2997 | * Check and copy current fragment |
JMF | 12:0071cb144c7a | 2998 | */ |
JMF | 12:0071cb144c7a | 2999 | frag_off = ( ssl->in_msg[6] << 16 ) | |
JMF | 12:0071cb144c7a | 3000 | ( ssl->in_msg[7] << 8 ) | |
JMF | 12:0071cb144c7a | 3001 | ssl->in_msg[8]; |
JMF | 12:0071cb144c7a | 3002 | frag_len = ( ssl->in_msg[9] << 16 ) | |
JMF | 12:0071cb144c7a | 3003 | ( ssl->in_msg[10] << 8 ) | |
JMF | 12:0071cb144c7a | 3004 | ssl->in_msg[11]; |
JMF | 12:0071cb144c7a | 3005 | |
JMF | 12:0071cb144c7a | 3006 | if( frag_off + frag_len > msg_len ) |
JMF | 12:0071cb144c7a | 3007 | { |
JMF | 12:0071cb144c7a | 3008 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid fragment offset/len: %d + %d > %d", |
JMF | 12:0071cb144c7a | 3009 | frag_off, frag_len, msg_len ) ); |
JMF | 12:0071cb144c7a | 3010 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 3011 | } |
JMF | 12:0071cb144c7a | 3012 | |
JMF | 12:0071cb144c7a | 3013 | if( frag_len + 12 > ssl->in_msglen ) |
JMF | 12:0071cb144c7a | 3014 | { |
JMF | 12:0071cb144c7a | 3015 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid fragment length: %d + 12 > %d", |
JMF | 12:0071cb144c7a | 3016 | frag_len, ssl->in_msglen ) ); |
JMF | 12:0071cb144c7a | 3017 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 3018 | } |
JMF | 12:0071cb144c7a | 3019 | |
JMF | 12:0071cb144c7a | 3020 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %d, length = %d", |
JMF | 12:0071cb144c7a | 3021 | frag_off, frag_len ) ); |
JMF | 12:0071cb144c7a | 3022 | |
JMF | 12:0071cb144c7a | 3023 | memcpy( msg + frag_off, ssl->in_msg + 12, frag_len ); |
JMF | 12:0071cb144c7a | 3024 | ssl_bitmask_set( bitmask, frag_off, frag_len ); |
JMF | 12:0071cb144c7a | 3025 | |
JMF | 12:0071cb144c7a | 3026 | /* |
JMF | 12:0071cb144c7a | 3027 | * Do we have the complete message by now? |
JMF | 12:0071cb144c7a | 3028 | * If yes, finalize it, else ask to read the next record. |
JMF | 12:0071cb144c7a | 3029 | */ |
JMF | 12:0071cb144c7a | 3030 | if( ssl_bitmask_check( bitmask, msg_len ) != 0 ) |
JMF | 12:0071cb144c7a | 3031 | { |
JMF | 12:0071cb144c7a | 3032 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "message is not complete yet" ) ); |
JMF | 12:0071cb144c7a | 3033 | return( MBEDTLS_ERR_SSL_WANT_READ ); |
JMF | 12:0071cb144c7a | 3034 | } |
JMF | 12:0071cb144c7a | 3035 | |
JMF | 12:0071cb144c7a | 3036 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake message completed" ) ); |
JMF | 12:0071cb144c7a | 3037 | |
JMF | 12:0071cb144c7a | 3038 | if( frag_len + 12 < ssl->in_msglen ) |
JMF | 12:0071cb144c7a | 3039 | { |
JMF | 12:0071cb144c7a | 3040 | /* |
JMF | 12:0071cb144c7a | 3041 | * We'got more handshake messages in the same record. |
JMF | 12:0071cb144c7a | 3042 | * This case is not handled now because no know implementation does |
JMF | 12:0071cb144c7a | 3043 | * that and it's hard to test, so we prefer to fail cleanly for now. |
JMF | 12:0071cb144c7a | 3044 | */ |
JMF | 12:0071cb144c7a | 3045 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "last fragment not alone in its record" ) ); |
JMF | 12:0071cb144c7a | 3046 | return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); |
JMF | 12:0071cb144c7a | 3047 | } |
JMF | 12:0071cb144c7a | 3048 | |
JMF | 12:0071cb144c7a | 3049 | if( ssl->in_left > ssl->next_record_offset ) |
JMF | 12:0071cb144c7a | 3050 | { |
JMF | 12:0071cb144c7a | 3051 | /* |
JMF | 12:0071cb144c7a | 3052 | * We've got more data in the buffer after the current record, |
JMF | 12:0071cb144c7a | 3053 | * that we don't want to overwrite. Move it before writing the |
JMF | 12:0071cb144c7a | 3054 | * reassembled message, and adjust in_left and next_record_offset. |
JMF | 12:0071cb144c7a | 3055 | */ |
JMF | 12:0071cb144c7a | 3056 | unsigned char *cur_remain = ssl->in_hdr + ssl->next_record_offset; |
JMF | 12:0071cb144c7a | 3057 | unsigned char *new_remain = ssl->in_msg + ssl->in_hslen; |
JMF | 12:0071cb144c7a | 3058 | size_t remain_len = ssl->in_left - ssl->next_record_offset; |
JMF | 12:0071cb144c7a | 3059 | |
JMF | 12:0071cb144c7a | 3060 | /* First compute and check new lengths */ |
JMF | 12:0071cb144c7a | 3061 | ssl->next_record_offset = new_remain - ssl->in_hdr; |
JMF | 12:0071cb144c7a | 3062 | ssl->in_left = ssl->next_record_offset + remain_len; |
JMF | 12:0071cb144c7a | 3063 | |
JMF | 12:0071cb144c7a | 3064 | if( ssl->in_left > MBEDTLS_SSL_BUFFER_LEN - |
JMF | 12:0071cb144c7a | 3065 | (size_t)( ssl->in_hdr - ssl->in_buf ) ) |
JMF | 12:0071cb144c7a | 3066 | { |
JMF | 12:0071cb144c7a | 3067 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "reassembled message too large for buffer" ) ); |
JMF | 12:0071cb144c7a | 3068 | return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); |
JMF | 12:0071cb144c7a | 3069 | } |
JMF | 12:0071cb144c7a | 3070 | |
JMF | 12:0071cb144c7a | 3071 | memmove( new_remain, cur_remain, remain_len ); |
JMF | 12:0071cb144c7a | 3072 | } |
JMF | 12:0071cb144c7a | 3073 | |
JMF | 12:0071cb144c7a | 3074 | memcpy( ssl->in_msg, ssl->handshake->hs_msg, ssl->in_hslen ); |
JMF | 12:0071cb144c7a | 3075 | |
JMF | 12:0071cb144c7a | 3076 | mbedtls_free( ssl->handshake->hs_msg ); |
JMF | 12:0071cb144c7a | 3077 | ssl->handshake->hs_msg = NULL; |
JMF | 12:0071cb144c7a | 3078 | |
JMF | 12:0071cb144c7a | 3079 | MBEDTLS_SSL_DEBUG_BUF( 3, "reassembled handshake message", |
JMF | 12:0071cb144c7a | 3080 | ssl->in_msg, ssl->in_hslen ); |
JMF | 12:0071cb144c7a | 3081 | |
JMF | 12:0071cb144c7a | 3082 | return( 0 ); |
JMF | 12:0071cb144c7a | 3083 | } |
JMF | 12:0071cb144c7a | 3084 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
JMF | 12:0071cb144c7a | 3085 | |
JMF | 12:0071cb144c7a | 3086 | static int ssl_prepare_handshake_record( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 3087 | { |
JMF | 12:0071cb144c7a | 3088 | if( ssl->in_msglen < mbedtls_ssl_hs_hdr_len( ssl ) ) |
JMF | 12:0071cb144c7a | 3089 | { |
JMF | 12:0071cb144c7a | 3090 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %d", |
JMF | 12:0071cb144c7a | 3091 | ssl->in_msglen ) ); |
JMF | 12:0071cb144c7a | 3092 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 3093 | } |
JMF | 12:0071cb144c7a | 3094 | |
JMF | 12:0071cb144c7a | 3095 | ssl->in_hslen = mbedtls_ssl_hs_hdr_len( ssl ) + ( |
JMF | 12:0071cb144c7a | 3096 | ( ssl->in_msg[1] << 16 ) | |
JMF | 12:0071cb144c7a | 3097 | ( ssl->in_msg[2] << 8 ) | |
JMF | 12:0071cb144c7a | 3098 | ssl->in_msg[3] ); |
JMF | 12:0071cb144c7a | 3099 | |
JMF | 12:0071cb144c7a | 3100 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "handshake message: msglen =" |
JMF | 12:0071cb144c7a | 3101 | " %d, type = %d, hslen = %d", |
JMF | 12:0071cb144c7a | 3102 | ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) ); |
JMF | 12:0071cb144c7a | 3103 | |
JMF | 12:0071cb144c7a | 3104 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 3105 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 3106 | { |
JMF | 12:0071cb144c7a | 3107 | int ret; |
JMF | 12:0071cb144c7a | 3108 | unsigned int recv_msg_seq = ( ssl->in_msg[4] << 8 ) | ssl->in_msg[5]; |
JMF | 12:0071cb144c7a | 3109 | |
JMF | 12:0071cb144c7a | 3110 | /* ssl->handshake is NULL when receiving ClientHello for renego */ |
JMF | 12:0071cb144c7a | 3111 | if( ssl->handshake != NULL && |
JMF | 12:0071cb144c7a | 3112 | recv_msg_seq != ssl->handshake->in_msg_seq ) |
JMF | 12:0071cb144c7a | 3113 | { |
JMF | 12:0071cb144c7a | 3114 | /* Retransmit only on last message from previous flight, to avoid |
JMF | 12:0071cb144c7a | 3115 | * too many retransmissions. |
JMF | 12:0071cb144c7a | 3116 | * Besides, No sane server ever retransmits HelloVerifyRequest */ |
JMF | 12:0071cb144c7a | 3117 | if( recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 && |
JMF | 12:0071cb144c7a | 3118 | ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST ) |
JMF | 12:0071cb144c7a | 3119 | { |
JMF | 12:0071cb144c7a | 3120 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "received message from last flight, " |
JMF | 12:0071cb144c7a | 3121 | "message_seq = %d, start_of_flight = %d", |
JMF | 12:0071cb144c7a | 3122 | recv_msg_seq, |
JMF | 12:0071cb144c7a | 3123 | ssl->handshake->in_flight_start_seq ) ); |
JMF | 12:0071cb144c7a | 3124 | |
JMF | 12:0071cb144c7a | 3125 | if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3126 | { |
JMF | 12:0071cb144c7a | 3127 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret ); |
JMF | 12:0071cb144c7a | 3128 | return( ret ); |
JMF | 12:0071cb144c7a | 3129 | } |
JMF | 12:0071cb144c7a | 3130 | } |
JMF | 12:0071cb144c7a | 3131 | else |
JMF | 12:0071cb144c7a | 3132 | { |
JMF | 12:0071cb144c7a | 3133 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: " |
JMF | 12:0071cb144c7a | 3134 | "message_seq = %d, expected = %d", |
JMF | 12:0071cb144c7a | 3135 | recv_msg_seq, |
JMF | 12:0071cb144c7a | 3136 | ssl->handshake->in_msg_seq ) ); |
JMF | 12:0071cb144c7a | 3137 | } |
JMF | 12:0071cb144c7a | 3138 | |
JMF | 12:0071cb144c7a | 3139 | return( MBEDTLS_ERR_SSL_WANT_READ ); |
JMF | 12:0071cb144c7a | 3140 | } |
JMF | 12:0071cb144c7a | 3141 | /* Wait until message completion to increment in_msg_seq */ |
JMF | 12:0071cb144c7a | 3142 | |
JMF | 12:0071cb144c7a | 3143 | /* Reassemble if current message is fragmented or reassembly is |
JMF | 12:0071cb144c7a | 3144 | * already in progress */ |
JMF | 12:0071cb144c7a | 3145 | if( ssl->in_msglen < ssl->in_hslen || |
JMF | 12:0071cb144c7a | 3146 | memcmp( ssl->in_msg + 6, "\0\0\0", 3 ) != 0 || |
JMF | 12:0071cb144c7a | 3147 | memcmp( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 || |
JMF | 12:0071cb144c7a | 3148 | ( ssl->handshake != NULL && ssl->handshake->hs_msg != NULL ) ) |
JMF | 12:0071cb144c7a | 3149 | { |
JMF | 12:0071cb144c7a | 3150 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) ); |
JMF | 12:0071cb144c7a | 3151 | |
JMF | 12:0071cb144c7a | 3152 | if( ( ret = ssl_reassemble_dtls_handshake( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3153 | { |
JMF | 12:0071cb144c7a | 3154 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_reassemble_dtls_handshake", ret ); |
JMF | 12:0071cb144c7a | 3155 | return( ret ); |
JMF | 12:0071cb144c7a | 3156 | } |
JMF | 12:0071cb144c7a | 3157 | } |
JMF | 12:0071cb144c7a | 3158 | } |
JMF | 12:0071cb144c7a | 3159 | else |
JMF | 12:0071cb144c7a | 3160 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
JMF | 12:0071cb144c7a | 3161 | /* With TLS we don't handle fragmentation (for now) */ |
JMF | 12:0071cb144c7a | 3162 | if( ssl->in_msglen < ssl->in_hslen ) |
JMF | 12:0071cb144c7a | 3163 | { |
JMF | 12:0071cb144c7a | 3164 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) ); |
JMF | 12:0071cb144c7a | 3165 | return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); |
JMF | 12:0071cb144c7a | 3166 | } |
JMF | 12:0071cb144c7a | 3167 | |
JMF | 12:0071cb144c7a | 3168 | if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER && |
JMF | 12:0071cb144c7a | 3169 | ssl->handshake != NULL ) |
JMF | 12:0071cb144c7a | 3170 | { |
JMF | 12:0071cb144c7a | 3171 | ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen ); |
JMF | 12:0071cb144c7a | 3172 | } |
JMF | 12:0071cb144c7a | 3173 | |
JMF | 12:0071cb144c7a | 3174 | /* Handshake message is complete, increment counter */ |
JMF | 12:0071cb144c7a | 3175 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 3176 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
JMF | 12:0071cb144c7a | 3177 | ssl->handshake != NULL ) |
JMF | 12:0071cb144c7a | 3178 | { |
JMF | 12:0071cb144c7a | 3179 | ssl->handshake->in_msg_seq++; |
JMF | 12:0071cb144c7a | 3180 | } |
JMF | 12:0071cb144c7a | 3181 | #endif |
JMF | 12:0071cb144c7a | 3182 | |
JMF | 12:0071cb144c7a | 3183 | return( 0 ); |
JMF | 12:0071cb144c7a | 3184 | } |
JMF | 12:0071cb144c7a | 3185 | |
JMF | 12:0071cb144c7a | 3186 | /* |
JMF | 12:0071cb144c7a | 3187 | * DTLS anti-replay: RFC 6347 4.1.2.6 |
JMF | 12:0071cb144c7a | 3188 | * |
JMF | 12:0071cb144c7a | 3189 | * in_window is a field of bits numbered from 0 (lsb) to 63 (msb). |
JMF | 12:0071cb144c7a | 3190 | * Bit n is set iff record number in_window_top - n has been seen. |
JMF | 12:0071cb144c7a | 3191 | * |
JMF | 12:0071cb144c7a | 3192 | * Usually, in_window_top is the last record number seen and the lsb of |
JMF | 12:0071cb144c7a | 3193 | * in_window is set. The only exception is the initial state (record number 0 |
JMF | 12:0071cb144c7a | 3194 | * not seen yet). |
JMF | 12:0071cb144c7a | 3195 | */ |
JMF | 12:0071cb144c7a | 3196 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
JMF | 12:0071cb144c7a | 3197 | static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 3198 | { |
JMF | 12:0071cb144c7a | 3199 | ssl->in_window_top = 0; |
JMF | 12:0071cb144c7a | 3200 | ssl->in_window = 0; |
JMF | 12:0071cb144c7a | 3201 | } |
JMF | 12:0071cb144c7a | 3202 | |
JMF | 12:0071cb144c7a | 3203 | static inline uint64_t ssl_load_six_bytes( unsigned char *buf ) |
JMF | 12:0071cb144c7a | 3204 | { |
JMF | 12:0071cb144c7a | 3205 | return( ( (uint64_t) buf[0] << 40 ) | |
JMF | 12:0071cb144c7a | 3206 | ( (uint64_t) buf[1] << 32 ) | |
JMF | 12:0071cb144c7a | 3207 | ( (uint64_t) buf[2] << 24 ) | |
JMF | 12:0071cb144c7a | 3208 | ( (uint64_t) buf[3] << 16 ) | |
JMF | 12:0071cb144c7a | 3209 | ( (uint64_t) buf[4] << 8 ) | |
JMF | 12:0071cb144c7a | 3210 | ( (uint64_t) buf[5] ) ); |
JMF | 12:0071cb144c7a | 3211 | } |
JMF | 12:0071cb144c7a | 3212 | |
JMF | 12:0071cb144c7a | 3213 | /* |
JMF | 12:0071cb144c7a | 3214 | * Return 0 if sequence number is acceptable, -1 otherwise |
JMF | 12:0071cb144c7a | 3215 | */ |
JMF | 12:0071cb144c7a | 3216 | int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 3217 | { |
JMF | 12:0071cb144c7a | 3218 | uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 ); |
JMF | 12:0071cb144c7a | 3219 | uint64_t bit; |
JMF | 12:0071cb144c7a | 3220 | |
JMF | 12:0071cb144c7a | 3221 | if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED ) |
JMF | 12:0071cb144c7a | 3222 | return( 0 ); |
JMF | 12:0071cb144c7a | 3223 | |
JMF | 12:0071cb144c7a | 3224 | if( rec_seqnum > ssl->in_window_top ) |
JMF | 12:0071cb144c7a | 3225 | return( 0 ); |
JMF | 12:0071cb144c7a | 3226 | |
JMF | 12:0071cb144c7a | 3227 | bit = ssl->in_window_top - rec_seqnum; |
JMF | 12:0071cb144c7a | 3228 | |
JMF | 12:0071cb144c7a | 3229 | if( bit >= 64 ) |
JMF | 12:0071cb144c7a | 3230 | return( -1 ); |
JMF | 12:0071cb144c7a | 3231 | |
JMF | 12:0071cb144c7a | 3232 | if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3233 | return( -1 ); |
JMF | 12:0071cb144c7a | 3234 | |
JMF | 12:0071cb144c7a | 3235 | return( 0 ); |
JMF | 12:0071cb144c7a | 3236 | } |
JMF | 12:0071cb144c7a | 3237 | |
JMF | 12:0071cb144c7a | 3238 | /* |
JMF | 12:0071cb144c7a | 3239 | * Update replay window on new validated record |
JMF | 12:0071cb144c7a | 3240 | */ |
JMF | 12:0071cb144c7a | 3241 | void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 3242 | { |
JMF | 12:0071cb144c7a | 3243 | uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 ); |
JMF | 12:0071cb144c7a | 3244 | |
JMF | 12:0071cb144c7a | 3245 | if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED ) |
JMF | 12:0071cb144c7a | 3246 | return; |
JMF | 12:0071cb144c7a | 3247 | |
JMF | 12:0071cb144c7a | 3248 | if( rec_seqnum > ssl->in_window_top ) |
JMF | 12:0071cb144c7a | 3249 | { |
JMF | 12:0071cb144c7a | 3250 | /* Update window_top and the contents of the window */ |
JMF | 12:0071cb144c7a | 3251 | uint64_t shift = rec_seqnum - ssl->in_window_top; |
JMF | 12:0071cb144c7a | 3252 | |
JMF | 12:0071cb144c7a | 3253 | if( shift >= 64 ) |
JMF | 12:0071cb144c7a | 3254 | ssl->in_window = 1; |
JMF | 12:0071cb144c7a | 3255 | else |
JMF | 12:0071cb144c7a | 3256 | { |
JMF | 12:0071cb144c7a | 3257 | ssl->in_window <<= shift; |
JMF | 12:0071cb144c7a | 3258 | ssl->in_window |= 1; |
JMF | 12:0071cb144c7a | 3259 | } |
JMF | 12:0071cb144c7a | 3260 | |
JMF | 12:0071cb144c7a | 3261 | ssl->in_window_top = rec_seqnum; |
JMF | 12:0071cb144c7a | 3262 | } |
JMF | 12:0071cb144c7a | 3263 | else |
JMF | 12:0071cb144c7a | 3264 | { |
JMF | 12:0071cb144c7a | 3265 | /* Mark that number as seen in the current window */ |
JMF | 12:0071cb144c7a | 3266 | uint64_t bit = ssl->in_window_top - rec_seqnum; |
JMF | 12:0071cb144c7a | 3267 | |
JMF | 12:0071cb144c7a | 3268 | if( bit < 64 ) /* Always true, but be extra sure */ |
JMF | 12:0071cb144c7a | 3269 | ssl->in_window |= (uint64_t) 1 << bit; |
JMF | 12:0071cb144c7a | 3270 | } |
JMF | 12:0071cb144c7a | 3271 | } |
JMF | 12:0071cb144c7a | 3272 | #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */ |
JMF | 12:0071cb144c7a | 3273 | |
JMF | 12:0071cb144c7a | 3274 | #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 3275 | /* Forward declaration */ |
JMF | 12:0071cb144c7a | 3276 | static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial ); |
JMF | 12:0071cb144c7a | 3277 | |
JMF | 12:0071cb144c7a | 3278 | /* |
JMF | 12:0071cb144c7a | 3279 | * Without any SSL context, check if a datagram looks like a ClientHello with |
JMF | 12:0071cb144c7a | 3280 | * a valid cookie, and if it doesn't, generate a HelloVerifyRequest message. |
JMF | 12:0071cb144c7a | 3281 | * Both input and output include full DTLS headers. |
JMF | 12:0071cb144c7a | 3282 | * |
JMF | 12:0071cb144c7a | 3283 | * - if cookie is valid, return 0 |
JMF | 12:0071cb144c7a | 3284 | * - if ClientHello looks superficially valid but cookie is not, |
JMF | 12:0071cb144c7a | 3285 | * fill obuf and set olen, then |
JMF | 12:0071cb144c7a | 3286 | * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED |
JMF | 12:0071cb144c7a | 3287 | * - otherwise return a specific error code |
JMF | 12:0071cb144c7a | 3288 | */ |
JMF | 12:0071cb144c7a | 3289 | static int ssl_check_dtls_clihlo_cookie( |
JMF | 12:0071cb144c7a | 3290 | mbedtls_ssl_cookie_write_t *f_cookie_write, |
JMF | 12:0071cb144c7a | 3291 | mbedtls_ssl_cookie_check_t *f_cookie_check, |
JMF | 12:0071cb144c7a | 3292 | void *p_cookie, |
JMF | 12:0071cb144c7a | 3293 | const unsigned char *cli_id, size_t cli_id_len, |
JMF | 12:0071cb144c7a | 3294 | const unsigned char *in, size_t in_len, |
JMF | 12:0071cb144c7a | 3295 | unsigned char *obuf, size_t buf_len, size_t *olen ) |
JMF | 12:0071cb144c7a | 3296 | { |
JMF | 12:0071cb144c7a | 3297 | size_t sid_len, cookie_len; |
JMF | 12:0071cb144c7a | 3298 | unsigned char *p; |
JMF | 12:0071cb144c7a | 3299 | |
JMF | 12:0071cb144c7a | 3300 | if( f_cookie_write == NULL || f_cookie_check == NULL ) |
JMF | 12:0071cb144c7a | 3301 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 3302 | |
JMF | 12:0071cb144c7a | 3303 | /* |
JMF | 12:0071cb144c7a | 3304 | * Structure of ClientHello with record and handshake headers, |
JMF | 12:0071cb144c7a | 3305 | * and expected values. We don't need to check a lot, more checks will be |
JMF | 12:0071cb144c7a | 3306 | * done when actually parsing the ClientHello - skipping those checks |
JMF | 12:0071cb144c7a | 3307 | * avoids code duplication and does not make cookie forging any easier. |
JMF | 12:0071cb144c7a | 3308 | * |
JMF | 12:0071cb144c7a | 3309 | * 0-0 ContentType type; copied, must be handshake |
JMF | 12:0071cb144c7a | 3310 | * 1-2 ProtocolVersion version; copied |
JMF | 12:0071cb144c7a | 3311 | * 3-4 uint16 epoch; copied, must be 0 |
JMF | 12:0071cb144c7a | 3312 | * 5-10 uint48 sequence_number; copied |
JMF | 12:0071cb144c7a | 3313 | * 11-12 uint16 length; (ignored) |
JMF | 12:0071cb144c7a | 3314 | * |
JMF | 12:0071cb144c7a | 3315 | * 13-13 HandshakeType msg_type; (ignored) |
JMF | 12:0071cb144c7a | 3316 | * 14-16 uint24 length; (ignored) |
JMF | 12:0071cb144c7a | 3317 | * 17-18 uint16 message_seq; copied |
JMF | 12:0071cb144c7a | 3318 | * 19-21 uint24 fragment_offset; copied, must be 0 |
JMF | 12:0071cb144c7a | 3319 | * 22-24 uint24 fragment_length; (ignored) |
JMF | 12:0071cb144c7a | 3320 | * |
JMF | 12:0071cb144c7a | 3321 | * 25-26 ProtocolVersion client_version; (ignored) |
JMF | 12:0071cb144c7a | 3322 | * 27-58 Random random; (ignored) |
JMF | 12:0071cb144c7a | 3323 | * 59-xx SessionID session_id; 1 byte len + sid_len content |
JMF | 12:0071cb144c7a | 3324 | * 60+ opaque cookie<0..2^8-1>; 1 byte len + content |
JMF | 12:0071cb144c7a | 3325 | * ... |
JMF | 12:0071cb144c7a | 3326 | * |
JMF | 12:0071cb144c7a | 3327 | * Minimum length is 61 bytes. |
JMF | 12:0071cb144c7a | 3328 | */ |
JMF | 12:0071cb144c7a | 3329 | if( in_len < 61 || |
JMF | 12:0071cb144c7a | 3330 | in[0] != MBEDTLS_SSL_MSG_HANDSHAKE || |
JMF | 12:0071cb144c7a | 3331 | in[3] != 0 || in[4] != 0 || |
JMF | 12:0071cb144c7a | 3332 | in[19] != 0 || in[20] != 0 || in[21] != 0 ) |
JMF | 12:0071cb144c7a | 3333 | { |
JMF | 12:0071cb144c7a | 3334 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
JMF | 12:0071cb144c7a | 3335 | } |
JMF | 12:0071cb144c7a | 3336 | |
JMF | 12:0071cb144c7a | 3337 | sid_len = in[59]; |
JMF | 12:0071cb144c7a | 3338 | if( sid_len > in_len - 61 ) |
JMF | 12:0071cb144c7a | 3339 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
JMF | 12:0071cb144c7a | 3340 | |
JMF | 12:0071cb144c7a | 3341 | cookie_len = in[60 + sid_len]; |
JMF | 12:0071cb144c7a | 3342 | if( cookie_len > in_len - 60 ) |
JMF | 12:0071cb144c7a | 3343 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
JMF | 12:0071cb144c7a | 3344 | |
JMF | 12:0071cb144c7a | 3345 | if( f_cookie_check( p_cookie, in + sid_len + 61, cookie_len, |
JMF | 12:0071cb144c7a | 3346 | cli_id, cli_id_len ) == 0 ) |
JMF | 12:0071cb144c7a | 3347 | { |
JMF | 12:0071cb144c7a | 3348 | /* Valid cookie */ |
JMF | 12:0071cb144c7a | 3349 | return( 0 ); |
JMF | 12:0071cb144c7a | 3350 | } |
JMF | 12:0071cb144c7a | 3351 | |
JMF | 12:0071cb144c7a | 3352 | /* |
JMF | 12:0071cb144c7a | 3353 | * If we get here, we've got an invalid cookie, let's prepare HVR. |
JMF | 12:0071cb144c7a | 3354 | * |
JMF | 12:0071cb144c7a | 3355 | * 0-0 ContentType type; copied |
JMF | 12:0071cb144c7a | 3356 | * 1-2 ProtocolVersion version; copied |
JMF | 12:0071cb144c7a | 3357 | * 3-4 uint16 epoch; copied |
JMF | 12:0071cb144c7a | 3358 | * 5-10 uint48 sequence_number; copied |
JMF | 12:0071cb144c7a | 3359 | * 11-12 uint16 length; olen - 13 |
JMF | 12:0071cb144c7a | 3360 | * |
JMF | 12:0071cb144c7a | 3361 | * 13-13 HandshakeType msg_type; hello_verify_request |
JMF | 12:0071cb144c7a | 3362 | * 14-16 uint24 length; olen - 25 |
JMF | 12:0071cb144c7a | 3363 | * 17-18 uint16 message_seq; copied |
JMF | 12:0071cb144c7a | 3364 | * 19-21 uint24 fragment_offset; copied |
JMF | 12:0071cb144c7a | 3365 | * 22-24 uint24 fragment_length; olen - 25 |
JMF | 12:0071cb144c7a | 3366 | * |
JMF | 12:0071cb144c7a | 3367 | * 25-26 ProtocolVersion server_version; 0xfe 0xff |
JMF | 12:0071cb144c7a | 3368 | * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie |
JMF | 12:0071cb144c7a | 3369 | * |
JMF | 12:0071cb144c7a | 3370 | * Minimum length is 28. |
JMF | 12:0071cb144c7a | 3371 | */ |
JMF | 12:0071cb144c7a | 3372 | if( buf_len < 28 ) |
JMF | 12:0071cb144c7a | 3373 | return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); |
JMF | 12:0071cb144c7a | 3374 | |
JMF | 12:0071cb144c7a | 3375 | /* Copy most fields and adapt others */ |
JMF | 12:0071cb144c7a | 3376 | memcpy( obuf, in, 25 ); |
JMF | 12:0071cb144c7a | 3377 | obuf[13] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST; |
JMF | 12:0071cb144c7a | 3378 | obuf[25] = 0xfe; |
JMF | 12:0071cb144c7a | 3379 | obuf[26] = 0xff; |
JMF | 12:0071cb144c7a | 3380 | |
JMF | 12:0071cb144c7a | 3381 | /* Generate and write actual cookie */ |
JMF | 12:0071cb144c7a | 3382 | p = obuf + 28; |
JMF | 12:0071cb144c7a | 3383 | if( f_cookie_write( p_cookie, |
JMF | 12:0071cb144c7a | 3384 | &p, obuf + buf_len, cli_id, cli_id_len ) != 0 ) |
JMF | 12:0071cb144c7a | 3385 | { |
JMF | 12:0071cb144c7a | 3386 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 3387 | } |
JMF | 12:0071cb144c7a | 3388 | |
JMF | 12:0071cb144c7a | 3389 | *olen = p - obuf; |
JMF | 12:0071cb144c7a | 3390 | |
JMF | 12:0071cb144c7a | 3391 | /* Go back and fill length fields */ |
JMF | 12:0071cb144c7a | 3392 | obuf[27] = (unsigned char)( *olen - 28 ); |
JMF | 12:0071cb144c7a | 3393 | |
JMF | 12:0071cb144c7a | 3394 | obuf[14] = obuf[22] = (unsigned char)( ( *olen - 25 ) >> 16 ); |
JMF | 12:0071cb144c7a | 3395 | obuf[15] = obuf[23] = (unsigned char)( ( *olen - 25 ) >> 8 ); |
JMF | 12:0071cb144c7a | 3396 | obuf[16] = obuf[24] = (unsigned char)( ( *olen - 25 ) ); |
JMF | 12:0071cb144c7a | 3397 | |
JMF | 12:0071cb144c7a | 3398 | obuf[11] = (unsigned char)( ( *olen - 13 ) >> 8 ); |
JMF | 12:0071cb144c7a | 3399 | obuf[12] = (unsigned char)( ( *olen - 13 ) ); |
JMF | 12:0071cb144c7a | 3400 | |
JMF | 12:0071cb144c7a | 3401 | return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED ); |
JMF | 12:0071cb144c7a | 3402 | } |
JMF | 12:0071cb144c7a | 3403 | |
JMF | 12:0071cb144c7a | 3404 | /* |
JMF | 12:0071cb144c7a | 3405 | * Handle possible client reconnect with the same UDP quadruplet |
JMF | 12:0071cb144c7a | 3406 | * (RFC 6347 Section 4.2.8). |
JMF | 12:0071cb144c7a | 3407 | * |
JMF | 12:0071cb144c7a | 3408 | * Called by ssl_parse_record_header() in case we receive an epoch 0 record |
JMF | 12:0071cb144c7a | 3409 | * that looks like a ClientHello. |
JMF | 12:0071cb144c7a | 3410 | * |
JMF | 12:0071cb144c7a | 3411 | * - if the input looks like a ClientHello without cookies, |
JMF | 12:0071cb144c7a | 3412 | * send back HelloVerifyRequest, then |
JMF | 12:0071cb144c7a | 3413 | * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED |
JMF | 12:0071cb144c7a | 3414 | * - if the input looks like a ClientHello with a valid cookie, |
JMF | 12:0071cb144c7a | 3415 | * reset the session of the current context, and |
JMF | 12:0071cb144c7a | 3416 | * return MBEDTLS_ERR_SSL_CLIENT_RECONNECT |
JMF | 12:0071cb144c7a | 3417 | * - if anything goes wrong, return a specific error code |
JMF | 12:0071cb144c7a | 3418 | * |
JMF | 12:0071cb144c7a | 3419 | * mbedtls_ssl_read_record() will ignore the record if anything else than |
JMF | 12:0071cb144c7a | 3420 | * MBEDTLS_ERR_SSL_CLIENT_RECONNECT or 0 is returned, although this function |
JMF | 12:0071cb144c7a | 3421 | * cannot not return 0. |
JMF | 12:0071cb144c7a | 3422 | */ |
JMF | 12:0071cb144c7a | 3423 | static int ssl_handle_possible_reconnect( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 3424 | { |
JMF | 12:0071cb144c7a | 3425 | int ret; |
JMF | 12:0071cb144c7a | 3426 | size_t len; |
JMF | 12:0071cb144c7a | 3427 | |
JMF | 12:0071cb144c7a | 3428 | ret = ssl_check_dtls_clihlo_cookie( |
JMF | 12:0071cb144c7a | 3429 | ssl->conf->f_cookie_write, |
JMF | 12:0071cb144c7a | 3430 | ssl->conf->f_cookie_check, |
JMF | 12:0071cb144c7a | 3431 | ssl->conf->p_cookie, |
JMF | 12:0071cb144c7a | 3432 | ssl->cli_id, ssl->cli_id_len, |
JMF | 12:0071cb144c7a | 3433 | ssl->in_buf, ssl->in_left, |
JMF | 12:0071cb144c7a | 3434 | ssl->out_buf, MBEDTLS_SSL_MAX_CONTENT_LEN, &len ); |
JMF | 12:0071cb144c7a | 3435 | |
JMF | 12:0071cb144c7a | 3436 | MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_dtls_clihlo_cookie", ret ); |
JMF | 12:0071cb144c7a | 3437 | |
JMF | 12:0071cb144c7a | 3438 | if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED ) |
JMF | 12:0071cb144c7a | 3439 | { |
JMF | 12:0071cb144c7a | 3440 | /* Dont check write errors as we can't do anything here. |
JMF | 12:0071cb144c7a | 3441 | * If the error is permanent we'll catch it later, |
JMF | 12:0071cb144c7a | 3442 | * if it's not, then hopefully it'll work next time. */ |
JMF | 12:0071cb144c7a | 3443 | (void) ssl->f_send( ssl->p_bio, ssl->out_buf, len ); |
JMF | 12:0071cb144c7a | 3444 | |
JMF | 12:0071cb144c7a | 3445 | return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED ); |
JMF | 12:0071cb144c7a | 3446 | } |
JMF | 12:0071cb144c7a | 3447 | |
JMF | 12:0071cb144c7a | 3448 | if( ret == 0 ) |
JMF | 12:0071cb144c7a | 3449 | { |
JMF | 12:0071cb144c7a | 3450 | /* Got a valid cookie, partially reset context */ |
JMF | 12:0071cb144c7a | 3451 | if( ( ret = ssl_session_reset_int( ssl, 1 ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3452 | { |
JMF | 12:0071cb144c7a | 3453 | MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret ); |
JMF | 12:0071cb144c7a | 3454 | return( ret ); |
JMF | 12:0071cb144c7a | 3455 | } |
JMF | 12:0071cb144c7a | 3456 | |
JMF | 12:0071cb144c7a | 3457 | return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT ); |
JMF | 12:0071cb144c7a | 3458 | } |
JMF | 12:0071cb144c7a | 3459 | |
JMF | 12:0071cb144c7a | 3460 | return( ret ); |
JMF | 12:0071cb144c7a | 3461 | } |
JMF | 12:0071cb144c7a | 3462 | #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */ |
JMF | 12:0071cb144c7a | 3463 | |
JMF | 12:0071cb144c7a | 3464 | /* |
JMF | 12:0071cb144c7a | 3465 | * ContentType type; |
JMF | 12:0071cb144c7a | 3466 | * ProtocolVersion version; |
JMF | 12:0071cb144c7a | 3467 | * uint16 epoch; // DTLS only |
JMF | 12:0071cb144c7a | 3468 | * uint48 sequence_number; // DTLS only |
JMF | 12:0071cb144c7a | 3469 | * uint16 length; |
JMF | 12:0071cb144c7a | 3470 | * |
JMF | 12:0071cb144c7a | 3471 | * Return 0 if header looks sane (and, for DTLS, the record is expected) |
JMF | 12:0071cb144c7a | 3472 | * MBEDTLS_ERR_SSL_INVALID_RECORD if the header looks bad, |
JMF | 12:0071cb144c7a | 3473 | * MBEDTLS_ERR_SSL_UNEXPECTED_RECORD (DTLS only) if sane but unexpected. |
JMF | 12:0071cb144c7a | 3474 | * |
JMF | 12:0071cb144c7a | 3475 | * With DTLS, mbedtls_ssl_read_record() will: |
JMF | 12:0071cb144c7a | 3476 | * 1. proceed with the record if this function returns 0 |
JMF | 12:0071cb144c7a | 3477 | * 2. drop only the current record if this function returns UNEXPECTED_RECORD |
JMF | 12:0071cb144c7a | 3478 | * 3. return CLIENT_RECONNECT if this function return that value |
JMF | 12:0071cb144c7a | 3479 | * 4. drop the whole datagram if this function returns anything else. |
JMF | 12:0071cb144c7a | 3480 | * Point 2 is needed when the peer is resending, and we have already received |
JMF | 12:0071cb144c7a | 3481 | * the first record from a datagram but are still waiting for the others. |
JMF | 12:0071cb144c7a | 3482 | */ |
JMF | 12:0071cb144c7a | 3483 | static int ssl_parse_record_header( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 3484 | { |
JMF | 12:0071cb144c7a | 3485 | int ret; |
JMF | 12:0071cb144c7a | 3486 | int major_ver, minor_ver; |
JMF | 12:0071cb144c7a | 3487 | |
JMF | 12:0071cb144c7a | 3488 | MBEDTLS_SSL_DEBUG_BUF( 4, "input record header", ssl->in_hdr, mbedtls_ssl_hdr_len( ssl ) ); |
JMF | 12:0071cb144c7a | 3489 | |
JMF | 12:0071cb144c7a | 3490 | ssl->in_msgtype = ssl->in_hdr[0]; |
JMF | 12:0071cb144c7a | 3491 | ssl->in_msglen = ( ssl->in_len[0] << 8 ) | ssl->in_len[1]; |
JMF | 12:0071cb144c7a | 3492 | mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, ssl->in_hdr + 1 ); |
JMF | 12:0071cb144c7a | 3493 | |
JMF | 12:0071cb144c7a | 3494 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, " |
JMF | 12:0071cb144c7a | 3495 | "version = [%d:%d], msglen = %d", |
JMF | 12:0071cb144c7a | 3496 | ssl->in_msgtype, |
JMF | 12:0071cb144c7a | 3497 | major_ver, minor_ver, ssl->in_msglen ) ); |
JMF | 12:0071cb144c7a | 3498 | |
JMF | 12:0071cb144c7a | 3499 | /* Check record type */ |
JMF | 12:0071cb144c7a | 3500 | if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE && |
JMF | 12:0071cb144c7a | 3501 | ssl->in_msgtype != MBEDTLS_SSL_MSG_ALERT && |
JMF | 12:0071cb144c7a | 3502 | ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC && |
JMF | 12:0071cb144c7a | 3503 | ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA ) |
JMF | 12:0071cb144c7a | 3504 | { |
JMF | 12:0071cb144c7a | 3505 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) ); |
JMF | 12:0071cb144c7a | 3506 | |
JMF | 12:0071cb144c7a | 3507 | if( ( ret = mbedtls_ssl_send_alert_message( ssl, |
JMF | 12:0071cb144c7a | 3508 | MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
JMF | 12:0071cb144c7a | 3509 | MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3510 | { |
JMF | 12:0071cb144c7a | 3511 | return( ret ); |
JMF | 12:0071cb144c7a | 3512 | } |
JMF | 12:0071cb144c7a | 3513 | |
JMF | 12:0071cb144c7a | 3514 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 3515 | } |
JMF | 12:0071cb144c7a | 3516 | |
JMF | 12:0071cb144c7a | 3517 | /* Check version */ |
JMF | 12:0071cb144c7a | 3518 | if( major_ver != ssl->major_ver ) |
JMF | 12:0071cb144c7a | 3519 | { |
JMF | 12:0071cb144c7a | 3520 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) ); |
JMF | 12:0071cb144c7a | 3521 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 3522 | } |
JMF | 12:0071cb144c7a | 3523 | |
JMF | 12:0071cb144c7a | 3524 | if( minor_ver > ssl->conf->max_minor_ver ) |
JMF | 12:0071cb144c7a | 3525 | { |
JMF | 12:0071cb144c7a | 3526 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) ); |
JMF | 12:0071cb144c7a | 3527 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 3528 | } |
JMF | 12:0071cb144c7a | 3529 | |
JMF | 12:0071cb144c7a | 3530 | /* Check length against the size of our buffer */ |
JMF | 12:0071cb144c7a | 3531 | if( ssl->in_msglen > MBEDTLS_SSL_BUFFER_LEN |
JMF | 12:0071cb144c7a | 3532 | - (size_t)( ssl->in_msg - ssl->in_buf ) ) |
JMF | 12:0071cb144c7a | 3533 | { |
JMF | 12:0071cb144c7a | 3534 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) ); |
JMF | 12:0071cb144c7a | 3535 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 3536 | } |
JMF | 12:0071cb144c7a | 3537 | |
JMF | 12:0071cb144c7a | 3538 | /* Check length against bounds of the current transform and version */ |
JMF | 12:0071cb144c7a | 3539 | if( ssl->transform_in == NULL ) |
JMF | 12:0071cb144c7a | 3540 | { |
JMF | 12:0071cb144c7a | 3541 | if( ssl->in_msglen < 1 || |
JMF | 12:0071cb144c7a | 3542 | ssl->in_msglen > MBEDTLS_SSL_MAX_CONTENT_LEN ) |
JMF | 12:0071cb144c7a | 3543 | { |
JMF | 12:0071cb144c7a | 3544 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) ); |
JMF | 12:0071cb144c7a | 3545 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 3546 | } |
JMF | 12:0071cb144c7a | 3547 | } |
JMF | 12:0071cb144c7a | 3548 | else |
JMF | 12:0071cb144c7a | 3549 | { |
JMF | 12:0071cb144c7a | 3550 | if( ssl->in_msglen < ssl->transform_in->minlen ) |
JMF | 12:0071cb144c7a | 3551 | { |
JMF | 12:0071cb144c7a | 3552 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) ); |
JMF | 12:0071cb144c7a | 3553 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 3554 | } |
JMF | 12:0071cb144c7a | 3555 | |
JMF | 12:0071cb144c7a | 3556 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 3557 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 && |
JMF | 12:0071cb144c7a | 3558 | ssl->in_msglen > ssl->transform_in->minlen + MBEDTLS_SSL_MAX_CONTENT_LEN ) |
JMF | 12:0071cb144c7a | 3559 | { |
JMF | 12:0071cb144c7a | 3560 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) ); |
JMF | 12:0071cb144c7a | 3561 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 3562 | } |
JMF | 12:0071cb144c7a | 3563 | #endif |
JMF | 12:0071cb144c7a | 3564 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
JMF | 12:0071cb144c7a | 3565 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 3566 | /* |
JMF | 12:0071cb144c7a | 3567 | * TLS encrypted messages can have up to 256 bytes of padding |
JMF | 12:0071cb144c7a | 3568 | */ |
JMF | 12:0071cb144c7a | 3569 | if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 && |
JMF | 12:0071cb144c7a | 3570 | ssl->in_msglen > ssl->transform_in->minlen + |
JMF | 12:0071cb144c7a | 3571 | MBEDTLS_SSL_MAX_CONTENT_LEN + 256 ) |
JMF | 12:0071cb144c7a | 3572 | { |
JMF | 12:0071cb144c7a | 3573 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) ); |
JMF | 12:0071cb144c7a | 3574 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 3575 | } |
JMF | 12:0071cb144c7a | 3576 | #endif |
JMF | 12:0071cb144c7a | 3577 | } |
JMF | 12:0071cb144c7a | 3578 | |
JMF | 12:0071cb144c7a | 3579 | /* |
JMF | 12:0071cb144c7a | 3580 | * DTLS-related tests done last, because most of them may result in |
JMF | 12:0071cb144c7a | 3581 | * silently dropping the record (but not the whole datagram), and we only |
JMF | 12:0071cb144c7a | 3582 | * want to consider that after ensuring that the "basic" fields (type, |
JMF | 12:0071cb144c7a | 3583 | * version, length) are sane. |
JMF | 12:0071cb144c7a | 3584 | */ |
JMF | 12:0071cb144c7a | 3585 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 3586 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 3587 | { |
JMF | 12:0071cb144c7a | 3588 | unsigned int rec_epoch = ( ssl->in_ctr[0] << 8 ) | ssl->in_ctr[1]; |
JMF | 12:0071cb144c7a | 3589 | |
JMF | 12:0071cb144c7a | 3590 | /* Drop unexpected ChangeCipherSpec messages */ |
JMF | 12:0071cb144c7a | 3591 | if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC && |
JMF | 12:0071cb144c7a | 3592 | ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC && |
JMF | 12:0071cb144c7a | 3593 | ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC ) |
JMF | 12:0071cb144c7a | 3594 | { |
JMF | 12:0071cb144c7a | 3595 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ChangeCipherSpec" ) ); |
JMF | 12:0071cb144c7a | 3596 | return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD ); |
JMF | 12:0071cb144c7a | 3597 | } |
JMF | 12:0071cb144c7a | 3598 | |
JMF | 12:0071cb144c7a | 3599 | /* Drop unexpected ApplicationData records, |
JMF | 12:0071cb144c7a | 3600 | * except at the beginning of renegotiations */ |
JMF | 12:0071cb144c7a | 3601 | if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA && |
JMF | 12:0071cb144c7a | 3602 | ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER |
JMF | 12:0071cb144c7a | 3603 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 3604 | && ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
JMF | 12:0071cb144c7a | 3605 | ssl->state == MBEDTLS_SSL_SERVER_HELLO ) |
JMF | 12:0071cb144c7a | 3606 | #endif |
JMF | 12:0071cb144c7a | 3607 | ) |
JMF | 12:0071cb144c7a | 3608 | { |
JMF | 12:0071cb144c7a | 3609 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) ); |
JMF | 12:0071cb144c7a | 3610 | return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD ); |
JMF | 12:0071cb144c7a | 3611 | } |
JMF | 12:0071cb144c7a | 3612 | |
JMF | 12:0071cb144c7a | 3613 | /* Check epoch (and sequence number) with DTLS */ |
JMF | 12:0071cb144c7a | 3614 | if( rec_epoch != ssl->in_epoch ) |
JMF | 12:0071cb144c7a | 3615 | { |
JMF | 12:0071cb144c7a | 3616 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: " |
JMF | 12:0071cb144c7a | 3617 | "expected %d, received %d", |
JMF | 12:0071cb144c7a | 3618 | ssl->in_epoch, rec_epoch ) ); |
JMF | 12:0071cb144c7a | 3619 | |
JMF | 12:0071cb144c7a | 3620 | #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 3621 | /* |
JMF | 12:0071cb144c7a | 3622 | * Check for an epoch 0 ClientHello. We can't use in_msg here to |
JMF | 12:0071cb144c7a | 3623 | * access the first byte of record content (handshake type), as we |
JMF | 12:0071cb144c7a | 3624 | * have an active transform (possibly iv_len != 0), so use the |
JMF | 12:0071cb144c7a | 3625 | * fact that the record header len is 13 instead. |
JMF | 12:0071cb144c7a | 3626 | */ |
JMF | 12:0071cb144c7a | 3627 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && |
JMF | 12:0071cb144c7a | 3628 | ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER && |
JMF | 12:0071cb144c7a | 3629 | rec_epoch == 0 && |
JMF | 12:0071cb144c7a | 3630 | ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE && |
JMF | 12:0071cb144c7a | 3631 | ssl->in_left > 13 && |
JMF | 12:0071cb144c7a | 3632 | ssl->in_buf[13] == MBEDTLS_SSL_HS_CLIENT_HELLO ) |
JMF | 12:0071cb144c7a | 3633 | { |
JMF | 12:0071cb144c7a | 3634 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect " |
JMF | 12:0071cb144c7a | 3635 | "from the same port" ) ); |
JMF | 12:0071cb144c7a | 3636 | return( ssl_handle_possible_reconnect( ssl ) ); |
JMF | 12:0071cb144c7a | 3637 | } |
JMF | 12:0071cb144c7a | 3638 | else |
JMF | 12:0071cb144c7a | 3639 | #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */ |
JMF | 12:0071cb144c7a | 3640 | return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD ); |
JMF | 12:0071cb144c7a | 3641 | } |
JMF | 12:0071cb144c7a | 3642 | |
JMF | 12:0071cb144c7a | 3643 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
JMF | 12:0071cb144c7a | 3644 | /* Replay detection only works for the current epoch */ |
JMF | 12:0071cb144c7a | 3645 | if( rec_epoch == ssl->in_epoch && |
JMF | 12:0071cb144c7a | 3646 | mbedtls_ssl_dtls_replay_check( ssl ) != 0 ) |
JMF | 12:0071cb144c7a | 3647 | { |
JMF | 12:0071cb144c7a | 3648 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) ); |
JMF | 12:0071cb144c7a | 3649 | return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD ); |
JMF | 12:0071cb144c7a | 3650 | } |
JMF | 12:0071cb144c7a | 3651 | #endif |
JMF | 12:0071cb144c7a | 3652 | } |
JMF | 12:0071cb144c7a | 3653 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
JMF | 12:0071cb144c7a | 3654 | |
JMF | 12:0071cb144c7a | 3655 | return( 0 ); |
JMF | 12:0071cb144c7a | 3656 | } |
JMF | 12:0071cb144c7a | 3657 | |
JMF | 12:0071cb144c7a | 3658 | /* |
JMF | 12:0071cb144c7a | 3659 | * If applicable, decrypt (and decompress) record content |
JMF | 12:0071cb144c7a | 3660 | */ |
JMF | 12:0071cb144c7a | 3661 | static int ssl_prepare_record_content( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 3662 | { |
JMF | 12:0071cb144c7a | 3663 | int ret, done = 0; |
JMF | 12:0071cb144c7a | 3664 | |
JMF | 12:0071cb144c7a | 3665 | MBEDTLS_SSL_DEBUG_BUF( 4, "input record from network", |
JMF | 12:0071cb144c7a | 3666 | ssl->in_hdr, mbedtls_ssl_hdr_len( ssl ) + ssl->in_msglen ); |
JMF | 12:0071cb144c7a | 3667 | |
JMF | 12:0071cb144c7a | 3668 | #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) |
JMF | 12:0071cb144c7a | 3669 | if( mbedtls_ssl_hw_record_read != NULL ) |
JMF | 12:0071cb144c7a | 3670 | { |
JMF | 12:0071cb144c7a | 3671 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_read()" ) ); |
JMF | 12:0071cb144c7a | 3672 | |
JMF | 12:0071cb144c7a | 3673 | ret = mbedtls_ssl_hw_record_read( ssl ); |
JMF | 12:0071cb144c7a | 3674 | if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH ) |
JMF | 12:0071cb144c7a | 3675 | { |
JMF | 12:0071cb144c7a | 3676 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_read", ret ); |
JMF | 12:0071cb144c7a | 3677 | return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); |
JMF | 12:0071cb144c7a | 3678 | } |
JMF | 12:0071cb144c7a | 3679 | |
JMF | 12:0071cb144c7a | 3680 | if( ret == 0 ) |
JMF | 12:0071cb144c7a | 3681 | done = 1; |
JMF | 12:0071cb144c7a | 3682 | } |
JMF | 12:0071cb144c7a | 3683 | #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */ |
JMF | 12:0071cb144c7a | 3684 | if( !done && ssl->transform_in != NULL ) |
JMF | 12:0071cb144c7a | 3685 | { |
JMF | 12:0071cb144c7a | 3686 | if( ( ret = ssl_decrypt_buf( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3687 | { |
JMF | 12:0071cb144c7a | 3688 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret ); |
JMF | 12:0071cb144c7a | 3689 | return( ret ); |
JMF | 12:0071cb144c7a | 3690 | } |
JMF | 12:0071cb144c7a | 3691 | |
JMF | 12:0071cb144c7a | 3692 | MBEDTLS_SSL_DEBUG_BUF( 4, "input payload after decrypt", |
JMF | 12:0071cb144c7a | 3693 | ssl->in_msg, ssl->in_msglen ); |
JMF | 12:0071cb144c7a | 3694 | |
JMF | 12:0071cb144c7a | 3695 | if( ssl->in_msglen > MBEDTLS_SSL_MAX_CONTENT_LEN ) |
JMF | 12:0071cb144c7a | 3696 | { |
JMF | 12:0071cb144c7a | 3697 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) ); |
JMF | 12:0071cb144c7a | 3698 | return( MBEDTLS_ERR_SSL_INVALID_RECORD ); |
JMF | 12:0071cb144c7a | 3699 | } |
JMF | 12:0071cb144c7a | 3700 | } |
JMF | 12:0071cb144c7a | 3701 | |
JMF | 12:0071cb144c7a | 3702 | #if defined(MBEDTLS_ZLIB_SUPPORT) |
JMF | 12:0071cb144c7a | 3703 | if( ssl->transform_in != NULL && |
JMF | 12:0071cb144c7a | 3704 | ssl->session_in->compression == MBEDTLS_SSL_COMPRESS_DEFLATE ) |
JMF | 12:0071cb144c7a | 3705 | { |
JMF | 12:0071cb144c7a | 3706 | if( ( ret = ssl_decompress_buf( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3707 | { |
JMF | 12:0071cb144c7a | 3708 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret ); |
JMF | 12:0071cb144c7a | 3709 | return( ret ); |
JMF | 12:0071cb144c7a | 3710 | } |
JMF | 12:0071cb144c7a | 3711 | } |
JMF | 12:0071cb144c7a | 3712 | #endif /* MBEDTLS_ZLIB_SUPPORT */ |
JMF | 12:0071cb144c7a | 3713 | |
JMF | 12:0071cb144c7a | 3714 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
JMF | 12:0071cb144c7a | 3715 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 3716 | { |
JMF | 12:0071cb144c7a | 3717 | mbedtls_ssl_dtls_replay_update( ssl ); |
JMF | 12:0071cb144c7a | 3718 | } |
JMF | 12:0071cb144c7a | 3719 | #endif |
JMF | 12:0071cb144c7a | 3720 | |
JMF | 12:0071cb144c7a | 3721 | return( 0 ); |
JMF | 12:0071cb144c7a | 3722 | } |
JMF | 12:0071cb144c7a | 3723 | |
JMF | 12:0071cb144c7a | 3724 | static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl ); |
JMF | 12:0071cb144c7a | 3725 | |
JMF | 12:0071cb144c7a | 3726 | /* |
JMF | 12:0071cb144c7a | 3727 | * Read a record. |
JMF | 12:0071cb144c7a | 3728 | * |
JMF | 12:0071cb144c7a | 3729 | * Silently ignore non-fatal alert (and for DTLS, invalid records as well, |
JMF | 12:0071cb144c7a | 3730 | * RFC 6347 4.1.2.7) and continue reading until a valid record is found. |
JMF | 12:0071cb144c7a | 3731 | * |
JMF | 12:0071cb144c7a | 3732 | */ |
JMF | 12:0071cb144c7a | 3733 | int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 3734 | { |
JMF | 12:0071cb144c7a | 3735 | int ret; |
JMF | 12:0071cb144c7a | 3736 | |
JMF | 12:0071cb144c7a | 3737 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read record" ) ); |
JMF | 12:0071cb144c7a | 3738 | |
JMF | 12:0071cb144c7a | 3739 | if( ssl->in_hslen != 0 && ssl->in_hslen < ssl->in_msglen ) |
JMF | 12:0071cb144c7a | 3740 | { |
JMF | 12:0071cb144c7a | 3741 | /* |
JMF | 12:0071cb144c7a | 3742 | * Get next Handshake message in the current record |
JMF | 12:0071cb144c7a | 3743 | */ |
JMF | 12:0071cb144c7a | 3744 | ssl->in_msglen -= ssl->in_hslen; |
JMF | 12:0071cb144c7a | 3745 | |
JMF | 12:0071cb144c7a | 3746 | memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen, |
JMF | 12:0071cb144c7a | 3747 | ssl->in_msglen ); |
JMF | 12:0071cb144c7a | 3748 | |
JMF | 12:0071cb144c7a | 3749 | MBEDTLS_SSL_DEBUG_BUF( 4, "remaining content in record", |
JMF | 12:0071cb144c7a | 3750 | ssl->in_msg, ssl->in_msglen ); |
JMF | 12:0071cb144c7a | 3751 | |
JMF | 12:0071cb144c7a | 3752 | if( ( ret = ssl_prepare_handshake_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3753 | return( ret ); |
JMF | 12:0071cb144c7a | 3754 | |
JMF | 12:0071cb144c7a | 3755 | return( 0 ); |
JMF | 12:0071cb144c7a | 3756 | } |
JMF | 12:0071cb144c7a | 3757 | |
JMF | 12:0071cb144c7a | 3758 | ssl->in_hslen = 0; |
JMF | 12:0071cb144c7a | 3759 | |
JMF | 12:0071cb144c7a | 3760 | /* |
JMF | 12:0071cb144c7a | 3761 | * Read the record header and parse it |
JMF | 12:0071cb144c7a | 3762 | */ |
JMF | 12:0071cb144c7a | 3763 | read_record_header: |
JMF | 12:0071cb144c7a | 3764 | if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3765 | { |
JMF | 12:0071cb144c7a | 3766 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret ); |
JMF | 12:0071cb144c7a | 3767 | return( ret ); |
JMF | 12:0071cb144c7a | 3768 | } |
JMF | 12:0071cb144c7a | 3769 | |
JMF | 12:0071cb144c7a | 3770 | if( ( ret = ssl_parse_record_header( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3771 | { |
JMF | 12:0071cb144c7a | 3772 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 3773 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
JMF | 12:0071cb144c7a | 3774 | ret != MBEDTLS_ERR_SSL_CLIENT_RECONNECT ) |
JMF | 12:0071cb144c7a | 3775 | { |
JMF | 12:0071cb144c7a | 3776 | if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD ) |
JMF | 12:0071cb144c7a | 3777 | { |
JMF | 12:0071cb144c7a | 3778 | /* Skip unexpected record (but not whole datagram) */ |
JMF | 12:0071cb144c7a | 3779 | ssl->next_record_offset = ssl->in_msglen |
JMF | 12:0071cb144c7a | 3780 | + mbedtls_ssl_hdr_len( ssl ); |
JMF | 12:0071cb144c7a | 3781 | |
JMF | 12:0071cb144c7a | 3782 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding unexpected record " |
JMF | 12:0071cb144c7a | 3783 | "(header)" ) ); |
JMF | 12:0071cb144c7a | 3784 | } |
JMF | 12:0071cb144c7a | 3785 | else |
JMF | 12:0071cb144c7a | 3786 | { |
JMF | 12:0071cb144c7a | 3787 | /* Skip invalid record and the rest of the datagram */ |
JMF | 12:0071cb144c7a | 3788 | ssl->next_record_offset = 0; |
JMF | 12:0071cb144c7a | 3789 | ssl->in_left = 0; |
JMF | 12:0071cb144c7a | 3790 | |
JMF | 12:0071cb144c7a | 3791 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record " |
JMF | 12:0071cb144c7a | 3792 | "(header)" ) ); |
JMF | 12:0071cb144c7a | 3793 | } |
JMF | 12:0071cb144c7a | 3794 | |
JMF | 12:0071cb144c7a | 3795 | /* Get next record */ |
JMF | 12:0071cb144c7a | 3796 | goto read_record_header; |
JMF | 12:0071cb144c7a | 3797 | } |
JMF | 12:0071cb144c7a | 3798 | #endif |
JMF | 12:0071cb144c7a | 3799 | return( ret ); |
JMF | 12:0071cb144c7a | 3800 | } |
JMF | 12:0071cb144c7a | 3801 | |
JMF | 12:0071cb144c7a | 3802 | /* |
JMF | 12:0071cb144c7a | 3803 | * Read and optionally decrypt the message contents |
JMF | 12:0071cb144c7a | 3804 | */ |
JMF | 12:0071cb144c7a | 3805 | if( ( ret = mbedtls_ssl_fetch_input( ssl, |
JMF | 12:0071cb144c7a | 3806 | mbedtls_ssl_hdr_len( ssl ) + ssl->in_msglen ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3807 | { |
JMF | 12:0071cb144c7a | 3808 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret ); |
JMF | 12:0071cb144c7a | 3809 | return( ret ); |
JMF | 12:0071cb144c7a | 3810 | } |
JMF | 12:0071cb144c7a | 3811 | |
JMF | 12:0071cb144c7a | 3812 | /* Done reading this record, get ready for the next one */ |
JMF | 12:0071cb144c7a | 3813 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 3814 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 3815 | ssl->next_record_offset = ssl->in_msglen + mbedtls_ssl_hdr_len( ssl ); |
JMF | 12:0071cb144c7a | 3816 | else |
JMF | 12:0071cb144c7a | 3817 | #endif |
JMF | 12:0071cb144c7a | 3818 | ssl->in_left = 0; |
JMF | 12:0071cb144c7a | 3819 | |
JMF | 12:0071cb144c7a | 3820 | if( ( ret = ssl_prepare_record_content( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3821 | { |
JMF | 12:0071cb144c7a | 3822 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 3823 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 3824 | { |
JMF | 12:0071cb144c7a | 3825 | /* Silently discard invalid records */ |
JMF | 12:0071cb144c7a | 3826 | if( ret == MBEDTLS_ERR_SSL_INVALID_RECORD || |
JMF | 12:0071cb144c7a | 3827 | ret == MBEDTLS_ERR_SSL_INVALID_MAC ) |
JMF | 12:0071cb144c7a | 3828 | { |
JMF | 12:0071cb144c7a | 3829 | /* Except when waiting for Finished as a bad mac here |
JMF | 12:0071cb144c7a | 3830 | * probably means something went wrong in the handshake |
JMF | 12:0071cb144c7a | 3831 | * (eg wrong psk used, mitm downgrade attempt, etc.) */ |
JMF | 12:0071cb144c7a | 3832 | if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED || |
JMF | 12:0071cb144c7a | 3833 | ssl->state == MBEDTLS_SSL_SERVER_FINISHED ) |
JMF | 12:0071cb144c7a | 3834 | { |
JMF | 12:0071cb144c7a | 3835 | #if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES) |
JMF | 12:0071cb144c7a | 3836 | if( ret == MBEDTLS_ERR_SSL_INVALID_MAC ) |
JMF | 12:0071cb144c7a | 3837 | { |
JMF | 12:0071cb144c7a | 3838 | mbedtls_ssl_send_alert_message( ssl, |
JMF | 12:0071cb144c7a | 3839 | MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
JMF | 12:0071cb144c7a | 3840 | MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC ); |
JMF | 12:0071cb144c7a | 3841 | } |
JMF | 12:0071cb144c7a | 3842 | #endif |
JMF | 12:0071cb144c7a | 3843 | return( ret ); |
JMF | 12:0071cb144c7a | 3844 | } |
JMF | 12:0071cb144c7a | 3845 | |
JMF | 12:0071cb144c7a | 3846 | #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) |
JMF | 12:0071cb144c7a | 3847 | if( ssl->conf->badmac_limit != 0 && |
JMF | 12:0071cb144c7a | 3848 | ++ssl->badmac_seen >= ssl->conf->badmac_limit ) |
JMF | 12:0071cb144c7a | 3849 | { |
JMF | 12:0071cb144c7a | 3850 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) ); |
JMF | 12:0071cb144c7a | 3851 | return( MBEDTLS_ERR_SSL_INVALID_MAC ); |
JMF | 12:0071cb144c7a | 3852 | } |
JMF | 12:0071cb144c7a | 3853 | #endif |
JMF | 12:0071cb144c7a | 3854 | |
JMF | 12:0071cb144c7a | 3855 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) ); |
JMF | 12:0071cb144c7a | 3856 | goto read_record_header; |
JMF | 12:0071cb144c7a | 3857 | } |
JMF | 12:0071cb144c7a | 3858 | |
JMF | 12:0071cb144c7a | 3859 | return( ret ); |
JMF | 12:0071cb144c7a | 3860 | } |
JMF | 12:0071cb144c7a | 3861 | else |
JMF | 12:0071cb144c7a | 3862 | #endif |
JMF | 12:0071cb144c7a | 3863 | { |
JMF | 12:0071cb144c7a | 3864 | /* Error out (and send alert) on invalid records */ |
JMF | 12:0071cb144c7a | 3865 | #if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES) |
JMF | 12:0071cb144c7a | 3866 | if( ret == MBEDTLS_ERR_SSL_INVALID_MAC ) |
JMF | 12:0071cb144c7a | 3867 | { |
JMF | 12:0071cb144c7a | 3868 | mbedtls_ssl_send_alert_message( ssl, |
JMF | 12:0071cb144c7a | 3869 | MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
JMF | 12:0071cb144c7a | 3870 | MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC ); |
JMF | 12:0071cb144c7a | 3871 | } |
JMF | 12:0071cb144c7a | 3872 | #endif |
JMF | 12:0071cb144c7a | 3873 | return( ret ); |
JMF | 12:0071cb144c7a | 3874 | } |
JMF | 12:0071cb144c7a | 3875 | } |
JMF | 12:0071cb144c7a | 3876 | |
JMF | 12:0071cb144c7a | 3877 | /* |
JMF | 12:0071cb144c7a | 3878 | * When we sent the last flight of the handshake, we MUST respond to a |
JMF | 12:0071cb144c7a | 3879 | * retransmit of the peer's previous flight with a retransmit. (In |
JMF | 12:0071cb144c7a | 3880 | * practice, only the Finished message will make it, other messages |
JMF | 12:0071cb144c7a | 3881 | * including CCS use the old transform so they're dropped as invalid.) |
JMF | 12:0071cb144c7a | 3882 | * |
JMF | 12:0071cb144c7a | 3883 | * If the record we received is not a handshake message, however, it |
JMF | 12:0071cb144c7a | 3884 | * means the peer received our last flight so we can clean up |
JMF | 12:0071cb144c7a | 3885 | * handshake info. |
JMF | 12:0071cb144c7a | 3886 | * |
JMF | 12:0071cb144c7a | 3887 | * This check needs to be done before prepare_handshake() due to an edge |
JMF | 12:0071cb144c7a | 3888 | * case: if the client immediately requests renegotiation, this |
JMF | 12:0071cb144c7a | 3889 | * finishes the current handshake first, avoiding the new ClientHello |
JMF | 12:0071cb144c7a | 3890 | * being mistaken for an ancient message in the current handshake. |
JMF | 12:0071cb144c7a | 3891 | */ |
JMF | 12:0071cb144c7a | 3892 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 3893 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
JMF | 12:0071cb144c7a | 3894 | ssl->handshake != NULL && |
JMF | 12:0071cb144c7a | 3895 | ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER ) |
JMF | 12:0071cb144c7a | 3896 | { |
JMF | 12:0071cb144c7a | 3897 | if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE && |
JMF | 12:0071cb144c7a | 3898 | ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED ) |
JMF | 12:0071cb144c7a | 3899 | { |
JMF | 12:0071cb144c7a | 3900 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "received retransmit of last flight" ) ); |
JMF | 12:0071cb144c7a | 3901 | |
JMF | 12:0071cb144c7a | 3902 | if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3903 | { |
JMF | 12:0071cb144c7a | 3904 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret ); |
JMF | 12:0071cb144c7a | 3905 | return( ret ); |
JMF | 12:0071cb144c7a | 3906 | } |
JMF | 12:0071cb144c7a | 3907 | |
JMF | 12:0071cb144c7a | 3908 | return( MBEDTLS_ERR_SSL_WANT_READ ); |
JMF | 12:0071cb144c7a | 3909 | } |
JMF | 12:0071cb144c7a | 3910 | else |
JMF | 12:0071cb144c7a | 3911 | { |
JMF | 12:0071cb144c7a | 3912 | ssl_handshake_wrapup_free_hs_transform( ssl ); |
JMF | 12:0071cb144c7a | 3913 | } |
JMF | 12:0071cb144c7a | 3914 | } |
JMF | 12:0071cb144c7a | 3915 | #endif |
JMF | 12:0071cb144c7a | 3916 | |
JMF | 12:0071cb144c7a | 3917 | /* |
JMF | 12:0071cb144c7a | 3918 | * Handle particular types of records |
JMF | 12:0071cb144c7a | 3919 | */ |
JMF | 12:0071cb144c7a | 3920 | if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) |
JMF | 12:0071cb144c7a | 3921 | { |
JMF | 12:0071cb144c7a | 3922 | if( ( ret = ssl_prepare_handshake_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3923 | return( ret ); |
JMF | 12:0071cb144c7a | 3924 | } |
JMF | 12:0071cb144c7a | 3925 | |
JMF | 12:0071cb144c7a | 3926 | if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT ) |
JMF | 12:0071cb144c7a | 3927 | { |
JMF | 12:0071cb144c7a | 3928 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]", |
JMF | 12:0071cb144c7a | 3929 | ssl->in_msg[0], ssl->in_msg[1] ) ); |
JMF | 12:0071cb144c7a | 3930 | |
JMF | 12:0071cb144c7a | 3931 | /* |
JMF | 12:0071cb144c7a | 3932 | * Ignore non-fatal alerts, except close_notify and no_renegotiation |
JMF | 12:0071cb144c7a | 3933 | */ |
JMF | 12:0071cb144c7a | 3934 | if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL ) |
JMF | 12:0071cb144c7a | 3935 | { |
JMF | 12:0071cb144c7a | 3936 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)", |
JMF | 12:0071cb144c7a | 3937 | ssl->in_msg[1] ) ); |
JMF | 12:0071cb144c7a | 3938 | return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE ); |
JMF | 12:0071cb144c7a | 3939 | } |
JMF | 12:0071cb144c7a | 3940 | |
JMF | 12:0071cb144c7a | 3941 | if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING && |
JMF | 12:0071cb144c7a | 3942 | ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) |
JMF | 12:0071cb144c7a | 3943 | { |
JMF | 12:0071cb144c7a | 3944 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) ); |
JMF | 12:0071cb144c7a | 3945 | return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY ); |
JMF | 12:0071cb144c7a | 3946 | } |
JMF | 12:0071cb144c7a | 3947 | |
JMF | 12:0071cb144c7a | 3948 | #if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED) |
JMF | 12:0071cb144c7a | 3949 | if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING && |
JMF | 12:0071cb144c7a | 3950 | ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION ) |
JMF | 12:0071cb144c7a | 3951 | { |
JMF | 12:0071cb144c7a | 3952 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) ); |
JMF | 12:0071cb144c7a | 3953 | /* Will be handled when trying to parse ServerHello */ |
JMF | 12:0071cb144c7a | 3954 | return( 0 ); |
JMF | 12:0071cb144c7a | 3955 | } |
JMF | 12:0071cb144c7a | 3956 | #endif |
JMF | 12:0071cb144c7a | 3957 | |
JMF | 12:0071cb144c7a | 3958 | #if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 3959 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 && |
JMF | 12:0071cb144c7a | 3960 | ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && |
JMF | 12:0071cb144c7a | 3961 | ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING && |
JMF | 12:0071cb144c7a | 3962 | ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT ) |
JMF | 12:0071cb144c7a | 3963 | { |
JMF | 12:0071cb144c7a | 3964 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) ); |
JMF | 12:0071cb144c7a | 3965 | /* Will be handled in mbedtls_ssl_parse_certificate() */ |
JMF | 12:0071cb144c7a | 3966 | return( 0 ); |
JMF | 12:0071cb144c7a | 3967 | } |
JMF | 12:0071cb144c7a | 3968 | #endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */ |
JMF | 12:0071cb144c7a | 3969 | |
JMF | 12:0071cb144c7a | 3970 | /* Silently ignore: fetch new message */ |
JMF | 12:0071cb144c7a | 3971 | goto read_record_header; |
JMF | 12:0071cb144c7a | 3972 | } |
JMF | 12:0071cb144c7a | 3973 | |
JMF | 12:0071cb144c7a | 3974 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) ); |
JMF | 12:0071cb144c7a | 3975 | |
JMF | 12:0071cb144c7a | 3976 | return( 0 ); |
JMF | 12:0071cb144c7a | 3977 | } |
JMF | 12:0071cb144c7a | 3978 | |
JMF | 12:0071cb144c7a | 3979 | int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 3980 | { |
JMF | 12:0071cb144c7a | 3981 | int ret; |
JMF | 12:0071cb144c7a | 3982 | |
JMF | 12:0071cb144c7a | 3983 | if( ( ret = mbedtls_ssl_send_alert_message( ssl, |
JMF | 12:0071cb144c7a | 3984 | MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
JMF | 12:0071cb144c7a | 3985 | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ) ) != 0 ) |
JMF | 12:0071cb144c7a | 3986 | { |
JMF | 12:0071cb144c7a | 3987 | return( ret ); |
JMF | 12:0071cb144c7a | 3988 | } |
JMF | 12:0071cb144c7a | 3989 | |
JMF | 12:0071cb144c7a | 3990 | return( 0 ); |
JMF | 12:0071cb144c7a | 3991 | } |
JMF | 12:0071cb144c7a | 3992 | |
JMF | 12:0071cb144c7a | 3993 | int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 3994 | unsigned char level, |
JMF | 12:0071cb144c7a | 3995 | unsigned char message ) |
JMF | 12:0071cb144c7a | 3996 | { |
JMF | 12:0071cb144c7a | 3997 | int ret; |
JMF | 12:0071cb144c7a | 3998 | |
JMF | 12:0071cb144c7a | 3999 | if( ssl == NULL || ssl->conf == NULL ) |
JMF | 12:0071cb144c7a | 4000 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 4001 | |
JMF | 12:0071cb144c7a | 4002 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) ); |
JMF | 12:0071cb144c7a | 4003 | |
JMF | 12:0071cb144c7a | 4004 | ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT; |
JMF | 12:0071cb144c7a | 4005 | ssl->out_msglen = 2; |
JMF | 12:0071cb144c7a | 4006 | ssl->out_msg[0] = level; |
JMF | 12:0071cb144c7a | 4007 | ssl->out_msg[1] = message; |
JMF | 12:0071cb144c7a | 4008 | |
JMF | 12:0071cb144c7a | 4009 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 4010 | { |
JMF | 12:0071cb144c7a | 4011 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
JMF | 12:0071cb144c7a | 4012 | return( ret ); |
JMF | 12:0071cb144c7a | 4013 | } |
JMF | 12:0071cb144c7a | 4014 | |
JMF | 12:0071cb144c7a | 4015 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) ); |
JMF | 12:0071cb144c7a | 4016 | |
JMF | 12:0071cb144c7a | 4017 | return( 0 ); |
JMF | 12:0071cb144c7a | 4018 | } |
JMF | 12:0071cb144c7a | 4019 | |
JMF | 12:0071cb144c7a | 4020 | /* |
JMF | 12:0071cb144c7a | 4021 | * Handshake functions |
JMF | 12:0071cb144c7a | 4022 | */ |
JMF | 12:0071cb144c7a | 4023 | #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \ |
JMF | 12:0071cb144c7a | 4024 | !defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) && \ |
JMF | 12:0071cb144c7a | 4025 | !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \ |
JMF | 12:0071cb144c7a | 4026 | !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ |
JMF | 12:0071cb144c7a | 4027 | !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ |
JMF | 12:0071cb144c7a | 4028 | !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \ |
JMF | 12:0071cb144c7a | 4029 | !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
JMF | 12:0071cb144c7a | 4030 | int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 4031 | { |
JMF | 12:0071cb144c7a | 4032 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
JMF | 12:0071cb144c7a | 4033 | |
JMF | 12:0071cb144c7a | 4034 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) ); |
JMF | 12:0071cb144c7a | 4035 | |
JMF | 12:0071cb144c7a | 4036 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
JMF | 12:0071cb144c7a | 4037 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
JMF | 12:0071cb144c7a | 4038 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || |
JMF | 12:0071cb144c7a | 4039 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
JMF | 12:0071cb144c7a | 4040 | { |
JMF | 12:0071cb144c7a | 4041 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) ); |
JMF | 12:0071cb144c7a | 4042 | ssl->state++; |
JMF | 12:0071cb144c7a | 4043 | return( 0 ); |
JMF | 12:0071cb144c7a | 4044 | } |
JMF | 12:0071cb144c7a | 4045 | |
JMF | 12:0071cb144c7a | 4046 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 4047 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 4048 | } |
JMF | 12:0071cb144c7a | 4049 | |
JMF | 12:0071cb144c7a | 4050 | int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 4051 | { |
JMF | 12:0071cb144c7a | 4052 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
JMF | 12:0071cb144c7a | 4053 | |
JMF | 12:0071cb144c7a | 4054 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) ); |
JMF | 12:0071cb144c7a | 4055 | |
JMF | 12:0071cb144c7a | 4056 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
JMF | 12:0071cb144c7a | 4057 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
JMF | 12:0071cb144c7a | 4058 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || |
JMF | 12:0071cb144c7a | 4059 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
JMF | 12:0071cb144c7a | 4060 | { |
JMF | 12:0071cb144c7a | 4061 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) ); |
JMF | 12:0071cb144c7a | 4062 | ssl->state++; |
JMF | 12:0071cb144c7a | 4063 | return( 0 ); |
JMF | 12:0071cb144c7a | 4064 | } |
JMF | 12:0071cb144c7a | 4065 | |
JMF | 12:0071cb144c7a | 4066 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 4067 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 4068 | } |
JMF | 12:0071cb144c7a | 4069 | #else |
JMF | 12:0071cb144c7a | 4070 | int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 4071 | { |
JMF | 12:0071cb144c7a | 4072 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
JMF | 12:0071cb144c7a | 4073 | size_t i, n; |
JMF | 12:0071cb144c7a | 4074 | const mbedtls_x509_crt *crt; |
JMF | 12:0071cb144c7a | 4075 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
JMF | 12:0071cb144c7a | 4076 | |
JMF | 12:0071cb144c7a | 4077 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) ); |
JMF | 12:0071cb144c7a | 4078 | |
JMF | 12:0071cb144c7a | 4079 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
JMF | 12:0071cb144c7a | 4080 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
JMF | 12:0071cb144c7a | 4081 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || |
JMF | 12:0071cb144c7a | 4082 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
JMF | 12:0071cb144c7a | 4083 | { |
JMF | 12:0071cb144c7a | 4084 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) ); |
JMF | 12:0071cb144c7a | 4085 | ssl->state++; |
JMF | 12:0071cb144c7a | 4086 | return( 0 ); |
JMF | 12:0071cb144c7a | 4087 | } |
JMF | 12:0071cb144c7a | 4088 | |
JMF | 12:0071cb144c7a | 4089 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 4090 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 4091 | { |
JMF | 12:0071cb144c7a | 4092 | if( ssl->client_auth == 0 ) |
JMF | 12:0071cb144c7a | 4093 | { |
JMF | 12:0071cb144c7a | 4094 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) ); |
JMF | 12:0071cb144c7a | 4095 | ssl->state++; |
JMF | 12:0071cb144c7a | 4096 | return( 0 ); |
JMF | 12:0071cb144c7a | 4097 | } |
JMF | 12:0071cb144c7a | 4098 | |
JMF | 12:0071cb144c7a | 4099 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 4100 | /* |
JMF | 12:0071cb144c7a | 4101 | * If using SSLv3 and got no cert, send an Alert message |
JMF | 12:0071cb144c7a | 4102 | * (otherwise an empty Certificate message will be sent). |
JMF | 12:0071cb144c7a | 4103 | */ |
JMF | 12:0071cb144c7a | 4104 | if( mbedtls_ssl_own_cert( ssl ) == NULL && |
JMF | 12:0071cb144c7a | 4105 | ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
JMF | 12:0071cb144c7a | 4106 | { |
JMF | 12:0071cb144c7a | 4107 | ssl->out_msglen = 2; |
JMF | 12:0071cb144c7a | 4108 | ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT; |
JMF | 12:0071cb144c7a | 4109 | ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING; |
JMF | 12:0071cb144c7a | 4110 | ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT; |
JMF | 12:0071cb144c7a | 4111 | |
JMF | 12:0071cb144c7a | 4112 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) ); |
JMF | 12:0071cb144c7a | 4113 | goto write_msg; |
JMF | 12:0071cb144c7a | 4114 | } |
JMF | 12:0071cb144c7a | 4115 | #endif /* MBEDTLS_SSL_PROTO_SSL3 */ |
JMF | 12:0071cb144c7a | 4116 | } |
JMF | 12:0071cb144c7a | 4117 | #endif /* MBEDTLS_SSL_CLI_C */ |
JMF | 12:0071cb144c7a | 4118 | #if defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 4119 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) |
JMF | 12:0071cb144c7a | 4120 | { |
JMF | 12:0071cb144c7a | 4121 | if( mbedtls_ssl_own_cert( ssl ) == NULL ) |
JMF | 12:0071cb144c7a | 4122 | { |
JMF | 12:0071cb144c7a | 4123 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) ); |
JMF | 12:0071cb144c7a | 4124 | return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED ); |
JMF | 12:0071cb144c7a | 4125 | } |
JMF | 12:0071cb144c7a | 4126 | } |
JMF | 12:0071cb144c7a | 4127 | #endif |
JMF | 12:0071cb144c7a | 4128 | |
JMF | 12:0071cb144c7a | 4129 | MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) ); |
JMF | 12:0071cb144c7a | 4130 | |
JMF | 12:0071cb144c7a | 4131 | /* |
JMF | 12:0071cb144c7a | 4132 | * 0 . 0 handshake type |
JMF | 12:0071cb144c7a | 4133 | * 1 . 3 handshake length |
JMF | 12:0071cb144c7a | 4134 | * 4 . 6 length of all certs |
JMF | 12:0071cb144c7a | 4135 | * 7 . 9 length of cert. 1 |
JMF | 12:0071cb144c7a | 4136 | * 10 . n-1 peer certificate |
JMF | 12:0071cb144c7a | 4137 | * n . n+2 length of cert. 2 |
JMF | 12:0071cb144c7a | 4138 | * n+3 . ... upper level cert, etc. |
JMF | 12:0071cb144c7a | 4139 | */ |
JMF | 12:0071cb144c7a | 4140 | i = 7; |
JMF | 12:0071cb144c7a | 4141 | crt = mbedtls_ssl_own_cert( ssl ); |
JMF | 12:0071cb144c7a | 4142 | |
JMF | 12:0071cb144c7a | 4143 | while( crt != NULL ) |
JMF | 12:0071cb144c7a | 4144 | { |
JMF | 12:0071cb144c7a | 4145 | n = crt->raw.len; |
JMF | 12:0071cb144c7a | 4146 | if( n > MBEDTLS_SSL_MAX_CONTENT_LEN - 3 - i ) |
JMF | 12:0071cb144c7a | 4147 | { |
JMF | 12:0071cb144c7a | 4148 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d", |
JMF | 12:0071cb144c7a | 4149 | i + 3 + n, MBEDTLS_SSL_MAX_CONTENT_LEN ) ); |
JMF | 12:0071cb144c7a | 4150 | return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE ); |
JMF | 12:0071cb144c7a | 4151 | } |
JMF | 12:0071cb144c7a | 4152 | |
JMF | 12:0071cb144c7a | 4153 | ssl->out_msg[i ] = (unsigned char)( n >> 16 ); |
JMF | 12:0071cb144c7a | 4154 | ssl->out_msg[i + 1] = (unsigned char)( n >> 8 ); |
JMF | 12:0071cb144c7a | 4155 | ssl->out_msg[i + 2] = (unsigned char)( n ); |
JMF | 12:0071cb144c7a | 4156 | |
JMF | 12:0071cb144c7a | 4157 | i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n ); |
JMF | 12:0071cb144c7a | 4158 | i += n; crt = crt->next; |
JMF | 12:0071cb144c7a | 4159 | } |
JMF | 12:0071cb144c7a | 4160 | |
JMF | 12:0071cb144c7a | 4161 | ssl->out_msg[4] = (unsigned char)( ( i - 7 ) >> 16 ); |
JMF | 12:0071cb144c7a | 4162 | ssl->out_msg[5] = (unsigned char)( ( i - 7 ) >> 8 ); |
JMF | 12:0071cb144c7a | 4163 | ssl->out_msg[6] = (unsigned char)( ( i - 7 ) ); |
JMF | 12:0071cb144c7a | 4164 | |
JMF | 12:0071cb144c7a | 4165 | ssl->out_msglen = i; |
JMF | 12:0071cb144c7a | 4166 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
JMF | 12:0071cb144c7a | 4167 | ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE; |
JMF | 12:0071cb144c7a | 4168 | |
JMF | 12:0071cb144c7a | 4169 | #if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 4170 | write_msg: |
JMF | 12:0071cb144c7a | 4171 | #endif |
JMF | 12:0071cb144c7a | 4172 | |
JMF | 12:0071cb144c7a | 4173 | ssl->state++; |
JMF | 12:0071cb144c7a | 4174 | |
JMF | 12:0071cb144c7a | 4175 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 4176 | { |
JMF | 12:0071cb144c7a | 4177 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
JMF | 12:0071cb144c7a | 4178 | return( ret ); |
JMF | 12:0071cb144c7a | 4179 | } |
JMF | 12:0071cb144c7a | 4180 | |
JMF | 12:0071cb144c7a | 4181 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) ); |
JMF | 12:0071cb144c7a | 4182 | |
JMF | 12:0071cb144c7a | 4183 | return( ret ); |
JMF | 12:0071cb144c7a | 4184 | } |
JMF | 12:0071cb144c7a | 4185 | |
JMF | 12:0071cb144c7a | 4186 | int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 4187 | { |
JMF | 12:0071cb144c7a | 4188 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
JMF | 12:0071cb144c7a | 4189 | size_t i, n; |
JMF | 12:0071cb144c7a | 4190 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
JMF | 12:0071cb144c7a | 4191 | int authmode = ssl->conf->authmode; |
JMF | 12:0071cb144c7a | 4192 | |
JMF | 12:0071cb144c7a | 4193 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) ); |
JMF | 12:0071cb144c7a | 4194 | |
JMF | 12:0071cb144c7a | 4195 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
JMF | 12:0071cb144c7a | 4196 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
JMF | 12:0071cb144c7a | 4197 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || |
JMF | 12:0071cb144c7a | 4198 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
JMF | 12:0071cb144c7a | 4199 | { |
JMF | 12:0071cb144c7a | 4200 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) ); |
JMF | 12:0071cb144c7a | 4201 | ssl->state++; |
JMF | 12:0071cb144c7a | 4202 | return( 0 ); |
JMF | 12:0071cb144c7a | 4203 | } |
JMF | 12:0071cb144c7a | 4204 | |
JMF | 12:0071cb144c7a | 4205 | #if defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 4206 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && |
JMF | 12:0071cb144c7a | 4207 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) |
JMF | 12:0071cb144c7a | 4208 | { |
JMF | 12:0071cb144c7a | 4209 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) ); |
JMF | 12:0071cb144c7a | 4210 | ssl->state++; |
JMF | 12:0071cb144c7a | 4211 | return( 0 ); |
JMF | 12:0071cb144c7a | 4212 | } |
JMF | 12:0071cb144c7a | 4213 | |
JMF | 12:0071cb144c7a | 4214 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
JMF | 12:0071cb144c7a | 4215 | if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET ) |
JMF | 12:0071cb144c7a | 4216 | authmode = ssl->handshake->sni_authmode; |
JMF | 12:0071cb144c7a | 4217 | #endif |
JMF | 12:0071cb144c7a | 4218 | |
JMF | 12:0071cb144c7a | 4219 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && |
JMF | 12:0071cb144c7a | 4220 | authmode == MBEDTLS_SSL_VERIFY_NONE ) |
JMF | 12:0071cb144c7a | 4221 | { |
JMF | 12:0071cb144c7a | 4222 | ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY; |
JMF | 12:0071cb144c7a | 4223 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) ); |
JMF | 12:0071cb144c7a | 4224 | ssl->state++; |
JMF | 12:0071cb144c7a | 4225 | return( 0 ); |
JMF | 12:0071cb144c7a | 4226 | } |
JMF | 12:0071cb144c7a | 4227 | #endif |
JMF | 12:0071cb144c7a | 4228 | |
JMF | 12:0071cb144c7a | 4229 | if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 4230 | { |
JMF | 12:0071cb144c7a | 4231 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); |
JMF | 12:0071cb144c7a | 4232 | return( ret ); |
JMF | 12:0071cb144c7a | 4233 | } |
JMF | 12:0071cb144c7a | 4234 | |
JMF | 12:0071cb144c7a | 4235 | ssl->state++; |
JMF | 12:0071cb144c7a | 4236 | |
JMF | 12:0071cb144c7a | 4237 | #if defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 4238 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 4239 | /* |
JMF | 12:0071cb144c7a | 4240 | * Check if the client sent an empty certificate |
JMF | 12:0071cb144c7a | 4241 | */ |
JMF | 12:0071cb144c7a | 4242 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && |
JMF | 12:0071cb144c7a | 4243 | ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
JMF | 12:0071cb144c7a | 4244 | { |
JMF | 12:0071cb144c7a | 4245 | if( ssl->in_msglen == 2 && |
JMF | 12:0071cb144c7a | 4246 | ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT && |
JMF | 12:0071cb144c7a | 4247 | ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING && |
JMF | 12:0071cb144c7a | 4248 | ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT ) |
JMF | 12:0071cb144c7a | 4249 | { |
JMF | 12:0071cb144c7a | 4250 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) ); |
JMF | 12:0071cb144c7a | 4251 | |
JMF | 12:0071cb144c7a | 4252 | ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING; |
JMF | 12:0071cb144c7a | 4253 | if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ) |
JMF | 12:0071cb144c7a | 4254 | return( 0 ); |
JMF | 12:0071cb144c7a | 4255 | else |
JMF | 12:0071cb144c7a | 4256 | return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE ); |
JMF | 12:0071cb144c7a | 4257 | } |
JMF | 12:0071cb144c7a | 4258 | } |
JMF | 12:0071cb144c7a | 4259 | #endif /* MBEDTLS_SSL_PROTO_SSL3 */ |
JMF | 12:0071cb144c7a | 4260 | |
JMF | 12:0071cb144c7a | 4261 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
JMF | 12:0071cb144c7a | 4262 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 4263 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && |
JMF | 12:0071cb144c7a | 4264 | ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 ) |
JMF | 12:0071cb144c7a | 4265 | { |
JMF | 12:0071cb144c7a | 4266 | if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) && |
JMF | 12:0071cb144c7a | 4267 | ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE && |
JMF | 12:0071cb144c7a | 4268 | ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE && |
JMF | 12:0071cb144c7a | 4269 | memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 ) |
JMF | 12:0071cb144c7a | 4270 | { |
JMF | 12:0071cb144c7a | 4271 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) ); |
JMF | 12:0071cb144c7a | 4272 | |
JMF | 12:0071cb144c7a | 4273 | ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING; |
JMF | 12:0071cb144c7a | 4274 | if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ) |
JMF | 12:0071cb144c7a | 4275 | return( 0 ); |
JMF | 12:0071cb144c7a | 4276 | else |
JMF | 12:0071cb144c7a | 4277 | return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE ); |
JMF | 12:0071cb144c7a | 4278 | } |
JMF | 12:0071cb144c7a | 4279 | } |
JMF | 12:0071cb144c7a | 4280 | #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \ |
JMF | 12:0071cb144c7a | 4281 | MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 4282 | #endif /* MBEDTLS_SSL_SRV_C */ |
JMF | 12:0071cb144c7a | 4283 | |
JMF | 12:0071cb144c7a | 4284 | if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) |
JMF | 12:0071cb144c7a | 4285 | { |
JMF | 12:0071cb144c7a | 4286 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) ); |
JMF | 12:0071cb144c7a | 4287 | return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); |
JMF | 12:0071cb144c7a | 4288 | } |
JMF | 12:0071cb144c7a | 4289 | |
JMF | 12:0071cb144c7a | 4290 | if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE || |
JMF | 12:0071cb144c7a | 4291 | ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 ) |
JMF | 12:0071cb144c7a | 4292 | { |
JMF | 12:0071cb144c7a | 4293 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) ); |
JMF | 12:0071cb144c7a | 4294 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); |
JMF | 12:0071cb144c7a | 4295 | } |
JMF | 12:0071cb144c7a | 4296 | |
JMF | 12:0071cb144c7a | 4297 | i = mbedtls_ssl_hs_hdr_len( ssl ); |
JMF | 12:0071cb144c7a | 4298 | |
JMF | 12:0071cb144c7a | 4299 | /* |
JMF | 12:0071cb144c7a | 4300 | * Same message structure as in mbedtls_ssl_write_certificate() |
JMF | 12:0071cb144c7a | 4301 | */ |
JMF | 12:0071cb144c7a | 4302 | n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2]; |
JMF | 12:0071cb144c7a | 4303 | |
JMF | 12:0071cb144c7a | 4304 | if( ssl->in_msg[i] != 0 || |
JMF | 12:0071cb144c7a | 4305 | ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) ) |
JMF | 12:0071cb144c7a | 4306 | { |
JMF | 12:0071cb144c7a | 4307 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) ); |
JMF | 12:0071cb144c7a | 4308 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); |
JMF | 12:0071cb144c7a | 4309 | } |
JMF | 12:0071cb144c7a | 4310 | |
JMF | 12:0071cb144c7a | 4311 | /* In case we tried to reuse a session but it failed */ |
JMF | 12:0071cb144c7a | 4312 | if( ssl->session_negotiate->peer_cert != NULL ) |
JMF | 12:0071cb144c7a | 4313 | { |
JMF | 12:0071cb144c7a | 4314 | mbedtls_x509_crt_free( ssl->session_negotiate->peer_cert ); |
JMF | 12:0071cb144c7a | 4315 | mbedtls_free( ssl->session_negotiate->peer_cert ); |
JMF | 12:0071cb144c7a | 4316 | } |
JMF | 12:0071cb144c7a | 4317 | |
JMF | 12:0071cb144c7a | 4318 | if( ( ssl->session_negotiate->peer_cert = mbedtls_calloc( 1, |
JMF | 12:0071cb144c7a | 4319 | sizeof( mbedtls_x509_crt ) ) ) == NULL ) |
JMF | 12:0071cb144c7a | 4320 | { |
JMF | 12:0071cb144c7a | 4321 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", |
JMF | 12:0071cb144c7a | 4322 | sizeof( mbedtls_x509_crt ) ) ); |
JMF | 12:0071cb144c7a | 4323 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 4324 | } |
JMF | 12:0071cb144c7a | 4325 | |
JMF | 12:0071cb144c7a | 4326 | mbedtls_x509_crt_init( ssl->session_negotiate->peer_cert ); |
JMF | 12:0071cb144c7a | 4327 | |
JMF | 12:0071cb144c7a | 4328 | i += 3; |
JMF | 12:0071cb144c7a | 4329 | |
JMF | 12:0071cb144c7a | 4330 | while( i < ssl->in_hslen ) |
JMF | 12:0071cb144c7a | 4331 | { |
JMF | 12:0071cb144c7a | 4332 | if( ssl->in_msg[i] != 0 ) |
JMF | 12:0071cb144c7a | 4333 | { |
JMF | 12:0071cb144c7a | 4334 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) ); |
JMF | 12:0071cb144c7a | 4335 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); |
JMF | 12:0071cb144c7a | 4336 | } |
JMF | 12:0071cb144c7a | 4337 | |
JMF | 12:0071cb144c7a | 4338 | n = ( (unsigned int) ssl->in_msg[i + 1] << 8 ) |
JMF | 12:0071cb144c7a | 4339 | | (unsigned int) ssl->in_msg[i + 2]; |
JMF | 12:0071cb144c7a | 4340 | i += 3; |
JMF | 12:0071cb144c7a | 4341 | |
JMF | 12:0071cb144c7a | 4342 | if( n < 128 || i + n > ssl->in_hslen ) |
JMF | 12:0071cb144c7a | 4343 | { |
JMF | 12:0071cb144c7a | 4344 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) ); |
JMF | 12:0071cb144c7a | 4345 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); |
JMF | 12:0071cb144c7a | 4346 | } |
JMF | 12:0071cb144c7a | 4347 | |
JMF | 12:0071cb144c7a | 4348 | ret = mbedtls_x509_crt_parse_der( ssl->session_negotiate->peer_cert, |
JMF | 12:0071cb144c7a | 4349 | ssl->in_msg + i, n ); |
JMF | 12:0071cb144c7a | 4350 | if( ret != 0 ) |
JMF | 12:0071cb144c7a | 4351 | { |
JMF | 12:0071cb144c7a | 4352 | MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret ); |
JMF | 12:0071cb144c7a | 4353 | return( ret ); |
JMF | 12:0071cb144c7a | 4354 | } |
JMF | 12:0071cb144c7a | 4355 | |
JMF | 12:0071cb144c7a | 4356 | i += n; |
JMF | 12:0071cb144c7a | 4357 | } |
JMF | 12:0071cb144c7a | 4358 | |
JMF | 12:0071cb144c7a | 4359 | MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", ssl->session_negotiate->peer_cert ); |
JMF | 12:0071cb144c7a | 4360 | |
JMF | 12:0071cb144c7a | 4361 | /* |
JMF | 12:0071cb144c7a | 4362 | * On client, make sure the server cert doesn't change during renego to |
JMF | 12:0071cb144c7a | 4363 | * avoid "triple handshake" attack: https://secure-resumption.com/ |
JMF | 12:0071cb144c7a | 4364 | */ |
JMF | 12:0071cb144c7a | 4365 | #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 4366 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT && |
JMF | 12:0071cb144c7a | 4367 | ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
JMF | 12:0071cb144c7a | 4368 | { |
JMF | 12:0071cb144c7a | 4369 | if( ssl->session->peer_cert == NULL ) |
JMF | 12:0071cb144c7a | 4370 | { |
JMF | 12:0071cb144c7a | 4371 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) ); |
JMF | 12:0071cb144c7a | 4372 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); |
JMF | 12:0071cb144c7a | 4373 | } |
JMF | 12:0071cb144c7a | 4374 | |
JMF | 12:0071cb144c7a | 4375 | if( ssl->session->peer_cert->raw.len != |
JMF | 12:0071cb144c7a | 4376 | ssl->session_negotiate->peer_cert->raw.len || |
JMF | 12:0071cb144c7a | 4377 | memcmp( ssl->session->peer_cert->raw.p, |
JMF | 12:0071cb144c7a | 4378 | ssl->session_negotiate->peer_cert->raw.p, |
JMF | 12:0071cb144c7a | 4379 | ssl->session->peer_cert->raw.len ) != 0 ) |
JMF | 12:0071cb144c7a | 4380 | { |
JMF | 12:0071cb144c7a | 4381 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "server cert changed during renegotiation" ) ); |
JMF | 12:0071cb144c7a | 4382 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); |
JMF | 12:0071cb144c7a | 4383 | } |
JMF | 12:0071cb144c7a | 4384 | } |
JMF | 12:0071cb144c7a | 4385 | #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */ |
JMF | 12:0071cb144c7a | 4386 | |
JMF | 12:0071cb144c7a | 4387 | if( authmode != MBEDTLS_SSL_VERIFY_NONE ) |
JMF | 12:0071cb144c7a | 4388 | { |
JMF | 12:0071cb144c7a | 4389 | mbedtls_x509_crt *ca_chain; |
JMF | 12:0071cb144c7a | 4390 | mbedtls_x509_crl *ca_crl; |
JMF | 12:0071cb144c7a | 4391 | |
JMF | 12:0071cb144c7a | 4392 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
JMF | 12:0071cb144c7a | 4393 | if( ssl->handshake->sni_ca_chain != NULL ) |
JMF | 12:0071cb144c7a | 4394 | { |
JMF | 12:0071cb144c7a | 4395 | ca_chain = ssl->handshake->sni_ca_chain; |
JMF | 12:0071cb144c7a | 4396 | ca_crl = ssl->handshake->sni_ca_crl; |
JMF | 12:0071cb144c7a | 4397 | } |
JMF | 12:0071cb144c7a | 4398 | else |
JMF | 12:0071cb144c7a | 4399 | #endif |
JMF | 12:0071cb144c7a | 4400 | { |
JMF | 12:0071cb144c7a | 4401 | ca_chain = ssl->conf->ca_chain; |
JMF | 12:0071cb144c7a | 4402 | ca_crl = ssl->conf->ca_crl; |
JMF | 12:0071cb144c7a | 4403 | } |
JMF | 12:0071cb144c7a | 4404 | |
JMF | 12:0071cb144c7a | 4405 | if( ca_chain == NULL ) |
JMF | 12:0071cb144c7a | 4406 | { |
JMF | 12:0071cb144c7a | 4407 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) ); |
JMF | 12:0071cb144c7a | 4408 | return( MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED ); |
JMF | 12:0071cb144c7a | 4409 | } |
JMF | 12:0071cb144c7a | 4410 | |
JMF | 12:0071cb144c7a | 4411 | /* |
JMF | 12:0071cb144c7a | 4412 | * Main check: verify certificate |
JMF | 12:0071cb144c7a | 4413 | */ |
JMF | 12:0071cb144c7a | 4414 | ret = mbedtls_x509_crt_verify_with_profile( |
JMF | 12:0071cb144c7a | 4415 | ssl->session_negotiate->peer_cert, |
JMF | 12:0071cb144c7a | 4416 | ca_chain, ca_crl, |
JMF | 12:0071cb144c7a | 4417 | ssl->conf->cert_profile, |
JMF | 12:0071cb144c7a | 4418 | ssl->hostname, |
JMF | 12:0071cb144c7a | 4419 | &ssl->session_negotiate->verify_result, |
JMF | 12:0071cb144c7a | 4420 | ssl->conf->f_vrfy, ssl->conf->p_vrfy ); |
JMF | 12:0071cb144c7a | 4421 | |
JMF | 12:0071cb144c7a | 4422 | if( ret != 0 ) |
JMF | 12:0071cb144c7a | 4423 | { |
JMF | 12:0071cb144c7a | 4424 | MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret ); |
JMF | 12:0071cb144c7a | 4425 | } |
JMF | 12:0071cb144c7a | 4426 | |
JMF | 12:0071cb144c7a | 4427 | /* |
JMF | 12:0071cb144c7a | 4428 | * Secondary checks: always done, but change 'ret' only if it was 0 |
JMF | 12:0071cb144c7a | 4429 | */ |
JMF | 12:0071cb144c7a | 4430 | |
JMF | 12:0071cb144c7a | 4431 | #if defined(MBEDTLS_ECP_C) |
JMF | 12:0071cb144c7a | 4432 | { |
JMF | 12:0071cb144c7a | 4433 | const mbedtls_pk_context *pk = &ssl->session_negotiate->peer_cert->pk; |
JMF | 12:0071cb144c7a | 4434 | |
JMF | 12:0071cb144c7a | 4435 | /* If certificate uses an EC key, make sure the curve is OK */ |
JMF | 12:0071cb144c7a | 4436 | if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) && |
JMF | 12:0071cb144c7a | 4437 | mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 ) |
JMF | 12:0071cb144c7a | 4438 | { |
JMF | 12:0071cb144c7a | 4439 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) ); |
JMF | 12:0071cb144c7a | 4440 | if( ret == 0 ) |
JMF | 12:0071cb144c7a | 4441 | ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE; |
JMF | 12:0071cb144c7a | 4442 | } |
JMF | 12:0071cb144c7a | 4443 | } |
JMF | 12:0071cb144c7a | 4444 | #endif /* MBEDTLS_ECP_C */ |
JMF | 12:0071cb144c7a | 4445 | |
JMF | 12:0071cb144c7a | 4446 | if( mbedtls_ssl_check_cert_usage( ssl->session_negotiate->peer_cert, |
JMF | 12:0071cb144c7a | 4447 | ciphersuite_info, |
JMF | 12:0071cb144c7a | 4448 | ! ssl->conf->endpoint, |
JMF | 12:0071cb144c7a | 4449 | &ssl->session_negotiate->verify_result ) != 0 ) |
JMF | 12:0071cb144c7a | 4450 | { |
JMF | 12:0071cb144c7a | 4451 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) ); |
JMF | 12:0071cb144c7a | 4452 | if( ret == 0 ) |
JMF | 12:0071cb144c7a | 4453 | ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE; |
JMF | 12:0071cb144c7a | 4454 | } |
JMF | 12:0071cb144c7a | 4455 | |
JMF | 12:0071cb144c7a | 4456 | if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ) |
JMF | 12:0071cb144c7a | 4457 | ret = 0; |
JMF | 12:0071cb144c7a | 4458 | } |
JMF | 12:0071cb144c7a | 4459 | |
JMF | 12:0071cb144c7a | 4460 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) ); |
JMF | 12:0071cb144c7a | 4461 | |
JMF | 12:0071cb144c7a | 4462 | return( ret ); |
JMF | 12:0071cb144c7a | 4463 | } |
JMF | 12:0071cb144c7a | 4464 | #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED |
JMF | 12:0071cb144c7a | 4465 | !MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED |
JMF | 12:0071cb144c7a | 4466 | !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED |
JMF | 12:0071cb144c7a | 4467 | !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED |
JMF | 12:0071cb144c7a | 4468 | !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
JMF | 12:0071cb144c7a | 4469 | !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED |
JMF | 12:0071cb144c7a | 4470 | !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ |
JMF | 12:0071cb144c7a | 4471 | |
JMF | 12:0071cb144c7a | 4472 | int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 4473 | { |
JMF | 12:0071cb144c7a | 4474 | int ret; |
JMF | 12:0071cb144c7a | 4475 | |
JMF | 12:0071cb144c7a | 4476 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) ); |
JMF | 12:0071cb144c7a | 4477 | |
JMF | 12:0071cb144c7a | 4478 | ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC; |
JMF | 12:0071cb144c7a | 4479 | ssl->out_msglen = 1; |
JMF | 12:0071cb144c7a | 4480 | ssl->out_msg[0] = 1; |
JMF | 12:0071cb144c7a | 4481 | |
JMF | 12:0071cb144c7a | 4482 | ssl->state++; |
JMF | 12:0071cb144c7a | 4483 | |
JMF | 12:0071cb144c7a | 4484 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 4485 | { |
JMF | 12:0071cb144c7a | 4486 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
JMF | 12:0071cb144c7a | 4487 | return( ret ); |
JMF | 12:0071cb144c7a | 4488 | } |
JMF | 12:0071cb144c7a | 4489 | |
JMF | 12:0071cb144c7a | 4490 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) ); |
JMF | 12:0071cb144c7a | 4491 | |
JMF | 12:0071cb144c7a | 4492 | return( 0 ); |
JMF | 12:0071cb144c7a | 4493 | } |
JMF | 12:0071cb144c7a | 4494 | |
JMF | 12:0071cb144c7a | 4495 | int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 4496 | { |
JMF | 12:0071cb144c7a | 4497 | int ret; |
JMF | 12:0071cb144c7a | 4498 | |
JMF | 12:0071cb144c7a | 4499 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) ); |
JMF | 12:0071cb144c7a | 4500 | |
JMF | 12:0071cb144c7a | 4501 | if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 4502 | { |
JMF | 12:0071cb144c7a | 4503 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); |
JMF | 12:0071cb144c7a | 4504 | return( ret ); |
JMF | 12:0071cb144c7a | 4505 | } |
JMF | 12:0071cb144c7a | 4506 | |
JMF | 12:0071cb144c7a | 4507 | if( ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC ) |
JMF | 12:0071cb144c7a | 4508 | { |
JMF | 12:0071cb144c7a | 4509 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) ); |
JMF | 12:0071cb144c7a | 4510 | return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); |
JMF | 12:0071cb144c7a | 4511 | } |
JMF | 12:0071cb144c7a | 4512 | |
JMF | 12:0071cb144c7a | 4513 | if( ssl->in_msglen != 1 || ssl->in_msg[0] != 1 ) |
JMF | 12:0071cb144c7a | 4514 | { |
JMF | 12:0071cb144c7a | 4515 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) ); |
JMF | 12:0071cb144c7a | 4516 | return( MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC ); |
JMF | 12:0071cb144c7a | 4517 | } |
JMF | 12:0071cb144c7a | 4518 | |
JMF | 12:0071cb144c7a | 4519 | /* |
JMF | 12:0071cb144c7a | 4520 | * Switch to our negotiated transform and session parameters for inbound |
JMF | 12:0071cb144c7a | 4521 | * data. |
JMF | 12:0071cb144c7a | 4522 | */ |
JMF | 12:0071cb144c7a | 4523 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) ); |
JMF | 12:0071cb144c7a | 4524 | ssl->transform_in = ssl->transform_negotiate; |
JMF | 12:0071cb144c7a | 4525 | ssl->session_in = ssl->session_negotiate; |
JMF | 12:0071cb144c7a | 4526 | |
JMF | 12:0071cb144c7a | 4527 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 4528 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 4529 | { |
JMF | 12:0071cb144c7a | 4530 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
JMF | 12:0071cb144c7a | 4531 | ssl_dtls_replay_reset( ssl ); |
JMF | 12:0071cb144c7a | 4532 | #endif |
JMF | 12:0071cb144c7a | 4533 | |
JMF | 12:0071cb144c7a | 4534 | /* Increment epoch */ |
JMF | 12:0071cb144c7a | 4535 | if( ++ssl->in_epoch == 0 ) |
JMF | 12:0071cb144c7a | 4536 | { |
JMF | 12:0071cb144c7a | 4537 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) ); |
JMF | 12:0071cb144c7a | 4538 | return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING ); |
JMF | 12:0071cb144c7a | 4539 | } |
JMF | 12:0071cb144c7a | 4540 | } |
JMF | 12:0071cb144c7a | 4541 | else |
JMF | 12:0071cb144c7a | 4542 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
JMF | 12:0071cb144c7a | 4543 | memset( ssl->in_ctr, 0, 8 ); |
JMF | 12:0071cb144c7a | 4544 | |
JMF | 12:0071cb144c7a | 4545 | /* |
JMF | 12:0071cb144c7a | 4546 | * Set the in_msg pointer to the correct location based on IV length |
JMF | 12:0071cb144c7a | 4547 | */ |
JMF | 12:0071cb144c7a | 4548 | if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 ) |
JMF | 12:0071cb144c7a | 4549 | { |
JMF | 12:0071cb144c7a | 4550 | ssl->in_msg = ssl->in_iv + ssl->transform_negotiate->ivlen - |
JMF | 12:0071cb144c7a | 4551 | ssl->transform_negotiate->fixed_ivlen; |
JMF | 12:0071cb144c7a | 4552 | } |
JMF | 12:0071cb144c7a | 4553 | else |
JMF | 12:0071cb144c7a | 4554 | ssl->in_msg = ssl->in_iv; |
JMF | 12:0071cb144c7a | 4555 | |
JMF | 12:0071cb144c7a | 4556 | #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) |
JMF | 12:0071cb144c7a | 4557 | if( mbedtls_ssl_hw_record_activate != NULL ) |
JMF | 12:0071cb144c7a | 4558 | { |
JMF | 12:0071cb144c7a | 4559 | if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_INBOUND ) ) != 0 ) |
JMF | 12:0071cb144c7a | 4560 | { |
JMF | 12:0071cb144c7a | 4561 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret ); |
JMF | 12:0071cb144c7a | 4562 | return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); |
JMF | 12:0071cb144c7a | 4563 | } |
JMF | 12:0071cb144c7a | 4564 | } |
JMF | 12:0071cb144c7a | 4565 | #endif |
JMF | 12:0071cb144c7a | 4566 | |
JMF | 12:0071cb144c7a | 4567 | ssl->state++; |
JMF | 12:0071cb144c7a | 4568 | |
JMF | 12:0071cb144c7a | 4569 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) ); |
JMF | 12:0071cb144c7a | 4570 | |
JMF | 12:0071cb144c7a | 4571 | return( 0 ); |
JMF | 12:0071cb144c7a | 4572 | } |
JMF | 12:0071cb144c7a | 4573 | |
JMF | 12:0071cb144c7a | 4574 | void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 4575 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info ) |
JMF | 12:0071cb144c7a | 4576 | { |
JMF | 12:0071cb144c7a | 4577 | ((void) ciphersuite_info); |
JMF | 12:0071cb144c7a | 4578 | |
JMF | 12:0071cb144c7a | 4579 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
JMF | 12:0071cb144c7a | 4580 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
JMF | 12:0071cb144c7a | 4581 | if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ) |
JMF | 12:0071cb144c7a | 4582 | ssl->handshake->update_checksum = ssl_update_checksum_md5sha1; |
JMF | 12:0071cb144c7a | 4583 | else |
JMF | 12:0071cb144c7a | 4584 | #endif |
JMF | 12:0071cb144c7a | 4585 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 4586 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 4587 | if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 ) |
JMF | 12:0071cb144c7a | 4588 | ssl->handshake->update_checksum = ssl_update_checksum_sha384; |
JMF | 12:0071cb144c7a | 4589 | else |
JMF | 12:0071cb144c7a | 4590 | #endif |
JMF | 12:0071cb144c7a | 4591 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 4592 | if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 ) |
JMF | 12:0071cb144c7a | 4593 | ssl->handshake->update_checksum = ssl_update_checksum_sha256; |
JMF | 12:0071cb144c7a | 4594 | else |
JMF | 12:0071cb144c7a | 4595 | #endif |
JMF | 12:0071cb144c7a | 4596 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 4597 | { |
JMF | 12:0071cb144c7a | 4598 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 4599 | return; |
JMF | 12:0071cb144c7a | 4600 | } |
JMF | 12:0071cb144c7a | 4601 | } |
JMF | 12:0071cb144c7a | 4602 | |
JMF | 12:0071cb144c7a | 4603 | void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 4604 | { |
JMF | 12:0071cb144c7a | 4605 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
JMF | 12:0071cb144c7a | 4606 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
JMF | 12:0071cb144c7a | 4607 | mbedtls_md5_starts( &ssl->handshake->fin_md5 ); |
JMF | 12:0071cb144c7a | 4608 | mbedtls_sha1_starts( &ssl->handshake->fin_sha1 ); |
JMF | 12:0071cb144c7a | 4609 | #endif |
JMF | 12:0071cb144c7a | 4610 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 4611 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 4612 | mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 ); |
JMF | 12:0071cb144c7a | 4613 | #endif |
JMF | 12:0071cb144c7a | 4614 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 4615 | mbedtls_sha512_starts( &ssl->handshake->fin_sha512, 1 ); |
JMF | 12:0071cb144c7a | 4616 | #endif |
JMF | 12:0071cb144c7a | 4617 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 4618 | } |
JMF | 12:0071cb144c7a | 4619 | |
JMF | 12:0071cb144c7a | 4620 | static void ssl_update_checksum_start( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 4621 | const unsigned char *buf, size_t len ) |
JMF | 12:0071cb144c7a | 4622 | { |
JMF | 12:0071cb144c7a | 4623 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
JMF | 12:0071cb144c7a | 4624 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
JMF | 12:0071cb144c7a | 4625 | mbedtls_md5_update( &ssl->handshake->fin_md5 , buf, len ); |
JMF | 12:0071cb144c7a | 4626 | mbedtls_sha1_update( &ssl->handshake->fin_sha1, buf, len ); |
JMF | 12:0071cb144c7a | 4627 | #endif |
JMF | 12:0071cb144c7a | 4628 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 4629 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 4630 | mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len ); |
JMF | 12:0071cb144c7a | 4631 | #endif |
JMF | 12:0071cb144c7a | 4632 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 4633 | mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len ); |
JMF | 12:0071cb144c7a | 4634 | #endif |
JMF | 12:0071cb144c7a | 4635 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 4636 | } |
JMF | 12:0071cb144c7a | 4637 | |
JMF | 12:0071cb144c7a | 4638 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
JMF | 12:0071cb144c7a | 4639 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
JMF | 12:0071cb144c7a | 4640 | static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 4641 | const unsigned char *buf, size_t len ) |
JMF | 12:0071cb144c7a | 4642 | { |
JMF | 12:0071cb144c7a | 4643 | mbedtls_md5_update( &ssl->handshake->fin_md5 , buf, len ); |
JMF | 12:0071cb144c7a | 4644 | mbedtls_sha1_update( &ssl->handshake->fin_sha1, buf, len ); |
JMF | 12:0071cb144c7a | 4645 | } |
JMF | 12:0071cb144c7a | 4646 | #endif |
JMF | 12:0071cb144c7a | 4647 | |
JMF | 12:0071cb144c7a | 4648 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 4649 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 4650 | static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 4651 | const unsigned char *buf, size_t len ) |
JMF | 12:0071cb144c7a | 4652 | { |
JMF | 12:0071cb144c7a | 4653 | mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len ); |
JMF | 12:0071cb144c7a | 4654 | } |
JMF | 12:0071cb144c7a | 4655 | #endif |
JMF | 12:0071cb144c7a | 4656 | |
JMF | 12:0071cb144c7a | 4657 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 4658 | static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 4659 | const unsigned char *buf, size_t len ) |
JMF | 12:0071cb144c7a | 4660 | { |
JMF | 12:0071cb144c7a | 4661 | mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len ); |
JMF | 12:0071cb144c7a | 4662 | } |
JMF | 12:0071cb144c7a | 4663 | #endif |
JMF | 12:0071cb144c7a | 4664 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 4665 | |
JMF | 12:0071cb144c7a | 4666 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 4667 | static void ssl_calc_finished_ssl( |
JMF | 12:0071cb144c7a | 4668 | mbedtls_ssl_context *ssl, unsigned char *buf, int from ) |
JMF | 12:0071cb144c7a | 4669 | { |
JMF | 12:0071cb144c7a | 4670 | const char *sender; |
JMF | 12:0071cb144c7a | 4671 | mbedtls_md5_context md5; |
JMF | 12:0071cb144c7a | 4672 | mbedtls_sha1_context sha1; |
JMF | 12:0071cb144c7a | 4673 | |
JMF | 12:0071cb144c7a | 4674 | unsigned char padbuf[48]; |
JMF | 12:0071cb144c7a | 4675 | unsigned char md5sum[16]; |
JMF | 12:0071cb144c7a | 4676 | unsigned char sha1sum[20]; |
JMF | 12:0071cb144c7a | 4677 | |
JMF | 12:0071cb144c7a | 4678 | mbedtls_ssl_session *session = ssl->session_negotiate; |
JMF | 12:0071cb144c7a | 4679 | if( !session ) |
JMF | 12:0071cb144c7a | 4680 | session = ssl->session; |
JMF | 12:0071cb144c7a | 4681 | |
JMF | 12:0071cb144c7a | 4682 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) ); |
JMF | 12:0071cb144c7a | 4683 | |
JMF | 12:0071cb144c7a | 4684 | mbedtls_md5_init( &md5 ); |
JMF | 12:0071cb144c7a | 4685 | mbedtls_sha1_init( &sha1 ); |
JMF | 12:0071cb144c7a | 4686 | |
JMF | 12:0071cb144c7a | 4687 | mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 ); |
JMF | 12:0071cb144c7a | 4688 | mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 ); |
JMF | 12:0071cb144c7a | 4689 | |
JMF | 12:0071cb144c7a | 4690 | /* |
JMF | 12:0071cb144c7a | 4691 | * SSLv3: |
JMF | 12:0071cb144c7a | 4692 | * hash = |
JMF | 12:0071cb144c7a | 4693 | * MD5( master + pad2 + |
JMF | 12:0071cb144c7a | 4694 | * MD5( handshake + sender + master + pad1 ) ) |
JMF | 12:0071cb144c7a | 4695 | * + SHA1( master + pad2 + |
JMF | 12:0071cb144c7a | 4696 | * SHA1( handshake + sender + master + pad1 ) ) |
JMF | 12:0071cb144c7a | 4697 | */ |
JMF | 12:0071cb144c7a | 4698 | |
JMF | 12:0071cb144c7a | 4699 | #if !defined(MBEDTLS_MD5_ALT) |
JMF | 12:0071cb144c7a | 4700 | MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *) |
JMF | 12:0071cb144c7a | 4701 | md5.state, sizeof( md5.state ) ); |
JMF | 12:0071cb144c7a | 4702 | #endif |
JMF | 12:0071cb144c7a | 4703 | |
JMF | 12:0071cb144c7a | 4704 | #if !defined(MBEDTLS_SHA1_ALT) |
JMF | 12:0071cb144c7a | 4705 | MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *) |
JMF | 12:0071cb144c7a | 4706 | sha1.state, sizeof( sha1.state ) ); |
JMF | 12:0071cb144c7a | 4707 | #endif |
JMF | 12:0071cb144c7a | 4708 | |
JMF | 12:0071cb144c7a | 4709 | sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT" |
JMF | 12:0071cb144c7a | 4710 | : "SRVR"; |
JMF | 12:0071cb144c7a | 4711 | |
JMF | 12:0071cb144c7a | 4712 | memset( padbuf, 0x36, 48 ); |
JMF | 12:0071cb144c7a | 4713 | |
JMF | 12:0071cb144c7a | 4714 | mbedtls_md5_update( &md5, (const unsigned char *) sender, 4 ); |
JMF | 12:0071cb144c7a | 4715 | mbedtls_md5_update( &md5, session->master, 48 ); |
JMF | 12:0071cb144c7a | 4716 | mbedtls_md5_update( &md5, padbuf, 48 ); |
JMF | 12:0071cb144c7a | 4717 | mbedtls_md5_finish( &md5, md5sum ); |
JMF | 12:0071cb144c7a | 4718 | |
JMF | 12:0071cb144c7a | 4719 | mbedtls_sha1_update( &sha1, (const unsigned char *) sender, 4 ); |
JMF | 12:0071cb144c7a | 4720 | mbedtls_sha1_update( &sha1, session->master, 48 ); |
JMF | 12:0071cb144c7a | 4721 | mbedtls_sha1_update( &sha1, padbuf, 40 ); |
JMF | 12:0071cb144c7a | 4722 | mbedtls_sha1_finish( &sha1, sha1sum ); |
JMF | 12:0071cb144c7a | 4723 | |
JMF | 12:0071cb144c7a | 4724 | memset( padbuf, 0x5C, 48 ); |
JMF | 12:0071cb144c7a | 4725 | |
JMF | 12:0071cb144c7a | 4726 | mbedtls_md5_starts( &md5 ); |
JMF | 12:0071cb144c7a | 4727 | mbedtls_md5_update( &md5, session->master, 48 ); |
JMF | 12:0071cb144c7a | 4728 | mbedtls_md5_update( &md5, padbuf, 48 ); |
JMF | 12:0071cb144c7a | 4729 | mbedtls_md5_update( &md5, md5sum, 16 ); |
JMF | 12:0071cb144c7a | 4730 | mbedtls_md5_finish( &md5, buf ); |
JMF | 12:0071cb144c7a | 4731 | |
JMF | 12:0071cb144c7a | 4732 | mbedtls_sha1_starts( &sha1 ); |
JMF | 12:0071cb144c7a | 4733 | mbedtls_sha1_update( &sha1, session->master, 48 ); |
JMF | 12:0071cb144c7a | 4734 | mbedtls_sha1_update( &sha1, padbuf , 40 ); |
JMF | 12:0071cb144c7a | 4735 | mbedtls_sha1_update( &sha1, sha1sum, 20 ); |
JMF | 12:0071cb144c7a | 4736 | mbedtls_sha1_finish( &sha1, buf + 16 ); |
JMF | 12:0071cb144c7a | 4737 | |
JMF | 12:0071cb144c7a | 4738 | MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 ); |
JMF | 12:0071cb144c7a | 4739 | |
JMF | 12:0071cb144c7a | 4740 | mbedtls_md5_free( &md5 ); |
JMF | 12:0071cb144c7a | 4741 | mbedtls_sha1_free( &sha1 ); |
JMF | 12:0071cb144c7a | 4742 | |
JMF | 12:0071cb144c7a | 4743 | mbedtls_zeroize( padbuf, sizeof( padbuf ) ); |
JMF | 12:0071cb144c7a | 4744 | mbedtls_zeroize( md5sum, sizeof( md5sum ) ); |
JMF | 12:0071cb144c7a | 4745 | mbedtls_zeroize( sha1sum, sizeof( sha1sum ) ); |
JMF | 12:0071cb144c7a | 4746 | |
JMF | 12:0071cb144c7a | 4747 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) ); |
JMF | 12:0071cb144c7a | 4748 | } |
JMF | 12:0071cb144c7a | 4749 | #endif /* MBEDTLS_SSL_PROTO_SSL3 */ |
JMF | 12:0071cb144c7a | 4750 | |
JMF | 12:0071cb144c7a | 4751 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) |
JMF | 12:0071cb144c7a | 4752 | static void ssl_calc_finished_tls( |
JMF | 12:0071cb144c7a | 4753 | mbedtls_ssl_context *ssl, unsigned char *buf, int from ) |
JMF | 12:0071cb144c7a | 4754 | { |
JMF | 12:0071cb144c7a | 4755 | int len = 12; |
JMF | 12:0071cb144c7a | 4756 | const char *sender; |
JMF | 12:0071cb144c7a | 4757 | mbedtls_md5_context md5; |
JMF | 12:0071cb144c7a | 4758 | mbedtls_sha1_context sha1; |
JMF | 12:0071cb144c7a | 4759 | unsigned char padbuf[36]; |
JMF | 12:0071cb144c7a | 4760 | |
JMF | 12:0071cb144c7a | 4761 | mbedtls_ssl_session *session = ssl->session_negotiate; |
JMF | 12:0071cb144c7a | 4762 | if( !session ) |
JMF | 12:0071cb144c7a | 4763 | session = ssl->session; |
JMF | 12:0071cb144c7a | 4764 | |
JMF | 12:0071cb144c7a | 4765 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) ); |
JMF | 12:0071cb144c7a | 4766 | |
JMF | 12:0071cb144c7a | 4767 | mbedtls_md5_init( &md5 ); |
JMF | 12:0071cb144c7a | 4768 | mbedtls_sha1_init( &sha1 ); |
JMF | 12:0071cb144c7a | 4769 | |
JMF | 12:0071cb144c7a | 4770 | mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 ); |
JMF | 12:0071cb144c7a | 4771 | mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 ); |
JMF | 12:0071cb144c7a | 4772 | |
JMF | 12:0071cb144c7a | 4773 | /* |
JMF | 12:0071cb144c7a | 4774 | * TLSv1: |
JMF | 12:0071cb144c7a | 4775 | * hash = PRF( master, finished_label, |
JMF | 12:0071cb144c7a | 4776 | * MD5( handshake ) + SHA1( handshake ) )[0..11] |
JMF | 12:0071cb144c7a | 4777 | */ |
JMF | 12:0071cb144c7a | 4778 | |
JMF | 12:0071cb144c7a | 4779 | #if !defined(MBEDTLS_MD5_ALT) |
JMF | 12:0071cb144c7a | 4780 | MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *) |
JMF | 12:0071cb144c7a | 4781 | md5.state, sizeof( md5.state ) ); |
JMF | 12:0071cb144c7a | 4782 | #endif |
JMF | 12:0071cb144c7a | 4783 | |
JMF | 12:0071cb144c7a | 4784 | #if !defined(MBEDTLS_SHA1_ALT) |
JMF | 12:0071cb144c7a | 4785 | MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *) |
JMF | 12:0071cb144c7a | 4786 | sha1.state, sizeof( sha1.state ) ); |
JMF | 12:0071cb144c7a | 4787 | #endif |
JMF | 12:0071cb144c7a | 4788 | |
JMF | 12:0071cb144c7a | 4789 | sender = ( from == MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 4790 | ? "client finished" |
JMF | 12:0071cb144c7a | 4791 | : "server finished"; |
JMF | 12:0071cb144c7a | 4792 | |
JMF | 12:0071cb144c7a | 4793 | mbedtls_md5_finish( &md5, padbuf ); |
JMF | 12:0071cb144c7a | 4794 | mbedtls_sha1_finish( &sha1, padbuf + 16 ); |
JMF | 12:0071cb144c7a | 4795 | |
JMF | 12:0071cb144c7a | 4796 | ssl->handshake->tls_prf( session->master, 48, sender, |
JMF | 12:0071cb144c7a | 4797 | padbuf, 36, buf, len ); |
JMF | 12:0071cb144c7a | 4798 | |
JMF | 12:0071cb144c7a | 4799 | MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len ); |
JMF | 12:0071cb144c7a | 4800 | |
JMF | 12:0071cb144c7a | 4801 | mbedtls_md5_free( &md5 ); |
JMF | 12:0071cb144c7a | 4802 | mbedtls_sha1_free( &sha1 ); |
JMF | 12:0071cb144c7a | 4803 | |
JMF | 12:0071cb144c7a | 4804 | mbedtls_zeroize( padbuf, sizeof( padbuf ) ); |
JMF | 12:0071cb144c7a | 4805 | |
JMF | 12:0071cb144c7a | 4806 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) ); |
JMF | 12:0071cb144c7a | 4807 | } |
JMF | 12:0071cb144c7a | 4808 | #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */ |
JMF | 12:0071cb144c7a | 4809 | |
JMF | 12:0071cb144c7a | 4810 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 4811 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 4812 | static void ssl_calc_finished_tls_sha256( |
JMF | 12:0071cb144c7a | 4813 | mbedtls_ssl_context *ssl, unsigned char *buf, int from ) |
JMF | 12:0071cb144c7a | 4814 | { |
JMF | 12:0071cb144c7a | 4815 | int len = 12; |
JMF | 12:0071cb144c7a | 4816 | const char *sender; |
JMF | 12:0071cb144c7a | 4817 | mbedtls_sha256_context sha256; |
JMF | 12:0071cb144c7a | 4818 | unsigned char padbuf[32]; |
JMF | 12:0071cb144c7a | 4819 | |
JMF | 12:0071cb144c7a | 4820 | mbedtls_ssl_session *session = ssl->session_negotiate; |
JMF | 12:0071cb144c7a | 4821 | if( !session ) |
JMF | 12:0071cb144c7a | 4822 | session = ssl->session; |
JMF | 12:0071cb144c7a | 4823 | |
JMF | 12:0071cb144c7a | 4824 | mbedtls_sha256_init( &sha256 ); |
JMF | 12:0071cb144c7a | 4825 | |
JMF | 12:0071cb144c7a | 4826 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) ); |
JMF | 12:0071cb144c7a | 4827 | |
JMF | 12:0071cb144c7a | 4828 | mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 ); |
JMF | 12:0071cb144c7a | 4829 | |
JMF | 12:0071cb144c7a | 4830 | /* |
JMF | 12:0071cb144c7a | 4831 | * TLSv1.2: |
JMF | 12:0071cb144c7a | 4832 | * hash = PRF( master, finished_label, |
JMF | 12:0071cb144c7a | 4833 | * Hash( handshake ) )[0.11] |
JMF | 12:0071cb144c7a | 4834 | */ |
JMF | 12:0071cb144c7a | 4835 | |
JMF | 12:0071cb144c7a | 4836 | #if !defined(MBEDTLS_SHA256_ALT) |
JMF | 12:0071cb144c7a | 4837 | MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *) |
JMF | 12:0071cb144c7a | 4838 | sha256.state, sizeof( sha256.state ) ); |
JMF | 12:0071cb144c7a | 4839 | #endif |
JMF | 12:0071cb144c7a | 4840 | |
JMF | 12:0071cb144c7a | 4841 | sender = ( from == MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 4842 | ? "client finished" |
JMF | 12:0071cb144c7a | 4843 | : "server finished"; |
JMF | 12:0071cb144c7a | 4844 | |
JMF | 12:0071cb144c7a | 4845 | mbedtls_sha256_finish( &sha256, padbuf ); |
JMF | 12:0071cb144c7a | 4846 | |
JMF | 12:0071cb144c7a | 4847 | ssl->handshake->tls_prf( session->master, 48, sender, |
JMF | 12:0071cb144c7a | 4848 | padbuf, 32, buf, len ); |
JMF | 12:0071cb144c7a | 4849 | |
JMF | 12:0071cb144c7a | 4850 | MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len ); |
JMF | 12:0071cb144c7a | 4851 | |
JMF | 12:0071cb144c7a | 4852 | mbedtls_sha256_free( &sha256 ); |
JMF | 12:0071cb144c7a | 4853 | |
JMF | 12:0071cb144c7a | 4854 | mbedtls_zeroize( padbuf, sizeof( padbuf ) ); |
JMF | 12:0071cb144c7a | 4855 | |
JMF | 12:0071cb144c7a | 4856 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) ); |
JMF | 12:0071cb144c7a | 4857 | } |
JMF | 12:0071cb144c7a | 4858 | #endif /* MBEDTLS_SHA256_C */ |
JMF | 12:0071cb144c7a | 4859 | |
JMF | 12:0071cb144c7a | 4860 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 4861 | static void ssl_calc_finished_tls_sha384( |
JMF | 12:0071cb144c7a | 4862 | mbedtls_ssl_context *ssl, unsigned char *buf, int from ) |
JMF | 12:0071cb144c7a | 4863 | { |
JMF | 12:0071cb144c7a | 4864 | int len = 12; |
JMF | 12:0071cb144c7a | 4865 | const char *sender; |
JMF | 12:0071cb144c7a | 4866 | mbedtls_sha512_context sha512; |
JMF | 12:0071cb144c7a | 4867 | unsigned char padbuf[48]; |
JMF | 12:0071cb144c7a | 4868 | |
JMF | 12:0071cb144c7a | 4869 | mbedtls_ssl_session *session = ssl->session_negotiate; |
JMF | 12:0071cb144c7a | 4870 | if( !session ) |
JMF | 12:0071cb144c7a | 4871 | session = ssl->session; |
JMF | 12:0071cb144c7a | 4872 | |
JMF | 12:0071cb144c7a | 4873 | mbedtls_sha512_init( &sha512 ); |
JMF | 12:0071cb144c7a | 4874 | |
JMF | 12:0071cb144c7a | 4875 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) ); |
JMF | 12:0071cb144c7a | 4876 | |
JMF | 12:0071cb144c7a | 4877 | mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 ); |
JMF | 12:0071cb144c7a | 4878 | |
JMF | 12:0071cb144c7a | 4879 | /* |
JMF | 12:0071cb144c7a | 4880 | * TLSv1.2: |
JMF | 12:0071cb144c7a | 4881 | * hash = PRF( master, finished_label, |
JMF | 12:0071cb144c7a | 4882 | * Hash( handshake ) )[0.11] |
JMF | 12:0071cb144c7a | 4883 | */ |
JMF | 12:0071cb144c7a | 4884 | |
JMF | 12:0071cb144c7a | 4885 | #if !defined(MBEDTLS_SHA512_ALT) |
JMF | 12:0071cb144c7a | 4886 | MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *) |
JMF | 12:0071cb144c7a | 4887 | sha512.state, sizeof( sha512.state ) ); |
JMF | 12:0071cb144c7a | 4888 | #endif |
JMF | 12:0071cb144c7a | 4889 | |
JMF | 12:0071cb144c7a | 4890 | sender = ( from == MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 4891 | ? "client finished" |
JMF | 12:0071cb144c7a | 4892 | : "server finished"; |
JMF | 12:0071cb144c7a | 4893 | |
JMF | 12:0071cb144c7a | 4894 | mbedtls_sha512_finish( &sha512, padbuf ); |
JMF | 12:0071cb144c7a | 4895 | |
JMF | 12:0071cb144c7a | 4896 | ssl->handshake->tls_prf( session->master, 48, sender, |
JMF | 12:0071cb144c7a | 4897 | padbuf, 48, buf, len ); |
JMF | 12:0071cb144c7a | 4898 | |
JMF | 12:0071cb144c7a | 4899 | MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len ); |
JMF | 12:0071cb144c7a | 4900 | |
JMF | 12:0071cb144c7a | 4901 | mbedtls_sha512_free( &sha512 ); |
JMF | 12:0071cb144c7a | 4902 | |
JMF | 12:0071cb144c7a | 4903 | mbedtls_zeroize( padbuf, sizeof( padbuf ) ); |
JMF | 12:0071cb144c7a | 4904 | |
JMF | 12:0071cb144c7a | 4905 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) ); |
JMF | 12:0071cb144c7a | 4906 | } |
JMF | 12:0071cb144c7a | 4907 | #endif /* MBEDTLS_SHA512_C */ |
JMF | 12:0071cb144c7a | 4908 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 4909 | |
JMF | 12:0071cb144c7a | 4910 | static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 4911 | { |
JMF | 12:0071cb144c7a | 4912 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) ); |
JMF | 12:0071cb144c7a | 4913 | |
JMF | 12:0071cb144c7a | 4914 | /* |
JMF | 12:0071cb144c7a | 4915 | * Free our handshake params |
JMF | 12:0071cb144c7a | 4916 | */ |
JMF | 12:0071cb144c7a | 4917 | mbedtls_ssl_handshake_free( ssl->handshake ); |
JMF | 12:0071cb144c7a | 4918 | mbedtls_free( ssl->handshake ); |
JMF | 12:0071cb144c7a | 4919 | ssl->handshake = NULL; |
JMF | 12:0071cb144c7a | 4920 | |
JMF | 12:0071cb144c7a | 4921 | /* |
JMF | 12:0071cb144c7a | 4922 | * Free the previous transform and swith in the current one |
JMF | 12:0071cb144c7a | 4923 | */ |
JMF | 12:0071cb144c7a | 4924 | if( ssl->transform ) |
JMF | 12:0071cb144c7a | 4925 | { |
JMF | 12:0071cb144c7a | 4926 | mbedtls_ssl_transform_free( ssl->transform ); |
JMF | 12:0071cb144c7a | 4927 | mbedtls_free( ssl->transform ); |
JMF | 12:0071cb144c7a | 4928 | } |
JMF | 12:0071cb144c7a | 4929 | ssl->transform = ssl->transform_negotiate; |
JMF | 12:0071cb144c7a | 4930 | ssl->transform_negotiate = NULL; |
JMF | 12:0071cb144c7a | 4931 | |
JMF | 12:0071cb144c7a | 4932 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) ); |
JMF | 12:0071cb144c7a | 4933 | } |
JMF | 12:0071cb144c7a | 4934 | |
JMF | 12:0071cb144c7a | 4935 | void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 4936 | { |
JMF | 12:0071cb144c7a | 4937 | int resume = ssl->handshake->resume; |
JMF | 12:0071cb144c7a | 4938 | |
JMF | 12:0071cb144c7a | 4939 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) ); |
JMF | 12:0071cb144c7a | 4940 | |
JMF | 12:0071cb144c7a | 4941 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 4942 | if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
JMF | 12:0071cb144c7a | 4943 | { |
JMF | 12:0071cb144c7a | 4944 | ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE; |
JMF | 12:0071cb144c7a | 4945 | ssl->renego_records_seen = 0; |
JMF | 12:0071cb144c7a | 4946 | } |
JMF | 12:0071cb144c7a | 4947 | #endif |
JMF | 12:0071cb144c7a | 4948 | |
JMF | 12:0071cb144c7a | 4949 | /* |
JMF | 12:0071cb144c7a | 4950 | * Free the previous session and switch in the current one |
JMF | 12:0071cb144c7a | 4951 | */ |
JMF | 12:0071cb144c7a | 4952 | if( ssl->session ) |
JMF | 12:0071cb144c7a | 4953 | { |
JMF | 12:0071cb144c7a | 4954 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
JMF | 12:0071cb144c7a | 4955 | /* RFC 7366 3.1: keep the EtM state */ |
JMF | 12:0071cb144c7a | 4956 | ssl->session_negotiate->encrypt_then_mac = |
JMF | 12:0071cb144c7a | 4957 | ssl->session->encrypt_then_mac; |
JMF | 12:0071cb144c7a | 4958 | #endif |
JMF | 12:0071cb144c7a | 4959 | |
JMF | 12:0071cb144c7a | 4960 | mbedtls_ssl_session_free( ssl->session ); |
JMF | 12:0071cb144c7a | 4961 | mbedtls_free( ssl->session ); |
JMF | 12:0071cb144c7a | 4962 | } |
JMF | 12:0071cb144c7a | 4963 | ssl->session = ssl->session_negotiate; |
JMF | 12:0071cb144c7a | 4964 | ssl->session_negotiate = NULL; |
JMF | 12:0071cb144c7a | 4965 | |
JMF | 12:0071cb144c7a | 4966 | /* |
JMF | 12:0071cb144c7a | 4967 | * Add cache entry |
JMF | 12:0071cb144c7a | 4968 | */ |
JMF | 12:0071cb144c7a | 4969 | if( ssl->conf->f_set_cache != NULL && |
JMF | 12:0071cb144c7a | 4970 | ssl->session->id_len != 0 && |
JMF | 12:0071cb144c7a | 4971 | resume == 0 ) |
JMF | 12:0071cb144c7a | 4972 | { |
JMF | 12:0071cb144c7a | 4973 | if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 ) |
JMF | 12:0071cb144c7a | 4974 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) ); |
JMF | 12:0071cb144c7a | 4975 | } |
JMF | 12:0071cb144c7a | 4976 | |
JMF | 12:0071cb144c7a | 4977 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 4978 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
JMF | 12:0071cb144c7a | 4979 | ssl->handshake->flight != NULL ) |
JMF | 12:0071cb144c7a | 4980 | { |
JMF | 12:0071cb144c7a | 4981 | /* Cancel handshake timer */ |
JMF | 12:0071cb144c7a | 4982 | ssl_set_timer( ssl, 0 ); |
JMF | 12:0071cb144c7a | 4983 | |
JMF | 12:0071cb144c7a | 4984 | /* Keep last flight around in case we need to resend it: |
JMF | 12:0071cb144c7a | 4985 | * we need the handshake and transform structures for that */ |
JMF | 12:0071cb144c7a | 4986 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) ); |
JMF | 12:0071cb144c7a | 4987 | } |
JMF | 12:0071cb144c7a | 4988 | else |
JMF | 12:0071cb144c7a | 4989 | #endif |
JMF | 12:0071cb144c7a | 4990 | ssl_handshake_wrapup_free_hs_transform( ssl ); |
JMF | 12:0071cb144c7a | 4991 | |
JMF | 12:0071cb144c7a | 4992 | ssl->state++; |
JMF | 12:0071cb144c7a | 4993 | |
JMF | 12:0071cb144c7a | 4994 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) ); |
JMF | 12:0071cb144c7a | 4995 | } |
JMF | 12:0071cb144c7a | 4996 | |
JMF | 12:0071cb144c7a | 4997 | int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 4998 | { |
JMF | 12:0071cb144c7a | 4999 | int ret, hash_len; |
JMF | 12:0071cb144c7a | 5000 | |
JMF | 12:0071cb144c7a | 5001 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) ); |
JMF | 12:0071cb144c7a | 5002 | |
JMF | 12:0071cb144c7a | 5003 | /* |
JMF | 12:0071cb144c7a | 5004 | * Set the out_msg pointer to the correct location based on IV length |
JMF | 12:0071cb144c7a | 5005 | */ |
JMF | 12:0071cb144c7a | 5006 | if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 ) |
JMF | 12:0071cb144c7a | 5007 | { |
JMF | 12:0071cb144c7a | 5008 | ssl->out_msg = ssl->out_iv + ssl->transform_negotiate->ivlen - |
JMF | 12:0071cb144c7a | 5009 | ssl->transform_negotiate->fixed_ivlen; |
JMF | 12:0071cb144c7a | 5010 | } |
JMF | 12:0071cb144c7a | 5011 | else |
JMF | 12:0071cb144c7a | 5012 | ssl->out_msg = ssl->out_iv; |
JMF | 12:0071cb144c7a | 5013 | |
JMF | 12:0071cb144c7a | 5014 | ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint ); |
JMF | 12:0071cb144c7a | 5015 | |
JMF | 12:0071cb144c7a | 5016 | /* |
JMF | 12:0071cb144c7a | 5017 | * RFC 5246 7.4.9 (Page 63) says 12 is the default length and ciphersuites |
JMF | 12:0071cb144c7a | 5018 | * may define some other value. Currently (early 2016), no defined |
JMF | 12:0071cb144c7a | 5019 | * ciphersuite does this (and this is unlikely to change as activity has |
JMF | 12:0071cb144c7a | 5020 | * moved to TLS 1.3 now) so we can keep the hardcoded 12 here. |
JMF | 12:0071cb144c7a | 5021 | */ |
JMF | 12:0071cb144c7a | 5022 | hash_len = ( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12; |
JMF | 12:0071cb144c7a | 5023 | |
JMF | 12:0071cb144c7a | 5024 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 5025 | ssl->verify_data_len = hash_len; |
JMF | 12:0071cb144c7a | 5026 | memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len ); |
JMF | 12:0071cb144c7a | 5027 | #endif |
JMF | 12:0071cb144c7a | 5028 | |
JMF | 12:0071cb144c7a | 5029 | ssl->out_msglen = 4 + hash_len; |
JMF | 12:0071cb144c7a | 5030 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
JMF | 12:0071cb144c7a | 5031 | ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED; |
JMF | 12:0071cb144c7a | 5032 | |
JMF | 12:0071cb144c7a | 5033 | /* |
JMF | 12:0071cb144c7a | 5034 | * In case of session resuming, invert the client and server |
JMF | 12:0071cb144c7a | 5035 | * ChangeCipherSpec messages order. |
JMF | 12:0071cb144c7a | 5036 | */ |
JMF | 12:0071cb144c7a | 5037 | if( ssl->handshake->resume != 0 ) |
JMF | 12:0071cb144c7a | 5038 | { |
JMF | 12:0071cb144c7a | 5039 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 5040 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 5041 | ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP; |
JMF | 12:0071cb144c7a | 5042 | #endif |
JMF | 12:0071cb144c7a | 5043 | #if defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 5044 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) |
JMF | 12:0071cb144c7a | 5045 | ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC; |
JMF | 12:0071cb144c7a | 5046 | #endif |
JMF | 12:0071cb144c7a | 5047 | } |
JMF | 12:0071cb144c7a | 5048 | else |
JMF | 12:0071cb144c7a | 5049 | ssl->state++; |
JMF | 12:0071cb144c7a | 5050 | |
JMF | 12:0071cb144c7a | 5051 | /* |
JMF | 12:0071cb144c7a | 5052 | * Switch to our negotiated transform and session parameters for outbound |
JMF | 12:0071cb144c7a | 5053 | * data. |
JMF | 12:0071cb144c7a | 5054 | */ |
JMF | 12:0071cb144c7a | 5055 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) ); |
JMF | 12:0071cb144c7a | 5056 | |
JMF | 12:0071cb144c7a | 5057 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 5058 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 5059 | { |
JMF | 12:0071cb144c7a | 5060 | unsigned char i; |
JMF | 12:0071cb144c7a | 5061 | |
JMF | 12:0071cb144c7a | 5062 | /* Remember current epoch settings for resending */ |
JMF | 12:0071cb144c7a | 5063 | ssl->handshake->alt_transform_out = ssl->transform_out; |
JMF | 12:0071cb144c7a | 5064 | memcpy( ssl->handshake->alt_out_ctr, ssl->out_ctr, 8 ); |
JMF | 12:0071cb144c7a | 5065 | |
JMF | 12:0071cb144c7a | 5066 | /* Set sequence_number to zero */ |
JMF | 12:0071cb144c7a | 5067 | memset( ssl->out_ctr + 2, 0, 6 ); |
JMF | 12:0071cb144c7a | 5068 | |
JMF | 12:0071cb144c7a | 5069 | /* Increment epoch */ |
JMF | 12:0071cb144c7a | 5070 | for( i = 2; i > 0; i-- ) |
JMF | 12:0071cb144c7a | 5071 | if( ++ssl->out_ctr[i - 1] != 0 ) |
JMF | 12:0071cb144c7a | 5072 | break; |
JMF | 12:0071cb144c7a | 5073 | |
JMF | 12:0071cb144c7a | 5074 | /* The loop goes to its end iff the counter is wrapping */ |
JMF | 12:0071cb144c7a | 5075 | if( i == 0 ) |
JMF | 12:0071cb144c7a | 5076 | { |
JMF | 12:0071cb144c7a | 5077 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) ); |
JMF | 12:0071cb144c7a | 5078 | return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING ); |
JMF | 12:0071cb144c7a | 5079 | } |
JMF | 12:0071cb144c7a | 5080 | } |
JMF | 12:0071cb144c7a | 5081 | else |
JMF | 12:0071cb144c7a | 5082 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
JMF | 12:0071cb144c7a | 5083 | memset( ssl->out_ctr, 0, 8 ); |
JMF | 12:0071cb144c7a | 5084 | |
JMF | 12:0071cb144c7a | 5085 | ssl->transform_out = ssl->transform_negotiate; |
JMF | 12:0071cb144c7a | 5086 | ssl->session_out = ssl->session_negotiate; |
JMF | 12:0071cb144c7a | 5087 | |
JMF | 12:0071cb144c7a | 5088 | #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) |
JMF | 12:0071cb144c7a | 5089 | if( mbedtls_ssl_hw_record_activate != NULL ) |
JMF | 12:0071cb144c7a | 5090 | { |
JMF | 12:0071cb144c7a | 5091 | if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 ) |
JMF | 12:0071cb144c7a | 5092 | { |
JMF | 12:0071cb144c7a | 5093 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret ); |
JMF | 12:0071cb144c7a | 5094 | return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); |
JMF | 12:0071cb144c7a | 5095 | } |
JMF | 12:0071cb144c7a | 5096 | } |
JMF | 12:0071cb144c7a | 5097 | #endif |
JMF | 12:0071cb144c7a | 5098 | |
JMF | 12:0071cb144c7a | 5099 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 5100 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 5101 | mbedtls_ssl_send_flight_completed( ssl ); |
JMF | 12:0071cb144c7a | 5102 | #endif |
JMF | 12:0071cb144c7a | 5103 | |
JMF | 12:0071cb144c7a | 5104 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 5105 | { |
JMF | 12:0071cb144c7a | 5106 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
JMF | 12:0071cb144c7a | 5107 | return( ret ); |
JMF | 12:0071cb144c7a | 5108 | } |
JMF | 12:0071cb144c7a | 5109 | |
JMF | 12:0071cb144c7a | 5110 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) ); |
JMF | 12:0071cb144c7a | 5111 | |
JMF | 12:0071cb144c7a | 5112 | return( 0 ); |
JMF | 12:0071cb144c7a | 5113 | } |
JMF | 12:0071cb144c7a | 5114 | |
JMF | 12:0071cb144c7a | 5115 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 5116 | #define SSL_MAX_HASH_LEN 36 |
JMF | 12:0071cb144c7a | 5117 | #else |
JMF | 12:0071cb144c7a | 5118 | #define SSL_MAX_HASH_LEN 12 |
JMF | 12:0071cb144c7a | 5119 | #endif |
JMF | 12:0071cb144c7a | 5120 | |
JMF | 12:0071cb144c7a | 5121 | int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 5122 | { |
JMF | 12:0071cb144c7a | 5123 | int ret; |
JMF | 12:0071cb144c7a | 5124 | unsigned int hash_len; |
JMF | 12:0071cb144c7a | 5125 | unsigned char buf[SSL_MAX_HASH_LEN]; |
JMF | 12:0071cb144c7a | 5126 | |
JMF | 12:0071cb144c7a | 5127 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) ); |
JMF | 12:0071cb144c7a | 5128 | |
JMF | 12:0071cb144c7a | 5129 | ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 ); |
JMF | 12:0071cb144c7a | 5130 | |
JMF | 12:0071cb144c7a | 5131 | if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 5132 | { |
JMF | 12:0071cb144c7a | 5133 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); |
JMF | 12:0071cb144c7a | 5134 | return( ret ); |
JMF | 12:0071cb144c7a | 5135 | } |
JMF | 12:0071cb144c7a | 5136 | |
JMF | 12:0071cb144c7a | 5137 | if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) |
JMF | 12:0071cb144c7a | 5138 | { |
JMF | 12:0071cb144c7a | 5139 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) ); |
JMF | 12:0071cb144c7a | 5140 | return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); |
JMF | 12:0071cb144c7a | 5141 | } |
JMF | 12:0071cb144c7a | 5142 | |
JMF | 12:0071cb144c7a | 5143 | /* There is currently no ciphersuite using another length with TLS 1.2 */ |
JMF | 12:0071cb144c7a | 5144 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 5145 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
JMF | 12:0071cb144c7a | 5146 | hash_len = 36; |
JMF | 12:0071cb144c7a | 5147 | else |
JMF | 12:0071cb144c7a | 5148 | #endif |
JMF | 12:0071cb144c7a | 5149 | hash_len = 12; |
JMF | 12:0071cb144c7a | 5150 | |
JMF | 12:0071cb144c7a | 5151 | if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED || |
JMF | 12:0071cb144c7a | 5152 | ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len ) |
JMF | 12:0071cb144c7a | 5153 | { |
JMF | 12:0071cb144c7a | 5154 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) ); |
JMF | 12:0071cb144c7a | 5155 | return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED ); |
JMF | 12:0071cb144c7a | 5156 | } |
JMF | 12:0071cb144c7a | 5157 | |
JMF | 12:0071cb144c7a | 5158 | if( mbedtls_ssl_safer_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), |
JMF | 12:0071cb144c7a | 5159 | buf, hash_len ) != 0 ) |
JMF | 12:0071cb144c7a | 5160 | { |
JMF | 12:0071cb144c7a | 5161 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) ); |
JMF | 12:0071cb144c7a | 5162 | return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED ); |
JMF | 12:0071cb144c7a | 5163 | } |
JMF | 12:0071cb144c7a | 5164 | |
JMF | 12:0071cb144c7a | 5165 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 5166 | ssl->verify_data_len = hash_len; |
JMF | 12:0071cb144c7a | 5167 | memcpy( ssl->peer_verify_data, buf, hash_len ); |
JMF | 12:0071cb144c7a | 5168 | #endif |
JMF | 12:0071cb144c7a | 5169 | |
JMF | 12:0071cb144c7a | 5170 | if( ssl->handshake->resume != 0 ) |
JMF | 12:0071cb144c7a | 5171 | { |
JMF | 12:0071cb144c7a | 5172 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 5173 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 5174 | ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC; |
JMF | 12:0071cb144c7a | 5175 | #endif |
JMF | 12:0071cb144c7a | 5176 | #if defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 5177 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) |
JMF | 12:0071cb144c7a | 5178 | ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP; |
JMF | 12:0071cb144c7a | 5179 | #endif |
JMF | 12:0071cb144c7a | 5180 | } |
JMF | 12:0071cb144c7a | 5181 | else |
JMF | 12:0071cb144c7a | 5182 | ssl->state++; |
JMF | 12:0071cb144c7a | 5183 | |
JMF | 12:0071cb144c7a | 5184 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 5185 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 5186 | mbedtls_ssl_recv_flight_completed( ssl ); |
JMF | 12:0071cb144c7a | 5187 | #endif |
JMF | 12:0071cb144c7a | 5188 | |
JMF | 12:0071cb144c7a | 5189 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) ); |
JMF | 12:0071cb144c7a | 5190 | |
JMF | 12:0071cb144c7a | 5191 | return( 0 ); |
JMF | 12:0071cb144c7a | 5192 | } |
JMF | 12:0071cb144c7a | 5193 | |
JMF | 12:0071cb144c7a | 5194 | static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake ) |
JMF | 12:0071cb144c7a | 5195 | { |
JMF | 12:0071cb144c7a | 5196 | memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) ); |
JMF | 12:0071cb144c7a | 5197 | |
JMF | 12:0071cb144c7a | 5198 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
JMF | 12:0071cb144c7a | 5199 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
JMF | 12:0071cb144c7a | 5200 | mbedtls_md5_init( &handshake->fin_md5 ); |
JMF | 12:0071cb144c7a | 5201 | mbedtls_sha1_init( &handshake->fin_sha1 ); |
JMF | 12:0071cb144c7a | 5202 | mbedtls_md5_starts( &handshake->fin_md5 ); |
JMF | 12:0071cb144c7a | 5203 | mbedtls_sha1_starts( &handshake->fin_sha1 ); |
JMF | 12:0071cb144c7a | 5204 | #endif |
JMF | 12:0071cb144c7a | 5205 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 5206 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 5207 | mbedtls_sha256_init( &handshake->fin_sha256 ); |
JMF | 12:0071cb144c7a | 5208 | mbedtls_sha256_starts( &handshake->fin_sha256, 0 ); |
JMF | 12:0071cb144c7a | 5209 | #endif |
JMF | 12:0071cb144c7a | 5210 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 5211 | mbedtls_sha512_init( &handshake->fin_sha512 ); |
JMF | 12:0071cb144c7a | 5212 | mbedtls_sha512_starts( &handshake->fin_sha512, 1 ); |
JMF | 12:0071cb144c7a | 5213 | #endif |
JMF | 12:0071cb144c7a | 5214 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 5215 | |
JMF | 12:0071cb144c7a | 5216 | handshake->update_checksum = ssl_update_checksum_start; |
JMF | 12:0071cb144c7a | 5217 | handshake->sig_alg = MBEDTLS_SSL_HASH_SHA1; |
JMF | 12:0071cb144c7a | 5218 | |
JMF | 12:0071cb144c7a | 5219 | #if defined(MBEDTLS_DHM_C) |
JMF | 12:0071cb144c7a | 5220 | mbedtls_dhm_init( &handshake->dhm_ctx ); |
JMF | 12:0071cb144c7a | 5221 | #endif |
JMF | 12:0071cb144c7a | 5222 | #if defined(MBEDTLS_ECDH_C) |
JMF | 12:0071cb144c7a | 5223 | mbedtls_ecdh_init( &handshake->ecdh_ctx ); |
JMF | 12:0071cb144c7a | 5224 | #endif |
JMF | 12:0071cb144c7a | 5225 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
JMF | 12:0071cb144c7a | 5226 | mbedtls_ecjpake_init( &handshake->ecjpake_ctx ); |
JMF | 12:0071cb144c7a | 5227 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 5228 | handshake->ecjpake_cache = NULL; |
JMF | 12:0071cb144c7a | 5229 | handshake->ecjpake_cache_len = 0; |
JMF | 12:0071cb144c7a | 5230 | #endif |
JMF | 12:0071cb144c7a | 5231 | #endif |
JMF | 12:0071cb144c7a | 5232 | |
JMF | 12:0071cb144c7a | 5233 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
JMF | 12:0071cb144c7a | 5234 | handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET; |
JMF | 12:0071cb144c7a | 5235 | #endif |
JMF | 12:0071cb144c7a | 5236 | } |
JMF | 12:0071cb144c7a | 5237 | |
JMF | 12:0071cb144c7a | 5238 | static void ssl_transform_init( mbedtls_ssl_transform *transform ) |
JMF | 12:0071cb144c7a | 5239 | { |
JMF | 12:0071cb144c7a | 5240 | memset( transform, 0, sizeof(mbedtls_ssl_transform) ); |
JMF | 12:0071cb144c7a | 5241 | |
JMF | 12:0071cb144c7a | 5242 | mbedtls_cipher_init( &transform->cipher_ctx_enc ); |
JMF | 12:0071cb144c7a | 5243 | mbedtls_cipher_init( &transform->cipher_ctx_dec ); |
JMF | 12:0071cb144c7a | 5244 | |
JMF | 12:0071cb144c7a | 5245 | mbedtls_md_init( &transform->md_ctx_enc ); |
JMF | 12:0071cb144c7a | 5246 | mbedtls_md_init( &transform->md_ctx_dec ); |
JMF | 12:0071cb144c7a | 5247 | } |
JMF | 12:0071cb144c7a | 5248 | |
JMF | 12:0071cb144c7a | 5249 | void mbedtls_ssl_session_init( mbedtls_ssl_session *session ) |
JMF | 12:0071cb144c7a | 5250 | { |
JMF | 12:0071cb144c7a | 5251 | memset( session, 0, sizeof(mbedtls_ssl_session) ); |
JMF | 12:0071cb144c7a | 5252 | } |
JMF | 12:0071cb144c7a | 5253 | |
JMF | 12:0071cb144c7a | 5254 | static int ssl_handshake_init( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 5255 | { |
JMF | 12:0071cb144c7a | 5256 | /* Clear old handshake information if present */ |
JMF | 12:0071cb144c7a | 5257 | if( ssl->transform_negotiate ) |
JMF | 12:0071cb144c7a | 5258 | mbedtls_ssl_transform_free( ssl->transform_negotiate ); |
JMF | 12:0071cb144c7a | 5259 | if( ssl->session_negotiate ) |
JMF | 12:0071cb144c7a | 5260 | mbedtls_ssl_session_free( ssl->session_negotiate ); |
JMF | 12:0071cb144c7a | 5261 | if( ssl->handshake ) |
JMF | 12:0071cb144c7a | 5262 | mbedtls_ssl_handshake_free( ssl->handshake ); |
JMF | 12:0071cb144c7a | 5263 | |
JMF | 12:0071cb144c7a | 5264 | /* |
JMF | 12:0071cb144c7a | 5265 | * Either the pointers are now NULL or cleared properly and can be freed. |
JMF | 12:0071cb144c7a | 5266 | * Now allocate missing structures. |
JMF | 12:0071cb144c7a | 5267 | */ |
JMF | 12:0071cb144c7a | 5268 | if( ssl->transform_negotiate == NULL ) |
JMF | 12:0071cb144c7a | 5269 | { |
JMF | 12:0071cb144c7a | 5270 | ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) ); |
JMF | 12:0071cb144c7a | 5271 | } |
JMF | 12:0071cb144c7a | 5272 | |
JMF | 12:0071cb144c7a | 5273 | if( ssl->session_negotiate == NULL ) |
JMF | 12:0071cb144c7a | 5274 | { |
JMF | 12:0071cb144c7a | 5275 | ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) ); |
JMF | 12:0071cb144c7a | 5276 | } |
JMF | 12:0071cb144c7a | 5277 | |
JMF | 12:0071cb144c7a | 5278 | if( ssl->handshake == NULL ) |
JMF | 12:0071cb144c7a | 5279 | { |
JMF | 12:0071cb144c7a | 5280 | ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) ); |
JMF | 12:0071cb144c7a | 5281 | } |
JMF | 12:0071cb144c7a | 5282 | |
JMF | 12:0071cb144c7a | 5283 | /* All pointers should exist and can be directly freed without issue */ |
JMF | 12:0071cb144c7a | 5284 | if( ssl->handshake == NULL || |
JMF | 12:0071cb144c7a | 5285 | ssl->transform_negotiate == NULL || |
JMF | 12:0071cb144c7a | 5286 | ssl->session_negotiate == NULL ) |
JMF | 12:0071cb144c7a | 5287 | { |
JMF | 12:0071cb144c7a | 5288 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) ); |
JMF | 12:0071cb144c7a | 5289 | |
JMF | 12:0071cb144c7a | 5290 | mbedtls_free( ssl->handshake ); |
JMF | 12:0071cb144c7a | 5291 | mbedtls_free( ssl->transform_negotiate ); |
JMF | 12:0071cb144c7a | 5292 | mbedtls_free( ssl->session_negotiate ); |
JMF | 12:0071cb144c7a | 5293 | |
JMF | 12:0071cb144c7a | 5294 | ssl->handshake = NULL; |
JMF | 12:0071cb144c7a | 5295 | ssl->transform_negotiate = NULL; |
JMF | 12:0071cb144c7a | 5296 | ssl->session_negotiate = NULL; |
JMF | 12:0071cb144c7a | 5297 | |
JMF | 12:0071cb144c7a | 5298 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 5299 | } |
JMF | 12:0071cb144c7a | 5300 | |
JMF | 12:0071cb144c7a | 5301 | /* Initialize structures */ |
JMF | 12:0071cb144c7a | 5302 | mbedtls_ssl_session_init( ssl->session_negotiate ); |
JMF | 12:0071cb144c7a | 5303 | ssl_transform_init( ssl->transform_negotiate ); |
JMF | 12:0071cb144c7a | 5304 | ssl_handshake_params_init( ssl->handshake ); |
JMF | 12:0071cb144c7a | 5305 | |
JMF | 12:0071cb144c7a | 5306 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 5307 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 5308 | { |
JMF | 12:0071cb144c7a | 5309 | ssl->handshake->alt_transform_out = ssl->transform_out; |
JMF | 12:0071cb144c7a | 5310 | |
JMF | 12:0071cb144c7a | 5311 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 5312 | ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING; |
JMF | 12:0071cb144c7a | 5313 | else |
JMF | 12:0071cb144c7a | 5314 | ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING; |
JMF | 12:0071cb144c7a | 5315 | |
JMF | 12:0071cb144c7a | 5316 | ssl_set_timer( ssl, 0 ); |
JMF | 12:0071cb144c7a | 5317 | } |
JMF | 12:0071cb144c7a | 5318 | #endif |
JMF | 12:0071cb144c7a | 5319 | |
JMF | 12:0071cb144c7a | 5320 | return( 0 ); |
JMF | 12:0071cb144c7a | 5321 | } |
JMF | 12:0071cb144c7a | 5322 | |
JMF | 12:0071cb144c7a | 5323 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 5324 | /* Dummy cookie callbacks for defaults */ |
JMF | 12:0071cb144c7a | 5325 | static int ssl_cookie_write_dummy( void *ctx, |
JMF | 12:0071cb144c7a | 5326 | unsigned char **p, unsigned char *end, |
JMF | 12:0071cb144c7a | 5327 | const unsigned char *cli_id, size_t cli_id_len ) |
JMF | 12:0071cb144c7a | 5328 | { |
JMF | 12:0071cb144c7a | 5329 | ((void) ctx); |
JMF | 12:0071cb144c7a | 5330 | ((void) p); |
JMF | 12:0071cb144c7a | 5331 | ((void) end); |
JMF | 12:0071cb144c7a | 5332 | ((void) cli_id); |
JMF | 12:0071cb144c7a | 5333 | ((void) cli_id_len); |
JMF | 12:0071cb144c7a | 5334 | |
JMF | 12:0071cb144c7a | 5335 | return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); |
JMF | 12:0071cb144c7a | 5336 | } |
JMF | 12:0071cb144c7a | 5337 | |
JMF | 12:0071cb144c7a | 5338 | static int ssl_cookie_check_dummy( void *ctx, |
JMF | 12:0071cb144c7a | 5339 | const unsigned char *cookie, size_t cookie_len, |
JMF | 12:0071cb144c7a | 5340 | const unsigned char *cli_id, size_t cli_id_len ) |
JMF | 12:0071cb144c7a | 5341 | { |
JMF | 12:0071cb144c7a | 5342 | ((void) ctx); |
JMF | 12:0071cb144c7a | 5343 | ((void) cookie); |
JMF | 12:0071cb144c7a | 5344 | ((void) cookie_len); |
JMF | 12:0071cb144c7a | 5345 | ((void) cli_id); |
JMF | 12:0071cb144c7a | 5346 | ((void) cli_id_len); |
JMF | 12:0071cb144c7a | 5347 | |
JMF | 12:0071cb144c7a | 5348 | return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); |
JMF | 12:0071cb144c7a | 5349 | } |
JMF | 12:0071cb144c7a | 5350 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */ |
JMF | 12:0071cb144c7a | 5351 | |
JMF | 12:0071cb144c7a | 5352 | /* |
JMF | 12:0071cb144c7a | 5353 | * Initialize an SSL context |
JMF | 12:0071cb144c7a | 5354 | */ |
JMF | 12:0071cb144c7a | 5355 | void mbedtls_ssl_init( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 5356 | { |
JMF | 12:0071cb144c7a | 5357 | memset( ssl, 0, sizeof( mbedtls_ssl_context ) ); |
JMF | 12:0071cb144c7a | 5358 | } |
JMF | 12:0071cb144c7a | 5359 | |
JMF | 12:0071cb144c7a | 5360 | /* |
JMF | 12:0071cb144c7a | 5361 | * Setup an SSL context |
JMF | 12:0071cb144c7a | 5362 | */ |
JMF | 12:0071cb144c7a | 5363 | int mbedtls_ssl_setup( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 5364 | const mbedtls_ssl_config *conf ) |
JMF | 12:0071cb144c7a | 5365 | { |
JMF | 12:0071cb144c7a | 5366 | int ret; |
JMF | 12:0071cb144c7a | 5367 | const size_t len = MBEDTLS_SSL_BUFFER_LEN; |
JMF | 12:0071cb144c7a | 5368 | |
JMF | 12:0071cb144c7a | 5369 | ssl->conf = conf; |
JMF | 12:0071cb144c7a | 5370 | |
JMF | 12:0071cb144c7a | 5371 | /* |
JMF | 12:0071cb144c7a | 5372 | * Prepare base structures |
JMF | 12:0071cb144c7a | 5373 | */ |
JMF | 12:0071cb144c7a | 5374 | if( ( ssl-> in_buf = mbedtls_calloc( 1, len ) ) == NULL || |
JMF | 12:0071cb144c7a | 5375 | ( ssl->out_buf = mbedtls_calloc( 1, len ) ) == NULL ) |
JMF | 12:0071cb144c7a | 5376 | { |
JMF | 12:0071cb144c7a | 5377 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", len ) ); |
JMF | 12:0071cb144c7a | 5378 | mbedtls_free( ssl->in_buf ); |
JMF | 12:0071cb144c7a | 5379 | ssl->in_buf = NULL; |
JMF | 12:0071cb144c7a | 5380 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 5381 | } |
JMF | 12:0071cb144c7a | 5382 | |
JMF | 12:0071cb144c7a | 5383 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 5384 | if( conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 5385 | { |
JMF | 12:0071cb144c7a | 5386 | ssl->out_hdr = ssl->out_buf; |
JMF | 12:0071cb144c7a | 5387 | ssl->out_ctr = ssl->out_buf + 3; |
JMF | 12:0071cb144c7a | 5388 | ssl->out_len = ssl->out_buf + 11; |
JMF | 12:0071cb144c7a | 5389 | ssl->out_iv = ssl->out_buf + 13; |
JMF | 12:0071cb144c7a | 5390 | ssl->out_msg = ssl->out_buf + 13; |
JMF | 12:0071cb144c7a | 5391 | |
JMF | 12:0071cb144c7a | 5392 | ssl->in_hdr = ssl->in_buf; |
JMF | 12:0071cb144c7a | 5393 | ssl->in_ctr = ssl->in_buf + 3; |
JMF | 12:0071cb144c7a | 5394 | ssl->in_len = ssl->in_buf + 11; |
JMF | 12:0071cb144c7a | 5395 | ssl->in_iv = ssl->in_buf + 13; |
JMF | 12:0071cb144c7a | 5396 | ssl->in_msg = ssl->in_buf + 13; |
JMF | 12:0071cb144c7a | 5397 | } |
JMF | 12:0071cb144c7a | 5398 | else |
JMF | 12:0071cb144c7a | 5399 | #endif |
JMF | 12:0071cb144c7a | 5400 | { |
JMF | 12:0071cb144c7a | 5401 | ssl->out_ctr = ssl->out_buf; |
JMF | 12:0071cb144c7a | 5402 | ssl->out_hdr = ssl->out_buf + 8; |
JMF | 12:0071cb144c7a | 5403 | ssl->out_len = ssl->out_buf + 11; |
JMF | 12:0071cb144c7a | 5404 | ssl->out_iv = ssl->out_buf + 13; |
JMF | 12:0071cb144c7a | 5405 | ssl->out_msg = ssl->out_buf + 13; |
JMF | 12:0071cb144c7a | 5406 | |
JMF | 12:0071cb144c7a | 5407 | ssl->in_ctr = ssl->in_buf; |
JMF | 12:0071cb144c7a | 5408 | ssl->in_hdr = ssl->in_buf + 8; |
JMF | 12:0071cb144c7a | 5409 | ssl->in_len = ssl->in_buf + 11; |
JMF | 12:0071cb144c7a | 5410 | ssl->in_iv = ssl->in_buf + 13; |
JMF | 12:0071cb144c7a | 5411 | ssl->in_msg = ssl->in_buf + 13; |
JMF | 12:0071cb144c7a | 5412 | } |
JMF | 12:0071cb144c7a | 5413 | |
JMF | 12:0071cb144c7a | 5414 | if( ( ret = ssl_handshake_init( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 5415 | return( ret ); |
JMF | 12:0071cb144c7a | 5416 | |
JMF | 12:0071cb144c7a | 5417 | return( 0 ); |
JMF | 12:0071cb144c7a | 5418 | } |
JMF | 12:0071cb144c7a | 5419 | |
JMF | 12:0071cb144c7a | 5420 | /* |
JMF | 12:0071cb144c7a | 5421 | * Reset an initialized and used SSL context for re-use while retaining |
JMF | 12:0071cb144c7a | 5422 | * all application-set variables, function pointers and data. |
JMF | 12:0071cb144c7a | 5423 | * |
JMF | 12:0071cb144c7a | 5424 | * If partial is non-zero, keep data in the input buffer and client ID. |
JMF | 12:0071cb144c7a | 5425 | * (Use when a DTLS client reconnects from the same port.) |
JMF | 12:0071cb144c7a | 5426 | */ |
JMF | 12:0071cb144c7a | 5427 | static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial ) |
JMF | 12:0071cb144c7a | 5428 | { |
JMF | 12:0071cb144c7a | 5429 | int ret; |
JMF | 12:0071cb144c7a | 5430 | |
JMF | 12:0071cb144c7a | 5431 | ssl->state = MBEDTLS_SSL_HELLO_REQUEST; |
JMF | 12:0071cb144c7a | 5432 | |
JMF | 12:0071cb144c7a | 5433 | /* Cancel any possibly running timer */ |
JMF | 12:0071cb144c7a | 5434 | ssl_set_timer( ssl, 0 ); |
JMF | 12:0071cb144c7a | 5435 | |
JMF | 12:0071cb144c7a | 5436 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 5437 | ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE; |
JMF | 12:0071cb144c7a | 5438 | ssl->renego_records_seen = 0; |
JMF | 12:0071cb144c7a | 5439 | |
JMF | 12:0071cb144c7a | 5440 | ssl->verify_data_len = 0; |
JMF | 12:0071cb144c7a | 5441 | memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN ); |
JMF | 12:0071cb144c7a | 5442 | memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN ); |
JMF | 12:0071cb144c7a | 5443 | #endif |
JMF | 12:0071cb144c7a | 5444 | ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION; |
JMF | 12:0071cb144c7a | 5445 | |
JMF | 12:0071cb144c7a | 5446 | ssl->in_offt = NULL; |
JMF | 12:0071cb144c7a | 5447 | |
JMF | 12:0071cb144c7a | 5448 | ssl->in_msg = ssl->in_buf + 13; |
JMF | 12:0071cb144c7a | 5449 | ssl->in_msgtype = 0; |
JMF | 12:0071cb144c7a | 5450 | ssl->in_msglen = 0; |
JMF | 12:0071cb144c7a | 5451 | if( partial == 0 ) |
JMF | 12:0071cb144c7a | 5452 | ssl->in_left = 0; |
JMF | 12:0071cb144c7a | 5453 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 5454 | ssl->next_record_offset = 0; |
JMF | 12:0071cb144c7a | 5455 | ssl->in_epoch = 0; |
JMF | 12:0071cb144c7a | 5456 | #endif |
JMF | 12:0071cb144c7a | 5457 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
JMF | 12:0071cb144c7a | 5458 | ssl_dtls_replay_reset( ssl ); |
JMF | 12:0071cb144c7a | 5459 | #endif |
JMF | 12:0071cb144c7a | 5460 | |
JMF | 12:0071cb144c7a | 5461 | ssl->in_hslen = 0; |
JMF | 12:0071cb144c7a | 5462 | ssl->nb_zero = 0; |
JMF | 12:0071cb144c7a | 5463 | ssl->record_read = 0; |
JMF | 12:0071cb144c7a | 5464 | |
JMF | 12:0071cb144c7a | 5465 | ssl->out_msg = ssl->out_buf + 13; |
JMF | 12:0071cb144c7a | 5466 | ssl->out_msgtype = 0; |
JMF | 12:0071cb144c7a | 5467 | ssl->out_msglen = 0; |
JMF | 12:0071cb144c7a | 5468 | ssl->out_left = 0; |
JMF | 12:0071cb144c7a | 5469 | #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) |
JMF | 12:0071cb144c7a | 5470 | if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED ) |
JMF | 12:0071cb144c7a | 5471 | ssl->split_done = 0; |
JMF | 12:0071cb144c7a | 5472 | #endif |
JMF | 12:0071cb144c7a | 5473 | |
JMF | 12:0071cb144c7a | 5474 | ssl->transform_in = NULL; |
JMF | 12:0071cb144c7a | 5475 | ssl->transform_out = NULL; |
JMF | 12:0071cb144c7a | 5476 | |
JMF | 12:0071cb144c7a | 5477 | memset( ssl->out_buf, 0, MBEDTLS_SSL_BUFFER_LEN ); |
JMF | 12:0071cb144c7a | 5478 | if( partial == 0 ) |
JMF | 12:0071cb144c7a | 5479 | memset( ssl->in_buf, 0, MBEDTLS_SSL_BUFFER_LEN ); |
JMF | 12:0071cb144c7a | 5480 | |
JMF | 12:0071cb144c7a | 5481 | #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) |
JMF | 12:0071cb144c7a | 5482 | if( mbedtls_ssl_hw_record_reset != NULL ) |
JMF | 12:0071cb144c7a | 5483 | { |
JMF | 12:0071cb144c7a | 5484 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) ); |
JMF | 12:0071cb144c7a | 5485 | if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 5486 | { |
JMF | 12:0071cb144c7a | 5487 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret ); |
JMF | 12:0071cb144c7a | 5488 | return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); |
JMF | 12:0071cb144c7a | 5489 | } |
JMF | 12:0071cb144c7a | 5490 | } |
JMF | 12:0071cb144c7a | 5491 | #endif |
JMF | 12:0071cb144c7a | 5492 | |
JMF | 12:0071cb144c7a | 5493 | if( ssl->transform ) |
JMF | 12:0071cb144c7a | 5494 | { |
JMF | 12:0071cb144c7a | 5495 | mbedtls_ssl_transform_free( ssl->transform ); |
JMF | 12:0071cb144c7a | 5496 | mbedtls_free( ssl->transform ); |
JMF | 12:0071cb144c7a | 5497 | ssl->transform = NULL; |
JMF | 12:0071cb144c7a | 5498 | } |
JMF | 12:0071cb144c7a | 5499 | |
JMF | 12:0071cb144c7a | 5500 | if( ssl->session ) |
JMF | 12:0071cb144c7a | 5501 | { |
JMF | 12:0071cb144c7a | 5502 | mbedtls_ssl_session_free( ssl->session ); |
JMF | 12:0071cb144c7a | 5503 | mbedtls_free( ssl->session ); |
JMF | 12:0071cb144c7a | 5504 | ssl->session = NULL; |
JMF | 12:0071cb144c7a | 5505 | } |
JMF | 12:0071cb144c7a | 5506 | |
JMF | 12:0071cb144c7a | 5507 | #if defined(MBEDTLS_SSL_ALPN) |
JMF | 12:0071cb144c7a | 5508 | ssl->alpn_chosen = NULL; |
JMF | 12:0071cb144c7a | 5509 | #endif |
JMF | 12:0071cb144c7a | 5510 | |
JMF | 12:0071cb144c7a | 5511 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 5512 | if( partial == 0 ) |
JMF | 12:0071cb144c7a | 5513 | { |
JMF | 12:0071cb144c7a | 5514 | mbedtls_free( ssl->cli_id ); |
JMF | 12:0071cb144c7a | 5515 | ssl->cli_id = NULL; |
JMF | 12:0071cb144c7a | 5516 | ssl->cli_id_len = 0; |
JMF | 12:0071cb144c7a | 5517 | } |
JMF | 12:0071cb144c7a | 5518 | #endif |
JMF | 12:0071cb144c7a | 5519 | |
JMF | 12:0071cb144c7a | 5520 | if( ( ret = ssl_handshake_init( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 5521 | return( ret ); |
JMF | 12:0071cb144c7a | 5522 | |
JMF | 12:0071cb144c7a | 5523 | return( 0 ); |
JMF | 12:0071cb144c7a | 5524 | } |
JMF | 12:0071cb144c7a | 5525 | |
JMF | 12:0071cb144c7a | 5526 | /* |
JMF | 12:0071cb144c7a | 5527 | * Reset an initialized and used SSL context for re-use while retaining |
JMF | 12:0071cb144c7a | 5528 | * all application-set variables, function pointers and data. |
JMF | 12:0071cb144c7a | 5529 | */ |
JMF | 12:0071cb144c7a | 5530 | int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 5531 | { |
JMF | 12:0071cb144c7a | 5532 | return( ssl_session_reset_int( ssl, 0 ) ); |
JMF | 12:0071cb144c7a | 5533 | } |
JMF | 12:0071cb144c7a | 5534 | |
JMF | 12:0071cb144c7a | 5535 | /* |
JMF | 12:0071cb144c7a | 5536 | * SSL set accessors |
JMF | 12:0071cb144c7a | 5537 | */ |
JMF | 12:0071cb144c7a | 5538 | void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint ) |
JMF | 12:0071cb144c7a | 5539 | { |
JMF | 12:0071cb144c7a | 5540 | conf->endpoint = endpoint; |
JMF | 12:0071cb144c7a | 5541 | } |
JMF | 12:0071cb144c7a | 5542 | |
JMF | 12:0071cb144c7a | 5543 | void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport ) |
JMF | 12:0071cb144c7a | 5544 | { |
JMF | 12:0071cb144c7a | 5545 | conf->transport = transport; |
JMF | 12:0071cb144c7a | 5546 | } |
JMF | 12:0071cb144c7a | 5547 | |
JMF | 12:0071cb144c7a | 5548 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
JMF | 12:0071cb144c7a | 5549 | void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode ) |
JMF | 12:0071cb144c7a | 5550 | { |
JMF | 12:0071cb144c7a | 5551 | conf->anti_replay = mode; |
JMF | 12:0071cb144c7a | 5552 | } |
JMF | 12:0071cb144c7a | 5553 | #endif |
JMF | 12:0071cb144c7a | 5554 | |
JMF | 12:0071cb144c7a | 5555 | #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) |
JMF | 12:0071cb144c7a | 5556 | void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit ) |
JMF | 12:0071cb144c7a | 5557 | { |
JMF | 12:0071cb144c7a | 5558 | conf->badmac_limit = limit; |
JMF | 12:0071cb144c7a | 5559 | } |
JMF | 12:0071cb144c7a | 5560 | #endif |
JMF | 12:0071cb144c7a | 5561 | |
JMF | 12:0071cb144c7a | 5562 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 5563 | void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf, uint32_t min, uint32_t max ) |
JMF | 12:0071cb144c7a | 5564 | { |
JMF | 12:0071cb144c7a | 5565 | conf->hs_timeout_min = min; |
JMF | 12:0071cb144c7a | 5566 | conf->hs_timeout_max = max; |
JMF | 12:0071cb144c7a | 5567 | } |
JMF | 12:0071cb144c7a | 5568 | #endif |
JMF | 12:0071cb144c7a | 5569 | |
JMF | 12:0071cb144c7a | 5570 | void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode ) |
JMF | 12:0071cb144c7a | 5571 | { |
JMF | 12:0071cb144c7a | 5572 | conf->authmode = authmode; |
JMF | 12:0071cb144c7a | 5573 | } |
JMF | 12:0071cb144c7a | 5574 | |
JMF | 12:0071cb144c7a | 5575 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
JMF | 12:0071cb144c7a | 5576 | void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5577 | int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), |
JMF | 12:0071cb144c7a | 5578 | void *p_vrfy ) |
JMF | 12:0071cb144c7a | 5579 | { |
JMF | 12:0071cb144c7a | 5580 | conf->f_vrfy = f_vrfy; |
JMF | 12:0071cb144c7a | 5581 | conf->p_vrfy = p_vrfy; |
JMF | 12:0071cb144c7a | 5582 | } |
JMF | 12:0071cb144c7a | 5583 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
JMF | 12:0071cb144c7a | 5584 | |
JMF | 12:0071cb144c7a | 5585 | void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5586 | int (*f_rng)(void *, unsigned char *, size_t), |
JMF | 12:0071cb144c7a | 5587 | void *p_rng ) |
JMF | 12:0071cb144c7a | 5588 | { |
JMF | 12:0071cb144c7a | 5589 | conf->f_rng = f_rng; |
JMF | 12:0071cb144c7a | 5590 | conf->p_rng = p_rng; |
JMF | 12:0071cb144c7a | 5591 | } |
JMF | 12:0071cb144c7a | 5592 | |
JMF | 12:0071cb144c7a | 5593 | void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5594 | void (*f_dbg)(void *, int, const char *, int, const char *), |
JMF | 12:0071cb144c7a | 5595 | void *p_dbg ) |
JMF | 12:0071cb144c7a | 5596 | { |
JMF | 12:0071cb144c7a | 5597 | conf->f_dbg = f_dbg; |
JMF | 12:0071cb144c7a | 5598 | conf->p_dbg = p_dbg; |
JMF | 12:0071cb144c7a | 5599 | } |
JMF | 12:0071cb144c7a | 5600 | |
JMF | 12:0071cb144c7a | 5601 | void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 5602 | void *p_bio, |
JMF | 12:0071cb144c7a | 5603 | mbedtls_ssl_send_t *f_send, |
JMF | 12:0071cb144c7a | 5604 | mbedtls_ssl_recv_t *f_recv, |
JMF | 12:0071cb144c7a | 5605 | mbedtls_ssl_recv_timeout_t *f_recv_timeout ) |
JMF | 12:0071cb144c7a | 5606 | { |
JMF | 12:0071cb144c7a | 5607 | ssl->p_bio = p_bio; |
JMF | 12:0071cb144c7a | 5608 | ssl->f_send = f_send; |
JMF | 12:0071cb144c7a | 5609 | ssl->f_recv = f_recv; |
JMF | 12:0071cb144c7a | 5610 | ssl->f_recv_timeout = f_recv_timeout; |
JMF | 12:0071cb144c7a | 5611 | } |
JMF | 12:0071cb144c7a | 5612 | |
JMF | 12:0071cb144c7a | 5613 | void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout ) |
JMF | 12:0071cb144c7a | 5614 | { |
JMF | 12:0071cb144c7a | 5615 | conf->read_timeout = timeout; |
JMF | 12:0071cb144c7a | 5616 | } |
JMF | 12:0071cb144c7a | 5617 | |
JMF | 12:0071cb144c7a | 5618 | void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 5619 | void *p_timer, |
JMF | 12:0071cb144c7a | 5620 | mbedtls_ssl_set_timer_t *f_set_timer, |
JMF | 12:0071cb144c7a | 5621 | mbedtls_ssl_get_timer_t *f_get_timer ) |
JMF | 12:0071cb144c7a | 5622 | { |
JMF | 12:0071cb144c7a | 5623 | ssl->p_timer = p_timer; |
JMF | 12:0071cb144c7a | 5624 | ssl->f_set_timer = f_set_timer; |
JMF | 12:0071cb144c7a | 5625 | ssl->f_get_timer = f_get_timer; |
JMF | 12:0071cb144c7a | 5626 | |
JMF | 12:0071cb144c7a | 5627 | /* Make sure we start with no timer running */ |
JMF | 12:0071cb144c7a | 5628 | ssl_set_timer( ssl, 0 ); |
JMF | 12:0071cb144c7a | 5629 | } |
JMF | 12:0071cb144c7a | 5630 | |
JMF | 12:0071cb144c7a | 5631 | #if defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 5632 | void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5633 | void *p_cache, |
JMF | 12:0071cb144c7a | 5634 | int (*f_get_cache)(void *, mbedtls_ssl_session *), |
JMF | 12:0071cb144c7a | 5635 | int (*f_set_cache)(void *, const mbedtls_ssl_session *) ) |
JMF | 12:0071cb144c7a | 5636 | { |
JMF | 12:0071cb144c7a | 5637 | conf->p_cache = p_cache; |
JMF | 12:0071cb144c7a | 5638 | conf->f_get_cache = f_get_cache; |
JMF | 12:0071cb144c7a | 5639 | conf->f_set_cache = f_set_cache; |
JMF | 12:0071cb144c7a | 5640 | } |
JMF | 12:0071cb144c7a | 5641 | #endif /* MBEDTLS_SSL_SRV_C */ |
JMF | 12:0071cb144c7a | 5642 | |
JMF | 12:0071cb144c7a | 5643 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 5644 | int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session ) |
JMF | 12:0071cb144c7a | 5645 | { |
JMF | 12:0071cb144c7a | 5646 | int ret; |
JMF | 12:0071cb144c7a | 5647 | |
JMF | 12:0071cb144c7a | 5648 | if( ssl == NULL || |
JMF | 12:0071cb144c7a | 5649 | session == NULL || |
JMF | 12:0071cb144c7a | 5650 | ssl->session_negotiate == NULL || |
JMF | 12:0071cb144c7a | 5651 | ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 5652 | { |
JMF | 12:0071cb144c7a | 5653 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 5654 | } |
JMF | 12:0071cb144c7a | 5655 | |
JMF | 12:0071cb144c7a | 5656 | if( ( ret = ssl_session_copy( ssl->session_negotiate, session ) ) != 0 ) |
JMF | 12:0071cb144c7a | 5657 | return( ret ); |
JMF | 12:0071cb144c7a | 5658 | |
JMF | 12:0071cb144c7a | 5659 | ssl->handshake->resume = 1; |
JMF | 12:0071cb144c7a | 5660 | |
JMF | 12:0071cb144c7a | 5661 | return( 0 ); |
JMF | 12:0071cb144c7a | 5662 | } |
JMF | 12:0071cb144c7a | 5663 | #endif /* MBEDTLS_SSL_CLI_C */ |
JMF | 12:0071cb144c7a | 5664 | |
JMF | 12:0071cb144c7a | 5665 | void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5666 | const int *ciphersuites ) |
JMF | 12:0071cb144c7a | 5667 | { |
JMF | 12:0071cb144c7a | 5668 | conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = ciphersuites; |
JMF | 12:0071cb144c7a | 5669 | conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = ciphersuites; |
JMF | 12:0071cb144c7a | 5670 | conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = ciphersuites; |
JMF | 12:0071cb144c7a | 5671 | conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = ciphersuites; |
JMF | 12:0071cb144c7a | 5672 | } |
JMF | 12:0071cb144c7a | 5673 | |
JMF | 12:0071cb144c7a | 5674 | void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5675 | const int *ciphersuites, |
JMF | 12:0071cb144c7a | 5676 | int major, int minor ) |
JMF | 12:0071cb144c7a | 5677 | { |
JMF | 12:0071cb144c7a | 5678 | if( major != MBEDTLS_SSL_MAJOR_VERSION_3 ) |
JMF | 12:0071cb144c7a | 5679 | return; |
JMF | 12:0071cb144c7a | 5680 | |
JMF | 12:0071cb144c7a | 5681 | if( minor < MBEDTLS_SSL_MINOR_VERSION_0 || minor > MBEDTLS_SSL_MINOR_VERSION_3 ) |
JMF | 12:0071cb144c7a | 5682 | return; |
JMF | 12:0071cb144c7a | 5683 | |
JMF | 12:0071cb144c7a | 5684 | conf->ciphersuite_list[minor] = ciphersuites; |
JMF | 12:0071cb144c7a | 5685 | } |
JMF | 12:0071cb144c7a | 5686 | |
JMF | 12:0071cb144c7a | 5687 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
JMF | 12:0071cb144c7a | 5688 | void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5689 | const mbedtls_x509_crt_profile *profile ) |
JMF | 12:0071cb144c7a | 5690 | { |
JMF | 12:0071cb144c7a | 5691 | conf->cert_profile = profile; |
JMF | 12:0071cb144c7a | 5692 | } |
JMF | 12:0071cb144c7a | 5693 | |
JMF | 12:0071cb144c7a | 5694 | /* Append a new keycert entry to a (possibly empty) list */ |
JMF | 12:0071cb144c7a | 5695 | static int ssl_append_key_cert( mbedtls_ssl_key_cert **head, |
JMF | 12:0071cb144c7a | 5696 | mbedtls_x509_crt *cert, |
JMF | 12:0071cb144c7a | 5697 | mbedtls_pk_context *key ) |
JMF | 12:0071cb144c7a | 5698 | { |
JMF | 12:0071cb144c7a | 5699 | mbedtls_ssl_key_cert *new; |
JMF | 12:0071cb144c7a | 5700 | |
JMF | 12:0071cb144c7a | 5701 | new = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) ); |
JMF | 12:0071cb144c7a | 5702 | if( new == NULL ) |
JMF | 12:0071cb144c7a | 5703 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 5704 | |
JMF | 12:0071cb144c7a | 5705 | new->cert = cert; |
JMF | 12:0071cb144c7a | 5706 | new->key = key; |
JMF | 12:0071cb144c7a | 5707 | new->next = NULL; |
JMF | 12:0071cb144c7a | 5708 | |
JMF | 12:0071cb144c7a | 5709 | /* Update head is the list was null, else add to the end */ |
JMF | 12:0071cb144c7a | 5710 | if( *head == NULL ) |
JMF | 12:0071cb144c7a | 5711 | { |
JMF | 12:0071cb144c7a | 5712 | *head = new; |
JMF | 12:0071cb144c7a | 5713 | } |
JMF | 12:0071cb144c7a | 5714 | else |
JMF | 12:0071cb144c7a | 5715 | { |
JMF | 12:0071cb144c7a | 5716 | mbedtls_ssl_key_cert *cur = *head; |
JMF | 12:0071cb144c7a | 5717 | while( cur->next != NULL ) |
JMF | 12:0071cb144c7a | 5718 | cur = cur->next; |
JMF | 12:0071cb144c7a | 5719 | cur->next = new; |
JMF | 12:0071cb144c7a | 5720 | } |
JMF | 12:0071cb144c7a | 5721 | |
JMF | 12:0071cb144c7a | 5722 | return( 0 ); |
JMF | 12:0071cb144c7a | 5723 | } |
JMF | 12:0071cb144c7a | 5724 | |
JMF | 12:0071cb144c7a | 5725 | int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5726 | mbedtls_x509_crt *own_cert, |
JMF | 12:0071cb144c7a | 5727 | mbedtls_pk_context *pk_key ) |
JMF | 12:0071cb144c7a | 5728 | { |
JMF | 12:0071cb144c7a | 5729 | return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) ); |
JMF | 12:0071cb144c7a | 5730 | } |
JMF | 12:0071cb144c7a | 5731 | |
JMF | 12:0071cb144c7a | 5732 | void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5733 | mbedtls_x509_crt *ca_chain, |
JMF | 12:0071cb144c7a | 5734 | mbedtls_x509_crl *ca_crl ) |
JMF | 12:0071cb144c7a | 5735 | { |
JMF | 12:0071cb144c7a | 5736 | conf->ca_chain = ca_chain; |
JMF | 12:0071cb144c7a | 5737 | conf->ca_crl = ca_crl; |
JMF | 12:0071cb144c7a | 5738 | } |
JMF | 12:0071cb144c7a | 5739 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
JMF | 12:0071cb144c7a | 5740 | |
JMF | 12:0071cb144c7a | 5741 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
JMF | 12:0071cb144c7a | 5742 | int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 5743 | mbedtls_x509_crt *own_cert, |
JMF | 12:0071cb144c7a | 5744 | mbedtls_pk_context *pk_key ) |
JMF | 12:0071cb144c7a | 5745 | { |
JMF | 12:0071cb144c7a | 5746 | return( ssl_append_key_cert( &ssl->handshake->sni_key_cert, |
JMF | 12:0071cb144c7a | 5747 | own_cert, pk_key ) ); |
JMF | 12:0071cb144c7a | 5748 | } |
JMF | 12:0071cb144c7a | 5749 | |
JMF | 12:0071cb144c7a | 5750 | void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 5751 | mbedtls_x509_crt *ca_chain, |
JMF | 12:0071cb144c7a | 5752 | mbedtls_x509_crl *ca_crl ) |
JMF | 12:0071cb144c7a | 5753 | { |
JMF | 12:0071cb144c7a | 5754 | ssl->handshake->sni_ca_chain = ca_chain; |
JMF | 12:0071cb144c7a | 5755 | ssl->handshake->sni_ca_crl = ca_crl; |
JMF | 12:0071cb144c7a | 5756 | } |
JMF | 12:0071cb144c7a | 5757 | |
JMF | 12:0071cb144c7a | 5758 | void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 5759 | int authmode ) |
JMF | 12:0071cb144c7a | 5760 | { |
JMF | 12:0071cb144c7a | 5761 | ssl->handshake->sni_authmode = authmode; |
JMF | 12:0071cb144c7a | 5762 | } |
JMF | 12:0071cb144c7a | 5763 | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
JMF | 12:0071cb144c7a | 5764 | |
JMF | 12:0071cb144c7a | 5765 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
JMF | 12:0071cb144c7a | 5766 | /* |
JMF | 12:0071cb144c7a | 5767 | * Set EC J-PAKE password for current handshake |
JMF | 12:0071cb144c7a | 5768 | */ |
JMF | 12:0071cb144c7a | 5769 | int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 5770 | const unsigned char *pw, |
JMF | 12:0071cb144c7a | 5771 | size_t pw_len ) |
JMF | 12:0071cb144c7a | 5772 | { |
JMF | 12:0071cb144c7a | 5773 | mbedtls_ecjpake_role role; |
JMF | 12:0071cb144c7a | 5774 | |
JMF | 12:0071cb144c7a | 5775 | if( ssl->handshake == NULL || ssl->conf == NULL ) |
JMF | 12:0071cb144c7a | 5776 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 5777 | |
JMF | 12:0071cb144c7a | 5778 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) |
JMF | 12:0071cb144c7a | 5779 | role = MBEDTLS_ECJPAKE_SERVER; |
JMF | 12:0071cb144c7a | 5780 | else |
JMF | 12:0071cb144c7a | 5781 | role = MBEDTLS_ECJPAKE_CLIENT; |
JMF | 12:0071cb144c7a | 5782 | |
JMF | 12:0071cb144c7a | 5783 | return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx, |
JMF | 12:0071cb144c7a | 5784 | role, |
JMF | 12:0071cb144c7a | 5785 | MBEDTLS_MD_SHA256, |
JMF | 12:0071cb144c7a | 5786 | MBEDTLS_ECP_DP_SECP256R1, |
JMF | 12:0071cb144c7a | 5787 | pw, pw_len ) ); |
JMF | 12:0071cb144c7a | 5788 | } |
JMF | 12:0071cb144c7a | 5789 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
JMF | 12:0071cb144c7a | 5790 | |
JMF | 12:0071cb144c7a | 5791 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
JMF | 12:0071cb144c7a | 5792 | int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5793 | const unsigned char *psk, size_t psk_len, |
JMF | 12:0071cb144c7a | 5794 | const unsigned char *psk_identity, size_t psk_identity_len ) |
JMF | 12:0071cb144c7a | 5795 | { |
JMF | 12:0071cb144c7a | 5796 | if( psk == NULL || psk_identity == NULL ) |
JMF | 12:0071cb144c7a | 5797 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 5798 | |
JMF | 12:0071cb144c7a | 5799 | if( psk_len > MBEDTLS_PSK_MAX_LEN ) |
JMF | 12:0071cb144c7a | 5800 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 5801 | |
JMF | 12:0071cb144c7a | 5802 | /* Identity len will be encoded on two bytes */ |
JMF | 12:0071cb144c7a | 5803 | if( ( psk_identity_len >> 16 ) != 0 || |
JMF | 12:0071cb144c7a | 5804 | psk_identity_len > MBEDTLS_SSL_MAX_CONTENT_LEN ) |
JMF | 12:0071cb144c7a | 5805 | { |
JMF | 12:0071cb144c7a | 5806 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 5807 | } |
JMF | 12:0071cb144c7a | 5808 | |
JMF | 12:0071cb144c7a | 5809 | if( conf->psk != NULL || conf->psk_identity != NULL ) |
JMF | 12:0071cb144c7a | 5810 | { |
JMF | 12:0071cb144c7a | 5811 | mbedtls_free( conf->psk ); |
JMF | 12:0071cb144c7a | 5812 | mbedtls_free( conf->psk_identity ); |
JMF | 12:0071cb144c7a | 5813 | conf->psk = NULL; |
JMF | 12:0071cb144c7a | 5814 | conf->psk_identity = NULL; |
JMF | 12:0071cb144c7a | 5815 | } |
JMF | 12:0071cb144c7a | 5816 | |
JMF | 12:0071cb144c7a | 5817 | if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL || |
JMF | 12:0071cb144c7a | 5818 | ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL ) |
JMF | 12:0071cb144c7a | 5819 | { |
JMF | 12:0071cb144c7a | 5820 | mbedtls_free( conf->psk ); |
JMF | 12:0071cb144c7a | 5821 | mbedtls_free( conf->psk_identity ); |
JMF | 12:0071cb144c7a | 5822 | conf->psk = NULL; |
JMF | 12:0071cb144c7a | 5823 | conf->psk_identity = NULL; |
JMF | 12:0071cb144c7a | 5824 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 5825 | } |
JMF | 12:0071cb144c7a | 5826 | |
JMF | 12:0071cb144c7a | 5827 | conf->psk_len = psk_len; |
JMF | 12:0071cb144c7a | 5828 | conf->psk_identity_len = psk_identity_len; |
JMF | 12:0071cb144c7a | 5829 | |
JMF | 12:0071cb144c7a | 5830 | memcpy( conf->psk, psk, conf->psk_len ); |
JMF | 12:0071cb144c7a | 5831 | memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len ); |
JMF | 12:0071cb144c7a | 5832 | |
JMF | 12:0071cb144c7a | 5833 | return( 0 ); |
JMF | 12:0071cb144c7a | 5834 | } |
JMF | 12:0071cb144c7a | 5835 | |
JMF | 12:0071cb144c7a | 5836 | int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 5837 | const unsigned char *psk, size_t psk_len ) |
JMF | 12:0071cb144c7a | 5838 | { |
JMF | 12:0071cb144c7a | 5839 | if( psk == NULL || ssl->handshake == NULL ) |
JMF | 12:0071cb144c7a | 5840 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 5841 | |
JMF | 12:0071cb144c7a | 5842 | if( psk_len > MBEDTLS_PSK_MAX_LEN ) |
JMF | 12:0071cb144c7a | 5843 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 5844 | |
JMF | 12:0071cb144c7a | 5845 | if( ssl->handshake->psk != NULL ) |
JMF | 12:0071cb144c7a | 5846 | mbedtls_free( ssl->handshake->psk ); |
JMF | 12:0071cb144c7a | 5847 | |
JMF | 12:0071cb144c7a | 5848 | if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ) |
JMF | 12:0071cb144c7a | 5849 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 5850 | |
JMF | 12:0071cb144c7a | 5851 | ssl->handshake->psk_len = psk_len; |
JMF | 12:0071cb144c7a | 5852 | memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len ); |
JMF | 12:0071cb144c7a | 5853 | |
JMF | 12:0071cb144c7a | 5854 | return( 0 ); |
JMF | 12:0071cb144c7a | 5855 | } |
JMF | 12:0071cb144c7a | 5856 | |
JMF | 12:0071cb144c7a | 5857 | void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5858 | int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *, |
JMF | 12:0071cb144c7a | 5859 | size_t), |
JMF | 12:0071cb144c7a | 5860 | void *p_psk ) |
JMF | 12:0071cb144c7a | 5861 | { |
JMF | 12:0071cb144c7a | 5862 | conf->f_psk = f_psk; |
JMF | 12:0071cb144c7a | 5863 | conf->p_psk = p_psk; |
JMF | 12:0071cb144c7a | 5864 | } |
JMF | 12:0071cb144c7a | 5865 | #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ |
JMF | 12:0071cb144c7a | 5866 | |
JMF | 12:0071cb144c7a | 5867 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 5868 | int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G ) |
JMF | 12:0071cb144c7a | 5869 | { |
JMF | 12:0071cb144c7a | 5870 | int ret; |
JMF | 12:0071cb144c7a | 5871 | |
JMF | 12:0071cb144c7a | 5872 | if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 || |
JMF | 12:0071cb144c7a | 5873 | ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 ) |
JMF | 12:0071cb144c7a | 5874 | { |
JMF | 12:0071cb144c7a | 5875 | mbedtls_mpi_free( &conf->dhm_P ); |
JMF | 12:0071cb144c7a | 5876 | mbedtls_mpi_free( &conf->dhm_G ); |
JMF | 12:0071cb144c7a | 5877 | return( ret ); |
JMF | 12:0071cb144c7a | 5878 | } |
JMF | 12:0071cb144c7a | 5879 | |
JMF | 12:0071cb144c7a | 5880 | return( 0 ); |
JMF | 12:0071cb144c7a | 5881 | } |
JMF | 12:0071cb144c7a | 5882 | |
JMF | 12:0071cb144c7a | 5883 | int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx ) |
JMF | 12:0071cb144c7a | 5884 | { |
JMF | 12:0071cb144c7a | 5885 | int ret; |
JMF | 12:0071cb144c7a | 5886 | |
JMF | 12:0071cb144c7a | 5887 | if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 || |
JMF | 12:0071cb144c7a | 5888 | ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 ) |
JMF | 12:0071cb144c7a | 5889 | { |
JMF | 12:0071cb144c7a | 5890 | mbedtls_mpi_free( &conf->dhm_P ); |
JMF | 12:0071cb144c7a | 5891 | mbedtls_mpi_free( &conf->dhm_G ); |
JMF | 12:0071cb144c7a | 5892 | return( ret ); |
JMF | 12:0071cb144c7a | 5893 | } |
JMF | 12:0071cb144c7a | 5894 | |
JMF | 12:0071cb144c7a | 5895 | return( 0 ); |
JMF | 12:0071cb144c7a | 5896 | } |
JMF | 12:0071cb144c7a | 5897 | #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */ |
JMF | 12:0071cb144c7a | 5898 | |
JMF | 12:0071cb144c7a | 5899 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 5900 | /* |
JMF | 12:0071cb144c7a | 5901 | * Set the minimum length for Diffie-Hellman parameters |
JMF | 12:0071cb144c7a | 5902 | */ |
JMF | 12:0071cb144c7a | 5903 | void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5904 | unsigned int bitlen ) |
JMF | 12:0071cb144c7a | 5905 | { |
JMF | 12:0071cb144c7a | 5906 | conf->dhm_min_bitlen = bitlen; |
JMF | 12:0071cb144c7a | 5907 | } |
JMF | 12:0071cb144c7a | 5908 | #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */ |
JMF | 12:0071cb144c7a | 5909 | |
JMF | 12:0071cb144c7a | 5910 | #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) |
JMF | 12:0071cb144c7a | 5911 | /* |
JMF | 12:0071cb144c7a | 5912 | * Set allowed/preferred hashes for handshake signatures |
JMF | 12:0071cb144c7a | 5913 | */ |
JMF | 12:0071cb144c7a | 5914 | void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5915 | const int *hashes ) |
JMF | 12:0071cb144c7a | 5916 | { |
JMF | 12:0071cb144c7a | 5917 | conf->sig_hashes = hashes; |
JMF | 12:0071cb144c7a | 5918 | } |
JMF | 12:0071cb144c7a | 5919 | #endif |
JMF | 12:0071cb144c7a | 5920 | |
JMF | 12:0071cb144c7a | 5921 | #if defined(MBEDTLS_ECP_C) |
JMF | 12:0071cb144c7a | 5922 | /* |
JMF | 12:0071cb144c7a | 5923 | * Set the allowed elliptic curves |
JMF | 12:0071cb144c7a | 5924 | */ |
JMF | 12:0071cb144c7a | 5925 | void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5926 | const mbedtls_ecp_group_id *curve_list ) |
JMF | 12:0071cb144c7a | 5927 | { |
JMF | 12:0071cb144c7a | 5928 | conf->curve_list = curve_list; |
JMF | 12:0071cb144c7a | 5929 | } |
JMF | 12:0071cb144c7a | 5930 | #endif |
JMF | 12:0071cb144c7a | 5931 | |
JMF | 12:0071cb144c7a | 5932 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
JMF | 12:0071cb144c7a | 5933 | int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname ) |
JMF | 12:0071cb144c7a | 5934 | { |
JMF | 12:0071cb144c7a | 5935 | size_t hostname_len; |
JMF | 12:0071cb144c7a | 5936 | |
JMF | 12:0071cb144c7a | 5937 | if( hostname == NULL ) |
JMF | 12:0071cb144c7a | 5938 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 5939 | |
JMF | 12:0071cb144c7a | 5940 | hostname_len = strlen( hostname ); |
JMF | 12:0071cb144c7a | 5941 | |
JMF | 12:0071cb144c7a | 5942 | if( hostname_len + 1 == 0 ) |
JMF | 12:0071cb144c7a | 5943 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 5944 | |
JMF | 12:0071cb144c7a | 5945 | if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN ) |
JMF | 12:0071cb144c7a | 5946 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 5947 | |
JMF | 12:0071cb144c7a | 5948 | ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 ); |
JMF | 12:0071cb144c7a | 5949 | |
JMF | 12:0071cb144c7a | 5950 | if( ssl->hostname == NULL ) |
JMF | 12:0071cb144c7a | 5951 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
JMF | 12:0071cb144c7a | 5952 | |
JMF | 12:0071cb144c7a | 5953 | memcpy( ssl->hostname, hostname, hostname_len ); |
JMF | 12:0071cb144c7a | 5954 | |
JMF | 12:0071cb144c7a | 5955 | ssl->hostname[hostname_len] = '\0'; |
JMF | 12:0071cb144c7a | 5956 | |
JMF | 12:0071cb144c7a | 5957 | return( 0 ); |
JMF | 12:0071cb144c7a | 5958 | } |
JMF | 12:0071cb144c7a | 5959 | #endif |
JMF | 12:0071cb144c7a | 5960 | |
JMF | 12:0071cb144c7a | 5961 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
JMF | 12:0071cb144c7a | 5962 | void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 5963 | int (*f_sni)(void *, mbedtls_ssl_context *, |
JMF | 12:0071cb144c7a | 5964 | const unsigned char *, size_t), |
JMF | 12:0071cb144c7a | 5965 | void *p_sni ) |
JMF | 12:0071cb144c7a | 5966 | { |
JMF | 12:0071cb144c7a | 5967 | conf->f_sni = f_sni; |
JMF | 12:0071cb144c7a | 5968 | conf->p_sni = p_sni; |
JMF | 12:0071cb144c7a | 5969 | } |
JMF | 12:0071cb144c7a | 5970 | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
JMF | 12:0071cb144c7a | 5971 | |
JMF | 12:0071cb144c7a | 5972 | #if defined(MBEDTLS_SSL_ALPN) |
JMF | 12:0071cb144c7a | 5973 | int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos ) |
JMF | 12:0071cb144c7a | 5974 | { |
JMF | 12:0071cb144c7a | 5975 | size_t cur_len, tot_len; |
JMF | 12:0071cb144c7a | 5976 | const char **p; |
JMF | 12:0071cb144c7a | 5977 | |
JMF | 12:0071cb144c7a | 5978 | /* |
JMF | 12:0071cb144c7a | 5979 | * "Empty strings MUST NOT be included and byte strings MUST NOT be |
JMF | 12:0071cb144c7a | 5980 | * truncated". Check lengths now rather than later. |
JMF | 12:0071cb144c7a | 5981 | */ |
JMF | 12:0071cb144c7a | 5982 | tot_len = 0; |
JMF | 12:0071cb144c7a | 5983 | for( p = protos; *p != NULL; p++ ) |
JMF | 12:0071cb144c7a | 5984 | { |
JMF | 12:0071cb144c7a | 5985 | cur_len = strlen( *p ); |
JMF | 12:0071cb144c7a | 5986 | tot_len += cur_len; |
JMF | 12:0071cb144c7a | 5987 | |
JMF | 12:0071cb144c7a | 5988 | if( cur_len == 0 || cur_len > 255 || tot_len > 65535 ) |
JMF | 12:0071cb144c7a | 5989 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 5990 | } |
JMF | 12:0071cb144c7a | 5991 | |
JMF | 12:0071cb144c7a | 5992 | conf->alpn_list = protos; |
JMF | 12:0071cb144c7a | 5993 | |
JMF | 12:0071cb144c7a | 5994 | return( 0 ); |
JMF | 12:0071cb144c7a | 5995 | } |
JMF | 12:0071cb144c7a | 5996 | |
JMF | 12:0071cb144c7a | 5997 | const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 5998 | { |
JMF | 12:0071cb144c7a | 5999 | return( ssl->alpn_chosen ); |
JMF | 12:0071cb144c7a | 6000 | } |
JMF | 12:0071cb144c7a | 6001 | #endif /* MBEDTLS_SSL_ALPN */ |
JMF | 12:0071cb144c7a | 6002 | |
JMF | 12:0071cb144c7a | 6003 | void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor ) |
JMF | 12:0071cb144c7a | 6004 | { |
JMF | 12:0071cb144c7a | 6005 | conf->max_major_ver = major; |
JMF | 12:0071cb144c7a | 6006 | conf->max_minor_ver = minor; |
JMF | 12:0071cb144c7a | 6007 | } |
JMF | 12:0071cb144c7a | 6008 | |
JMF | 12:0071cb144c7a | 6009 | void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor ) |
JMF | 12:0071cb144c7a | 6010 | { |
JMF | 12:0071cb144c7a | 6011 | conf->min_major_ver = major; |
JMF | 12:0071cb144c7a | 6012 | conf->min_minor_ver = minor; |
JMF | 12:0071cb144c7a | 6013 | } |
JMF | 12:0071cb144c7a | 6014 | |
JMF | 12:0071cb144c7a | 6015 | #if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 6016 | void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback ) |
JMF | 12:0071cb144c7a | 6017 | { |
JMF | 12:0071cb144c7a | 6018 | conf->fallback = fallback; |
JMF | 12:0071cb144c7a | 6019 | } |
JMF | 12:0071cb144c7a | 6020 | #endif |
JMF | 12:0071cb144c7a | 6021 | |
JMF | 12:0071cb144c7a | 6022 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
JMF | 12:0071cb144c7a | 6023 | void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm ) |
JMF | 12:0071cb144c7a | 6024 | { |
JMF | 12:0071cb144c7a | 6025 | conf->encrypt_then_mac = etm; |
JMF | 12:0071cb144c7a | 6026 | } |
JMF | 12:0071cb144c7a | 6027 | #endif |
JMF | 12:0071cb144c7a | 6028 | |
JMF | 12:0071cb144c7a | 6029 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
JMF | 12:0071cb144c7a | 6030 | void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems ) |
JMF | 12:0071cb144c7a | 6031 | { |
JMF | 12:0071cb144c7a | 6032 | conf->extended_ms = ems; |
JMF | 12:0071cb144c7a | 6033 | } |
JMF | 12:0071cb144c7a | 6034 | #endif |
JMF | 12:0071cb144c7a | 6035 | |
JMF | 12:0071cb144c7a | 6036 | #if defined(MBEDTLS_ARC4_C) |
JMF | 12:0071cb144c7a | 6037 | void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 ) |
JMF | 12:0071cb144c7a | 6038 | { |
JMF | 12:0071cb144c7a | 6039 | conf->arc4_disabled = arc4; |
JMF | 12:0071cb144c7a | 6040 | } |
JMF | 12:0071cb144c7a | 6041 | #endif |
JMF | 12:0071cb144c7a | 6042 | |
JMF | 12:0071cb144c7a | 6043 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
JMF | 12:0071cb144c7a | 6044 | int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code ) |
JMF | 12:0071cb144c7a | 6045 | { |
JMF | 12:0071cb144c7a | 6046 | if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID || |
JMF | 12:0071cb144c7a | 6047 | mfl_code_to_length[mfl_code] > MBEDTLS_SSL_MAX_CONTENT_LEN ) |
JMF | 12:0071cb144c7a | 6048 | { |
JMF | 12:0071cb144c7a | 6049 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 6050 | } |
JMF | 12:0071cb144c7a | 6051 | |
JMF | 12:0071cb144c7a | 6052 | conf->mfl_code = mfl_code; |
JMF | 12:0071cb144c7a | 6053 | |
JMF | 12:0071cb144c7a | 6054 | return( 0 ); |
JMF | 12:0071cb144c7a | 6055 | } |
JMF | 12:0071cb144c7a | 6056 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
JMF | 12:0071cb144c7a | 6057 | |
JMF | 12:0071cb144c7a | 6058 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
JMF | 12:0071cb144c7a | 6059 | void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate ) |
JMF | 12:0071cb144c7a | 6060 | { |
JMF | 12:0071cb144c7a | 6061 | conf->trunc_hmac = truncate; |
JMF | 12:0071cb144c7a | 6062 | } |
JMF | 12:0071cb144c7a | 6063 | #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ |
JMF | 12:0071cb144c7a | 6064 | |
JMF | 12:0071cb144c7a | 6065 | #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) |
JMF | 12:0071cb144c7a | 6066 | void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split ) |
JMF | 12:0071cb144c7a | 6067 | { |
JMF | 12:0071cb144c7a | 6068 | conf->cbc_record_splitting = split; |
JMF | 12:0071cb144c7a | 6069 | } |
JMF | 12:0071cb144c7a | 6070 | #endif |
JMF | 12:0071cb144c7a | 6071 | |
JMF | 12:0071cb144c7a | 6072 | void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy ) |
JMF | 12:0071cb144c7a | 6073 | { |
JMF | 12:0071cb144c7a | 6074 | conf->allow_legacy_renegotiation = allow_legacy; |
JMF | 12:0071cb144c7a | 6075 | } |
JMF | 12:0071cb144c7a | 6076 | |
JMF | 12:0071cb144c7a | 6077 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 6078 | void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation ) |
JMF | 12:0071cb144c7a | 6079 | { |
JMF | 12:0071cb144c7a | 6080 | conf->disable_renegotiation = renegotiation; |
JMF | 12:0071cb144c7a | 6081 | } |
JMF | 12:0071cb144c7a | 6082 | |
JMF | 12:0071cb144c7a | 6083 | void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records ) |
JMF | 12:0071cb144c7a | 6084 | { |
JMF | 12:0071cb144c7a | 6085 | conf->renego_max_records = max_records; |
JMF | 12:0071cb144c7a | 6086 | } |
JMF | 12:0071cb144c7a | 6087 | |
JMF | 12:0071cb144c7a | 6088 | void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 6089 | const unsigned char period[8] ) |
JMF | 12:0071cb144c7a | 6090 | { |
JMF | 12:0071cb144c7a | 6091 | memcpy( conf->renego_period, period, 8 ); |
JMF | 12:0071cb144c7a | 6092 | } |
JMF | 12:0071cb144c7a | 6093 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
JMF | 12:0071cb144c7a | 6094 | |
JMF | 12:0071cb144c7a | 6095 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
JMF | 12:0071cb144c7a | 6096 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 6097 | void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets ) |
JMF | 12:0071cb144c7a | 6098 | { |
JMF | 12:0071cb144c7a | 6099 | conf->session_tickets = use_tickets; |
JMF | 12:0071cb144c7a | 6100 | } |
JMF | 12:0071cb144c7a | 6101 | #endif |
JMF | 12:0071cb144c7a | 6102 | |
JMF | 12:0071cb144c7a | 6103 | #if defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 6104 | void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 6105 | mbedtls_ssl_ticket_write_t *f_ticket_write, |
JMF | 12:0071cb144c7a | 6106 | mbedtls_ssl_ticket_parse_t *f_ticket_parse, |
JMF | 12:0071cb144c7a | 6107 | void *p_ticket ) |
JMF | 12:0071cb144c7a | 6108 | { |
JMF | 12:0071cb144c7a | 6109 | conf->f_ticket_write = f_ticket_write; |
JMF | 12:0071cb144c7a | 6110 | conf->f_ticket_parse = f_ticket_parse; |
JMF | 12:0071cb144c7a | 6111 | conf->p_ticket = p_ticket; |
JMF | 12:0071cb144c7a | 6112 | } |
JMF | 12:0071cb144c7a | 6113 | #endif |
JMF | 12:0071cb144c7a | 6114 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
JMF | 12:0071cb144c7a | 6115 | |
JMF | 12:0071cb144c7a | 6116 | #if defined(MBEDTLS_SSL_EXPORT_KEYS) |
JMF | 12:0071cb144c7a | 6117 | void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 6118 | mbedtls_ssl_export_keys_t *f_export_keys, |
JMF | 12:0071cb144c7a | 6119 | void *p_export_keys ) |
JMF | 12:0071cb144c7a | 6120 | { |
JMF | 12:0071cb144c7a | 6121 | conf->f_export_keys = f_export_keys; |
JMF | 12:0071cb144c7a | 6122 | conf->p_export_keys = p_export_keys; |
JMF | 12:0071cb144c7a | 6123 | } |
JMF | 12:0071cb144c7a | 6124 | #endif |
JMF | 12:0071cb144c7a | 6125 | |
JMF | 12:0071cb144c7a | 6126 | /* |
JMF | 12:0071cb144c7a | 6127 | * SSL get accessors |
JMF | 12:0071cb144c7a | 6128 | */ |
JMF | 12:0071cb144c7a | 6129 | size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6130 | { |
JMF | 12:0071cb144c7a | 6131 | return( ssl->in_offt == NULL ? 0 : ssl->in_msglen ); |
JMF | 12:0071cb144c7a | 6132 | } |
JMF | 12:0071cb144c7a | 6133 | |
JMF | 12:0071cb144c7a | 6134 | uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6135 | { |
JMF | 12:0071cb144c7a | 6136 | if( ssl->session != NULL ) |
JMF | 12:0071cb144c7a | 6137 | return( ssl->session->verify_result ); |
JMF | 12:0071cb144c7a | 6138 | |
JMF | 12:0071cb144c7a | 6139 | if( ssl->session_negotiate != NULL ) |
JMF | 12:0071cb144c7a | 6140 | return( ssl->session_negotiate->verify_result ); |
JMF | 12:0071cb144c7a | 6141 | |
JMF | 12:0071cb144c7a | 6142 | return( 0xFFFFFFFF ); |
JMF | 12:0071cb144c7a | 6143 | } |
JMF | 12:0071cb144c7a | 6144 | |
JMF | 12:0071cb144c7a | 6145 | const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6146 | { |
JMF | 12:0071cb144c7a | 6147 | if( ssl == NULL || ssl->session == NULL ) |
JMF | 12:0071cb144c7a | 6148 | return( NULL ); |
JMF | 12:0071cb144c7a | 6149 | |
JMF | 12:0071cb144c7a | 6150 | return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite ); |
JMF | 12:0071cb144c7a | 6151 | } |
JMF | 12:0071cb144c7a | 6152 | |
JMF | 12:0071cb144c7a | 6153 | const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6154 | { |
JMF | 12:0071cb144c7a | 6155 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 6156 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 6157 | { |
JMF | 12:0071cb144c7a | 6158 | switch( ssl->minor_ver ) |
JMF | 12:0071cb144c7a | 6159 | { |
JMF | 12:0071cb144c7a | 6160 | case MBEDTLS_SSL_MINOR_VERSION_2: |
JMF | 12:0071cb144c7a | 6161 | return( "DTLSv1.0" ); |
JMF | 12:0071cb144c7a | 6162 | |
JMF | 12:0071cb144c7a | 6163 | case MBEDTLS_SSL_MINOR_VERSION_3: |
JMF | 12:0071cb144c7a | 6164 | return( "DTLSv1.2" ); |
JMF | 12:0071cb144c7a | 6165 | |
JMF | 12:0071cb144c7a | 6166 | default: |
JMF | 12:0071cb144c7a | 6167 | return( "unknown (DTLS)" ); |
JMF | 12:0071cb144c7a | 6168 | } |
JMF | 12:0071cb144c7a | 6169 | } |
JMF | 12:0071cb144c7a | 6170 | #endif |
JMF | 12:0071cb144c7a | 6171 | |
JMF | 12:0071cb144c7a | 6172 | switch( ssl->minor_ver ) |
JMF | 12:0071cb144c7a | 6173 | { |
JMF | 12:0071cb144c7a | 6174 | case MBEDTLS_SSL_MINOR_VERSION_0: |
JMF | 12:0071cb144c7a | 6175 | return( "SSLv3.0" ); |
JMF | 12:0071cb144c7a | 6176 | |
JMF | 12:0071cb144c7a | 6177 | case MBEDTLS_SSL_MINOR_VERSION_1: |
JMF | 12:0071cb144c7a | 6178 | return( "TLSv1.0" ); |
JMF | 12:0071cb144c7a | 6179 | |
JMF | 12:0071cb144c7a | 6180 | case MBEDTLS_SSL_MINOR_VERSION_2: |
JMF | 12:0071cb144c7a | 6181 | return( "TLSv1.1" ); |
JMF | 12:0071cb144c7a | 6182 | |
JMF | 12:0071cb144c7a | 6183 | case MBEDTLS_SSL_MINOR_VERSION_3: |
JMF | 12:0071cb144c7a | 6184 | return( "TLSv1.2" ); |
JMF | 12:0071cb144c7a | 6185 | |
JMF | 12:0071cb144c7a | 6186 | default: |
JMF | 12:0071cb144c7a | 6187 | return( "unknown" ); |
JMF | 12:0071cb144c7a | 6188 | } |
JMF | 12:0071cb144c7a | 6189 | } |
JMF | 12:0071cb144c7a | 6190 | |
JMF | 12:0071cb144c7a | 6191 | int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6192 | { |
JMF | 12:0071cb144c7a | 6193 | size_t transform_expansion; |
JMF | 12:0071cb144c7a | 6194 | const mbedtls_ssl_transform *transform = ssl->transform_out; |
JMF | 12:0071cb144c7a | 6195 | |
JMF | 12:0071cb144c7a | 6196 | #if defined(MBEDTLS_ZLIB_SUPPORT) |
JMF | 12:0071cb144c7a | 6197 | if( ssl->session_out->compression != MBEDTLS_SSL_COMPRESS_NULL ) |
JMF | 12:0071cb144c7a | 6198 | return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); |
JMF | 12:0071cb144c7a | 6199 | #endif |
JMF | 12:0071cb144c7a | 6200 | |
JMF | 12:0071cb144c7a | 6201 | if( transform == NULL ) |
JMF | 12:0071cb144c7a | 6202 | return( (int) mbedtls_ssl_hdr_len( ssl ) ); |
JMF | 12:0071cb144c7a | 6203 | |
JMF | 12:0071cb144c7a | 6204 | switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) ) |
JMF | 12:0071cb144c7a | 6205 | { |
JMF | 12:0071cb144c7a | 6206 | case MBEDTLS_MODE_GCM: |
JMF | 12:0071cb144c7a | 6207 | case MBEDTLS_MODE_CCM: |
JMF | 12:0071cb144c7a | 6208 | case MBEDTLS_MODE_STREAM: |
JMF | 12:0071cb144c7a | 6209 | transform_expansion = transform->minlen; |
JMF | 12:0071cb144c7a | 6210 | break; |
JMF | 12:0071cb144c7a | 6211 | |
JMF | 12:0071cb144c7a | 6212 | case MBEDTLS_MODE_CBC: |
JMF | 12:0071cb144c7a | 6213 | transform_expansion = transform->maclen |
JMF | 12:0071cb144c7a | 6214 | + mbedtls_cipher_get_block_size( &transform->cipher_ctx_enc ); |
JMF | 12:0071cb144c7a | 6215 | break; |
JMF | 12:0071cb144c7a | 6216 | |
JMF | 12:0071cb144c7a | 6217 | default: |
JMF | 12:0071cb144c7a | 6218 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 6219 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 6220 | } |
JMF | 12:0071cb144c7a | 6221 | |
JMF | 12:0071cb144c7a | 6222 | return( (int)( mbedtls_ssl_hdr_len( ssl ) + transform_expansion ) ); |
JMF | 12:0071cb144c7a | 6223 | } |
JMF | 12:0071cb144c7a | 6224 | |
JMF | 12:0071cb144c7a | 6225 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
JMF | 12:0071cb144c7a | 6226 | size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6227 | { |
JMF | 12:0071cb144c7a | 6228 | size_t max_len; |
JMF | 12:0071cb144c7a | 6229 | |
JMF | 12:0071cb144c7a | 6230 | /* |
JMF | 12:0071cb144c7a | 6231 | * Assume mfl_code is correct since it was checked when set |
JMF | 12:0071cb144c7a | 6232 | */ |
JMF | 12:0071cb144c7a | 6233 | max_len = mfl_code_to_length[ssl->conf->mfl_code]; |
JMF | 12:0071cb144c7a | 6234 | |
JMF | 12:0071cb144c7a | 6235 | /* |
JMF | 12:0071cb144c7a | 6236 | * Check if a smaller max length was negotiated |
JMF | 12:0071cb144c7a | 6237 | */ |
JMF | 12:0071cb144c7a | 6238 | if( ssl->session_out != NULL && |
JMF | 12:0071cb144c7a | 6239 | mfl_code_to_length[ssl->session_out->mfl_code] < max_len ) |
JMF | 12:0071cb144c7a | 6240 | { |
JMF | 12:0071cb144c7a | 6241 | max_len = mfl_code_to_length[ssl->session_out->mfl_code]; |
JMF | 12:0071cb144c7a | 6242 | } |
JMF | 12:0071cb144c7a | 6243 | |
JMF | 12:0071cb144c7a | 6244 | return max_len; |
JMF | 12:0071cb144c7a | 6245 | } |
JMF | 12:0071cb144c7a | 6246 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
JMF | 12:0071cb144c7a | 6247 | |
JMF | 12:0071cb144c7a | 6248 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
JMF | 12:0071cb144c7a | 6249 | const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6250 | { |
JMF | 12:0071cb144c7a | 6251 | if( ssl == NULL || ssl->session == NULL ) |
JMF | 12:0071cb144c7a | 6252 | return( NULL ); |
JMF | 12:0071cb144c7a | 6253 | |
JMF | 12:0071cb144c7a | 6254 | return( ssl->session->peer_cert ); |
JMF | 12:0071cb144c7a | 6255 | } |
JMF | 12:0071cb144c7a | 6256 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
JMF | 12:0071cb144c7a | 6257 | |
JMF | 12:0071cb144c7a | 6258 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 6259 | int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl, mbedtls_ssl_session *dst ) |
JMF | 12:0071cb144c7a | 6260 | { |
JMF | 12:0071cb144c7a | 6261 | if( ssl == NULL || |
JMF | 12:0071cb144c7a | 6262 | dst == NULL || |
JMF | 12:0071cb144c7a | 6263 | ssl->session == NULL || |
JMF | 12:0071cb144c7a | 6264 | ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 6265 | { |
JMF | 12:0071cb144c7a | 6266 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 6267 | } |
JMF | 12:0071cb144c7a | 6268 | |
JMF | 12:0071cb144c7a | 6269 | return( ssl_session_copy( dst, ssl->session ) ); |
JMF | 12:0071cb144c7a | 6270 | } |
JMF | 12:0071cb144c7a | 6271 | #endif /* MBEDTLS_SSL_CLI_C */ |
JMF | 12:0071cb144c7a | 6272 | |
JMF | 12:0071cb144c7a | 6273 | /* |
JMF | 12:0071cb144c7a | 6274 | * Perform a single step of the SSL handshake |
JMF | 12:0071cb144c7a | 6275 | */ |
JMF | 12:0071cb144c7a | 6276 | int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6277 | { |
JMF | 12:0071cb144c7a | 6278 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
JMF | 12:0071cb144c7a | 6279 | |
JMF | 12:0071cb144c7a | 6280 | if( ssl == NULL || ssl->conf == NULL ) |
JMF | 12:0071cb144c7a | 6281 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 6282 | |
JMF | 12:0071cb144c7a | 6283 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 6284 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 6285 | ret = mbedtls_ssl_handshake_client_step( ssl ); |
JMF | 12:0071cb144c7a | 6286 | #endif |
JMF | 12:0071cb144c7a | 6287 | #if defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 6288 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) |
JMF | 12:0071cb144c7a | 6289 | ret = mbedtls_ssl_handshake_server_step( ssl ); |
JMF | 12:0071cb144c7a | 6290 | #endif |
JMF | 12:0071cb144c7a | 6291 | |
JMF | 12:0071cb144c7a | 6292 | return( ret ); |
JMF | 12:0071cb144c7a | 6293 | } |
JMF | 12:0071cb144c7a | 6294 | |
JMF | 12:0071cb144c7a | 6295 | /* |
JMF | 12:0071cb144c7a | 6296 | * Perform the SSL handshake |
JMF | 12:0071cb144c7a | 6297 | */ |
JMF | 12:0071cb144c7a | 6298 | int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6299 | { |
JMF | 12:0071cb144c7a | 6300 | int ret = 0; |
JMF | 12:0071cb144c7a | 6301 | |
JMF | 12:0071cb144c7a | 6302 | if( ssl == NULL || ssl->conf == NULL ) |
JMF | 12:0071cb144c7a | 6303 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 6304 | |
JMF | 12:0071cb144c7a | 6305 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) ); |
JMF | 12:0071cb144c7a | 6306 | |
JMF | 12:0071cb144c7a | 6307 | while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ) |
JMF | 12:0071cb144c7a | 6308 | { |
JMF | 12:0071cb144c7a | 6309 | ret = mbedtls_ssl_handshake_step( ssl ); |
JMF | 12:0071cb144c7a | 6310 | |
JMF | 12:0071cb144c7a | 6311 | if( ret != 0 ) |
JMF | 12:0071cb144c7a | 6312 | break; |
JMF | 12:0071cb144c7a | 6313 | } |
JMF | 12:0071cb144c7a | 6314 | |
JMF | 12:0071cb144c7a | 6315 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) ); |
JMF | 12:0071cb144c7a | 6316 | |
JMF | 12:0071cb144c7a | 6317 | return( ret ); |
JMF | 12:0071cb144c7a | 6318 | } |
JMF | 12:0071cb144c7a | 6319 | |
JMF | 12:0071cb144c7a | 6320 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 6321 | #if defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 6322 | /* |
JMF | 12:0071cb144c7a | 6323 | * Write HelloRequest to request renegotiation on server |
JMF | 12:0071cb144c7a | 6324 | */ |
JMF | 12:0071cb144c7a | 6325 | static int ssl_write_hello_request( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6326 | { |
JMF | 12:0071cb144c7a | 6327 | int ret; |
JMF | 12:0071cb144c7a | 6328 | |
JMF | 12:0071cb144c7a | 6329 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) ); |
JMF | 12:0071cb144c7a | 6330 | |
JMF | 12:0071cb144c7a | 6331 | ssl->out_msglen = 4; |
JMF | 12:0071cb144c7a | 6332 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
JMF | 12:0071cb144c7a | 6333 | ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST; |
JMF | 12:0071cb144c7a | 6334 | |
JMF | 12:0071cb144c7a | 6335 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6336 | { |
JMF | 12:0071cb144c7a | 6337 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
JMF | 12:0071cb144c7a | 6338 | return( ret ); |
JMF | 12:0071cb144c7a | 6339 | } |
JMF | 12:0071cb144c7a | 6340 | |
JMF | 12:0071cb144c7a | 6341 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) ); |
JMF | 12:0071cb144c7a | 6342 | |
JMF | 12:0071cb144c7a | 6343 | return( 0 ); |
JMF | 12:0071cb144c7a | 6344 | } |
JMF | 12:0071cb144c7a | 6345 | #endif /* MBEDTLS_SSL_SRV_C */ |
JMF | 12:0071cb144c7a | 6346 | |
JMF | 12:0071cb144c7a | 6347 | /* |
JMF | 12:0071cb144c7a | 6348 | * Actually renegotiate current connection, triggered by either: |
JMF | 12:0071cb144c7a | 6349 | * - any side: calling mbedtls_ssl_renegotiate(), |
JMF | 12:0071cb144c7a | 6350 | * - client: receiving a HelloRequest during mbedtls_ssl_read(), |
JMF | 12:0071cb144c7a | 6351 | * - server: receiving any handshake message on server during mbedtls_ssl_read() after |
JMF | 12:0071cb144c7a | 6352 | * the initial handshake is completed. |
JMF | 12:0071cb144c7a | 6353 | * If the handshake doesn't complete due to waiting for I/O, it will continue |
JMF | 12:0071cb144c7a | 6354 | * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively. |
JMF | 12:0071cb144c7a | 6355 | */ |
JMF | 12:0071cb144c7a | 6356 | static int ssl_start_renegotiation( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6357 | { |
JMF | 12:0071cb144c7a | 6358 | int ret; |
JMF | 12:0071cb144c7a | 6359 | |
JMF | 12:0071cb144c7a | 6360 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) ); |
JMF | 12:0071cb144c7a | 6361 | |
JMF | 12:0071cb144c7a | 6362 | if( ( ret = ssl_handshake_init( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6363 | return( ret ); |
JMF | 12:0071cb144c7a | 6364 | |
JMF | 12:0071cb144c7a | 6365 | /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and |
JMF | 12:0071cb144c7a | 6366 | * the ServerHello will have message_seq = 1" */ |
JMF | 12:0071cb144c7a | 6367 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 6368 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
JMF | 12:0071cb144c7a | 6369 | ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ) |
JMF | 12:0071cb144c7a | 6370 | { |
JMF | 12:0071cb144c7a | 6371 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) |
JMF | 12:0071cb144c7a | 6372 | ssl->handshake->out_msg_seq = 1; |
JMF | 12:0071cb144c7a | 6373 | else |
JMF | 12:0071cb144c7a | 6374 | ssl->handshake->in_msg_seq = 1; |
JMF | 12:0071cb144c7a | 6375 | } |
JMF | 12:0071cb144c7a | 6376 | #endif |
JMF | 12:0071cb144c7a | 6377 | |
JMF | 12:0071cb144c7a | 6378 | ssl->state = MBEDTLS_SSL_HELLO_REQUEST; |
JMF | 12:0071cb144c7a | 6379 | ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS; |
JMF | 12:0071cb144c7a | 6380 | |
JMF | 12:0071cb144c7a | 6381 | if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6382 | { |
JMF | 12:0071cb144c7a | 6383 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret ); |
JMF | 12:0071cb144c7a | 6384 | return( ret ); |
JMF | 12:0071cb144c7a | 6385 | } |
JMF | 12:0071cb144c7a | 6386 | |
JMF | 12:0071cb144c7a | 6387 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) ); |
JMF | 12:0071cb144c7a | 6388 | |
JMF | 12:0071cb144c7a | 6389 | return( 0 ); |
JMF | 12:0071cb144c7a | 6390 | } |
JMF | 12:0071cb144c7a | 6391 | |
JMF | 12:0071cb144c7a | 6392 | /* |
JMF | 12:0071cb144c7a | 6393 | * Renegotiate current connection on client, |
JMF | 12:0071cb144c7a | 6394 | * or request renegotiation on server |
JMF | 12:0071cb144c7a | 6395 | */ |
JMF | 12:0071cb144c7a | 6396 | int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6397 | { |
JMF | 12:0071cb144c7a | 6398 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
JMF | 12:0071cb144c7a | 6399 | |
JMF | 12:0071cb144c7a | 6400 | if( ssl == NULL || ssl->conf == NULL ) |
JMF | 12:0071cb144c7a | 6401 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 6402 | |
JMF | 12:0071cb144c7a | 6403 | #if defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 6404 | /* On server, just send the request */ |
JMF | 12:0071cb144c7a | 6405 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER ) |
JMF | 12:0071cb144c7a | 6406 | { |
JMF | 12:0071cb144c7a | 6407 | if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ) |
JMF | 12:0071cb144c7a | 6408 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 6409 | |
JMF | 12:0071cb144c7a | 6410 | ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING; |
JMF | 12:0071cb144c7a | 6411 | |
JMF | 12:0071cb144c7a | 6412 | /* Did we already try/start sending HelloRequest? */ |
JMF | 12:0071cb144c7a | 6413 | if( ssl->out_left != 0 ) |
JMF | 12:0071cb144c7a | 6414 | return( mbedtls_ssl_flush_output( ssl ) ); |
JMF | 12:0071cb144c7a | 6415 | |
JMF | 12:0071cb144c7a | 6416 | return( ssl_write_hello_request( ssl ) ); |
JMF | 12:0071cb144c7a | 6417 | } |
JMF | 12:0071cb144c7a | 6418 | #endif /* MBEDTLS_SSL_SRV_C */ |
JMF | 12:0071cb144c7a | 6419 | |
JMF | 12:0071cb144c7a | 6420 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 6421 | /* |
JMF | 12:0071cb144c7a | 6422 | * On client, either start the renegotiation process or, |
JMF | 12:0071cb144c7a | 6423 | * if already in progress, continue the handshake |
JMF | 12:0071cb144c7a | 6424 | */ |
JMF | 12:0071cb144c7a | 6425 | if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
JMF | 12:0071cb144c7a | 6426 | { |
JMF | 12:0071cb144c7a | 6427 | if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ) |
JMF | 12:0071cb144c7a | 6428 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 6429 | |
JMF | 12:0071cb144c7a | 6430 | if( ( ret = ssl_start_renegotiation( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6431 | { |
JMF | 12:0071cb144c7a | 6432 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret ); |
JMF | 12:0071cb144c7a | 6433 | return( ret ); |
JMF | 12:0071cb144c7a | 6434 | } |
JMF | 12:0071cb144c7a | 6435 | } |
JMF | 12:0071cb144c7a | 6436 | else |
JMF | 12:0071cb144c7a | 6437 | { |
JMF | 12:0071cb144c7a | 6438 | if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6439 | { |
JMF | 12:0071cb144c7a | 6440 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret ); |
JMF | 12:0071cb144c7a | 6441 | return( ret ); |
JMF | 12:0071cb144c7a | 6442 | } |
JMF | 12:0071cb144c7a | 6443 | } |
JMF | 12:0071cb144c7a | 6444 | #endif /* MBEDTLS_SSL_CLI_C */ |
JMF | 12:0071cb144c7a | 6445 | |
JMF | 12:0071cb144c7a | 6446 | return( ret ); |
JMF | 12:0071cb144c7a | 6447 | } |
JMF | 12:0071cb144c7a | 6448 | |
JMF | 12:0071cb144c7a | 6449 | /* |
JMF | 12:0071cb144c7a | 6450 | * Check record counters and renegotiate if they're above the limit. |
JMF | 12:0071cb144c7a | 6451 | */ |
JMF | 12:0071cb144c7a | 6452 | static int ssl_check_ctr_renegotiate( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6453 | { |
JMF | 12:0071cb144c7a | 6454 | if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER || |
JMF | 12:0071cb144c7a | 6455 | ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING || |
JMF | 12:0071cb144c7a | 6456 | ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ) |
JMF | 12:0071cb144c7a | 6457 | { |
JMF | 12:0071cb144c7a | 6458 | return( 0 ); |
JMF | 12:0071cb144c7a | 6459 | } |
JMF | 12:0071cb144c7a | 6460 | |
JMF | 12:0071cb144c7a | 6461 | if( memcmp( ssl->in_ctr, ssl->conf->renego_period, 8 ) <= 0 && |
JMF | 12:0071cb144c7a | 6462 | memcmp( ssl->out_ctr, ssl->conf->renego_period, 8 ) <= 0 ) |
JMF | 12:0071cb144c7a | 6463 | { |
JMF | 12:0071cb144c7a | 6464 | return( 0 ); |
JMF | 12:0071cb144c7a | 6465 | } |
JMF | 12:0071cb144c7a | 6466 | |
JMF | 12:0071cb144c7a | 6467 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) ); |
JMF | 12:0071cb144c7a | 6468 | return( mbedtls_ssl_renegotiate( ssl ) ); |
JMF | 12:0071cb144c7a | 6469 | } |
JMF | 12:0071cb144c7a | 6470 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
JMF | 12:0071cb144c7a | 6471 | |
JMF | 12:0071cb144c7a | 6472 | /* |
JMF | 12:0071cb144c7a | 6473 | * Receive application data decrypted from the SSL layer |
JMF | 12:0071cb144c7a | 6474 | */ |
JMF | 12:0071cb144c7a | 6475 | int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len ) |
JMF | 12:0071cb144c7a | 6476 | { |
JMF | 12:0071cb144c7a | 6477 | int ret, record_read = 0; |
JMF | 12:0071cb144c7a | 6478 | size_t n; |
JMF | 12:0071cb144c7a | 6479 | |
JMF | 12:0071cb144c7a | 6480 | if( ssl == NULL || ssl->conf == NULL ) |
JMF | 12:0071cb144c7a | 6481 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 6482 | |
JMF | 12:0071cb144c7a | 6483 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) ); |
JMF | 12:0071cb144c7a | 6484 | |
JMF | 12:0071cb144c7a | 6485 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 6486 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 6487 | { |
JMF | 12:0071cb144c7a | 6488 | if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6489 | return( ret ); |
JMF | 12:0071cb144c7a | 6490 | |
JMF | 12:0071cb144c7a | 6491 | if( ssl->handshake != NULL && |
JMF | 12:0071cb144c7a | 6492 | ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING ) |
JMF | 12:0071cb144c7a | 6493 | { |
JMF | 12:0071cb144c7a | 6494 | if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6495 | return( ret ); |
JMF | 12:0071cb144c7a | 6496 | } |
JMF | 12:0071cb144c7a | 6497 | } |
JMF | 12:0071cb144c7a | 6498 | #endif |
JMF | 12:0071cb144c7a | 6499 | |
JMF | 12:0071cb144c7a | 6500 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 6501 | if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6502 | { |
JMF | 12:0071cb144c7a | 6503 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret ); |
JMF | 12:0071cb144c7a | 6504 | return( ret ); |
JMF | 12:0071cb144c7a | 6505 | } |
JMF | 12:0071cb144c7a | 6506 | #endif |
JMF | 12:0071cb144c7a | 6507 | |
JMF | 12:0071cb144c7a | 6508 | if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ) |
JMF | 12:0071cb144c7a | 6509 | { |
JMF | 12:0071cb144c7a | 6510 | ret = mbedtls_ssl_handshake( ssl ); |
JMF | 12:0071cb144c7a | 6511 | if( ret == MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO ) |
JMF | 12:0071cb144c7a | 6512 | { |
JMF | 12:0071cb144c7a | 6513 | record_read = 1; |
JMF | 12:0071cb144c7a | 6514 | } |
JMF | 12:0071cb144c7a | 6515 | else if( ret != 0 ) |
JMF | 12:0071cb144c7a | 6516 | { |
JMF | 12:0071cb144c7a | 6517 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret ); |
JMF | 12:0071cb144c7a | 6518 | return( ret ); |
JMF | 12:0071cb144c7a | 6519 | } |
JMF | 12:0071cb144c7a | 6520 | } |
JMF | 12:0071cb144c7a | 6521 | |
JMF | 12:0071cb144c7a | 6522 | if( ssl->in_offt == NULL ) |
JMF | 12:0071cb144c7a | 6523 | { |
JMF | 12:0071cb144c7a | 6524 | /* Start timer if not already running */ |
JMF | 12:0071cb144c7a | 6525 | if( ssl->f_get_timer != NULL && |
JMF | 12:0071cb144c7a | 6526 | ssl->f_get_timer( ssl->p_timer ) == -1 ) |
JMF | 12:0071cb144c7a | 6527 | { |
JMF | 12:0071cb144c7a | 6528 | ssl_set_timer( ssl, ssl->conf->read_timeout ); |
JMF | 12:0071cb144c7a | 6529 | } |
JMF | 12:0071cb144c7a | 6530 | |
JMF | 12:0071cb144c7a | 6531 | if( ! record_read ) |
JMF | 12:0071cb144c7a | 6532 | { |
JMF | 12:0071cb144c7a | 6533 | if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6534 | { |
JMF | 12:0071cb144c7a | 6535 | if( ret == MBEDTLS_ERR_SSL_CONN_EOF ) |
JMF | 12:0071cb144c7a | 6536 | return( 0 ); |
JMF | 12:0071cb144c7a | 6537 | |
JMF | 12:0071cb144c7a | 6538 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); |
JMF | 12:0071cb144c7a | 6539 | return( ret ); |
JMF | 12:0071cb144c7a | 6540 | } |
JMF | 12:0071cb144c7a | 6541 | } |
JMF | 12:0071cb144c7a | 6542 | |
JMF | 12:0071cb144c7a | 6543 | if( ssl->in_msglen == 0 && |
JMF | 12:0071cb144c7a | 6544 | ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA ) |
JMF | 12:0071cb144c7a | 6545 | { |
JMF | 12:0071cb144c7a | 6546 | /* |
JMF | 12:0071cb144c7a | 6547 | * OpenSSL sends empty messages to randomize the IV |
JMF | 12:0071cb144c7a | 6548 | */ |
JMF | 12:0071cb144c7a | 6549 | if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6550 | { |
JMF | 12:0071cb144c7a | 6551 | if( ret == MBEDTLS_ERR_SSL_CONN_EOF ) |
JMF | 12:0071cb144c7a | 6552 | return( 0 ); |
JMF | 12:0071cb144c7a | 6553 | |
JMF | 12:0071cb144c7a | 6554 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); |
JMF | 12:0071cb144c7a | 6555 | return( ret ); |
JMF | 12:0071cb144c7a | 6556 | } |
JMF | 12:0071cb144c7a | 6557 | } |
JMF | 12:0071cb144c7a | 6558 | |
JMF | 12:0071cb144c7a | 6559 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 6560 | if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) |
JMF | 12:0071cb144c7a | 6561 | { |
JMF | 12:0071cb144c7a | 6562 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "received handshake message" ) ); |
JMF | 12:0071cb144c7a | 6563 | |
JMF | 12:0071cb144c7a | 6564 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 6565 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT && |
JMF | 12:0071cb144c7a | 6566 | ( ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST || |
JMF | 12:0071cb144c7a | 6567 | ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ) ) |
JMF | 12:0071cb144c7a | 6568 | { |
JMF | 12:0071cb144c7a | 6569 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) ); |
JMF | 12:0071cb144c7a | 6570 | |
JMF | 12:0071cb144c7a | 6571 | /* With DTLS, drop the packet (probably from last handshake) */ |
JMF | 12:0071cb144c7a | 6572 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 6573 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 6574 | return( MBEDTLS_ERR_SSL_WANT_READ ); |
JMF | 12:0071cb144c7a | 6575 | #endif |
JMF | 12:0071cb144c7a | 6576 | return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); |
JMF | 12:0071cb144c7a | 6577 | } |
JMF | 12:0071cb144c7a | 6578 | |
JMF | 12:0071cb144c7a | 6579 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && |
JMF | 12:0071cb144c7a | 6580 | ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO ) |
JMF | 12:0071cb144c7a | 6581 | { |
JMF | 12:0071cb144c7a | 6582 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) ); |
JMF | 12:0071cb144c7a | 6583 | |
JMF | 12:0071cb144c7a | 6584 | /* With DTLS, drop the packet (probably from last handshake) */ |
JMF | 12:0071cb144c7a | 6585 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 6586 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 6587 | return( MBEDTLS_ERR_SSL_WANT_READ ); |
JMF | 12:0071cb144c7a | 6588 | #endif |
JMF | 12:0071cb144c7a | 6589 | return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); |
JMF | 12:0071cb144c7a | 6590 | } |
JMF | 12:0071cb144c7a | 6591 | #endif |
JMF | 12:0071cb144c7a | 6592 | |
JMF | 12:0071cb144c7a | 6593 | if( ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED || |
JMF | 12:0071cb144c7a | 6594 | ( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && |
JMF | 12:0071cb144c7a | 6595 | ssl->conf->allow_legacy_renegotiation == |
JMF | 12:0071cb144c7a | 6596 | MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) ) |
JMF | 12:0071cb144c7a | 6597 | { |
JMF | 12:0071cb144c7a | 6598 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) ); |
JMF | 12:0071cb144c7a | 6599 | |
JMF | 12:0071cb144c7a | 6600 | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
JMF | 12:0071cb144c7a | 6601 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
JMF | 12:0071cb144c7a | 6602 | { |
JMF | 12:0071cb144c7a | 6603 | /* |
JMF | 12:0071cb144c7a | 6604 | * SSLv3 does not have a "no_renegotiation" alert |
JMF | 12:0071cb144c7a | 6605 | */ |
JMF | 12:0071cb144c7a | 6606 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6607 | return( ret ); |
JMF | 12:0071cb144c7a | 6608 | } |
JMF | 12:0071cb144c7a | 6609 | else |
JMF | 12:0071cb144c7a | 6610 | #endif /* MBEDTLS_SSL_PROTO_SSL3 */ |
JMF | 12:0071cb144c7a | 6611 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
JMF | 12:0071cb144c7a | 6612 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 6613 | if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 ) |
JMF | 12:0071cb144c7a | 6614 | { |
JMF | 12:0071cb144c7a | 6615 | if( ( ret = mbedtls_ssl_send_alert_message( ssl, |
JMF | 12:0071cb144c7a | 6616 | MBEDTLS_SSL_ALERT_LEVEL_WARNING, |
JMF | 12:0071cb144c7a | 6617 | MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6618 | { |
JMF | 12:0071cb144c7a | 6619 | return( ret ); |
JMF | 12:0071cb144c7a | 6620 | } |
JMF | 12:0071cb144c7a | 6621 | } |
JMF | 12:0071cb144c7a | 6622 | else |
JMF | 12:0071cb144c7a | 6623 | #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || |
JMF | 12:0071cb144c7a | 6624 | MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 6625 | { |
JMF | 12:0071cb144c7a | 6626 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
JMF | 12:0071cb144c7a | 6627 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
JMF | 12:0071cb144c7a | 6628 | } |
JMF | 12:0071cb144c7a | 6629 | } |
JMF | 12:0071cb144c7a | 6630 | else |
JMF | 12:0071cb144c7a | 6631 | { |
JMF | 12:0071cb144c7a | 6632 | /* DTLS clients need to know renego is server-initiated */ |
JMF | 12:0071cb144c7a | 6633 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 6634 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
JMF | 12:0071cb144c7a | 6635 | ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 6636 | { |
JMF | 12:0071cb144c7a | 6637 | ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING; |
JMF | 12:0071cb144c7a | 6638 | } |
JMF | 12:0071cb144c7a | 6639 | #endif |
JMF | 12:0071cb144c7a | 6640 | ret = ssl_start_renegotiation( ssl ); |
JMF | 12:0071cb144c7a | 6641 | if( ret == MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO ) |
JMF | 12:0071cb144c7a | 6642 | { |
JMF | 12:0071cb144c7a | 6643 | record_read = 1; |
JMF | 12:0071cb144c7a | 6644 | } |
JMF | 12:0071cb144c7a | 6645 | else if( ret != 0 ) |
JMF | 12:0071cb144c7a | 6646 | { |
JMF | 12:0071cb144c7a | 6647 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret ); |
JMF | 12:0071cb144c7a | 6648 | return( ret ); |
JMF | 12:0071cb144c7a | 6649 | } |
JMF | 12:0071cb144c7a | 6650 | } |
JMF | 12:0071cb144c7a | 6651 | |
JMF | 12:0071cb144c7a | 6652 | /* If a non-handshake record was read during renego, fallthrough, |
JMF | 12:0071cb144c7a | 6653 | * else tell the user they should call mbedtls_ssl_read() again */ |
JMF | 12:0071cb144c7a | 6654 | if( ! record_read ) |
JMF | 12:0071cb144c7a | 6655 | return( MBEDTLS_ERR_SSL_WANT_READ ); |
JMF | 12:0071cb144c7a | 6656 | } |
JMF | 12:0071cb144c7a | 6657 | else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ) |
JMF | 12:0071cb144c7a | 6658 | { |
JMF | 12:0071cb144c7a | 6659 | |
JMF | 12:0071cb144c7a | 6660 | if( ssl->conf->renego_max_records >= 0 ) |
JMF | 12:0071cb144c7a | 6661 | { |
JMF | 12:0071cb144c7a | 6662 | if( ++ssl->renego_records_seen > ssl->conf->renego_max_records ) |
JMF | 12:0071cb144c7a | 6663 | { |
JMF | 12:0071cb144c7a | 6664 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, " |
JMF | 12:0071cb144c7a | 6665 | "but not honored by client" ) ); |
JMF | 12:0071cb144c7a | 6666 | return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); |
JMF | 12:0071cb144c7a | 6667 | } |
JMF | 12:0071cb144c7a | 6668 | } |
JMF | 12:0071cb144c7a | 6669 | } |
JMF | 12:0071cb144c7a | 6670 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
JMF | 12:0071cb144c7a | 6671 | |
JMF | 12:0071cb144c7a | 6672 | /* Fatal and closure alerts handled by mbedtls_ssl_read_record() */ |
JMF | 12:0071cb144c7a | 6673 | if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT ) |
JMF | 12:0071cb144c7a | 6674 | { |
JMF | 12:0071cb144c7a | 6675 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) ); |
JMF | 12:0071cb144c7a | 6676 | return( MBEDTLS_ERR_SSL_WANT_READ ); |
JMF | 12:0071cb144c7a | 6677 | } |
JMF | 12:0071cb144c7a | 6678 | |
JMF | 12:0071cb144c7a | 6679 | if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA ) |
JMF | 12:0071cb144c7a | 6680 | { |
JMF | 12:0071cb144c7a | 6681 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) ); |
JMF | 12:0071cb144c7a | 6682 | return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); |
JMF | 12:0071cb144c7a | 6683 | } |
JMF | 12:0071cb144c7a | 6684 | |
JMF | 12:0071cb144c7a | 6685 | ssl->in_offt = ssl->in_msg; |
JMF | 12:0071cb144c7a | 6686 | |
JMF | 12:0071cb144c7a | 6687 | /* We're going to return something now, cancel timer, |
JMF | 12:0071cb144c7a | 6688 | * except if handshake (renegotiation) is in progress */ |
JMF | 12:0071cb144c7a | 6689 | if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER ) |
JMF | 12:0071cb144c7a | 6690 | ssl_set_timer( ssl, 0 ); |
JMF | 12:0071cb144c7a | 6691 | |
JMF | 12:0071cb144c7a | 6692 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 6693 | /* If we requested renego but received AppData, resend HelloRequest. |
JMF | 12:0071cb144c7a | 6694 | * Do it now, after setting in_offt, to avoid taking this branch |
JMF | 12:0071cb144c7a | 6695 | * again if ssl_write_hello_request() returns WANT_WRITE */ |
JMF | 12:0071cb144c7a | 6696 | #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 6697 | if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER && |
JMF | 12:0071cb144c7a | 6698 | ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ) |
JMF | 12:0071cb144c7a | 6699 | { |
JMF | 12:0071cb144c7a | 6700 | if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6701 | { |
JMF | 12:0071cb144c7a | 6702 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret ); |
JMF | 12:0071cb144c7a | 6703 | return( ret ); |
JMF | 12:0071cb144c7a | 6704 | } |
JMF | 12:0071cb144c7a | 6705 | } |
JMF | 12:0071cb144c7a | 6706 | #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */ |
JMF | 12:0071cb144c7a | 6707 | #endif |
JMF | 12:0071cb144c7a | 6708 | } |
JMF | 12:0071cb144c7a | 6709 | |
JMF | 12:0071cb144c7a | 6710 | n = ( len < ssl->in_msglen ) |
JMF | 12:0071cb144c7a | 6711 | ? len : ssl->in_msglen; |
JMF | 12:0071cb144c7a | 6712 | |
JMF | 12:0071cb144c7a | 6713 | memcpy( buf, ssl->in_offt, n ); |
JMF | 12:0071cb144c7a | 6714 | ssl->in_msglen -= n; |
JMF | 12:0071cb144c7a | 6715 | |
JMF | 12:0071cb144c7a | 6716 | if( ssl->in_msglen == 0 ) |
JMF | 12:0071cb144c7a | 6717 | /* all bytes consumed */ |
JMF | 12:0071cb144c7a | 6718 | ssl->in_offt = NULL; |
JMF | 12:0071cb144c7a | 6719 | else |
JMF | 12:0071cb144c7a | 6720 | /* more data available */ |
JMF | 12:0071cb144c7a | 6721 | ssl->in_offt += n; |
JMF | 12:0071cb144c7a | 6722 | |
JMF | 12:0071cb144c7a | 6723 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) ); |
JMF | 12:0071cb144c7a | 6724 | |
JMF | 12:0071cb144c7a | 6725 | return( (int) n ); |
JMF | 12:0071cb144c7a | 6726 | } |
JMF | 12:0071cb144c7a | 6727 | |
JMF | 12:0071cb144c7a | 6728 | /* |
JMF | 12:0071cb144c7a | 6729 | * Send application data to be encrypted by the SSL layer, |
JMF | 12:0071cb144c7a | 6730 | * taking care of max fragment length and buffer size |
JMF | 12:0071cb144c7a | 6731 | */ |
JMF | 12:0071cb144c7a | 6732 | static int ssl_write_real( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 6733 | const unsigned char *buf, size_t len ) |
JMF | 12:0071cb144c7a | 6734 | { |
JMF | 12:0071cb144c7a | 6735 | int ret; |
JMF | 12:0071cb144c7a | 6736 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
JMF | 12:0071cb144c7a | 6737 | size_t max_len = mbedtls_ssl_get_max_frag_len( ssl ); |
JMF | 12:0071cb144c7a | 6738 | |
JMF | 12:0071cb144c7a | 6739 | if( len > max_len ) |
JMF | 12:0071cb144c7a | 6740 | { |
JMF | 12:0071cb144c7a | 6741 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 6742 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 6743 | { |
JMF | 12:0071cb144c7a | 6744 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) " |
JMF | 12:0071cb144c7a | 6745 | "maximum fragment length: %d > %d", |
JMF | 12:0071cb144c7a | 6746 | len, max_len ) ); |
JMF | 12:0071cb144c7a | 6747 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 6748 | } |
JMF | 12:0071cb144c7a | 6749 | else |
JMF | 12:0071cb144c7a | 6750 | #endif |
JMF | 12:0071cb144c7a | 6751 | len = max_len; |
JMF | 12:0071cb144c7a | 6752 | } |
JMF | 12:0071cb144c7a | 6753 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
JMF | 12:0071cb144c7a | 6754 | |
JMF | 12:0071cb144c7a | 6755 | if( ssl->out_left != 0 ) |
JMF | 12:0071cb144c7a | 6756 | { |
JMF | 12:0071cb144c7a | 6757 | if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6758 | { |
JMF | 12:0071cb144c7a | 6759 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret ); |
JMF | 12:0071cb144c7a | 6760 | return( ret ); |
JMF | 12:0071cb144c7a | 6761 | } |
JMF | 12:0071cb144c7a | 6762 | } |
JMF | 12:0071cb144c7a | 6763 | else |
JMF | 12:0071cb144c7a | 6764 | { |
JMF | 12:0071cb144c7a | 6765 | ssl->out_msglen = len; |
JMF | 12:0071cb144c7a | 6766 | ssl->out_msgtype = MBEDTLS_SSL_MSG_APPLICATION_DATA; |
JMF | 12:0071cb144c7a | 6767 | memcpy( ssl->out_msg, buf, len ); |
JMF | 12:0071cb144c7a | 6768 | |
JMF | 12:0071cb144c7a | 6769 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6770 | { |
JMF | 12:0071cb144c7a | 6771 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
JMF | 12:0071cb144c7a | 6772 | return( ret ); |
JMF | 12:0071cb144c7a | 6773 | } |
JMF | 12:0071cb144c7a | 6774 | } |
JMF | 12:0071cb144c7a | 6775 | |
JMF | 12:0071cb144c7a | 6776 | return( (int) len ); |
JMF | 12:0071cb144c7a | 6777 | } |
JMF | 12:0071cb144c7a | 6778 | |
JMF | 12:0071cb144c7a | 6779 | /* |
JMF | 12:0071cb144c7a | 6780 | * Write application data, doing 1/n-1 splitting if necessary. |
JMF | 12:0071cb144c7a | 6781 | * |
JMF | 12:0071cb144c7a | 6782 | * With non-blocking I/O, ssl_write_real() may return WANT_WRITE, |
JMF | 12:0071cb144c7a | 6783 | * then the caller will call us again with the same arguments, so |
JMF | 12:0071cb144c7a | 6784 | * remember wether we already did the split or not. |
JMF | 12:0071cb144c7a | 6785 | */ |
JMF | 12:0071cb144c7a | 6786 | #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) |
JMF | 12:0071cb144c7a | 6787 | static int ssl_write_split( mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 6788 | const unsigned char *buf, size_t len ) |
JMF | 12:0071cb144c7a | 6789 | { |
JMF | 12:0071cb144c7a | 6790 | int ret; |
JMF | 12:0071cb144c7a | 6791 | |
JMF | 12:0071cb144c7a | 6792 | if( ssl->conf->cbc_record_splitting == |
JMF | 12:0071cb144c7a | 6793 | MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED || |
JMF | 12:0071cb144c7a | 6794 | len <= 1 || |
JMF | 12:0071cb144c7a | 6795 | ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_1 || |
JMF | 12:0071cb144c7a | 6796 | mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc ) |
JMF | 12:0071cb144c7a | 6797 | != MBEDTLS_MODE_CBC ) |
JMF | 12:0071cb144c7a | 6798 | { |
JMF | 12:0071cb144c7a | 6799 | return( ssl_write_real( ssl, buf, len ) ); |
JMF | 12:0071cb144c7a | 6800 | } |
JMF | 12:0071cb144c7a | 6801 | |
JMF | 12:0071cb144c7a | 6802 | if( ssl->split_done == 0 ) |
JMF | 12:0071cb144c7a | 6803 | { |
JMF | 12:0071cb144c7a | 6804 | if( ( ret = ssl_write_real( ssl, buf, 1 ) ) <= 0 ) |
JMF | 12:0071cb144c7a | 6805 | return( ret ); |
JMF | 12:0071cb144c7a | 6806 | ssl->split_done = 1; |
JMF | 12:0071cb144c7a | 6807 | } |
JMF | 12:0071cb144c7a | 6808 | |
JMF | 12:0071cb144c7a | 6809 | if( ( ret = ssl_write_real( ssl, buf + 1, len - 1 ) ) <= 0 ) |
JMF | 12:0071cb144c7a | 6810 | return( ret ); |
JMF | 12:0071cb144c7a | 6811 | ssl->split_done = 0; |
JMF | 12:0071cb144c7a | 6812 | |
JMF | 12:0071cb144c7a | 6813 | return( ret + 1 ); |
JMF | 12:0071cb144c7a | 6814 | } |
JMF | 12:0071cb144c7a | 6815 | #endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */ |
JMF | 12:0071cb144c7a | 6816 | |
JMF | 12:0071cb144c7a | 6817 | /* |
JMF | 12:0071cb144c7a | 6818 | * Write application data (public-facing wrapper) |
JMF | 12:0071cb144c7a | 6819 | */ |
JMF | 12:0071cb144c7a | 6820 | int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len ) |
JMF | 12:0071cb144c7a | 6821 | { |
JMF | 12:0071cb144c7a | 6822 | int ret; |
JMF | 12:0071cb144c7a | 6823 | |
JMF | 12:0071cb144c7a | 6824 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) ); |
JMF | 12:0071cb144c7a | 6825 | |
JMF | 12:0071cb144c7a | 6826 | if( ssl == NULL || ssl->conf == NULL ) |
JMF | 12:0071cb144c7a | 6827 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 6828 | |
JMF | 12:0071cb144c7a | 6829 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 6830 | if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6831 | { |
JMF | 12:0071cb144c7a | 6832 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret ); |
JMF | 12:0071cb144c7a | 6833 | return( ret ); |
JMF | 12:0071cb144c7a | 6834 | } |
JMF | 12:0071cb144c7a | 6835 | #endif |
JMF | 12:0071cb144c7a | 6836 | |
JMF | 12:0071cb144c7a | 6837 | if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ) |
JMF | 12:0071cb144c7a | 6838 | { |
JMF | 12:0071cb144c7a | 6839 | if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6840 | { |
JMF | 12:0071cb144c7a | 6841 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret ); |
JMF | 12:0071cb144c7a | 6842 | return( ret ); |
JMF | 12:0071cb144c7a | 6843 | } |
JMF | 12:0071cb144c7a | 6844 | } |
JMF | 12:0071cb144c7a | 6845 | |
JMF | 12:0071cb144c7a | 6846 | #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) |
JMF | 12:0071cb144c7a | 6847 | ret = ssl_write_split( ssl, buf, len ); |
JMF | 12:0071cb144c7a | 6848 | #else |
JMF | 12:0071cb144c7a | 6849 | ret = ssl_write_real( ssl, buf, len ); |
JMF | 12:0071cb144c7a | 6850 | #endif |
JMF | 12:0071cb144c7a | 6851 | |
JMF | 12:0071cb144c7a | 6852 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) ); |
JMF | 12:0071cb144c7a | 6853 | |
JMF | 12:0071cb144c7a | 6854 | return( ret ); |
JMF | 12:0071cb144c7a | 6855 | } |
JMF | 12:0071cb144c7a | 6856 | |
JMF | 12:0071cb144c7a | 6857 | /* |
JMF | 12:0071cb144c7a | 6858 | * Notify the peer that the connection is being closed |
JMF | 12:0071cb144c7a | 6859 | */ |
JMF | 12:0071cb144c7a | 6860 | int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 6861 | { |
JMF | 12:0071cb144c7a | 6862 | int ret; |
JMF | 12:0071cb144c7a | 6863 | |
JMF | 12:0071cb144c7a | 6864 | if( ssl == NULL || ssl->conf == NULL ) |
JMF | 12:0071cb144c7a | 6865 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
JMF | 12:0071cb144c7a | 6866 | |
JMF | 12:0071cb144c7a | 6867 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) ); |
JMF | 12:0071cb144c7a | 6868 | |
JMF | 12:0071cb144c7a | 6869 | if( ssl->out_left != 0 ) |
JMF | 12:0071cb144c7a | 6870 | return( mbedtls_ssl_flush_output( ssl ) ); |
JMF | 12:0071cb144c7a | 6871 | |
JMF | 12:0071cb144c7a | 6872 | if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER ) |
JMF | 12:0071cb144c7a | 6873 | { |
JMF | 12:0071cb144c7a | 6874 | if( ( ret = mbedtls_ssl_send_alert_message( ssl, |
JMF | 12:0071cb144c7a | 6875 | MBEDTLS_SSL_ALERT_LEVEL_WARNING, |
JMF | 12:0071cb144c7a | 6876 | MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 ) |
JMF | 12:0071cb144c7a | 6877 | { |
JMF | 12:0071cb144c7a | 6878 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret ); |
JMF | 12:0071cb144c7a | 6879 | return( ret ); |
JMF | 12:0071cb144c7a | 6880 | } |
JMF | 12:0071cb144c7a | 6881 | } |
JMF | 12:0071cb144c7a | 6882 | |
JMF | 12:0071cb144c7a | 6883 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) ); |
JMF | 12:0071cb144c7a | 6884 | |
JMF | 12:0071cb144c7a | 6885 | return( 0 ); |
JMF | 12:0071cb144c7a | 6886 | } |
JMF | 12:0071cb144c7a | 6887 | |
JMF | 12:0071cb144c7a | 6888 | void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform ) |
JMF | 12:0071cb144c7a | 6889 | { |
JMF | 12:0071cb144c7a | 6890 | if( transform == NULL ) |
JMF | 12:0071cb144c7a | 6891 | return; |
JMF | 12:0071cb144c7a | 6892 | |
JMF | 12:0071cb144c7a | 6893 | #if defined(MBEDTLS_ZLIB_SUPPORT) |
JMF | 12:0071cb144c7a | 6894 | deflateEnd( &transform->ctx_deflate ); |
JMF | 12:0071cb144c7a | 6895 | inflateEnd( &transform->ctx_inflate ); |
JMF | 12:0071cb144c7a | 6896 | #endif |
JMF | 12:0071cb144c7a | 6897 | |
JMF | 12:0071cb144c7a | 6898 | mbedtls_cipher_free( &transform->cipher_ctx_enc ); |
JMF | 12:0071cb144c7a | 6899 | mbedtls_cipher_free( &transform->cipher_ctx_dec ); |
JMF | 12:0071cb144c7a | 6900 | |
JMF | 12:0071cb144c7a | 6901 | mbedtls_md_free( &transform->md_ctx_enc ); |
JMF | 12:0071cb144c7a | 6902 | mbedtls_md_free( &transform->md_ctx_dec ); |
JMF | 12:0071cb144c7a | 6903 | |
JMF | 12:0071cb144c7a | 6904 | mbedtls_zeroize( transform, sizeof( mbedtls_ssl_transform ) ); |
JMF | 12:0071cb144c7a | 6905 | } |
JMF | 12:0071cb144c7a | 6906 | |
JMF | 12:0071cb144c7a | 6907 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
JMF | 12:0071cb144c7a | 6908 | static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert ) |
JMF | 12:0071cb144c7a | 6909 | { |
JMF | 12:0071cb144c7a | 6910 | mbedtls_ssl_key_cert *cur = key_cert, *next; |
JMF | 12:0071cb144c7a | 6911 | |
JMF | 12:0071cb144c7a | 6912 | while( cur != NULL ) |
JMF | 12:0071cb144c7a | 6913 | { |
JMF | 12:0071cb144c7a | 6914 | next = cur->next; |
JMF | 12:0071cb144c7a | 6915 | mbedtls_free( cur ); |
JMF | 12:0071cb144c7a | 6916 | cur = next; |
JMF | 12:0071cb144c7a | 6917 | } |
JMF | 12:0071cb144c7a | 6918 | } |
JMF | 12:0071cb144c7a | 6919 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
JMF | 12:0071cb144c7a | 6920 | |
JMF | 12:0071cb144c7a | 6921 | void mbedtls_ssl_handshake_free( mbedtls_ssl_handshake_params *handshake ) |
JMF | 12:0071cb144c7a | 6922 | { |
JMF | 12:0071cb144c7a | 6923 | if( handshake == NULL ) |
JMF | 12:0071cb144c7a | 6924 | return; |
JMF | 12:0071cb144c7a | 6925 | |
JMF | 12:0071cb144c7a | 6926 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
JMF | 12:0071cb144c7a | 6927 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
JMF | 12:0071cb144c7a | 6928 | mbedtls_md5_free( &handshake->fin_md5 ); |
JMF | 12:0071cb144c7a | 6929 | mbedtls_sha1_free( &handshake->fin_sha1 ); |
JMF | 12:0071cb144c7a | 6930 | #endif |
JMF | 12:0071cb144c7a | 6931 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
JMF | 12:0071cb144c7a | 6932 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 6933 | mbedtls_sha256_free( &handshake->fin_sha256 ); |
JMF | 12:0071cb144c7a | 6934 | #endif |
JMF | 12:0071cb144c7a | 6935 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 6936 | mbedtls_sha512_free( &handshake->fin_sha512 ); |
JMF | 12:0071cb144c7a | 6937 | #endif |
JMF | 12:0071cb144c7a | 6938 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
JMF | 12:0071cb144c7a | 6939 | |
JMF | 12:0071cb144c7a | 6940 | #if defined(MBEDTLS_DHM_C) |
JMF | 12:0071cb144c7a | 6941 | mbedtls_dhm_free( &handshake->dhm_ctx ); |
JMF | 12:0071cb144c7a | 6942 | #endif |
JMF | 12:0071cb144c7a | 6943 | #if defined(MBEDTLS_ECDH_C) |
JMF | 12:0071cb144c7a | 6944 | mbedtls_ecdh_free( &handshake->ecdh_ctx ); |
JMF | 12:0071cb144c7a | 6945 | #endif |
JMF | 12:0071cb144c7a | 6946 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
JMF | 12:0071cb144c7a | 6947 | mbedtls_ecjpake_free( &handshake->ecjpake_ctx ); |
JMF | 12:0071cb144c7a | 6948 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 6949 | mbedtls_free( handshake->ecjpake_cache ); |
JMF | 12:0071cb144c7a | 6950 | handshake->ecjpake_cache = NULL; |
JMF | 12:0071cb144c7a | 6951 | handshake->ecjpake_cache_len = 0; |
JMF | 12:0071cb144c7a | 6952 | #endif |
JMF | 12:0071cb144c7a | 6953 | #endif |
JMF | 12:0071cb144c7a | 6954 | |
JMF | 12:0071cb144c7a | 6955 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
JMF | 12:0071cb144c7a | 6956 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
JMF | 12:0071cb144c7a | 6957 | /* explicit void pointer cast for buggy MS compiler */ |
JMF | 12:0071cb144c7a | 6958 | mbedtls_free( (void *) handshake->curves ); |
JMF | 12:0071cb144c7a | 6959 | #endif |
JMF | 12:0071cb144c7a | 6960 | |
JMF | 12:0071cb144c7a | 6961 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
JMF | 12:0071cb144c7a | 6962 | if( handshake->psk != NULL ) |
JMF | 12:0071cb144c7a | 6963 | { |
JMF | 12:0071cb144c7a | 6964 | mbedtls_zeroize( handshake->psk, handshake->psk_len ); |
JMF | 12:0071cb144c7a | 6965 | mbedtls_free( handshake->psk ); |
JMF | 12:0071cb144c7a | 6966 | } |
JMF | 12:0071cb144c7a | 6967 | #endif |
JMF | 12:0071cb144c7a | 6968 | |
JMF | 12:0071cb144c7a | 6969 | #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ |
JMF | 12:0071cb144c7a | 6970 | defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
JMF | 12:0071cb144c7a | 6971 | /* |
JMF | 12:0071cb144c7a | 6972 | * Free only the linked list wrapper, not the keys themselves |
JMF | 12:0071cb144c7a | 6973 | * since the belong to the SNI callback |
JMF | 12:0071cb144c7a | 6974 | */ |
JMF | 12:0071cb144c7a | 6975 | if( handshake->sni_key_cert != NULL ) |
JMF | 12:0071cb144c7a | 6976 | { |
JMF | 12:0071cb144c7a | 6977 | mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next; |
JMF | 12:0071cb144c7a | 6978 | |
JMF | 12:0071cb144c7a | 6979 | while( cur != NULL ) |
JMF | 12:0071cb144c7a | 6980 | { |
JMF | 12:0071cb144c7a | 6981 | next = cur->next; |
JMF | 12:0071cb144c7a | 6982 | mbedtls_free( cur ); |
JMF | 12:0071cb144c7a | 6983 | cur = next; |
JMF | 12:0071cb144c7a | 6984 | } |
JMF | 12:0071cb144c7a | 6985 | } |
JMF | 12:0071cb144c7a | 6986 | #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
JMF | 12:0071cb144c7a | 6987 | |
JMF | 12:0071cb144c7a | 6988 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 6989 | mbedtls_free( handshake->verify_cookie ); |
JMF | 12:0071cb144c7a | 6990 | mbedtls_free( handshake->hs_msg ); |
JMF | 12:0071cb144c7a | 6991 | ssl_flight_free( handshake->flight ); |
JMF | 12:0071cb144c7a | 6992 | #endif |
JMF | 12:0071cb144c7a | 6993 | |
JMF | 12:0071cb144c7a | 6994 | mbedtls_zeroize( handshake, sizeof( mbedtls_ssl_handshake_params ) ); |
JMF | 12:0071cb144c7a | 6995 | } |
JMF | 12:0071cb144c7a | 6996 | |
JMF | 12:0071cb144c7a | 6997 | void mbedtls_ssl_session_free( mbedtls_ssl_session *session ) |
JMF | 12:0071cb144c7a | 6998 | { |
JMF | 12:0071cb144c7a | 6999 | if( session == NULL ) |
JMF | 12:0071cb144c7a | 7000 | return; |
JMF | 12:0071cb144c7a | 7001 | |
JMF | 12:0071cb144c7a | 7002 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
JMF | 12:0071cb144c7a | 7003 | if( session->peer_cert != NULL ) |
JMF | 12:0071cb144c7a | 7004 | { |
JMF | 12:0071cb144c7a | 7005 | mbedtls_x509_crt_free( session->peer_cert ); |
JMF | 12:0071cb144c7a | 7006 | mbedtls_free( session->peer_cert ); |
JMF | 12:0071cb144c7a | 7007 | } |
JMF | 12:0071cb144c7a | 7008 | #endif |
JMF | 12:0071cb144c7a | 7009 | |
JMF | 12:0071cb144c7a | 7010 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 7011 | mbedtls_free( session->ticket ); |
JMF | 12:0071cb144c7a | 7012 | #endif |
JMF | 12:0071cb144c7a | 7013 | |
JMF | 12:0071cb144c7a | 7014 | mbedtls_zeroize( session, sizeof( mbedtls_ssl_session ) ); |
JMF | 12:0071cb144c7a | 7015 | } |
JMF | 12:0071cb144c7a | 7016 | |
JMF | 12:0071cb144c7a | 7017 | /* |
JMF | 12:0071cb144c7a | 7018 | * Free an SSL context |
JMF | 12:0071cb144c7a | 7019 | */ |
JMF | 12:0071cb144c7a | 7020 | void mbedtls_ssl_free( mbedtls_ssl_context *ssl ) |
JMF | 12:0071cb144c7a | 7021 | { |
JMF | 12:0071cb144c7a | 7022 | if( ssl == NULL ) |
JMF | 12:0071cb144c7a | 7023 | return; |
JMF | 12:0071cb144c7a | 7024 | |
JMF | 12:0071cb144c7a | 7025 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) ); |
JMF | 12:0071cb144c7a | 7026 | |
JMF | 12:0071cb144c7a | 7027 | if( ssl->out_buf != NULL ) |
JMF | 12:0071cb144c7a | 7028 | { |
JMF | 12:0071cb144c7a | 7029 | mbedtls_zeroize( ssl->out_buf, MBEDTLS_SSL_BUFFER_LEN ); |
JMF | 12:0071cb144c7a | 7030 | mbedtls_free( ssl->out_buf ); |
JMF | 12:0071cb144c7a | 7031 | } |
JMF | 12:0071cb144c7a | 7032 | |
JMF | 12:0071cb144c7a | 7033 | if( ssl->in_buf != NULL ) |
JMF | 12:0071cb144c7a | 7034 | { |
JMF | 12:0071cb144c7a | 7035 | mbedtls_zeroize( ssl->in_buf, MBEDTLS_SSL_BUFFER_LEN ); |
JMF | 12:0071cb144c7a | 7036 | mbedtls_free( ssl->in_buf ); |
JMF | 12:0071cb144c7a | 7037 | } |
JMF | 12:0071cb144c7a | 7038 | |
JMF | 12:0071cb144c7a | 7039 | #if defined(MBEDTLS_ZLIB_SUPPORT) |
JMF | 12:0071cb144c7a | 7040 | if( ssl->compress_buf != NULL ) |
JMF | 12:0071cb144c7a | 7041 | { |
JMF | 12:0071cb144c7a | 7042 | mbedtls_zeroize( ssl->compress_buf, MBEDTLS_SSL_BUFFER_LEN ); |
JMF | 12:0071cb144c7a | 7043 | mbedtls_free( ssl->compress_buf ); |
JMF | 12:0071cb144c7a | 7044 | } |
JMF | 12:0071cb144c7a | 7045 | #endif |
JMF | 12:0071cb144c7a | 7046 | |
JMF | 12:0071cb144c7a | 7047 | if( ssl->transform ) |
JMF | 12:0071cb144c7a | 7048 | { |
JMF | 12:0071cb144c7a | 7049 | mbedtls_ssl_transform_free( ssl->transform ); |
JMF | 12:0071cb144c7a | 7050 | mbedtls_free( ssl->transform ); |
JMF | 12:0071cb144c7a | 7051 | } |
JMF | 12:0071cb144c7a | 7052 | |
JMF | 12:0071cb144c7a | 7053 | if( ssl->handshake ) |
JMF | 12:0071cb144c7a | 7054 | { |
JMF | 12:0071cb144c7a | 7055 | mbedtls_ssl_handshake_free( ssl->handshake ); |
JMF | 12:0071cb144c7a | 7056 | mbedtls_ssl_transform_free( ssl->transform_negotiate ); |
JMF | 12:0071cb144c7a | 7057 | mbedtls_ssl_session_free( ssl->session_negotiate ); |
JMF | 12:0071cb144c7a | 7058 | |
JMF | 12:0071cb144c7a | 7059 | mbedtls_free( ssl->handshake ); |
JMF | 12:0071cb144c7a | 7060 | mbedtls_free( ssl->transform_negotiate ); |
JMF | 12:0071cb144c7a | 7061 | mbedtls_free( ssl->session_negotiate ); |
JMF | 12:0071cb144c7a | 7062 | } |
JMF | 12:0071cb144c7a | 7063 | |
JMF | 12:0071cb144c7a | 7064 | if( ssl->session ) |
JMF | 12:0071cb144c7a | 7065 | { |
JMF | 12:0071cb144c7a | 7066 | mbedtls_ssl_session_free( ssl->session ); |
JMF | 12:0071cb144c7a | 7067 | mbedtls_free( ssl->session ); |
JMF | 12:0071cb144c7a | 7068 | } |
JMF | 12:0071cb144c7a | 7069 | |
JMF | 12:0071cb144c7a | 7070 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
JMF | 12:0071cb144c7a | 7071 | if( ssl->hostname != NULL ) |
JMF | 12:0071cb144c7a | 7072 | { |
JMF | 12:0071cb144c7a | 7073 | mbedtls_zeroize( ssl->hostname, strlen( ssl->hostname ) ); |
JMF | 12:0071cb144c7a | 7074 | mbedtls_free( ssl->hostname ); |
JMF | 12:0071cb144c7a | 7075 | } |
JMF | 12:0071cb144c7a | 7076 | #endif |
JMF | 12:0071cb144c7a | 7077 | |
JMF | 12:0071cb144c7a | 7078 | #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) |
JMF | 12:0071cb144c7a | 7079 | if( mbedtls_ssl_hw_record_finish != NULL ) |
JMF | 12:0071cb144c7a | 7080 | { |
JMF | 12:0071cb144c7a | 7081 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) ); |
JMF | 12:0071cb144c7a | 7082 | mbedtls_ssl_hw_record_finish( ssl ); |
JMF | 12:0071cb144c7a | 7083 | } |
JMF | 12:0071cb144c7a | 7084 | #endif |
JMF | 12:0071cb144c7a | 7085 | |
JMF | 12:0071cb144c7a | 7086 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 7087 | mbedtls_free( ssl->cli_id ); |
JMF | 12:0071cb144c7a | 7088 | #endif |
JMF | 12:0071cb144c7a | 7089 | |
JMF | 12:0071cb144c7a | 7090 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) ); |
JMF | 12:0071cb144c7a | 7091 | |
JMF | 12:0071cb144c7a | 7092 | /* Actually clear after last debug message */ |
JMF | 12:0071cb144c7a | 7093 | mbedtls_zeroize( ssl, sizeof( mbedtls_ssl_context ) ); |
JMF | 12:0071cb144c7a | 7094 | } |
JMF | 12:0071cb144c7a | 7095 | |
JMF | 12:0071cb144c7a | 7096 | /* |
JMF | 12:0071cb144c7a | 7097 | * Initialze mbedtls_ssl_config |
JMF | 12:0071cb144c7a | 7098 | */ |
JMF | 12:0071cb144c7a | 7099 | void mbedtls_ssl_config_init( mbedtls_ssl_config *conf ) |
JMF | 12:0071cb144c7a | 7100 | { |
JMF | 12:0071cb144c7a | 7101 | memset( conf, 0, sizeof( mbedtls_ssl_config ) ); |
JMF | 12:0071cb144c7a | 7102 | } |
JMF | 12:0071cb144c7a | 7103 | |
JMF | 12:0071cb144c7a | 7104 | #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) |
JMF | 12:0071cb144c7a | 7105 | static int ssl_preset_default_hashes[] = { |
JMF | 12:0071cb144c7a | 7106 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 7107 | MBEDTLS_MD_SHA512, |
JMF | 12:0071cb144c7a | 7108 | MBEDTLS_MD_SHA384, |
JMF | 12:0071cb144c7a | 7109 | #endif |
JMF | 12:0071cb144c7a | 7110 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 7111 | MBEDTLS_MD_SHA256, |
JMF | 12:0071cb144c7a | 7112 | MBEDTLS_MD_SHA224, |
JMF | 12:0071cb144c7a | 7113 | #endif |
JMF | 12:0071cb144c7a | 7114 | #if defined(MBEDTLS_SHA1_C) |
JMF | 12:0071cb144c7a | 7115 | MBEDTLS_MD_SHA1, |
JMF | 12:0071cb144c7a | 7116 | #endif |
JMF | 12:0071cb144c7a | 7117 | MBEDTLS_MD_NONE |
JMF | 12:0071cb144c7a | 7118 | }; |
JMF | 12:0071cb144c7a | 7119 | #endif |
JMF | 12:0071cb144c7a | 7120 | |
JMF | 12:0071cb144c7a | 7121 | static int ssl_preset_suiteb_ciphersuites[] = { |
JMF | 12:0071cb144c7a | 7122 | MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, |
JMF | 12:0071cb144c7a | 7123 | MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, |
JMF | 12:0071cb144c7a | 7124 | 0 |
JMF | 12:0071cb144c7a | 7125 | }; |
JMF | 12:0071cb144c7a | 7126 | |
JMF | 12:0071cb144c7a | 7127 | #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) |
JMF | 12:0071cb144c7a | 7128 | static int ssl_preset_suiteb_hashes[] = { |
JMF | 12:0071cb144c7a | 7129 | MBEDTLS_MD_SHA256, |
JMF | 12:0071cb144c7a | 7130 | MBEDTLS_MD_SHA384, |
JMF | 12:0071cb144c7a | 7131 | MBEDTLS_MD_NONE |
JMF | 12:0071cb144c7a | 7132 | }; |
JMF | 12:0071cb144c7a | 7133 | #endif |
JMF | 12:0071cb144c7a | 7134 | |
JMF | 12:0071cb144c7a | 7135 | #if defined(MBEDTLS_ECP_C) |
JMF | 12:0071cb144c7a | 7136 | static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = { |
JMF | 12:0071cb144c7a | 7137 | MBEDTLS_ECP_DP_SECP256R1, |
JMF | 12:0071cb144c7a | 7138 | MBEDTLS_ECP_DP_SECP384R1, |
JMF | 12:0071cb144c7a | 7139 | MBEDTLS_ECP_DP_NONE |
JMF | 12:0071cb144c7a | 7140 | }; |
JMF | 12:0071cb144c7a | 7141 | #endif |
JMF | 12:0071cb144c7a | 7142 | |
JMF | 12:0071cb144c7a | 7143 | /* |
JMF | 12:0071cb144c7a | 7144 | * Load default in mbedtls_ssl_config |
JMF | 12:0071cb144c7a | 7145 | */ |
JMF | 12:0071cb144c7a | 7146 | int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf, |
JMF | 12:0071cb144c7a | 7147 | int endpoint, int transport, int preset ) |
JMF | 12:0071cb144c7a | 7148 | { |
JMF | 12:0071cb144c7a | 7149 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 7150 | int ret; |
JMF | 12:0071cb144c7a | 7151 | #endif |
JMF | 12:0071cb144c7a | 7152 | |
JMF | 12:0071cb144c7a | 7153 | /* Use the functions here so that they are covered in tests, |
JMF | 12:0071cb144c7a | 7154 | * but otherwise access member directly for efficiency */ |
JMF | 12:0071cb144c7a | 7155 | mbedtls_ssl_conf_endpoint( conf, endpoint ); |
JMF | 12:0071cb144c7a | 7156 | mbedtls_ssl_conf_transport( conf, transport ); |
JMF | 12:0071cb144c7a | 7157 | |
JMF | 12:0071cb144c7a | 7158 | /* |
JMF | 12:0071cb144c7a | 7159 | * Things that are common to all presets |
JMF | 12:0071cb144c7a | 7160 | */ |
JMF | 12:0071cb144c7a | 7161 | #if defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 7162 | if( endpoint == MBEDTLS_SSL_IS_CLIENT ) |
JMF | 12:0071cb144c7a | 7163 | { |
JMF | 12:0071cb144c7a | 7164 | conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED; |
JMF | 12:0071cb144c7a | 7165 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
JMF | 12:0071cb144c7a | 7166 | conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED; |
JMF | 12:0071cb144c7a | 7167 | #endif |
JMF | 12:0071cb144c7a | 7168 | } |
JMF | 12:0071cb144c7a | 7169 | #endif |
JMF | 12:0071cb144c7a | 7170 | |
JMF | 12:0071cb144c7a | 7171 | #if defined(MBEDTLS_ARC4_C) |
JMF | 12:0071cb144c7a | 7172 | conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED; |
JMF | 12:0071cb144c7a | 7173 | #endif |
JMF | 12:0071cb144c7a | 7174 | |
JMF | 12:0071cb144c7a | 7175 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
JMF | 12:0071cb144c7a | 7176 | conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED; |
JMF | 12:0071cb144c7a | 7177 | #endif |
JMF | 12:0071cb144c7a | 7178 | |
JMF | 12:0071cb144c7a | 7179 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
JMF | 12:0071cb144c7a | 7180 | conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; |
JMF | 12:0071cb144c7a | 7181 | #endif |
JMF | 12:0071cb144c7a | 7182 | |
JMF | 12:0071cb144c7a | 7183 | #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) |
JMF | 12:0071cb144c7a | 7184 | conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED; |
JMF | 12:0071cb144c7a | 7185 | #endif |
JMF | 12:0071cb144c7a | 7186 | |
JMF | 12:0071cb144c7a | 7187 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 7188 | conf->f_cookie_write = ssl_cookie_write_dummy; |
JMF | 12:0071cb144c7a | 7189 | conf->f_cookie_check = ssl_cookie_check_dummy; |
JMF | 12:0071cb144c7a | 7190 | #endif |
JMF | 12:0071cb144c7a | 7191 | |
JMF | 12:0071cb144c7a | 7192 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
JMF | 12:0071cb144c7a | 7193 | conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED; |
JMF | 12:0071cb144c7a | 7194 | #endif |
JMF | 12:0071cb144c7a | 7195 | |
JMF | 12:0071cb144c7a | 7196 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 7197 | conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN; |
JMF | 12:0071cb144c7a | 7198 | conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX; |
JMF | 12:0071cb144c7a | 7199 | #endif |
JMF | 12:0071cb144c7a | 7200 | |
JMF | 12:0071cb144c7a | 7201 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
JMF | 12:0071cb144c7a | 7202 | conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT; |
JMF | 12:0071cb144c7a | 7203 | memset( conf->renego_period, 0xFF, 7 ); |
JMF | 12:0071cb144c7a | 7204 | conf->renego_period[7] = 0x00; |
JMF | 12:0071cb144c7a | 7205 | #endif |
JMF | 12:0071cb144c7a | 7206 | |
JMF | 12:0071cb144c7a | 7207 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C) |
JMF | 12:0071cb144c7a | 7208 | if( endpoint == MBEDTLS_SSL_IS_SERVER ) |
JMF | 12:0071cb144c7a | 7209 | { |
JMF | 12:0071cb144c7a | 7210 | if( ( ret = mbedtls_ssl_conf_dh_param( conf, |
JMF | 12:0071cb144c7a | 7211 | MBEDTLS_DHM_RFC5114_MODP_2048_P, |
JMF | 12:0071cb144c7a | 7212 | MBEDTLS_DHM_RFC5114_MODP_2048_G ) ) != 0 ) |
JMF | 12:0071cb144c7a | 7213 | { |
JMF | 12:0071cb144c7a | 7214 | return( ret ); |
JMF | 12:0071cb144c7a | 7215 | } |
JMF | 12:0071cb144c7a | 7216 | } |
JMF | 12:0071cb144c7a | 7217 | #endif |
JMF | 12:0071cb144c7a | 7218 | |
JMF | 12:0071cb144c7a | 7219 | /* |
JMF | 12:0071cb144c7a | 7220 | * Preset-specific defaults |
JMF | 12:0071cb144c7a | 7221 | */ |
JMF | 12:0071cb144c7a | 7222 | switch( preset ) |
JMF | 12:0071cb144c7a | 7223 | { |
JMF | 12:0071cb144c7a | 7224 | /* |
JMF | 12:0071cb144c7a | 7225 | * NSA Suite B |
JMF | 12:0071cb144c7a | 7226 | */ |
JMF | 12:0071cb144c7a | 7227 | case MBEDTLS_SSL_PRESET_SUITEB: |
JMF | 12:0071cb144c7a | 7228 | conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3; |
JMF | 12:0071cb144c7a | 7229 | conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */ |
JMF | 12:0071cb144c7a | 7230 | conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION; |
JMF | 12:0071cb144c7a | 7231 | conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION; |
JMF | 12:0071cb144c7a | 7232 | |
JMF | 12:0071cb144c7a | 7233 | conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = |
JMF | 12:0071cb144c7a | 7234 | conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = |
JMF | 12:0071cb144c7a | 7235 | conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = |
JMF | 12:0071cb144c7a | 7236 | conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = |
JMF | 12:0071cb144c7a | 7237 | ssl_preset_suiteb_ciphersuites; |
JMF | 12:0071cb144c7a | 7238 | |
JMF | 12:0071cb144c7a | 7239 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
JMF | 12:0071cb144c7a | 7240 | conf->cert_profile = &mbedtls_x509_crt_profile_suiteb; |
JMF | 12:0071cb144c7a | 7241 | #endif |
JMF | 12:0071cb144c7a | 7242 | |
JMF | 12:0071cb144c7a | 7243 | #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) |
JMF | 12:0071cb144c7a | 7244 | conf->sig_hashes = ssl_preset_suiteb_hashes; |
JMF | 12:0071cb144c7a | 7245 | #endif |
JMF | 12:0071cb144c7a | 7246 | |
JMF | 12:0071cb144c7a | 7247 | #if defined(MBEDTLS_ECP_C) |
JMF | 12:0071cb144c7a | 7248 | conf->curve_list = ssl_preset_suiteb_curves; |
JMF | 12:0071cb144c7a | 7249 | #endif |
JMF | 12:0071cb144c7a | 7250 | break; |
JMF | 12:0071cb144c7a | 7251 | |
JMF | 12:0071cb144c7a | 7252 | /* |
JMF | 12:0071cb144c7a | 7253 | * Default |
JMF | 12:0071cb144c7a | 7254 | */ |
JMF | 12:0071cb144c7a | 7255 | default: |
JMF | 12:0071cb144c7a | 7256 | conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3; |
JMF | 12:0071cb144c7a | 7257 | conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_1; /* TLS 1.0 */ |
JMF | 12:0071cb144c7a | 7258 | conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION; |
JMF | 12:0071cb144c7a | 7259 | conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION; |
JMF | 12:0071cb144c7a | 7260 | |
JMF | 12:0071cb144c7a | 7261 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 7262 | if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 7263 | conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2; |
JMF | 12:0071cb144c7a | 7264 | #endif |
JMF | 12:0071cb144c7a | 7265 | |
JMF | 12:0071cb144c7a | 7266 | conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = |
JMF | 12:0071cb144c7a | 7267 | conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = |
JMF | 12:0071cb144c7a | 7268 | conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = |
JMF | 12:0071cb144c7a | 7269 | conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = |
JMF | 12:0071cb144c7a | 7270 | mbedtls_ssl_list_ciphersuites(); |
JMF | 12:0071cb144c7a | 7271 | |
JMF | 12:0071cb144c7a | 7272 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
JMF | 12:0071cb144c7a | 7273 | conf->cert_profile = &mbedtls_x509_crt_profile_default; |
JMF | 12:0071cb144c7a | 7274 | #endif |
JMF | 12:0071cb144c7a | 7275 | |
JMF | 12:0071cb144c7a | 7276 | #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) |
JMF | 12:0071cb144c7a | 7277 | conf->sig_hashes = ssl_preset_default_hashes; |
JMF | 12:0071cb144c7a | 7278 | #endif |
JMF | 12:0071cb144c7a | 7279 | |
JMF | 12:0071cb144c7a | 7280 | #if defined(MBEDTLS_ECP_C) |
JMF | 12:0071cb144c7a | 7281 | conf->curve_list = mbedtls_ecp_grp_id_list(); |
JMF | 12:0071cb144c7a | 7282 | #endif |
JMF | 12:0071cb144c7a | 7283 | |
JMF | 12:0071cb144c7a | 7284 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C) |
JMF | 12:0071cb144c7a | 7285 | conf->dhm_min_bitlen = 1024; |
JMF | 12:0071cb144c7a | 7286 | #endif |
JMF | 12:0071cb144c7a | 7287 | } |
JMF | 12:0071cb144c7a | 7288 | |
JMF | 12:0071cb144c7a | 7289 | return( 0 ); |
JMF | 12:0071cb144c7a | 7290 | } |
JMF | 12:0071cb144c7a | 7291 | |
JMF | 12:0071cb144c7a | 7292 | /* |
JMF | 12:0071cb144c7a | 7293 | * Free mbedtls_ssl_config |
JMF | 12:0071cb144c7a | 7294 | */ |
JMF | 12:0071cb144c7a | 7295 | void mbedtls_ssl_config_free( mbedtls_ssl_config *conf ) |
JMF | 12:0071cb144c7a | 7296 | { |
JMF | 12:0071cb144c7a | 7297 | #if defined(MBEDTLS_DHM_C) |
JMF | 12:0071cb144c7a | 7298 | mbedtls_mpi_free( &conf->dhm_P ); |
JMF | 12:0071cb144c7a | 7299 | mbedtls_mpi_free( &conf->dhm_G ); |
JMF | 12:0071cb144c7a | 7300 | #endif |
JMF | 12:0071cb144c7a | 7301 | |
JMF | 12:0071cb144c7a | 7302 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
JMF | 12:0071cb144c7a | 7303 | if( conf->psk != NULL ) |
JMF | 12:0071cb144c7a | 7304 | { |
JMF | 12:0071cb144c7a | 7305 | mbedtls_zeroize( conf->psk, conf->psk_len ); |
JMF | 12:0071cb144c7a | 7306 | mbedtls_zeroize( conf->psk_identity, conf->psk_identity_len ); |
JMF | 12:0071cb144c7a | 7307 | mbedtls_free( conf->psk ); |
JMF | 12:0071cb144c7a | 7308 | mbedtls_free( conf->psk_identity ); |
JMF | 12:0071cb144c7a | 7309 | conf->psk_len = 0; |
JMF | 12:0071cb144c7a | 7310 | conf->psk_identity_len = 0; |
JMF | 12:0071cb144c7a | 7311 | } |
JMF | 12:0071cb144c7a | 7312 | #endif |
JMF | 12:0071cb144c7a | 7313 | |
JMF | 12:0071cb144c7a | 7314 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
JMF | 12:0071cb144c7a | 7315 | ssl_key_cert_free( conf->key_cert ); |
JMF | 12:0071cb144c7a | 7316 | #endif |
JMF | 12:0071cb144c7a | 7317 | |
JMF | 12:0071cb144c7a | 7318 | mbedtls_zeroize( conf, sizeof( mbedtls_ssl_config ) ); |
JMF | 12:0071cb144c7a | 7319 | } |
JMF | 12:0071cb144c7a | 7320 | |
JMF | 12:0071cb144c7a | 7321 | #if defined(MBEDTLS_PK_C) && \ |
JMF | 12:0071cb144c7a | 7322 | ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) ) |
JMF | 12:0071cb144c7a | 7323 | /* |
JMF | 12:0071cb144c7a | 7324 | * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX |
JMF | 12:0071cb144c7a | 7325 | */ |
JMF | 12:0071cb144c7a | 7326 | unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk ) |
JMF | 12:0071cb144c7a | 7327 | { |
JMF | 12:0071cb144c7a | 7328 | #if defined(MBEDTLS_RSA_C) |
JMF | 12:0071cb144c7a | 7329 | if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) ) |
JMF | 12:0071cb144c7a | 7330 | return( MBEDTLS_SSL_SIG_RSA ); |
JMF | 12:0071cb144c7a | 7331 | #endif |
JMF | 12:0071cb144c7a | 7332 | #if defined(MBEDTLS_ECDSA_C) |
JMF | 12:0071cb144c7a | 7333 | if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) ) |
JMF | 12:0071cb144c7a | 7334 | return( MBEDTLS_SSL_SIG_ECDSA ); |
JMF | 12:0071cb144c7a | 7335 | #endif |
JMF | 12:0071cb144c7a | 7336 | return( MBEDTLS_SSL_SIG_ANON ); |
JMF | 12:0071cb144c7a | 7337 | } |
JMF | 12:0071cb144c7a | 7338 | |
JMF | 12:0071cb144c7a | 7339 | mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig ) |
JMF | 12:0071cb144c7a | 7340 | { |
JMF | 12:0071cb144c7a | 7341 | switch( sig ) |
JMF | 12:0071cb144c7a | 7342 | { |
JMF | 12:0071cb144c7a | 7343 | #if defined(MBEDTLS_RSA_C) |
JMF | 12:0071cb144c7a | 7344 | case MBEDTLS_SSL_SIG_RSA: |
JMF | 12:0071cb144c7a | 7345 | return( MBEDTLS_PK_RSA ); |
JMF | 12:0071cb144c7a | 7346 | #endif |
JMF | 12:0071cb144c7a | 7347 | #if defined(MBEDTLS_ECDSA_C) |
JMF | 12:0071cb144c7a | 7348 | case MBEDTLS_SSL_SIG_ECDSA: |
JMF | 12:0071cb144c7a | 7349 | return( MBEDTLS_PK_ECDSA ); |
JMF | 12:0071cb144c7a | 7350 | #endif |
JMF | 12:0071cb144c7a | 7351 | default: |
JMF | 12:0071cb144c7a | 7352 | return( MBEDTLS_PK_NONE ); |
JMF | 12:0071cb144c7a | 7353 | } |
JMF | 12:0071cb144c7a | 7354 | } |
JMF | 12:0071cb144c7a | 7355 | #endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */ |
JMF | 12:0071cb144c7a | 7356 | |
JMF | 12:0071cb144c7a | 7357 | /* |
JMF | 12:0071cb144c7a | 7358 | * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX |
JMF | 12:0071cb144c7a | 7359 | */ |
JMF | 12:0071cb144c7a | 7360 | mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash ) |
JMF | 12:0071cb144c7a | 7361 | { |
JMF | 12:0071cb144c7a | 7362 | switch( hash ) |
JMF | 12:0071cb144c7a | 7363 | { |
JMF | 12:0071cb144c7a | 7364 | #if defined(MBEDTLS_MD5_C) |
JMF | 12:0071cb144c7a | 7365 | case MBEDTLS_SSL_HASH_MD5: |
JMF | 12:0071cb144c7a | 7366 | return( MBEDTLS_MD_MD5 ); |
JMF | 12:0071cb144c7a | 7367 | #endif |
JMF | 12:0071cb144c7a | 7368 | #if defined(MBEDTLS_SHA1_C) |
JMF | 12:0071cb144c7a | 7369 | case MBEDTLS_SSL_HASH_SHA1: |
JMF | 12:0071cb144c7a | 7370 | return( MBEDTLS_MD_SHA1 ); |
JMF | 12:0071cb144c7a | 7371 | #endif |
JMF | 12:0071cb144c7a | 7372 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 7373 | case MBEDTLS_SSL_HASH_SHA224: |
JMF | 12:0071cb144c7a | 7374 | return( MBEDTLS_MD_SHA224 ); |
JMF | 12:0071cb144c7a | 7375 | case MBEDTLS_SSL_HASH_SHA256: |
JMF | 12:0071cb144c7a | 7376 | return( MBEDTLS_MD_SHA256 ); |
JMF | 12:0071cb144c7a | 7377 | #endif |
JMF | 12:0071cb144c7a | 7378 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 7379 | case MBEDTLS_SSL_HASH_SHA384: |
JMF | 12:0071cb144c7a | 7380 | return( MBEDTLS_MD_SHA384 ); |
JMF | 12:0071cb144c7a | 7381 | case MBEDTLS_SSL_HASH_SHA512: |
JMF | 12:0071cb144c7a | 7382 | return( MBEDTLS_MD_SHA512 ); |
JMF | 12:0071cb144c7a | 7383 | #endif |
JMF | 12:0071cb144c7a | 7384 | default: |
JMF | 12:0071cb144c7a | 7385 | return( MBEDTLS_MD_NONE ); |
JMF | 12:0071cb144c7a | 7386 | } |
JMF | 12:0071cb144c7a | 7387 | } |
JMF | 12:0071cb144c7a | 7388 | |
JMF | 12:0071cb144c7a | 7389 | /* |
JMF | 12:0071cb144c7a | 7390 | * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX |
JMF | 12:0071cb144c7a | 7391 | */ |
JMF | 12:0071cb144c7a | 7392 | unsigned char mbedtls_ssl_hash_from_md_alg( int md ) |
JMF | 12:0071cb144c7a | 7393 | { |
JMF | 12:0071cb144c7a | 7394 | switch( md ) |
JMF | 12:0071cb144c7a | 7395 | { |
JMF | 12:0071cb144c7a | 7396 | #if defined(MBEDTLS_MD5_C) |
JMF | 12:0071cb144c7a | 7397 | case MBEDTLS_MD_MD5: |
JMF | 12:0071cb144c7a | 7398 | return( MBEDTLS_SSL_HASH_MD5 ); |
JMF | 12:0071cb144c7a | 7399 | #endif |
JMF | 12:0071cb144c7a | 7400 | #if defined(MBEDTLS_SHA1_C) |
JMF | 12:0071cb144c7a | 7401 | case MBEDTLS_MD_SHA1: |
JMF | 12:0071cb144c7a | 7402 | return( MBEDTLS_SSL_HASH_SHA1 ); |
JMF | 12:0071cb144c7a | 7403 | #endif |
JMF | 12:0071cb144c7a | 7404 | #if defined(MBEDTLS_SHA256_C) |
JMF | 12:0071cb144c7a | 7405 | case MBEDTLS_MD_SHA224: |
JMF | 12:0071cb144c7a | 7406 | return( MBEDTLS_SSL_HASH_SHA224 ); |
JMF | 12:0071cb144c7a | 7407 | case MBEDTLS_MD_SHA256: |
JMF | 12:0071cb144c7a | 7408 | return( MBEDTLS_SSL_HASH_SHA256 ); |
JMF | 12:0071cb144c7a | 7409 | #endif |
JMF | 12:0071cb144c7a | 7410 | #if defined(MBEDTLS_SHA512_C) |
JMF | 12:0071cb144c7a | 7411 | case MBEDTLS_MD_SHA384: |
JMF | 12:0071cb144c7a | 7412 | return( MBEDTLS_SSL_HASH_SHA384 ); |
JMF | 12:0071cb144c7a | 7413 | case MBEDTLS_MD_SHA512: |
JMF | 12:0071cb144c7a | 7414 | return( MBEDTLS_SSL_HASH_SHA512 ); |
JMF | 12:0071cb144c7a | 7415 | #endif |
JMF | 12:0071cb144c7a | 7416 | default: |
JMF | 12:0071cb144c7a | 7417 | return( MBEDTLS_SSL_HASH_NONE ); |
JMF | 12:0071cb144c7a | 7418 | } |
JMF | 12:0071cb144c7a | 7419 | } |
JMF | 12:0071cb144c7a | 7420 | |
JMF | 12:0071cb144c7a | 7421 | #if defined(MBEDTLS_ECP_C) |
JMF | 12:0071cb144c7a | 7422 | /* |
JMF | 12:0071cb144c7a | 7423 | * Check if a curve proposed by the peer is in our list. |
JMF | 12:0071cb144c7a | 7424 | * Return 0 if we're willing to use it, -1 otherwise. |
JMF | 12:0071cb144c7a | 7425 | */ |
JMF | 12:0071cb144c7a | 7426 | int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id ) |
JMF | 12:0071cb144c7a | 7427 | { |
JMF | 12:0071cb144c7a | 7428 | const mbedtls_ecp_group_id *gid; |
JMF | 12:0071cb144c7a | 7429 | |
JMF | 12:0071cb144c7a | 7430 | if( ssl->conf->curve_list == NULL ) |
JMF | 12:0071cb144c7a | 7431 | return( -1 ); |
JMF | 12:0071cb144c7a | 7432 | |
JMF | 12:0071cb144c7a | 7433 | for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ ) |
JMF | 12:0071cb144c7a | 7434 | if( *gid == grp_id ) |
JMF | 12:0071cb144c7a | 7435 | return( 0 ); |
JMF | 12:0071cb144c7a | 7436 | |
JMF | 12:0071cb144c7a | 7437 | return( -1 ); |
JMF | 12:0071cb144c7a | 7438 | } |
JMF | 12:0071cb144c7a | 7439 | #endif /* MBEDTLS_ECP_C */ |
JMF | 12:0071cb144c7a | 7440 | |
JMF | 12:0071cb144c7a | 7441 | #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) |
JMF | 12:0071cb144c7a | 7442 | /* |
JMF | 12:0071cb144c7a | 7443 | * Check if a hash proposed by the peer is in our list. |
JMF | 12:0071cb144c7a | 7444 | * Return 0 if we're willing to use it, -1 otherwise. |
JMF | 12:0071cb144c7a | 7445 | */ |
JMF | 12:0071cb144c7a | 7446 | int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl, |
JMF | 12:0071cb144c7a | 7447 | mbedtls_md_type_t md ) |
JMF | 12:0071cb144c7a | 7448 | { |
JMF | 12:0071cb144c7a | 7449 | const int *cur; |
JMF | 12:0071cb144c7a | 7450 | |
JMF | 12:0071cb144c7a | 7451 | if( ssl->conf->sig_hashes == NULL ) |
JMF | 12:0071cb144c7a | 7452 | return( -1 ); |
JMF | 12:0071cb144c7a | 7453 | |
JMF | 12:0071cb144c7a | 7454 | for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ ) |
JMF | 12:0071cb144c7a | 7455 | if( *cur == (int) md ) |
JMF | 12:0071cb144c7a | 7456 | return( 0 ); |
JMF | 12:0071cb144c7a | 7457 | |
JMF | 12:0071cb144c7a | 7458 | return( -1 ); |
JMF | 12:0071cb144c7a | 7459 | } |
JMF | 12:0071cb144c7a | 7460 | #endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */ |
JMF | 12:0071cb144c7a | 7461 | |
JMF | 12:0071cb144c7a | 7462 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
JMF | 12:0071cb144c7a | 7463 | int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert, |
JMF | 12:0071cb144c7a | 7464 | const mbedtls_ssl_ciphersuite_t *ciphersuite, |
JMF | 12:0071cb144c7a | 7465 | int cert_endpoint, |
JMF | 12:0071cb144c7a | 7466 | uint32_t *flags ) |
JMF | 12:0071cb144c7a | 7467 | { |
JMF | 12:0071cb144c7a | 7468 | int ret = 0; |
JMF | 12:0071cb144c7a | 7469 | #if defined(MBEDTLS_X509_CHECK_KEY_USAGE) |
JMF | 12:0071cb144c7a | 7470 | int usage = 0; |
JMF | 12:0071cb144c7a | 7471 | #endif |
JMF | 12:0071cb144c7a | 7472 | #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE) |
JMF | 12:0071cb144c7a | 7473 | const char *ext_oid; |
JMF | 12:0071cb144c7a | 7474 | size_t ext_len; |
JMF | 12:0071cb144c7a | 7475 | #endif |
JMF | 12:0071cb144c7a | 7476 | |
JMF | 12:0071cb144c7a | 7477 | #if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \ |
JMF | 12:0071cb144c7a | 7478 | !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE) |
JMF | 12:0071cb144c7a | 7479 | ((void) cert); |
JMF | 12:0071cb144c7a | 7480 | ((void) cert_endpoint); |
JMF | 12:0071cb144c7a | 7481 | ((void) flags); |
JMF | 12:0071cb144c7a | 7482 | #endif |
JMF | 12:0071cb144c7a | 7483 | |
JMF | 12:0071cb144c7a | 7484 | #if defined(MBEDTLS_X509_CHECK_KEY_USAGE) |
JMF | 12:0071cb144c7a | 7485 | if( cert_endpoint == MBEDTLS_SSL_IS_SERVER ) |
JMF | 12:0071cb144c7a | 7486 | { |
JMF | 12:0071cb144c7a | 7487 | /* Server part of the key exchange */ |
JMF | 12:0071cb144c7a | 7488 | switch( ciphersuite->key_exchange ) |
JMF | 12:0071cb144c7a | 7489 | { |
JMF | 12:0071cb144c7a | 7490 | case MBEDTLS_KEY_EXCHANGE_RSA: |
JMF | 12:0071cb144c7a | 7491 | case MBEDTLS_KEY_EXCHANGE_RSA_PSK: |
JMF | 12:0071cb144c7a | 7492 | usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT; |
JMF | 12:0071cb144c7a | 7493 | break; |
JMF | 12:0071cb144c7a | 7494 | |
JMF | 12:0071cb144c7a | 7495 | case MBEDTLS_KEY_EXCHANGE_DHE_RSA: |
JMF | 12:0071cb144c7a | 7496 | case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: |
JMF | 12:0071cb144c7a | 7497 | case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: |
JMF | 12:0071cb144c7a | 7498 | usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE; |
JMF | 12:0071cb144c7a | 7499 | break; |
JMF | 12:0071cb144c7a | 7500 | |
JMF | 12:0071cb144c7a | 7501 | case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: |
JMF | 12:0071cb144c7a | 7502 | case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: |
JMF | 12:0071cb144c7a | 7503 | usage = MBEDTLS_X509_KU_KEY_AGREEMENT; |
JMF | 12:0071cb144c7a | 7504 | break; |
JMF | 12:0071cb144c7a | 7505 | |
JMF | 12:0071cb144c7a | 7506 | /* Don't use default: we want warnings when adding new values */ |
JMF | 12:0071cb144c7a | 7507 | case MBEDTLS_KEY_EXCHANGE_NONE: |
JMF | 12:0071cb144c7a | 7508 | case MBEDTLS_KEY_EXCHANGE_PSK: |
JMF | 12:0071cb144c7a | 7509 | case MBEDTLS_KEY_EXCHANGE_DHE_PSK: |
JMF | 12:0071cb144c7a | 7510 | case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: |
JMF | 12:0071cb144c7a | 7511 | case MBEDTLS_KEY_EXCHANGE_ECJPAKE: |
JMF | 12:0071cb144c7a | 7512 | usage = 0; |
JMF | 12:0071cb144c7a | 7513 | } |
JMF | 12:0071cb144c7a | 7514 | } |
JMF | 12:0071cb144c7a | 7515 | else |
JMF | 12:0071cb144c7a | 7516 | { |
JMF | 12:0071cb144c7a | 7517 | /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */ |
JMF | 12:0071cb144c7a | 7518 | usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE; |
JMF | 12:0071cb144c7a | 7519 | } |
JMF | 12:0071cb144c7a | 7520 | |
JMF | 12:0071cb144c7a | 7521 | if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 ) |
JMF | 12:0071cb144c7a | 7522 | { |
JMF | 12:0071cb144c7a | 7523 | *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE; |
JMF | 12:0071cb144c7a | 7524 | ret = -1; |
JMF | 12:0071cb144c7a | 7525 | } |
JMF | 12:0071cb144c7a | 7526 | #else |
JMF | 12:0071cb144c7a | 7527 | ((void) ciphersuite); |
JMF | 12:0071cb144c7a | 7528 | #endif /* MBEDTLS_X509_CHECK_KEY_USAGE */ |
JMF | 12:0071cb144c7a | 7529 | |
JMF | 12:0071cb144c7a | 7530 | #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE) |
JMF | 12:0071cb144c7a | 7531 | if( cert_endpoint == MBEDTLS_SSL_IS_SERVER ) |
JMF | 12:0071cb144c7a | 7532 | { |
JMF | 12:0071cb144c7a | 7533 | ext_oid = MBEDTLS_OID_SERVER_AUTH; |
JMF | 12:0071cb144c7a | 7534 | ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH ); |
JMF | 12:0071cb144c7a | 7535 | } |
JMF | 12:0071cb144c7a | 7536 | else |
JMF | 12:0071cb144c7a | 7537 | { |
JMF | 12:0071cb144c7a | 7538 | ext_oid = MBEDTLS_OID_CLIENT_AUTH; |
JMF | 12:0071cb144c7a | 7539 | ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH ); |
JMF | 12:0071cb144c7a | 7540 | } |
JMF | 12:0071cb144c7a | 7541 | |
JMF | 12:0071cb144c7a | 7542 | if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 ) |
JMF | 12:0071cb144c7a | 7543 | { |
JMF | 12:0071cb144c7a | 7544 | *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE; |
JMF | 12:0071cb144c7a | 7545 | ret = -1; |
JMF | 12:0071cb144c7a | 7546 | } |
JMF | 12:0071cb144c7a | 7547 | #endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */ |
JMF | 12:0071cb144c7a | 7548 | |
JMF | 12:0071cb144c7a | 7549 | return( ret ); |
JMF | 12:0071cb144c7a | 7550 | } |
JMF | 12:0071cb144c7a | 7551 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
JMF | 12:0071cb144c7a | 7552 | |
JMF | 12:0071cb144c7a | 7553 | /* |
JMF | 12:0071cb144c7a | 7554 | * Convert version numbers to/from wire format |
JMF | 12:0071cb144c7a | 7555 | * and, for DTLS, to/from TLS equivalent. |
JMF | 12:0071cb144c7a | 7556 | * |
JMF | 12:0071cb144c7a | 7557 | * For TLS this is the identity. |
JMF | 12:0071cb144c7a | 7558 | * For DTLS, use one complement (v -> 255 - v, and then map as follows: |
JMF | 12:0071cb144c7a | 7559 | * 1.0 <-> 3.2 (DTLS 1.0 is based on TLS 1.1) |
JMF | 12:0071cb144c7a | 7560 | * 1.x <-> 3.x+1 for x != 0 (DTLS 1.2 based on TLS 1.2) |
JMF | 12:0071cb144c7a | 7561 | */ |
JMF | 12:0071cb144c7a | 7562 | void mbedtls_ssl_write_version( int major, int minor, int transport, |
JMF | 12:0071cb144c7a | 7563 | unsigned char ver[2] ) |
JMF | 12:0071cb144c7a | 7564 | { |
JMF | 12:0071cb144c7a | 7565 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 7566 | if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 7567 | { |
JMF | 12:0071cb144c7a | 7568 | if( minor == MBEDTLS_SSL_MINOR_VERSION_2 ) |
JMF | 12:0071cb144c7a | 7569 | --minor; /* DTLS 1.0 stored as TLS 1.1 internally */ |
JMF | 12:0071cb144c7a | 7570 | |
JMF | 12:0071cb144c7a | 7571 | ver[0] = (unsigned char)( 255 - ( major - 2 ) ); |
JMF | 12:0071cb144c7a | 7572 | ver[1] = (unsigned char)( 255 - ( minor - 1 ) ); |
JMF | 12:0071cb144c7a | 7573 | } |
JMF | 12:0071cb144c7a | 7574 | else |
JMF | 12:0071cb144c7a | 7575 | #else |
JMF | 12:0071cb144c7a | 7576 | ((void) transport); |
JMF | 12:0071cb144c7a | 7577 | #endif |
JMF | 12:0071cb144c7a | 7578 | { |
JMF | 12:0071cb144c7a | 7579 | ver[0] = (unsigned char) major; |
JMF | 12:0071cb144c7a | 7580 | ver[1] = (unsigned char) minor; |
JMF | 12:0071cb144c7a | 7581 | } |
JMF | 12:0071cb144c7a | 7582 | } |
JMF | 12:0071cb144c7a | 7583 | |
JMF | 12:0071cb144c7a | 7584 | void mbedtls_ssl_read_version( int *major, int *minor, int transport, |
JMF | 12:0071cb144c7a | 7585 | const unsigned char ver[2] ) |
JMF | 12:0071cb144c7a | 7586 | { |
JMF | 12:0071cb144c7a | 7587 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
JMF | 12:0071cb144c7a | 7588 | if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
JMF | 12:0071cb144c7a | 7589 | { |
JMF | 12:0071cb144c7a | 7590 | *major = 255 - ver[0] + 2; |
JMF | 12:0071cb144c7a | 7591 | *minor = 255 - ver[1] + 1; |
JMF | 12:0071cb144c7a | 7592 | |
JMF | 12:0071cb144c7a | 7593 | if( *minor == MBEDTLS_SSL_MINOR_VERSION_1 ) |
JMF | 12:0071cb144c7a | 7594 | ++*minor; /* DTLS 1.0 stored as TLS 1.1 internally */ |
JMF | 12:0071cb144c7a | 7595 | } |
JMF | 12:0071cb144c7a | 7596 | else |
JMF | 12:0071cb144c7a | 7597 | #else |
JMF | 12:0071cb144c7a | 7598 | ((void) transport); |
JMF | 12:0071cb144c7a | 7599 | #endif |
JMF | 12:0071cb144c7a | 7600 | { |
JMF | 12:0071cb144c7a | 7601 | *major = ver[0]; |
JMF | 12:0071cb144c7a | 7602 | *minor = ver[1]; |
JMF | 12:0071cb144c7a | 7603 | } |
JMF | 12:0071cb144c7a | 7604 | } |
JMF | 12:0071cb144c7a | 7605 | |
JMF | 12:0071cb144c7a | 7606 | #endif /* MBEDTLS_SSL_TLS_C */ |