Timothy Beight / Mbed 2 deprecated 6_songs-from-the-cloud

This is a fork due to permission issues

Dependencies:   mbed Socket lwip-eth lwip-sys lwip

Fork of 6_songs-from-the-cloud by MakingMusicWorkshop

mbed-client/mbedtls/source/ssl_tls.c@0:f7c60d3e7b8a, 2016-05-18 (annotated)

Committer:
maclobdell
Date:
Wed May 18 19:06:32 2016 +0000
Revision:
0:f7c60d3e7b8a
clean version

Who changed what in which revision?

UserRevisionLine numberNew contents of line
maclobdell 0:f7c60d3e7b8a 1 /*
maclobdell 0:f7c60d3e7b8a 2 * SSLv3/TLSv1 shared functions
maclobdell 0:f7c60d3e7b8a 3 *
maclobdell 0:f7c60d3e7b8a 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
maclobdell 0:f7c60d3e7b8a 5 * SPDX-License-Identifier: Apache-2.0
maclobdell 0:f7c60d3e7b8a 6 *
maclobdell 0:f7c60d3e7b8a 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
maclobdell 0:f7c60d3e7b8a 8 * not use this file except in compliance with the License.
maclobdell 0:f7c60d3e7b8a 9 * You may obtain a copy of the License at
maclobdell 0:f7c60d3e7b8a 10 *
maclobdell 0:f7c60d3e7b8a 11 * http://www.apache.org/licenses/LICENSE-2.0
maclobdell 0:f7c60d3e7b8a 12 *
maclobdell 0:f7c60d3e7b8a 13 * Unless required by applicable law or agreed to in writing, software
maclobdell 0:f7c60d3e7b8a 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
maclobdell 0:f7c60d3e7b8a 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
maclobdell 0:f7c60d3e7b8a 16 * See the License for the specific language governing permissions and
maclobdell 0:f7c60d3e7b8a 17 * limitations under the License.
maclobdell 0:f7c60d3e7b8a 18 *
maclobdell 0:f7c60d3e7b8a 19 * This file is part of mbed TLS (https://tls.mbed.org)
maclobdell 0:f7c60d3e7b8a 20 */
maclobdell 0:f7c60d3e7b8a 21 /*
maclobdell 0:f7c60d3e7b8a 22 * The SSL 3.0 specification was drafted by Netscape in 1996,
maclobdell 0:f7c60d3e7b8a 23 * and became an IETF standard in 1999.
maclobdell 0:f7c60d3e7b8a 24 *
maclobdell 0:f7c60d3e7b8a 25 * http://wp.netscape.com/eng/ssl3/
maclobdell 0:f7c60d3e7b8a 26 * http://www.ietf.org/rfc/rfc2246.txt
maclobdell 0:f7c60d3e7b8a 27 * http://www.ietf.org/rfc/rfc4346.txt
maclobdell 0:f7c60d3e7b8a 28 */
maclobdell 0:f7c60d3e7b8a 29
maclobdell 0:f7c60d3e7b8a 30 #if !defined(MBEDTLS_CONFIG_FILE)
maclobdell 0:f7c60d3e7b8a 31 #include "mbedtls/config.h"
maclobdell 0:f7c60d3e7b8a 32 #else
maclobdell 0:f7c60d3e7b8a 33 #include MBEDTLS_CONFIG_FILE
maclobdell 0:f7c60d3e7b8a 34 #endif
maclobdell 0:f7c60d3e7b8a 35
maclobdell 0:f7c60d3e7b8a 36 #if defined(MBEDTLS_SSL_TLS_C)
maclobdell 0:f7c60d3e7b8a 37
maclobdell 0:f7c60d3e7b8a 38 #include "mbedtls/debug.h"
maclobdell 0:f7c60d3e7b8a 39 #include "mbedtls/ssl.h"
maclobdell 0:f7c60d3e7b8a 40 #include "mbedtls/ssl_internal.h"
maclobdell 0:f7c60d3e7b8a 41
maclobdell 0:f7c60d3e7b8a 42 #include <string.h>
maclobdell 0:f7c60d3e7b8a 43
maclobdell 0:f7c60d3e7b8a 44 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
maclobdell 0:f7c60d3e7b8a 45 defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
maclobdell 0:f7c60d3e7b8a 46 #include "mbedtls/oid.h"
maclobdell 0:f7c60d3e7b8a 47 #endif
maclobdell 0:f7c60d3e7b8a 48
maclobdell 0:f7c60d3e7b8a 49 #if defined(MBEDTLS_PLATFORM_C)
maclobdell 0:f7c60d3e7b8a 50 #include "mbedtls/platform.h"
maclobdell 0:f7c60d3e7b8a 51 #else
maclobdell 0:f7c60d3e7b8a 52 #include <stdlib.h>
maclobdell 0:f7c60d3e7b8a 53 #define mbedtls_calloc calloc
maclobdell 0:f7c60d3e7b8a 54 #define mbedtls_free free
maclobdell 0:f7c60d3e7b8a 55 #endif
maclobdell 0:f7c60d3e7b8a 56
maclobdell 0:f7c60d3e7b8a 57 /* Implementation that should never be optimized out by the compiler */
maclobdell 0:f7c60d3e7b8a 58 static void mbedtls_zeroize( void *v, size_t n ) {
maclobdell 0:f7c60d3e7b8a 59 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
maclobdell 0:f7c60d3e7b8a 60 }
maclobdell 0:f7c60d3e7b8a 61
maclobdell 0:f7c60d3e7b8a 62 /* Length of the "epoch" field in the record header */
maclobdell 0:f7c60d3e7b8a 63 static inline size_t ssl_ep_len( const mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 64 {
maclobdell 0:f7c60d3e7b8a 65 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 66 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 67 return( 2 );
maclobdell 0:f7c60d3e7b8a 68 #else
maclobdell 0:f7c60d3e7b8a 69 ((void) ssl);
maclobdell 0:f7c60d3e7b8a 70 #endif
maclobdell 0:f7c60d3e7b8a 71 return( 0 );
maclobdell 0:f7c60d3e7b8a 72 }
maclobdell 0:f7c60d3e7b8a 73
maclobdell 0:f7c60d3e7b8a 74 /*
maclobdell 0:f7c60d3e7b8a 75 * Start a timer.
maclobdell 0:f7c60d3e7b8a 76 * Passing millisecs = 0 cancels a running timer.
maclobdell 0:f7c60d3e7b8a 77 */
maclobdell 0:f7c60d3e7b8a 78 static void ssl_set_timer( mbedtls_ssl_context *ssl, uint32_t millisecs )
maclobdell 0:f7c60d3e7b8a 79 {
maclobdell 0:f7c60d3e7b8a 80 if( ssl->f_set_timer == NULL )
maclobdell 0:f7c60d3e7b8a 81 return;
maclobdell 0:f7c60d3e7b8a 82
maclobdell 0:f7c60d3e7b8a 83 MBEDTLS_SSL_DEBUG_MSG( 3, ( "set_timer to %d ms", (int) millisecs ) );
maclobdell 0:f7c60d3e7b8a 84 ssl->f_set_timer( ssl->p_timer, millisecs / 4, millisecs );
maclobdell 0:f7c60d3e7b8a 85 }
maclobdell 0:f7c60d3e7b8a 86
maclobdell 0:f7c60d3e7b8a 87 /*
maclobdell 0:f7c60d3e7b8a 88 * Return -1 is timer is expired, 0 if it isn't.
maclobdell 0:f7c60d3e7b8a 89 */
maclobdell 0:f7c60d3e7b8a 90 static int ssl_check_timer( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 91 {
maclobdell 0:f7c60d3e7b8a 92 if( ssl->f_get_timer == NULL )
maclobdell 0:f7c60d3e7b8a 93 return( 0 );
maclobdell 0:f7c60d3e7b8a 94
maclobdell 0:f7c60d3e7b8a 95 if( ssl->f_get_timer( ssl->p_timer ) == 2 )
maclobdell 0:f7c60d3e7b8a 96 {
maclobdell 0:f7c60d3e7b8a 97 MBEDTLS_SSL_DEBUG_MSG( 3, ( "timer expired" ) );
maclobdell 0:f7c60d3e7b8a 98 return( -1 );
maclobdell 0:f7c60d3e7b8a 99 }
maclobdell 0:f7c60d3e7b8a 100
maclobdell 0:f7c60d3e7b8a 101 return( 0 );
maclobdell 0:f7c60d3e7b8a 102 }
maclobdell 0:f7c60d3e7b8a 103
maclobdell 0:f7c60d3e7b8a 104 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 105 /*
maclobdell 0:f7c60d3e7b8a 106 * Double the retransmit timeout value, within the allowed range,
maclobdell 0:f7c60d3e7b8a 107 * returning -1 if the maximum value has already been reached.
maclobdell 0:f7c60d3e7b8a 108 */
maclobdell 0:f7c60d3e7b8a 109 static int ssl_double_retransmit_timeout( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 110 {
maclobdell 0:f7c60d3e7b8a 111 uint32_t new_timeout;
maclobdell 0:f7c60d3e7b8a 112
maclobdell 0:f7c60d3e7b8a 113 if( ssl->handshake->retransmit_timeout >= ssl->conf->hs_timeout_max )
maclobdell 0:f7c60d3e7b8a 114 return( -1 );
maclobdell 0:f7c60d3e7b8a 115
maclobdell 0:f7c60d3e7b8a 116 new_timeout = 2 * ssl->handshake->retransmit_timeout;
maclobdell 0:f7c60d3e7b8a 117
maclobdell 0:f7c60d3e7b8a 118 /* Avoid arithmetic overflow and range overflow */
maclobdell 0:f7c60d3e7b8a 119 if( new_timeout < ssl->handshake->retransmit_timeout ||
maclobdell 0:f7c60d3e7b8a 120 new_timeout > ssl->conf->hs_timeout_max )
maclobdell 0:f7c60d3e7b8a 121 {
maclobdell 0:f7c60d3e7b8a 122 new_timeout = ssl->conf->hs_timeout_max;
maclobdell 0:f7c60d3e7b8a 123 }
maclobdell 0:f7c60d3e7b8a 124
maclobdell 0:f7c60d3e7b8a 125 ssl->handshake->retransmit_timeout = new_timeout;
maclobdell 0:f7c60d3e7b8a 126 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
maclobdell 0:f7c60d3e7b8a 127 ssl->handshake->retransmit_timeout ) );
maclobdell 0:f7c60d3e7b8a 128
maclobdell 0:f7c60d3e7b8a 129 return( 0 );
maclobdell 0:f7c60d3e7b8a 130 }
maclobdell 0:f7c60d3e7b8a 131
maclobdell 0:f7c60d3e7b8a 132 static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 133 {
maclobdell 0:f7c60d3e7b8a 134 ssl->handshake->retransmit_timeout = ssl->conf->hs_timeout_min;
maclobdell 0:f7c60d3e7b8a 135 MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
maclobdell 0:f7c60d3e7b8a 136 ssl->handshake->retransmit_timeout ) );
maclobdell 0:f7c60d3e7b8a 137 }
maclobdell 0:f7c60d3e7b8a 138 #endif /* MBEDTLS_SSL_PROTO_DTLS */
maclobdell 0:f7c60d3e7b8a 139
maclobdell 0:f7c60d3e7b8a 140 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
maclobdell 0:f7c60d3e7b8a 141 /*
maclobdell 0:f7c60d3e7b8a 142 * Convert max_fragment_length codes to length.
maclobdell 0:f7c60d3e7b8a 143 * RFC 6066 says:
maclobdell 0:f7c60d3e7b8a 144 * enum{
maclobdell 0:f7c60d3e7b8a 145 * 2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
maclobdell 0:f7c60d3e7b8a 146 * } MaxFragmentLength;
maclobdell 0:f7c60d3e7b8a 147 * and we add 0 -> extension unused
maclobdell 0:f7c60d3e7b8a 148 */
maclobdell 0:f7c60d3e7b8a 149 static unsigned int mfl_code_to_length[MBEDTLS_SSL_MAX_FRAG_LEN_INVALID] =
maclobdell 0:f7c60d3e7b8a 150 {
maclobdell 0:f7c60d3e7b8a 151 MBEDTLS_SSL_MAX_CONTENT_LEN, /* MBEDTLS_SSL_MAX_FRAG_LEN_NONE */
maclobdell 0:f7c60d3e7b8a 152 512, /* MBEDTLS_SSL_MAX_FRAG_LEN_512 */
maclobdell 0:f7c60d3e7b8a 153 1024, /* MBEDTLS_SSL_MAX_FRAG_LEN_1024 */
maclobdell 0:f7c60d3e7b8a 154 2048, /* MBEDTLS_SSL_MAX_FRAG_LEN_2048 */
maclobdell 0:f7c60d3e7b8a 155 4096, /* MBEDTLS_SSL_MAX_FRAG_LEN_4096 */
maclobdell 0:f7c60d3e7b8a 156 };
maclobdell 0:f7c60d3e7b8a 157 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
maclobdell 0:f7c60d3e7b8a 158
maclobdell 0:f7c60d3e7b8a 159 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 160 static int ssl_session_copy( mbedtls_ssl_session *dst, const mbedtls_ssl_session *src )
maclobdell 0:f7c60d3e7b8a 161 {
maclobdell 0:f7c60d3e7b8a 162 mbedtls_ssl_session_free( dst );
maclobdell 0:f7c60d3e7b8a 163 memcpy( dst, src, sizeof( mbedtls_ssl_session ) );
maclobdell 0:f7c60d3e7b8a 164
maclobdell 0:f7c60d3e7b8a 165 #if defined(MBEDTLS_X509_CRT_PARSE_C)
maclobdell 0:f7c60d3e7b8a 166 if( src->peer_cert != NULL )
maclobdell 0:f7c60d3e7b8a 167 {
maclobdell 0:f7c60d3e7b8a 168 int ret;
maclobdell 0:f7c60d3e7b8a 169
maclobdell 0:f7c60d3e7b8a 170 dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
maclobdell 0:f7c60d3e7b8a 171 if( dst->peer_cert == NULL )
maclobdell 0:f7c60d3e7b8a 172 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 173
maclobdell 0:f7c60d3e7b8a 174 mbedtls_x509_crt_init( dst->peer_cert );
maclobdell 0:f7c60d3e7b8a 175
maclobdell 0:f7c60d3e7b8a 176 if( ( ret = mbedtls_x509_crt_parse_der( dst->peer_cert, src->peer_cert->raw.p,
maclobdell 0:f7c60d3e7b8a 177 src->peer_cert->raw.len ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 178 {
maclobdell 0:f7c60d3e7b8a 179 mbedtls_free( dst->peer_cert );
maclobdell 0:f7c60d3e7b8a 180 dst->peer_cert = NULL;
maclobdell 0:f7c60d3e7b8a 181 return( ret );
maclobdell 0:f7c60d3e7b8a 182 }
maclobdell 0:f7c60d3e7b8a 183 }
maclobdell 0:f7c60d3e7b8a 184 #endif /* MBEDTLS_X509_CRT_PARSE_C */
maclobdell 0:f7c60d3e7b8a 185
maclobdell 0:f7c60d3e7b8a 186 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 187 if( src->ticket != NULL )
maclobdell 0:f7c60d3e7b8a 188 {
maclobdell 0:f7c60d3e7b8a 189 dst->ticket = mbedtls_calloc( 1, src->ticket_len );
maclobdell 0:f7c60d3e7b8a 190 if( dst->ticket == NULL )
maclobdell 0:f7c60d3e7b8a 191 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 192
maclobdell 0:f7c60d3e7b8a 193 memcpy( dst->ticket, src->ticket, src->ticket_len );
maclobdell 0:f7c60d3e7b8a 194 }
maclobdell 0:f7c60d3e7b8a 195 #endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
maclobdell 0:f7c60d3e7b8a 196
maclobdell 0:f7c60d3e7b8a 197 return( 0 );
maclobdell 0:f7c60d3e7b8a 198 }
maclobdell 0:f7c60d3e7b8a 199 #endif /* MBEDTLS_SSL_CLI_C */
maclobdell 0:f7c60d3e7b8a 200
maclobdell 0:f7c60d3e7b8a 201 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
maclobdell 0:f7c60d3e7b8a 202 int (*mbedtls_ssl_hw_record_init)( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 203 const unsigned char *key_enc, const unsigned char *key_dec,
maclobdell 0:f7c60d3e7b8a 204 size_t keylen,
maclobdell 0:f7c60d3e7b8a 205 const unsigned char *iv_enc, const unsigned char *iv_dec,
maclobdell 0:f7c60d3e7b8a 206 size_t ivlen,
maclobdell 0:f7c60d3e7b8a 207 const unsigned char *mac_enc, const unsigned char *mac_dec,
maclobdell 0:f7c60d3e7b8a 208 size_t maclen ) = NULL;
maclobdell 0:f7c60d3e7b8a 209 int (*mbedtls_ssl_hw_record_activate)( mbedtls_ssl_context *ssl, int direction) = NULL;
maclobdell 0:f7c60d3e7b8a 210 int (*mbedtls_ssl_hw_record_reset)( mbedtls_ssl_context *ssl ) = NULL;
maclobdell 0:f7c60d3e7b8a 211 int (*mbedtls_ssl_hw_record_write)( mbedtls_ssl_context *ssl ) = NULL;
maclobdell 0:f7c60d3e7b8a 212 int (*mbedtls_ssl_hw_record_read)( mbedtls_ssl_context *ssl ) = NULL;
maclobdell 0:f7c60d3e7b8a 213 int (*mbedtls_ssl_hw_record_finish)( mbedtls_ssl_context *ssl ) = NULL;
maclobdell 0:f7c60d3e7b8a 214 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
maclobdell 0:f7c60d3e7b8a 215
maclobdell 0:f7c60d3e7b8a 216 /*
maclobdell 0:f7c60d3e7b8a 217 * Key material generation
maclobdell 0:f7c60d3e7b8a 218 */
maclobdell 0:f7c60d3e7b8a 219 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 220 static int ssl3_prf( const unsigned char *secret, size_t slen,
maclobdell 0:f7c60d3e7b8a 221 const char *label,
maclobdell 0:f7c60d3e7b8a 222 const unsigned char *random, size_t rlen,
maclobdell 0:f7c60d3e7b8a 223 unsigned char *dstbuf, size_t dlen )
maclobdell 0:f7c60d3e7b8a 224 {
maclobdell 0:f7c60d3e7b8a 225 size_t i;
maclobdell 0:f7c60d3e7b8a 226 mbedtls_md5_context md5;
maclobdell 0:f7c60d3e7b8a 227 mbedtls_sha1_context sha1;
maclobdell 0:f7c60d3e7b8a 228 unsigned char padding[16];
maclobdell 0:f7c60d3e7b8a 229 unsigned char sha1sum[20];
maclobdell 0:f7c60d3e7b8a 230 ((void)label);
maclobdell 0:f7c60d3e7b8a 231
maclobdell 0:f7c60d3e7b8a 232 mbedtls_md5_init( &md5 );
maclobdell 0:f7c60d3e7b8a 233 mbedtls_sha1_init( &sha1 );
maclobdell 0:f7c60d3e7b8a 234
maclobdell 0:f7c60d3e7b8a 235 /*
maclobdell 0:f7c60d3e7b8a 236 * SSLv3:
maclobdell 0:f7c60d3e7b8a 237 * block =
maclobdell 0:f7c60d3e7b8a 238 * MD5( secret + SHA1( 'A' + secret + random ) ) +
maclobdell 0:f7c60d3e7b8a 239 * MD5( secret + SHA1( 'BB' + secret + random ) ) +
maclobdell 0:f7c60d3e7b8a 240 * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
maclobdell 0:f7c60d3e7b8a 241 * ...
maclobdell 0:f7c60d3e7b8a 242 */
maclobdell 0:f7c60d3e7b8a 243 for( i = 0; i < dlen / 16; i++ )
maclobdell 0:f7c60d3e7b8a 244 {
maclobdell 0:f7c60d3e7b8a 245 memset( padding, (unsigned char) ('A' + i), 1 + i );
maclobdell 0:f7c60d3e7b8a 246
maclobdell 0:f7c60d3e7b8a 247 mbedtls_sha1_starts( &sha1 );
maclobdell 0:f7c60d3e7b8a 248 mbedtls_sha1_update( &sha1, padding, 1 + i );
maclobdell 0:f7c60d3e7b8a 249 mbedtls_sha1_update( &sha1, secret, slen );
maclobdell 0:f7c60d3e7b8a 250 mbedtls_sha1_update( &sha1, random, rlen );
maclobdell 0:f7c60d3e7b8a 251 mbedtls_sha1_finish( &sha1, sha1sum );
maclobdell 0:f7c60d3e7b8a 252
maclobdell 0:f7c60d3e7b8a 253 mbedtls_md5_starts( &md5 );
maclobdell 0:f7c60d3e7b8a 254 mbedtls_md5_update( &md5, secret, slen );
maclobdell 0:f7c60d3e7b8a 255 mbedtls_md5_update( &md5, sha1sum, 20 );
maclobdell 0:f7c60d3e7b8a 256 mbedtls_md5_finish( &md5, dstbuf + i * 16 );
maclobdell 0:f7c60d3e7b8a 257 }
maclobdell 0:f7c60d3e7b8a 258
maclobdell 0:f7c60d3e7b8a 259 mbedtls_md5_free( &md5 );
maclobdell 0:f7c60d3e7b8a 260 mbedtls_sha1_free( &sha1 );
maclobdell 0:f7c60d3e7b8a 261
maclobdell 0:f7c60d3e7b8a 262 mbedtls_zeroize( padding, sizeof( padding ) );
maclobdell 0:f7c60d3e7b8a 263 mbedtls_zeroize( sha1sum, sizeof( sha1sum ) );
maclobdell 0:f7c60d3e7b8a 264
maclobdell 0:f7c60d3e7b8a 265 return( 0 );
maclobdell 0:f7c60d3e7b8a 266 }
maclobdell 0:f7c60d3e7b8a 267 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
maclobdell 0:f7c60d3e7b8a 268
maclobdell 0:f7c60d3e7b8a 269 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
maclobdell 0:f7c60d3e7b8a 270 static int tls1_prf( const unsigned char *secret, size_t slen,
maclobdell 0:f7c60d3e7b8a 271 const char *label,
maclobdell 0:f7c60d3e7b8a 272 const unsigned char *random, size_t rlen,
maclobdell 0:f7c60d3e7b8a 273 unsigned char *dstbuf, size_t dlen )
maclobdell 0:f7c60d3e7b8a 274 {
maclobdell 0:f7c60d3e7b8a 275 size_t nb, hs;
maclobdell 0:f7c60d3e7b8a 276 size_t i, j, k;
maclobdell 0:f7c60d3e7b8a 277 const unsigned char *S1, *S2;
maclobdell 0:f7c60d3e7b8a 278 unsigned char tmp[128];
maclobdell 0:f7c60d3e7b8a 279 unsigned char h_i[20];
maclobdell 0:f7c60d3e7b8a 280 const mbedtls_md_info_t *md_info;
maclobdell 0:f7c60d3e7b8a 281 mbedtls_md_context_t md_ctx;
maclobdell 0:f7c60d3e7b8a 282 int ret;
maclobdell 0:f7c60d3e7b8a 283
maclobdell 0:f7c60d3e7b8a 284 mbedtls_md_init( &md_ctx );
maclobdell 0:f7c60d3e7b8a 285
maclobdell 0:f7c60d3e7b8a 286 if( sizeof( tmp ) < 20 + strlen( label ) + rlen )
maclobdell 0:f7c60d3e7b8a 287 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 288
maclobdell 0:f7c60d3e7b8a 289 hs = ( slen + 1 ) / 2;
maclobdell 0:f7c60d3e7b8a 290 S1 = secret;
maclobdell 0:f7c60d3e7b8a 291 S2 = secret + slen - hs;
maclobdell 0:f7c60d3e7b8a 292
maclobdell 0:f7c60d3e7b8a 293 nb = strlen( label );
maclobdell 0:f7c60d3e7b8a 294 memcpy( tmp + 20, label, nb );
maclobdell 0:f7c60d3e7b8a 295 memcpy( tmp + 20 + nb, random, rlen );
maclobdell 0:f7c60d3e7b8a 296 nb += rlen;
maclobdell 0:f7c60d3e7b8a 297
maclobdell 0:f7c60d3e7b8a 298 /*
maclobdell 0:f7c60d3e7b8a 299 * First compute P_md5(secret,label+random)[0..dlen]
maclobdell 0:f7c60d3e7b8a 300 */
maclobdell 0:f7c60d3e7b8a 301 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_MD5 ) ) == NULL )
maclobdell 0:f7c60d3e7b8a 302 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 303
maclobdell 0:f7c60d3e7b8a 304 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 305 return( ret );
maclobdell 0:f7c60d3e7b8a 306
maclobdell 0:f7c60d3e7b8a 307 mbedtls_md_hmac_starts( &md_ctx, S1, hs );
maclobdell 0:f7c60d3e7b8a 308 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
maclobdell 0:f7c60d3e7b8a 309 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
maclobdell 0:f7c60d3e7b8a 310
maclobdell 0:f7c60d3e7b8a 311 for( i = 0; i < dlen; i += 16 )
maclobdell 0:f7c60d3e7b8a 312 {
maclobdell 0:f7c60d3e7b8a 313 mbedtls_md_hmac_reset ( &md_ctx );
maclobdell 0:f7c60d3e7b8a 314 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 + nb );
maclobdell 0:f7c60d3e7b8a 315 mbedtls_md_hmac_finish( &md_ctx, h_i );
maclobdell 0:f7c60d3e7b8a 316
maclobdell 0:f7c60d3e7b8a 317 mbedtls_md_hmac_reset ( &md_ctx );
maclobdell 0:f7c60d3e7b8a 318 mbedtls_md_hmac_update( &md_ctx, 4 + tmp, 16 );
maclobdell 0:f7c60d3e7b8a 319 mbedtls_md_hmac_finish( &md_ctx, 4 + tmp );
maclobdell 0:f7c60d3e7b8a 320
maclobdell 0:f7c60d3e7b8a 321 k = ( i + 16 > dlen ) ? dlen % 16 : 16;
maclobdell 0:f7c60d3e7b8a 322
maclobdell 0:f7c60d3e7b8a 323 for( j = 0; j < k; j++ )
maclobdell 0:f7c60d3e7b8a 324 dstbuf[i + j] = h_i[j];
maclobdell 0:f7c60d3e7b8a 325 }
maclobdell 0:f7c60d3e7b8a 326
maclobdell 0:f7c60d3e7b8a 327 mbedtls_md_free( &md_ctx );
maclobdell 0:f7c60d3e7b8a 328
maclobdell 0:f7c60d3e7b8a 329 /*
maclobdell 0:f7c60d3e7b8a 330 * XOR out with P_sha1(secret,label+random)[0..dlen]
maclobdell 0:f7c60d3e7b8a 331 */
maclobdell 0:f7c60d3e7b8a 332 if( ( md_info = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 ) ) == NULL )
maclobdell 0:f7c60d3e7b8a 333 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 334
maclobdell 0:f7c60d3e7b8a 335 if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 336 return( ret );
maclobdell 0:f7c60d3e7b8a 337
maclobdell 0:f7c60d3e7b8a 338 mbedtls_md_hmac_starts( &md_ctx, S2, hs );
maclobdell 0:f7c60d3e7b8a 339 mbedtls_md_hmac_update( &md_ctx, tmp + 20, nb );
maclobdell 0:f7c60d3e7b8a 340 mbedtls_md_hmac_finish( &md_ctx, tmp );
maclobdell 0:f7c60d3e7b8a 341
maclobdell 0:f7c60d3e7b8a 342 for( i = 0; i < dlen; i += 20 )
maclobdell 0:f7c60d3e7b8a 343 {
maclobdell 0:f7c60d3e7b8a 344 mbedtls_md_hmac_reset ( &md_ctx );
maclobdell 0:f7c60d3e7b8a 345 mbedtls_md_hmac_update( &md_ctx, tmp, 20 + nb );
maclobdell 0:f7c60d3e7b8a 346 mbedtls_md_hmac_finish( &md_ctx, h_i );
maclobdell 0:f7c60d3e7b8a 347
maclobdell 0:f7c60d3e7b8a 348 mbedtls_md_hmac_reset ( &md_ctx );
maclobdell 0:f7c60d3e7b8a 349 mbedtls_md_hmac_update( &md_ctx, tmp, 20 );
maclobdell 0:f7c60d3e7b8a 350 mbedtls_md_hmac_finish( &md_ctx, tmp );
maclobdell 0:f7c60d3e7b8a 351
maclobdell 0:f7c60d3e7b8a 352 k = ( i + 20 > dlen ) ? dlen % 20 : 20;
maclobdell 0:f7c60d3e7b8a 353
maclobdell 0:f7c60d3e7b8a 354 for( j = 0; j < k; j++ )
maclobdell 0:f7c60d3e7b8a 355 dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
maclobdell 0:f7c60d3e7b8a 356 }
maclobdell 0:f7c60d3e7b8a 357
maclobdell 0:f7c60d3e7b8a 358 mbedtls_md_free( &md_ctx );
maclobdell 0:f7c60d3e7b8a 359
maclobdell 0:f7c60d3e7b8a 360 mbedtls_zeroize( tmp, sizeof( tmp ) );
maclobdell 0:f7c60d3e7b8a 361 mbedtls_zeroize( h_i, sizeof( h_i ) );
maclobdell 0:f7c60d3e7b8a 362
maclobdell 0:f7c60d3e7b8a 363 return( 0 );
maclobdell 0:f7c60d3e7b8a 364 }
maclobdell 0:f7c60d3e7b8a 365 #endif /* MBEDTLS_SSL_PROTO_TLS1) || MBEDTLS_SSL_PROTO_TLS1_1 */
maclobdell 0:f7c60d3e7b8a 366
maclobdell 0:f7c60d3e7b8a 367 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 368 static int tls_prf_generic( mbedtls_md_type_t md_type,
maclobdell 0:f7c60d3e7b8a 369 const unsigned char *secret, size_t slen,
maclobdell 0:f7c60d3e7b8a 370 const char *label,
maclobdell 0:f7c60d3e7b8a 371 const unsigned char *random, size_t rlen,
maclobdell 0:f7c60d3e7b8a 372 unsigned char *dstbuf, size_t dlen )
maclobdell 0:f7c60d3e7b8a 373 {
maclobdell 0:f7c60d3e7b8a 374 size_t nb;
maclobdell 0:f7c60d3e7b8a 375 size_t i, j, k, md_len;
maclobdell 0:f7c60d3e7b8a 376 unsigned char tmp[128];
maclobdell 0:f7c60d3e7b8a 377 unsigned char h_i[MBEDTLS_MD_MAX_SIZE];
maclobdell 0:f7c60d3e7b8a 378 const mbedtls_md_info_t *md_info;
maclobdell 0:f7c60d3e7b8a 379 mbedtls_md_context_t md_ctx;
maclobdell 0:f7c60d3e7b8a 380 int ret;
maclobdell 0:f7c60d3e7b8a 381
maclobdell 0:f7c60d3e7b8a 382 mbedtls_md_init( &md_ctx );
maclobdell 0:f7c60d3e7b8a 383
maclobdell 0:f7c60d3e7b8a 384 if( ( md_info = mbedtls_md_info_from_type( md_type ) ) == NULL )
maclobdell 0:f7c60d3e7b8a 385 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 386
maclobdell 0:f7c60d3e7b8a 387 md_len = mbedtls_md_get_size( md_info );
maclobdell 0:f7c60d3e7b8a 388
maclobdell 0:f7c60d3e7b8a 389 if( sizeof( tmp ) < md_len + strlen( label ) + rlen )
maclobdell 0:f7c60d3e7b8a 390 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 391
maclobdell 0:f7c60d3e7b8a 392 nb = strlen( label );
maclobdell 0:f7c60d3e7b8a 393 memcpy( tmp + md_len, label, nb );
maclobdell 0:f7c60d3e7b8a 394 memcpy( tmp + md_len + nb, random, rlen );
maclobdell 0:f7c60d3e7b8a 395 nb += rlen;
maclobdell 0:f7c60d3e7b8a 396
maclobdell 0:f7c60d3e7b8a 397 /*
maclobdell 0:f7c60d3e7b8a 398 * Compute P_<hash>(secret, label + random)[0..dlen]
maclobdell 0:f7c60d3e7b8a 399 */
maclobdell 0:f7c60d3e7b8a 400 if ( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 401 return( ret );
maclobdell 0:f7c60d3e7b8a 402
maclobdell 0:f7c60d3e7b8a 403 mbedtls_md_hmac_starts( &md_ctx, secret, slen );
maclobdell 0:f7c60d3e7b8a 404 mbedtls_md_hmac_update( &md_ctx, tmp + md_len, nb );
maclobdell 0:f7c60d3e7b8a 405 mbedtls_md_hmac_finish( &md_ctx, tmp );
maclobdell 0:f7c60d3e7b8a 406
maclobdell 0:f7c60d3e7b8a 407 for( i = 0; i < dlen; i += md_len )
maclobdell 0:f7c60d3e7b8a 408 {
maclobdell 0:f7c60d3e7b8a 409 mbedtls_md_hmac_reset ( &md_ctx );
maclobdell 0:f7c60d3e7b8a 410 mbedtls_md_hmac_update( &md_ctx, tmp, md_len + nb );
maclobdell 0:f7c60d3e7b8a 411 mbedtls_md_hmac_finish( &md_ctx, h_i );
maclobdell 0:f7c60d3e7b8a 412
maclobdell 0:f7c60d3e7b8a 413 mbedtls_md_hmac_reset ( &md_ctx );
maclobdell 0:f7c60d3e7b8a 414 mbedtls_md_hmac_update( &md_ctx, tmp, md_len );
maclobdell 0:f7c60d3e7b8a 415 mbedtls_md_hmac_finish( &md_ctx, tmp );
maclobdell 0:f7c60d3e7b8a 416
maclobdell 0:f7c60d3e7b8a 417 k = ( i + md_len > dlen ) ? dlen % md_len : md_len;
maclobdell 0:f7c60d3e7b8a 418
maclobdell 0:f7c60d3e7b8a 419 for( j = 0; j < k; j++ )
maclobdell 0:f7c60d3e7b8a 420 dstbuf[i + j] = h_i[j];
maclobdell 0:f7c60d3e7b8a 421 }
maclobdell 0:f7c60d3e7b8a 422
maclobdell 0:f7c60d3e7b8a 423 mbedtls_md_free( &md_ctx );
maclobdell 0:f7c60d3e7b8a 424
maclobdell 0:f7c60d3e7b8a 425 mbedtls_zeroize( tmp, sizeof( tmp ) );
maclobdell 0:f7c60d3e7b8a 426 mbedtls_zeroize( h_i, sizeof( h_i ) );
maclobdell 0:f7c60d3e7b8a 427
maclobdell 0:f7c60d3e7b8a 428 return( 0 );
maclobdell 0:f7c60d3e7b8a 429 }
maclobdell 0:f7c60d3e7b8a 430
maclobdell 0:f7c60d3e7b8a 431 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 432 static int tls_prf_sha256( const unsigned char *secret, size_t slen,
maclobdell 0:f7c60d3e7b8a 433 const char *label,
maclobdell 0:f7c60d3e7b8a 434 const unsigned char *random, size_t rlen,
maclobdell 0:f7c60d3e7b8a 435 unsigned char *dstbuf, size_t dlen )
maclobdell 0:f7c60d3e7b8a 436 {
maclobdell 0:f7c60d3e7b8a 437 return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
maclobdell 0:f7c60d3e7b8a 438 label, random, rlen, dstbuf, dlen ) );
maclobdell 0:f7c60d3e7b8a 439 }
maclobdell 0:f7c60d3e7b8a 440 #endif /* MBEDTLS_SHA256_C */
maclobdell 0:f7c60d3e7b8a 441
maclobdell 0:f7c60d3e7b8a 442 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 443 static int tls_prf_sha384( const unsigned char *secret, size_t slen,
maclobdell 0:f7c60d3e7b8a 444 const char *label,
maclobdell 0:f7c60d3e7b8a 445 const unsigned char *random, size_t rlen,
maclobdell 0:f7c60d3e7b8a 446 unsigned char *dstbuf, size_t dlen )
maclobdell 0:f7c60d3e7b8a 447 {
maclobdell 0:f7c60d3e7b8a 448 return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
maclobdell 0:f7c60d3e7b8a 449 label, random, rlen, dstbuf, dlen ) );
maclobdell 0:f7c60d3e7b8a 450 }
maclobdell 0:f7c60d3e7b8a 451 #endif /* MBEDTLS_SHA512_C */
maclobdell 0:f7c60d3e7b8a 452 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 453
maclobdell 0:f7c60d3e7b8a 454 static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
maclobdell 0:f7c60d3e7b8a 455
maclobdell 0:f7c60d3e7b8a 456 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
maclobdell 0:f7c60d3e7b8a 457 defined(MBEDTLS_SSL_PROTO_TLS1_1)
maclobdell 0:f7c60d3e7b8a 458 static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *, const unsigned char *, size_t );
maclobdell 0:f7c60d3e7b8a 459 #endif
maclobdell 0:f7c60d3e7b8a 460
maclobdell 0:f7c60d3e7b8a 461 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 462 static void ssl_calc_verify_ssl( mbedtls_ssl_context *, unsigned char * );
maclobdell 0:f7c60d3e7b8a 463 static void ssl_calc_finished_ssl( mbedtls_ssl_context *, unsigned char *, int );
maclobdell 0:f7c60d3e7b8a 464 #endif
maclobdell 0:f7c60d3e7b8a 465
maclobdell 0:f7c60d3e7b8a 466 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
maclobdell 0:f7c60d3e7b8a 467 static void ssl_calc_verify_tls( mbedtls_ssl_context *, unsigned char * );
maclobdell 0:f7c60d3e7b8a 468 static void ssl_calc_finished_tls( mbedtls_ssl_context *, unsigned char *, int );
maclobdell 0:f7c60d3e7b8a 469 #endif
maclobdell 0:f7c60d3e7b8a 470
maclobdell 0:f7c60d3e7b8a 471 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 472 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 473 static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
maclobdell 0:f7c60d3e7b8a 474 static void ssl_calc_verify_tls_sha256( mbedtls_ssl_context *,unsigned char * );
maclobdell 0:f7c60d3e7b8a 475 static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
maclobdell 0:f7c60d3e7b8a 476 #endif
maclobdell 0:f7c60d3e7b8a 477
maclobdell 0:f7c60d3e7b8a 478 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 479 static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
maclobdell 0:f7c60d3e7b8a 480 static void ssl_calc_verify_tls_sha384( mbedtls_ssl_context *, unsigned char * );
maclobdell 0:f7c60d3e7b8a 481 static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
maclobdell 0:f7c60d3e7b8a 482 #endif
maclobdell 0:f7c60d3e7b8a 483 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 484
maclobdell 0:f7c60d3e7b8a 485 int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 486 {
maclobdell 0:f7c60d3e7b8a 487 int ret = 0;
maclobdell 0:f7c60d3e7b8a 488 unsigned char tmp[64];
maclobdell 0:f7c60d3e7b8a 489 unsigned char keyblk[256];
maclobdell 0:f7c60d3e7b8a 490 unsigned char *key1;
maclobdell 0:f7c60d3e7b8a 491 unsigned char *key2;
maclobdell 0:f7c60d3e7b8a 492 unsigned char *mac_enc;
maclobdell 0:f7c60d3e7b8a 493 unsigned char *mac_dec;
maclobdell 0:f7c60d3e7b8a 494 size_t iv_copy_len;
maclobdell 0:f7c60d3e7b8a 495 const mbedtls_cipher_info_t *cipher_info;
maclobdell 0:f7c60d3e7b8a 496 const mbedtls_md_info_t *md_info;
maclobdell 0:f7c60d3e7b8a 497
maclobdell 0:f7c60d3e7b8a 498 mbedtls_ssl_session *session = ssl->session_negotiate;
maclobdell 0:f7c60d3e7b8a 499 mbedtls_ssl_transform *transform = ssl->transform_negotiate;
maclobdell 0:f7c60d3e7b8a 500 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
maclobdell 0:f7c60d3e7b8a 501
maclobdell 0:f7c60d3e7b8a 502 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
maclobdell 0:f7c60d3e7b8a 503
maclobdell 0:f7c60d3e7b8a 504 cipher_info = mbedtls_cipher_info_from_type( transform->ciphersuite_info->cipher );
maclobdell 0:f7c60d3e7b8a 505 if( cipher_info == NULL )
maclobdell 0:f7c60d3e7b8a 506 {
maclobdell 0:f7c60d3e7b8a 507 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %d not found",
maclobdell 0:f7c60d3e7b8a 508 transform->ciphersuite_info->cipher ) );
maclobdell 0:f7c60d3e7b8a 509 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 510 }
maclobdell 0:f7c60d3e7b8a 511
maclobdell 0:f7c60d3e7b8a 512 md_info = mbedtls_md_info_from_type( transform->ciphersuite_info->mac );
maclobdell 0:f7c60d3e7b8a 513 if( md_info == NULL )
maclobdell 0:f7c60d3e7b8a 514 {
maclobdell 0:f7c60d3e7b8a 515 MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %d not found",
maclobdell 0:f7c60d3e7b8a 516 transform->ciphersuite_info->mac ) );
maclobdell 0:f7c60d3e7b8a 517 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 518 }
maclobdell 0:f7c60d3e7b8a 519
maclobdell 0:f7c60d3e7b8a 520 /*
maclobdell 0:f7c60d3e7b8a 521 * Set appropriate PRF function and other SSL / TLS / TLS1.2 functions
maclobdell 0:f7c60d3e7b8a 522 */
maclobdell 0:f7c60d3e7b8a 523 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 524 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
maclobdell 0:f7c60d3e7b8a 525 {
maclobdell 0:f7c60d3e7b8a 526 handshake->tls_prf = ssl3_prf;
maclobdell 0:f7c60d3e7b8a 527 handshake->calc_verify = ssl_calc_verify_ssl;
maclobdell 0:f7c60d3e7b8a 528 handshake->calc_finished = ssl_calc_finished_ssl;
maclobdell 0:f7c60d3e7b8a 529 }
maclobdell 0:f7c60d3e7b8a 530 else
maclobdell 0:f7c60d3e7b8a 531 #endif
maclobdell 0:f7c60d3e7b8a 532 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
maclobdell 0:f7c60d3e7b8a 533 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
maclobdell 0:f7c60d3e7b8a 534 {
maclobdell 0:f7c60d3e7b8a 535 handshake->tls_prf = tls1_prf;
maclobdell 0:f7c60d3e7b8a 536 handshake->calc_verify = ssl_calc_verify_tls;
maclobdell 0:f7c60d3e7b8a 537 handshake->calc_finished = ssl_calc_finished_tls;
maclobdell 0:f7c60d3e7b8a 538 }
maclobdell 0:f7c60d3e7b8a 539 else
maclobdell 0:f7c60d3e7b8a 540 #endif
maclobdell 0:f7c60d3e7b8a 541 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 542 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 543 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
maclobdell 0:f7c60d3e7b8a 544 transform->ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
maclobdell 0:f7c60d3e7b8a 545 {
maclobdell 0:f7c60d3e7b8a 546 handshake->tls_prf = tls_prf_sha384;
maclobdell 0:f7c60d3e7b8a 547 handshake->calc_verify = ssl_calc_verify_tls_sha384;
maclobdell 0:f7c60d3e7b8a 548 handshake->calc_finished = ssl_calc_finished_tls_sha384;
maclobdell 0:f7c60d3e7b8a 549 }
maclobdell 0:f7c60d3e7b8a 550 else
maclobdell 0:f7c60d3e7b8a 551 #endif
maclobdell 0:f7c60d3e7b8a 552 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 553 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
maclobdell 0:f7c60d3e7b8a 554 {
maclobdell 0:f7c60d3e7b8a 555 handshake->tls_prf = tls_prf_sha256;
maclobdell 0:f7c60d3e7b8a 556 handshake->calc_verify = ssl_calc_verify_tls_sha256;
maclobdell 0:f7c60d3e7b8a 557 handshake->calc_finished = ssl_calc_finished_tls_sha256;
maclobdell 0:f7c60d3e7b8a 558 }
maclobdell 0:f7c60d3e7b8a 559 else
maclobdell 0:f7c60d3e7b8a 560 #endif
maclobdell 0:f7c60d3e7b8a 561 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 562 {
maclobdell 0:f7c60d3e7b8a 563 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 564 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 565 }
maclobdell 0:f7c60d3e7b8a 566
maclobdell 0:f7c60d3e7b8a 567 /*
maclobdell 0:f7c60d3e7b8a 568 * SSLv3:
maclobdell 0:f7c60d3e7b8a 569 * master =
maclobdell 0:f7c60d3e7b8a 570 * MD5( premaster + SHA1( 'A' + premaster + randbytes ) ) +
maclobdell 0:f7c60d3e7b8a 571 * MD5( premaster + SHA1( 'BB' + premaster + randbytes ) ) +
maclobdell 0:f7c60d3e7b8a 572 * MD5( premaster + SHA1( 'CCC' + premaster + randbytes ) )
maclobdell 0:f7c60d3e7b8a 573 *
maclobdell 0:f7c60d3e7b8a 574 * TLSv1+:
maclobdell 0:f7c60d3e7b8a 575 * master = PRF( premaster, "master secret", randbytes )[0..47]
maclobdell 0:f7c60d3e7b8a 576 */
maclobdell 0:f7c60d3e7b8a 577 if( handshake->resume == 0 )
maclobdell 0:f7c60d3e7b8a 578 {
maclobdell 0:f7c60d3e7b8a 579 MBEDTLS_SSL_DEBUG_BUF( 3, "premaster secret", handshake->premaster,
maclobdell 0:f7c60d3e7b8a 580 handshake->pmslen );
maclobdell 0:f7c60d3e7b8a 581
maclobdell 0:f7c60d3e7b8a 582 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
maclobdell 0:f7c60d3e7b8a 583 if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
maclobdell 0:f7c60d3e7b8a 584 {
maclobdell 0:f7c60d3e7b8a 585 unsigned char session_hash[48];
maclobdell 0:f7c60d3e7b8a 586 size_t hash_len;
maclobdell 0:f7c60d3e7b8a 587
maclobdell 0:f7c60d3e7b8a 588 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using extended master secret" ) );
maclobdell 0:f7c60d3e7b8a 589
maclobdell 0:f7c60d3e7b8a 590 ssl->handshake->calc_verify( ssl, session_hash );
maclobdell 0:f7c60d3e7b8a 591
maclobdell 0:f7c60d3e7b8a 592 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 593 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
maclobdell 0:f7c60d3e7b8a 594 {
maclobdell 0:f7c60d3e7b8a 595 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 596 if( ssl->transform_negotiate->ciphersuite_info->mac ==
maclobdell 0:f7c60d3e7b8a 597 MBEDTLS_MD_SHA384 )
maclobdell 0:f7c60d3e7b8a 598 {
maclobdell 0:f7c60d3e7b8a 599 hash_len = 48;
maclobdell 0:f7c60d3e7b8a 600 }
maclobdell 0:f7c60d3e7b8a 601 else
maclobdell 0:f7c60d3e7b8a 602 #endif
maclobdell 0:f7c60d3e7b8a 603 hash_len = 32;
maclobdell 0:f7c60d3e7b8a 604 }
maclobdell 0:f7c60d3e7b8a 605 else
maclobdell 0:f7c60d3e7b8a 606 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 607 hash_len = 36;
maclobdell 0:f7c60d3e7b8a 608
maclobdell 0:f7c60d3e7b8a 609 MBEDTLS_SSL_DEBUG_BUF( 3, "session hash", session_hash, hash_len );
maclobdell 0:f7c60d3e7b8a 610
maclobdell 0:f7c60d3e7b8a 611 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
maclobdell 0:f7c60d3e7b8a 612 "extended master secret",
maclobdell 0:f7c60d3e7b8a 613 session_hash, hash_len,
maclobdell 0:f7c60d3e7b8a 614 session->master, 48 );
maclobdell 0:f7c60d3e7b8a 615 if( ret != 0 )
maclobdell 0:f7c60d3e7b8a 616 {
maclobdell 0:f7c60d3e7b8a 617 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
maclobdell 0:f7c60d3e7b8a 618 return( ret );
maclobdell 0:f7c60d3e7b8a 619 }
maclobdell 0:f7c60d3e7b8a 620
maclobdell 0:f7c60d3e7b8a 621 }
maclobdell 0:f7c60d3e7b8a 622 else
maclobdell 0:f7c60d3e7b8a 623 #endif
maclobdell 0:f7c60d3e7b8a 624 ret = handshake->tls_prf( handshake->premaster, handshake->pmslen,
maclobdell 0:f7c60d3e7b8a 625 "master secret",
maclobdell 0:f7c60d3e7b8a 626 handshake->randbytes, 64,
maclobdell 0:f7c60d3e7b8a 627 session->master, 48 );
maclobdell 0:f7c60d3e7b8a 628 if( ret != 0 )
maclobdell 0:f7c60d3e7b8a 629 {
maclobdell 0:f7c60d3e7b8a 630 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
maclobdell 0:f7c60d3e7b8a 631 return( ret );
maclobdell 0:f7c60d3e7b8a 632 }
maclobdell 0:f7c60d3e7b8a 633
maclobdell 0:f7c60d3e7b8a 634 mbedtls_zeroize( handshake->premaster, sizeof(handshake->premaster) );
maclobdell 0:f7c60d3e7b8a 635 }
maclobdell 0:f7c60d3e7b8a 636 else
maclobdell 0:f7c60d3e7b8a 637 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
maclobdell 0:f7c60d3e7b8a 638
maclobdell 0:f7c60d3e7b8a 639 /*
maclobdell 0:f7c60d3e7b8a 640 * Swap the client and server random values.
maclobdell 0:f7c60d3e7b8a 641 */
maclobdell 0:f7c60d3e7b8a 642 memcpy( tmp, handshake->randbytes, 64 );
maclobdell 0:f7c60d3e7b8a 643 memcpy( handshake->randbytes, tmp + 32, 32 );
maclobdell 0:f7c60d3e7b8a 644 memcpy( handshake->randbytes + 32, tmp, 32 );
maclobdell 0:f7c60d3e7b8a 645 mbedtls_zeroize( tmp, sizeof( tmp ) );
maclobdell 0:f7c60d3e7b8a 646
maclobdell 0:f7c60d3e7b8a 647 /*
maclobdell 0:f7c60d3e7b8a 648 * SSLv3:
maclobdell 0:f7c60d3e7b8a 649 * key block =
maclobdell 0:f7c60d3e7b8a 650 * MD5( master + SHA1( 'A' + master + randbytes ) ) +
maclobdell 0:f7c60d3e7b8a 651 * MD5( master + SHA1( 'BB' + master + randbytes ) ) +
maclobdell 0:f7c60d3e7b8a 652 * MD5( master + SHA1( 'CCC' + master + randbytes ) ) +
maclobdell 0:f7c60d3e7b8a 653 * MD5( master + SHA1( 'DDDD' + master + randbytes ) ) +
maclobdell 0:f7c60d3e7b8a 654 * ...
maclobdell 0:f7c60d3e7b8a 655 *
maclobdell 0:f7c60d3e7b8a 656 * TLSv1:
maclobdell 0:f7c60d3e7b8a 657 * key block = PRF( master, "key expansion", randbytes )
maclobdell 0:f7c60d3e7b8a 658 */
maclobdell 0:f7c60d3e7b8a 659 ret = handshake->tls_prf( session->master, 48, "key expansion",
maclobdell 0:f7c60d3e7b8a 660 handshake->randbytes, 64, keyblk, 256 );
maclobdell 0:f7c60d3e7b8a 661 if( ret != 0 )
maclobdell 0:f7c60d3e7b8a 662 {
maclobdell 0:f7c60d3e7b8a 663 MBEDTLS_SSL_DEBUG_RET( 1, "prf", ret );
maclobdell 0:f7c60d3e7b8a 664 return( ret );
maclobdell 0:f7c60d3e7b8a 665 }
maclobdell 0:f7c60d3e7b8a 666
maclobdell 0:f7c60d3e7b8a 667 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
maclobdell 0:f7c60d3e7b8a 668 mbedtls_ssl_get_ciphersuite_name( session->ciphersuite ) ) );
maclobdell 0:f7c60d3e7b8a 669 MBEDTLS_SSL_DEBUG_BUF( 3, "master secret", session->master, 48 );
maclobdell 0:f7c60d3e7b8a 670 MBEDTLS_SSL_DEBUG_BUF( 4, "random bytes", handshake->randbytes, 64 );
maclobdell 0:f7c60d3e7b8a 671 MBEDTLS_SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
maclobdell 0:f7c60d3e7b8a 672
maclobdell 0:f7c60d3e7b8a 673 mbedtls_zeroize( handshake->randbytes, sizeof( handshake->randbytes ) );
maclobdell 0:f7c60d3e7b8a 674
maclobdell 0:f7c60d3e7b8a 675 /*
maclobdell 0:f7c60d3e7b8a 676 * Determine the appropriate key, IV and MAC length.
maclobdell 0:f7c60d3e7b8a 677 */
maclobdell 0:f7c60d3e7b8a 678
maclobdell 0:f7c60d3e7b8a 679 transform->keylen = cipher_info->key_bitlen / 8;
maclobdell 0:f7c60d3e7b8a 680
maclobdell 0:f7c60d3e7b8a 681 if( cipher_info->mode == MBEDTLS_MODE_GCM ||
maclobdell 0:f7c60d3e7b8a 682 cipher_info->mode == MBEDTLS_MODE_CCM )
maclobdell 0:f7c60d3e7b8a 683 {
maclobdell 0:f7c60d3e7b8a 684 transform->maclen = 0;
maclobdell 0:f7c60d3e7b8a 685
maclobdell 0:f7c60d3e7b8a 686 transform->ivlen = 12;
maclobdell 0:f7c60d3e7b8a 687 transform->fixed_ivlen = 4;
maclobdell 0:f7c60d3e7b8a 688
maclobdell 0:f7c60d3e7b8a 689 /* Minimum length is expicit IV + tag */
maclobdell 0:f7c60d3e7b8a 690 transform->minlen = transform->ivlen - transform->fixed_ivlen
maclobdell 0:f7c60d3e7b8a 691 + ( transform->ciphersuite_info->flags &
maclobdell 0:f7c60d3e7b8a 692 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16 );
maclobdell 0:f7c60d3e7b8a 693 }
maclobdell 0:f7c60d3e7b8a 694 else
maclobdell 0:f7c60d3e7b8a 695 {
maclobdell 0:f7c60d3e7b8a 696 /* Initialize HMAC contexts */
maclobdell 0:f7c60d3e7b8a 697 if( ( ret = mbedtls_md_setup( &transform->md_ctx_enc, md_info, 1 ) ) != 0 ||
maclobdell 0:f7c60d3e7b8a 698 ( ret = mbedtls_md_setup( &transform->md_ctx_dec, md_info, 1 ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 699 {
maclobdell 0:f7c60d3e7b8a 700 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
maclobdell 0:f7c60d3e7b8a 701 return( ret );
maclobdell 0:f7c60d3e7b8a 702 }
maclobdell 0:f7c60d3e7b8a 703
maclobdell 0:f7c60d3e7b8a 704 /* Get MAC length */
maclobdell 0:f7c60d3e7b8a 705 transform->maclen = mbedtls_md_get_size( md_info );
maclobdell 0:f7c60d3e7b8a 706
maclobdell 0:f7c60d3e7b8a 707 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
maclobdell 0:f7c60d3e7b8a 708 /*
maclobdell 0:f7c60d3e7b8a 709 * If HMAC is to be truncated, we shall keep the leftmost bytes,
maclobdell 0:f7c60d3e7b8a 710 * (rfc 6066 page 13 or rfc 2104 section 4),
maclobdell 0:f7c60d3e7b8a 711 * so we only need to adjust the length here.
maclobdell 0:f7c60d3e7b8a 712 */
maclobdell 0:f7c60d3e7b8a 713 if( session->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
maclobdell 0:f7c60d3e7b8a 714 transform->maclen = MBEDTLS_SSL_TRUNCATED_HMAC_LEN;
maclobdell 0:f7c60d3e7b8a 715 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
maclobdell 0:f7c60d3e7b8a 716
maclobdell 0:f7c60d3e7b8a 717 /* IV length */
maclobdell 0:f7c60d3e7b8a 718 transform->ivlen = cipher_info->iv_size;
maclobdell 0:f7c60d3e7b8a 719
maclobdell 0:f7c60d3e7b8a 720 /* Minimum length */
maclobdell 0:f7c60d3e7b8a 721 if( cipher_info->mode == MBEDTLS_MODE_STREAM )
maclobdell 0:f7c60d3e7b8a 722 transform->minlen = transform->maclen;
maclobdell 0:f7c60d3e7b8a 723 else
maclobdell 0:f7c60d3e7b8a 724 {
maclobdell 0:f7c60d3e7b8a 725 /*
maclobdell 0:f7c60d3e7b8a 726 * GenericBlockCipher:
maclobdell 0:f7c60d3e7b8a 727 * 1. if EtM is in use: one block plus MAC
maclobdell 0:f7c60d3e7b8a 728 * otherwise: * first multiple of blocklen greater than maclen
maclobdell 0:f7c60d3e7b8a 729 * 2. IV except for SSL3 and TLS 1.0
maclobdell 0:f7c60d3e7b8a 730 */
maclobdell 0:f7c60d3e7b8a 731 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
maclobdell 0:f7c60d3e7b8a 732 if( session->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
maclobdell 0:f7c60d3e7b8a 733 {
maclobdell 0:f7c60d3e7b8a 734 transform->minlen = transform->maclen
maclobdell 0:f7c60d3e7b8a 735 + cipher_info->block_size;
maclobdell 0:f7c60d3e7b8a 736 }
maclobdell 0:f7c60d3e7b8a 737 else
maclobdell 0:f7c60d3e7b8a 738 #endif
maclobdell 0:f7c60d3e7b8a 739 {
maclobdell 0:f7c60d3e7b8a 740 transform->minlen = transform->maclen
maclobdell 0:f7c60d3e7b8a 741 + cipher_info->block_size
maclobdell 0:f7c60d3e7b8a 742 - transform->maclen % cipher_info->block_size;
maclobdell 0:f7c60d3e7b8a 743 }
maclobdell 0:f7c60d3e7b8a 744
maclobdell 0:f7c60d3e7b8a 745 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
maclobdell 0:f7c60d3e7b8a 746 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
maclobdell 0:f7c60d3e7b8a 747 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_1 )
maclobdell 0:f7c60d3e7b8a 748 ; /* No need to adjust minlen */
maclobdell 0:f7c60d3e7b8a 749 else
maclobdell 0:f7c60d3e7b8a 750 #endif
maclobdell 0:f7c60d3e7b8a 751 #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 752 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_2 ||
maclobdell 0:f7c60d3e7b8a 753 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
maclobdell 0:f7c60d3e7b8a 754 {
maclobdell 0:f7c60d3e7b8a 755 transform->minlen += transform->ivlen;
maclobdell 0:f7c60d3e7b8a 756 }
maclobdell 0:f7c60d3e7b8a 757 else
maclobdell 0:f7c60d3e7b8a 758 #endif
maclobdell 0:f7c60d3e7b8a 759 {
maclobdell 0:f7c60d3e7b8a 760 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 761 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 762 }
maclobdell 0:f7c60d3e7b8a 763 }
maclobdell 0:f7c60d3e7b8a 764 }
maclobdell 0:f7c60d3e7b8a 765
maclobdell 0:f7c60d3e7b8a 766 MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %d, minlen: %d, ivlen: %d, maclen: %d",
maclobdell 0:f7c60d3e7b8a 767 transform->keylen, transform->minlen, transform->ivlen,
maclobdell 0:f7c60d3e7b8a 768 transform->maclen ) );
maclobdell 0:f7c60d3e7b8a 769
maclobdell 0:f7c60d3e7b8a 770 /*
maclobdell 0:f7c60d3e7b8a 771 * Finally setup the cipher contexts, IVs and MAC secrets.
maclobdell 0:f7c60d3e7b8a 772 */
maclobdell 0:f7c60d3e7b8a 773 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 774 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 775 {
maclobdell 0:f7c60d3e7b8a 776 key1 = keyblk + transform->maclen * 2;
maclobdell 0:f7c60d3e7b8a 777 key2 = keyblk + transform->maclen * 2 + transform->keylen;
maclobdell 0:f7c60d3e7b8a 778
maclobdell 0:f7c60d3e7b8a 779 mac_enc = keyblk;
maclobdell 0:f7c60d3e7b8a 780 mac_dec = keyblk + transform->maclen;
maclobdell 0:f7c60d3e7b8a 781
maclobdell 0:f7c60d3e7b8a 782 /*
maclobdell 0:f7c60d3e7b8a 783 * This is not used in TLS v1.1.
maclobdell 0:f7c60d3e7b8a 784 */
maclobdell 0:f7c60d3e7b8a 785 iv_copy_len = ( transform->fixed_ivlen ) ?
maclobdell 0:f7c60d3e7b8a 786 transform->fixed_ivlen : transform->ivlen;
maclobdell 0:f7c60d3e7b8a 787 memcpy( transform->iv_enc, key2 + transform->keylen, iv_copy_len );
maclobdell 0:f7c60d3e7b8a 788 memcpy( transform->iv_dec, key2 + transform->keylen + iv_copy_len,
maclobdell 0:f7c60d3e7b8a 789 iv_copy_len );
maclobdell 0:f7c60d3e7b8a 790 }
maclobdell 0:f7c60d3e7b8a 791 else
maclobdell 0:f7c60d3e7b8a 792 #endif /* MBEDTLS_SSL_CLI_C */
maclobdell 0:f7c60d3e7b8a 793 #if defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 794 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
maclobdell 0:f7c60d3e7b8a 795 {
maclobdell 0:f7c60d3e7b8a 796 key1 = keyblk + transform->maclen * 2 + transform->keylen;
maclobdell 0:f7c60d3e7b8a 797 key2 = keyblk + transform->maclen * 2;
maclobdell 0:f7c60d3e7b8a 798
maclobdell 0:f7c60d3e7b8a 799 mac_enc = keyblk + transform->maclen;
maclobdell 0:f7c60d3e7b8a 800 mac_dec = keyblk;
maclobdell 0:f7c60d3e7b8a 801
maclobdell 0:f7c60d3e7b8a 802 /*
maclobdell 0:f7c60d3e7b8a 803 * This is not used in TLS v1.1.
maclobdell 0:f7c60d3e7b8a 804 */
maclobdell 0:f7c60d3e7b8a 805 iv_copy_len = ( transform->fixed_ivlen ) ?
maclobdell 0:f7c60d3e7b8a 806 transform->fixed_ivlen : transform->ivlen;
maclobdell 0:f7c60d3e7b8a 807 memcpy( transform->iv_dec, key1 + transform->keylen, iv_copy_len );
maclobdell 0:f7c60d3e7b8a 808 memcpy( transform->iv_enc, key1 + transform->keylen + iv_copy_len,
maclobdell 0:f7c60d3e7b8a 809 iv_copy_len );
maclobdell 0:f7c60d3e7b8a 810 }
maclobdell 0:f7c60d3e7b8a 811 else
maclobdell 0:f7c60d3e7b8a 812 #endif /* MBEDTLS_SSL_SRV_C */
maclobdell 0:f7c60d3e7b8a 813 {
maclobdell 0:f7c60d3e7b8a 814 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 815 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 816 }
maclobdell 0:f7c60d3e7b8a 817
maclobdell 0:f7c60d3e7b8a 818 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 819 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
maclobdell 0:f7c60d3e7b8a 820 {
maclobdell 0:f7c60d3e7b8a 821 if( transform->maclen > sizeof transform->mac_enc )
maclobdell 0:f7c60d3e7b8a 822 {
maclobdell 0:f7c60d3e7b8a 823 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 824 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 825 }
maclobdell 0:f7c60d3e7b8a 826
maclobdell 0:f7c60d3e7b8a 827 memcpy( transform->mac_enc, mac_enc, transform->maclen );
maclobdell 0:f7c60d3e7b8a 828 memcpy( transform->mac_dec, mac_dec, transform->maclen );
maclobdell 0:f7c60d3e7b8a 829 }
maclobdell 0:f7c60d3e7b8a 830 else
maclobdell 0:f7c60d3e7b8a 831 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
maclobdell 0:f7c60d3e7b8a 832 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
maclobdell 0:f7c60d3e7b8a 833 defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 834 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
maclobdell 0:f7c60d3e7b8a 835 {
maclobdell 0:f7c60d3e7b8a 836 mbedtls_md_hmac_starts( &transform->md_ctx_enc, mac_enc, transform->maclen );
maclobdell 0:f7c60d3e7b8a 837 mbedtls_md_hmac_starts( &transform->md_ctx_dec, mac_dec, transform->maclen );
maclobdell 0:f7c60d3e7b8a 838 }
maclobdell 0:f7c60d3e7b8a 839 else
maclobdell 0:f7c60d3e7b8a 840 #endif
maclobdell 0:f7c60d3e7b8a 841 {
maclobdell 0:f7c60d3e7b8a 842 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 843 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 844 }
maclobdell 0:f7c60d3e7b8a 845
maclobdell 0:f7c60d3e7b8a 846 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
maclobdell 0:f7c60d3e7b8a 847 if( mbedtls_ssl_hw_record_init != NULL )
maclobdell 0:f7c60d3e7b8a 848 {
maclobdell 0:f7c60d3e7b8a 849 int ret = 0;
maclobdell 0:f7c60d3e7b8a 850
maclobdell 0:f7c60d3e7b8a 851 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_init()" ) );
maclobdell 0:f7c60d3e7b8a 852
maclobdell 0:f7c60d3e7b8a 853 if( ( ret = mbedtls_ssl_hw_record_init( ssl, key1, key2, transform->keylen,
maclobdell 0:f7c60d3e7b8a 854 transform->iv_enc, transform->iv_dec,
maclobdell 0:f7c60d3e7b8a 855 iv_copy_len,
maclobdell 0:f7c60d3e7b8a 856 mac_enc, mac_dec,
maclobdell 0:f7c60d3e7b8a 857 transform->maclen ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 858 {
maclobdell 0:f7c60d3e7b8a 859 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_init", ret );
maclobdell 0:f7c60d3e7b8a 860 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
maclobdell 0:f7c60d3e7b8a 861 }
maclobdell 0:f7c60d3e7b8a 862 }
maclobdell 0:f7c60d3e7b8a 863 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
maclobdell 0:f7c60d3e7b8a 864
maclobdell 0:f7c60d3e7b8a 865 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
maclobdell 0:f7c60d3e7b8a 866 if( ssl->conf->f_export_keys != NULL )
maclobdell 0:f7c60d3e7b8a 867 {
maclobdell 0:f7c60d3e7b8a 868 ssl->conf->f_export_keys( ssl->conf->p_export_keys,
maclobdell 0:f7c60d3e7b8a 869 session->master, keyblk,
maclobdell 0:f7c60d3e7b8a 870 transform->maclen, transform->keylen,
maclobdell 0:f7c60d3e7b8a 871 iv_copy_len );
maclobdell 0:f7c60d3e7b8a 872 }
maclobdell 0:f7c60d3e7b8a 873 #endif
maclobdell 0:f7c60d3e7b8a 874
maclobdell 0:f7c60d3e7b8a 875 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc,
maclobdell 0:f7c60d3e7b8a 876 cipher_info ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 877 {
maclobdell 0:f7c60d3e7b8a 878 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
maclobdell 0:f7c60d3e7b8a 879 return( ret );
maclobdell 0:f7c60d3e7b8a 880 }
maclobdell 0:f7c60d3e7b8a 881
maclobdell 0:f7c60d3e7b8a 882 if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec,
maclobdell 0:f7c60d3e7b8a 883 cipher_info ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 884 {
maclobdell 0:f7c60d3e7b8a 885 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret );
maclobdell 0:f7c60d3e7b8a 886 return( ret );
maclobdell 0:f7c60d3e7b8a 887 }
maclobdell 0:f7c60d3e7b8a 888
maclobdell 0:f7c60d3e7b8a 889 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, key1,
maclobdell 0:f7c60d3e7b8a 890 cipher_info->key_bitlen,
maclobdell 0:f7c60d3e7b8a 891 MBEDTLS_ENCRYPT ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 892 {
maclobdell 0:f7c60d3e7b8a 893 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
maclobdell 0:f7c60d3e7b8a 894 return( ret );
maclobdell 0:f7c60d3e7b8a 895 }
maclobdell 0:f7c60d3e7b8a 896
maclobdell 0:f7c60d3e7b8a 897 if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, key2,
maclobdell 0:f7c60d3e7b8a 898 cipher_info->key_bitlen,
maclobdell 0:f7c60d3e7b8a 899 MBEDTLS_DECRYPT ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 900 {
maclobdell 0:f7c60d3e7b8a 901 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret );
maclobdell 0:f7c60d3e7b8a 902 return( ret );
maclobdell 0:f7c60d3e7b8a 903 }
maclobdell 0:f7c60d3e7b8a 904
maclobdell 0:f7c60d3e7b8a 905 #if defined(MBEDTLS_CIPHER_MODE_CBC)
maclobdell 0:f7c60d3e7b8a 906 if( cipher_info->mode == MBEDTLS_MODE_CBC )
maclobdell 0:f7c60d3e7b8a 907 {
maclobdell 0:f7c60d3e7b8a 908 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_enc,
maclobdell 0:f7c60d3e7b8a 909 MBEDTLS_PADDING_NONE ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 910 {
maclobdell 0:f7c60d3e7b8a 911 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
maclobdell 0:f7c60d3e7b8a 912 return( ret );
maclobdell 0:f7c60d3e7b8a 913 }
maclobdell 0:f7c60d3e7b8a 914
maclobdell 0:f7c60d3e7b8a 915 if( ( ret = mbedtls_cipher_set_padding_mode( &transform->cipher_ctx_dec,
maclobdell 0:f7c60d3e7b8a 916 MBEDTLS_PADDING_NONE ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 917 {
maclobdell 0:f7c60d3e7b8a 918 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_set_padding_mode", ret );
maclobdell 0:f7c60d3e7b8a 919 return( ret );
maclobdell 0:f7c60d3e7b8a 920 }
maclobdell 0:f7c60d3e7b8a 921 }
maclobdell 0:f7c60d3e7b8a 922 #endif /* MBEDTLS_CIPHER_MODE_CBC */
maclobdell 0:f7c60d3e7b8a 923
maclobdell 0:f7c60d3e7b8a 924 mbedtls_zeroize( keyblk, sizeof( keyblk ) );
maclobdell 0:f7c60d3e7b8a 925
maclobdell 0:f7c60d3e7b8a 926 #if defined(MBEDTLS_ZLIB_SUPPORT)
maclobdell 0:f7c60d3e7b8a 927 // Initialize compression
maclobdell 0:f7c60d3e7b8a 928 //
maclobdell 0:f7c60d3e7b8a 929 if( session->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
maclobdell 0:f7c60d3e7b8a 930 {
maclobdell 0:f7c60d3e7b8a 931 if( ssl->compress_buf == NULL )
maclobdell 0:f7c60d3e7b8a 932 {
maclobdell 0:f7c60d3e7b8a 933 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
maclobdell 0:f7c60d3e7b8a 934 ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_BUFFER_LEN );
maclobdell 0:f7c60d3e7b8a 935 if( ssl->compress_buf == NULL )
maclobdell 0:f7c60d3e7b8a 936 {
maclobdell 0:f7c60d3e7b8a 937 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
maclobdell 0:f7c60d3e7b8a 938 MBEDTLS_SSL_BUFFER_LEN ) );
maclobdell 0:f7c60d3e7b8a 939 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 940 }
maclobdell 0:f7c60d3e7b8a 941 }
maclobdell 0:f7c60d3e7b8a 942
maclobdell 0:f7c60d3e7b8a 943 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
maclobdell 0:f7c60d3e7b8a 944
maclobdell 0:f7c60d3e7b8a 945 memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) );
maclobdell 0:f7c60d3e7b8a 946 memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) );
maclobdell 0:f7c60d3e7b8a 947
maclobdell 0:f7c60d3e7b8a 948 if( deflateInit( &transform->ctx_deflate,
maclobdell 0:f7c60d3e7b8a 949 Z_DEFAULT_COMPRESSION ) != Z_OK ||
maclobdell 0:f7c60d3e7b8a 950 inflateInit( &transform->ctx_inflate ) != Z_OK )
maclobdell 0:f7c60d3e7b8a 951 {
maclobdell 0:f7c60d3e7b8a 952 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
maclobdell 0:f7c60d3e7b8a 953 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
maclobdell 0:f7c60d3e7b8a 954 }
maclobdell 0:f7c60d3e7b8a 955 }
maclobdell 0:f7c60d3e7b8a 956 #endif /* MBEDTLS_ZLIB_SUPPORT */
maclobdell 0:f7c60d3e7b8a 957
maclobdell 0:f7c60d3e7b8a 958 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
maclobdell 0:f7c60d3e7b8a 959
maclobdell 0:f7c60d3e7b8a 960 return( 0 );
maclobdell 0:f7c60d3e7b8a 961 }
maclobdell 0:f7c60d3e7b8a 962
maclobdell 0:f7c60d3e7b8a 963 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 964 void ssl_calc_verify_ssl( mbedtls_ssl_context *ssl, unsigned char hash[36] )
maclobdell 0:f7c60d3e7b8a 965 {
maclobdell 0:f7c60d3e7b8a 966 mbedtls_md5_context md5;
maclobdell 0:f7c60d3e7b8a 967 mbedtls_sha1_context sha1;
maclobdell 0:f7c60d3e7b8a 968 unsigned char pad_1[48];
maclobdell 0:f7c60d3e7b8a 969 unsigned char pad_2[48];
maclobdell 0:f7c60d3e7b8a 970
maclobdell 0:f7c60d3e7b8a 971 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
maclobdell 0:f7c60d3e7b8a 972
maclobdell 0:f7c60d3e7b8a 973 mbedtls_md5_init( &md5 );
maclobdell 0:f7c60d3e7b8a 974 mbedtls_sha1_init( &sha1 );
maclobdell 0:f7c60d3e7b8a 975
maclobdell 0:f7c60d3e7b8a 976 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
maclobdell 0:f7c60d3e7b8a 977 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
maclobdell 0:f7c60d3e7b8a 978
maclobdell 0:f7c60d3e7b8a 979 memset( pad_1, 0x36, 48 );
maclobdell 0:f7c60d3e7b8a 980 memset( pad_2, 0x5C, 48 );
maclobdell 0:f7c60d3e7b8a 981
maclobdell 0:f7c60d3e7b8a 982 mbedtls_md5_update( &md5, ssl->session_negotiate->master, 48 );
maclobdell 0:f7c60d3e7b8a 983 mbedtls_md5_update( &md5, pad_1, 48 );
maclobdell 0:f7c60d3e7b8a 984 mbedtls_md5_finish( &md5, hash );
maclobdell 0:f7c60d3e7b8a 985
maclobdell 0:f7c60d3e7b8a 986 mbedtls_md5_starts( &md5 );
maclobdell 0:f7c60d3e7b8a 987 mbedtls_md5_update( &md5, ssl->session_negotiate->master, 48 );
maclobdell 0:f7c60d3e7b8a 988 mbedtls_md5_update( &md5, pad_2, 48 );
maclobdell 0:f7c60d3e7b8a 989 mbedtls_md5_update( &md5, hash, 16 );
maclobdell 0:f7c60d3e7b8a 990 mbedtls_md5_finish( &md5, hash );
maclobdell 0:f7c60d3e7b8a 991
maclobdell 0:f7c60d3e7b8a 992 mbedtls_sha1_update( &sha1, ssl->session_negotiate->master, 48 );
maclobdell 0:f7c60d3e7b8a 993 mbedtls_sha1_update( &sha1, pad_1, 40 );
maclobdell 0:f7c60d3e7b8a 994 mbedtls_sha1_finish( &sha1, hash + 16 );
maclobdell 0:f7c60d3e7b8a 995
maclobdell 0:f7c60d3e7b8a 996 mbedtls_sha1_starts( &sha1 );
maclobdell 0:f7c60d3e7b8a 997 mbedtls_sha1_update( &sha1, ssl->session_negotiate->master, 48 );
maclobdell 0:f7c60d3e7b8a 998 mbedtls_sha1_update( &sha1, pad_2, 40 );
maclobdell 0:f7c60d3e7b8a 999 mbedtls_sha1_update( &sha1, hash + 16, 20 );
maclobdell 0:f7c60d3e7b8a 1000 mbedtls_sha1_finish( &sha1, hash + 16 );
maclobdell 0:f7c60d3e7b8a 1001
maclobdell 0:f7c60d3e7b8a 1002 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 );
maclobdell 0:f7c60d3e7b8a 1003 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
maclobdell 0:f7c60d3e7b8a 1004
maclobdell 0:f7c60d3e7b8a 1005 mbedtls_md5_free( &md5 );
maclobdell 0:f7c60d3e7b8a 1006 mbedtls_sha1_free( &sha1 );
maclobdell 0:f7c60d3e7b8a 1007
maclobdell 0:f7c60d3e7b8a 1008 return;
maclobdell 0:f7c60d3e7b8a 1009 }
maclobdell 0:f7c60d3e7b8a 1010 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
maclobdell 0:f7c60d3e7b8a 1011
maclobdell 0:f7c60d3e7b8a 1012 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
maclobdell 0:f7c60d3e7b8a 1013 void ssl_calc_verify_tls( mbedtls_ssl_context *ssl, unsigned char hash[36] )
maclobdell 0:f7c60d3e7b8a 1014 {
maclobdell 0:f7c60d3e7b8a 1015 mbedtls_md5_context md5;
maclobdell 0:f7c60d3e7b8a 1016 mbedtls_sha1_context sha1;
maclobdell 0:f7c60d3e7b8a 1017
maclobdell 0:f7c60d3e7b8a 1018 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
maclobdell 0:f7c60d3e7b8a 1019
maclobdell 0:f7c60d3e7b8a 1020 mbedtls_md5_init( &md5 );
maclobdell 0:f7c60d3e7b8a 1021 mbedtls_sha1_init( &sha1 );
maclobdell 0:f7c60d3e7b8a 1022
maclobdell 0:f7c60d3e7b8a 1023 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
maclobdell 0:f7c60d3e7b8a 1024 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
maclobdell 0:f7c60d3e7b8a 1025
maclobdell 0:f7c60d3e7b8a 1026 mbedtls_md5_finish( &md5, hash );
maclobdell 0:f7c60d3e7b8a 1027 mbedtls_sha1_finish( &sha1, hash + 16 );
maclobdell 0:f7c60d3e7b8a 1028
maclobdell 0:f7c60d3e7b8a 1029 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 );
maclobdell 0:f7c60d3e7b8a 1030 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
maclobdell 0:f7c60d3e7b8a 1031
maclobdell 0:f7c60d3e7b8a 1032 mbedtls_md5_free( &md5 );
maclobdell 0:f7c60d3e7b8a 1033 mbedtls_sha1_free( &sha1 );
maclobdell 0:f7c60d3e7b8a 1034
maclobdell 0:f7c60d3e7b8a 1035 return;
maclobdell 0:f7c60d3e7b8a 1036 }
maclobdell 0:f7c60d3e7b8a 1037 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
maclobdell 0:f7c60d3e7b8a 1038
maclobdell 0:f7c60d3e7b8a 1039 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 1040 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 1041 void ssl_calc_verify_tls_sha256( mbedtls_ssl_context *ssl, unsigned char hash[32] )
maclobdell 0:f7c60d3e7b8a 1042 {
maclobdell 0:f7c60d3e7b8a 1043 mbedtls_sha256_context sha256;
maclobdell 0:f7c60d3e7b8a 1044
maclobdell 0:f7c60d3e7b8a 1045 mbedtls_sha256_init( &sha256 );
maclobdell 0:f7c60d3e7b8a 1046
maclobdell 0:f7c60d3e7b8a 1047 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
maclobdell 0:f7c60d3e7b8a 1048
maclobdell 0:f7c60d3e7b8a 1049 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
maclobdell 0:f7c60d3e7b8a 1050 mbedtls_sha256_finish( &sha256, hash );
maclobdell 0:f7c60d3e7b8a 1051
maclobdell 0:f7c60d3e7b8a 1052 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 32 );
maclobdell 0:f7c60d3e7b8a 1053 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
maclobdell 0:f7c60d3e7b8a 1054
maclobdell 0:f7c60d3e7b8a 1055 mbedtls_sha256_free( &sha256 );
maclobdell 0:f7c60d3e7b8a 1056
maclobdell 0:f7c60d3e7b8a 1057 return;
maclobdell 0:f7c60d3e7b8a 1058 }
maclobdell 0:f7c60d3e7b8a 1059 #endif /* MBEDTLS_SHA256_C */
maclobdell 0:f7c60d3e7b8a 1060
maclobdell 0:f7c60d3e7b8a 1061 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 1062 void ssl_calc_verify_tls_sha384( mbedtls_ssl_context *ssl, unsigned char hash[48] )
maclobdell 0:f7c60d3e7b8a 1063 {
maclobdell 0:f7c60d3e7b8a 1064 mbedtls_sha512_context sha512;
maclobdell 0:f7c60d3e7b8a 1065
maclobdell 0:f7c60d3e7b8a 1066 mbedtls_sha512_init( &sha512 );
maclobdell 0:f7c60d3e7b8a 1067
maclobdell 0:f7c60d3e7b8a 1068 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
maclobdell 0:f7c60d3e7b8a 1069
maclobdell 0:f7c60d3e7b8a 1070 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
maclobdell 0:f7c60d3e7b8a 1071 mbedtls_sha512_finish( &sha512, hash );
maclobdell 0:f7c60d3e7b8a 1072
maclobdell 0:f7c60d3e7b8a 1073 MBEDTLS_SSL_DEBUG_BUF( 3, "calculated verify result", hash, 48 );
maclobdell 0:f7c60d3e7b8a 1074 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
maclobdell 0:f7c60d3e7b8a 1075
maclobdell 0:f7c60d3e7b8a 1076 mbedtls_sha512_free( &sha512 );
maclobdell 0:f7c60d3e7b8a 1077
maclobdell 0:f7c60d3e7b8a 1078 return;
maclobdell 0:f7c60d3e7b8a 1079 }
maclobdell 0:f7c60d3e7b8a 1080 #endif /* MBEDTLS_SHA512_C */
maclobdell 0:f7c60d3e7b8a 1081 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 1082
maclobdell 0:f7c60d3e7b8a 1083 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
maclobdell 0:f7c60d3e7b8a 1084 int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex )
maclobdell 0:f7c60d3e7b8a 1085 {
maclobdell 0:f7c60d3e7b8a 1086 unsigned char *p = ssl->handshake->premaster;
maclobdell 0:f7c60d3e7b8a 1087 unsigned char *end = p + sizeof( ssl->handshake->premaster );
maclobdell 0:f7c60d3e7b8a 1088 const unsigned char *psk = ssl->conf->psk;
maclobdell 0:f7c60d3e7b8a 1089 size_t psk_len = ssl->conf->psk_len;
maclobdell 0:f7c60d3e7b8a 1090
maclobdell 0:f7c60d3e7b8a 1091 /* If the psk callback was called, use its result */
maclobdell 0:f7c60d3e7b8a 1092 if( ssl->handshake->psk != NULL )
maclobdell 0:f7c60d3e7b8a 1093 {
maclobdell 0:f7c60d3e7b8a 1094 psk = ssl->handshake->psk;
maclobdell 0:f7c60d3e7b8a 1095 psk_len = ssl->handshake->psk_len;
maclobdell 0:f7c60d3e7b8a 1096 }
maclobdell 0:f7c60d3e7b8a 1097
maclobdell 0:f7c60d3e7b8a 1098 /*
maclobdell 0:f7c60d3e7b8a 1099 * PMS = struct {
maclobdell 0:f7c60d3e7b8a 1100 * opaque other_secret<0..2^16-1>;
maclobdell 0:f7c60d3e7b8a 1101 * opaque psk<0..2^16-1>;
maclobdell 0:f7c60d3e7b8a 1102 * };
maclobdell 0:f7c60d3e7b8a 1103 * with "other_secret" depending on the particular key exchange
maclobdell 0:f7c60d3e7b8a 1104 */
maclobdell 0:f7c60d3e7b8a 1105 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
maclobdell 0:f7c60d3e7b8a 1106 if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
maclobdell 0:f7c60d3e7b8a 1107 {
maclobdell 0:f7c60d3e7b8a 1108 if( end - p < 2 )
maclobdell 0:f7c60d3e7b8a 1109 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 1110
maclobdell 0:f7c60d3e7b8a 1111 *(p++) = (unsigned char)( psk_len >> 8 );
maclobdell 0:f7c60d3e7b8a 1112 *(p++) = (unsigned char)( psk_len );
maclobdell 0:f7c60d3e7b8a 1113
maclobdell 0:f7c60d3e7b8a 1114 if( end < p || (size_t)( end - p ) < psk_len )
maclobdell 0:f7c60d3e7b8a 1115 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 1116
maclobdell 0:f7c60d3e7b8a 1117 memset( p, 0, psk_len );
maclobdell 0:f7c60d3e7b8a 1118 p += psk_len;
maclobdell 0:f7c60d3e7b8a 1119 }
maclobdell 0:f7c60d3e7b8a 1120 else
maclobdell 0:f7c60d3e7b8a 1121 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
maclobdell 0:f7c60d3e7b8a 1122 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
maclobdell 0:f7c60d3e7b8a 1123 if( key_ex == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
maclobdell 0:f7c60d3e7b8a 1124 {
maclobdell 0:f7c60d3e7b8a 1125 /*
maclobdell 0:f7c60d3e7b8a 1126 * other_secret already set by the ClientKeyExchange message,
maclobdell 0:f7c60d3e7b8a 1127 * and is 48 bytes long
maclobdell 0:f7c60d3e7b8a 1128 */
maclobdell 0:f7c60d3e7b8a 1129 *p++ = 0;
maclobdell 0:f7c60d3e7b8a 1130 *p++ = 48;
maclobdell 0:f7c60d3e7b8a 1131 p += 48;
maclobdell 0:f7c60d3e7b8a 1132 }
maclobdell 0:f7c60d3e7b8a 1133 else
maclobdell 0:f7c60d3e7b8a 1134 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
maclobdell 0:f7c60d3e7b8a 1135 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
maclobdell 0:f7c60d3e7b8a 1136 if( key_ex == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
maclobdell 0:f7c60d3e7b8a 1137 {
maclobdell 0:f7c60d3e7b8a 1138 int ret;
maclobdell 0:f7c60d3e7b8a 1139 size_t len;
maclobdell 0:f7c60d3e7b8a 1140
maclobdell 0:f7c60d3e7b8a 1141 /* Write length only when we know the actual value */
maclobdell 0:f7c60d3e7b8a 1142 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
maclobdell 0:f7c60d3e7b8a 1143 p + 2, end - ( p + 2 ), &len,
maclobdell 0:f7c60d3e7b8a 1144 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 1145 {
maclobdell 0:f7c60d3e7b8a 1146 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
maclobdell 0:f7c60d3e7b8a 1147 return( ret );
maclobdell 0:f7c60d3e7b8a 1148 }
maclobdell 0:f7c60d3e7b8a 1149 *(p++) = (unsigned char)( len >> 8 );
maclobdell 0:f7c60d3e7b8a 1150 *(p++) = (unsigned char)( len );
maclobdell 0:f7c60d3e7b8a 1151 p += len;
maclobdell 0:f7c60d3e7b8a 1152
maclobdell 0:f7c60d3e7b8a 1153 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
maclobdell 0:f7c60d3e7b8a 1154 }
maclobdell 0:f7c60d3e7b8a 1155 else
maclobdell 0:f7c60d3e7b8a 1156 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
maclobdell 0:f7c60d3e7b8a 1157 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
maclobdell 0:f7c60d3e7b8a 1158 if( key_ex == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
maclobdell 0:f7c60d3e7b8a 1159 {
maclobdell 0:f7c60d3e7b8a 1160 int ret;
maclobdell 0:f7c60d3e7b8a 1161 size_t zlen;
maclobdell 0:f7c60d3e7b8a 1162
maclobdell 0:f7c60d3e7b8a 1163 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, &zlen,
maclobdell 0:f7c60d3e7b8a 1164 p + 2, end - ( p + 2 ),
maclobdell 0:f7c60d3e7b8a 1165 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 1166 {
maclobdell 0:f7c60d3e7b8a 1167 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
maclobdell 0:f7c60d3e7b8a 1168 return( ret );
maclobdell 0:f7c60d3e7b8a 1169 }
maclobdell 0:f7c60d3e7b8a 1170
maclobdell 0:f7c60d3e7b8a 1171 *(p++) = (unsigned char)( zlen >> 8 );
maclobdell 0:f7c60d3e7b8a 1172 *(p++) = (unsigned char)( zlen );
maclobdell 0:f7c60d3e7b8a 1173 p += zlen;
maclobdell 0:f7c60d3e7b8a 1174
maclobdell 0:f7c60d3e7b8a 1175 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z );
maclobdell 0:f7c60d3e7b8a 1176 }
maclobdell 0:f7c60d3e7b8a 1177 else
maclobdell 0:f7c60d3e7b8a 1178 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
maclobdell 0:f7c60d3e7b8a 1179 {
maclobdell 0:f7c60d3e7b8a 1180 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1181 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1182 }
maclobdell 0:f7c60d3e7b8a 1183
maclobdell 0:f7c60d3e7b8a 1184 /* opaque psk<0..2^16-1>; */
maclobdell 0:f7c60d3e7b8a 1185 if( end - p < 2 )
maclobdell 0:f7c60d3e7b8a 1186 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 1187
maclobdell 0:f7c60d3e7b8a 1188 *(p++) = (unsigned char)( psk_len >> 8 );
maclobdell 0:f7c60d3e7b8a 1189 *(p++) = (unsigned char)( psk_len );
maclobdell 0:f7c60d3e7b8a 1190
maclobdell 0:f7c60d3e7b8a 1191 if( end < p || (size_t)( end - p ) < psk_len )
maclobdell 0:f7c60d3e7b8a 1192 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 1193
maclobdell 0:f7c60d3e7b8a 1194 memcpy( p, psk, psk_len );
maclobdell 0:f7c60d3e7b8a 1195 p += psk_len;
maclobdell 0:f7c60d3e7b8a 1196
maclobdell 0:f7c60d3e7b8a 1197 ssl->handshake->pmslen = p - ssl->handshake->premaster;
maclobdell 0:f7c60d3e7b8a 1198
maclobdell 0:f7c60d3e7b8a 1199 return( 0 );
maclobdell 0:f7c60d3e7b8a 1200 }
maclobdell 0:f7c60d3e7b8a 1201 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
maclobdell 0:f7c60d3e7b8a 1202
maclobdell 0:f7c60d3e7b8a 1203 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 1204 /*
maclobdell 0:f7c60d3e7b8a 1205 * SSLv3.0 MAC functions
maclobdell 0:f7c60d3e7b8a 1206 */
maclobdell 0:f7c60d3e7b8a 1207 static void ssl_mac( mbedtls_md_context_t *md_ctx, unsigned char *secret,
maclobdell 0:f7c60d3e7b8a 1208 unsigned char *buf, size_t len,
maclobdell 0:f7c60d3e7b8a 1209 unsigned char *ctr, int type )
maclobdell 0:f7c60d3e7b8a 1210 {
maclobdell 0:f7c60d3e7b8a 1211 unsigned char header[11];
maclobdell 0:f7c60d3e7b8a 1212 unsigned char padding[48];
maclobdell 0:f7c60d3e7b8a 1213 int padlen;
maclobdell 0:f7c60d3e7b8a 1214 int md_size = mbedtls_md_get_size( md_ctx->md_info );
maclobdell 0:f7c60d3e7b8a 1215 int md_type = mbedtls_md_get_type( md_ctx->md_info );
maclobdell 0:f7c60d3e7b8a 1216
maclobdell 0:f7c60d3e7b8a 1217 /* Only MD5 and SHA-1 supported */
maclobdell 0:f7c60d3e7b8a 1218 if( md_type == MBEDTLS_MD_MD5 )
maclobdell 0:f7c60d3e7b8a 1219 padlen = 48;
maclobdell 0:f7c60d3e7b8a 1220 else
maclobdell 0:f7c60d3e7b8a 1221 padlen = 40;
maclobdell 0:f7c60d3e7b8a 1222
maclobdell 0:f7c60d3e7b8a 1223 memcpy( header, ctr, 8 );
maclobdell 0:f7c60d3e7b8a 1224 header[ 8] = (unsigned char) type;
maclobdell 0:f7c60d3e7b8a 1225 header[ 9] = (unsigned char)( len >> 8 );
maclobdell 0:f7c60d3e7b8a 1226 header[10] = (unsigned char)( len );
maclobdell 0:f7c60d3e7b8a 1227
maclobdell 0:f7c60d3e7b8a 1228 memset( padding, 0x36, padlen );
maclobdell 0:f7c60d3e7b8a 1229 mbedtls_md_starts( md_ctx );
maclobdell 0:f7c60d3e7b8a 1230 mbedtls_md_update( md_ctx, secret, md_size );
maclobdell 0:f7c60d3e7b8a 1231 mbedtls_md_update( md_ctx, padding, padlen );
maclobdell 0:f7c60d3e7b8a 1232 mbedtls_md_update( md_ctx, header, 11 );
maclobdell 0:f7c60d3e7b8a 1233 mbedtls_md_update( md_ctx, buf, len );
maclobdell 0:f7c60d3e7b8a 1234 mbedtls_md_finish( md_ctx, buf + len );
maclobdell 0:f7c60d3e7b8a 1235
maclobdell 0:f7c60d3e7b8a 1236 memset( padding, 0x5C, padlen );
maclobdell 0:f7c60d3e7b8a 1237 mbedtls_md_starts( md_ctx );
maclobdell 0:f7c60d3e7b8a 1238 mbedtls_md_update( md_ctx, secret, md_size );
maclobdell 0:f7c60d3e7b8a 1239 mbedtls_md_update( md_ctx, padding, padlen );
maclobdell 0:f7c60d3e7b8a 1240 mbedtls_md_update( md_ctx, buf + len, md_size );
maclobdell 0:f7c60d3e7b8a 1241 mbedtls_md_finish( md_ctx, buf + len );
maclobdell 0:f7c60d3e7b8a 1242 }
maclobdell 0:f7c60d3e7b8a 1243 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
maclobdell 0:f7c60d3e7b8a 1244
maclobdell 0:f7c60d3e7b8a 1245 #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER) || \
maclobdell 0:f7c60d3e7b8a 1246 ( defined(MBEDTLS_CIPHER_MODE_CBC) && \
maclobdell 0:f7c60d3e7b8a 1247 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) ) )
maclobdell 0:f7c60d3e7b8a 1248 #define SSL_SOME_MODES_USE_MAC
maclobdell 0:f7c60d3e7b8a 1249 #endif
maclobdell 0:f7c60d3e7b8a 1250
maclobdell 0:f7c60d3e7b8a 1251 /*
maclobdell 0:f7c60d3e7b8a 1252 * Encryption/decryption functions
maclobdell 0:f7c60d3e7b8a 1253 */
maclobdell 0:f7c60d3e7b8a 1254 static int ssl_encrypt_buf( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 1255 {
maclobdell 0:f7c60d3e7b8a 1256 mbedtls_cipher_mode_t mode;
maclobdell 0:f7c60d3e7b8a 1257 int auth_done = 0;
maclobdell 0:f7c60d3e7b8a 1258
maclobdell 0:f7c60d3e7b8a 1259 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
maclobdell 0:f7c60d3e7b8a 1260
maclobdell 0:f7c60d3e7b8a 1261 if( ssl->session_out == NULL || ssl->transform_out == NULL )
maclobdell 0:f7c60d3e7b8a 1262 {
maclobdell 0:f7c60d3e7b8a 1263 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1264 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1265 }
maclobdell 0:f7c60d3e7b8a 1266
maclobdell 0:f7c60d3e7b8a 1267 mode = mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc );
maclobdell 0:f7c60d3e7b8a 1268
maclobdell 0:f7c60d3e7b8a 1269 MBEDTLS_SSL_DEBUG_BUF( 4, "before encrypt: output payload",
maclobdell 0:f7c60d3e7b8a 1270 ssl->out_msg, ssl->out_msglen );
maclobdell 0:f7c60d3e7b8a 1271
maclobdell 0:f7c60d3e7b8a 1272 /*
maclobdell 0:f7c60d3e7b8a 1273 * Add MAC before if needed
maclobdell 0:f7c60d3e7b8a 1274 */
maclobdell 0:f7c60d3e7b8a 1275 #if defined(SSL_SOME_MODES_USE_MAC)
maclobdell 0:f7c60d3e7b8a 1276 if( mode == MBEDTLS_MODE_STREAM ||
maclobdell 0:f7c60d3e7b8a 1277 ( mode == MBEDTLS_MODE_CBC
maclobdell 0:f7c60d3e7b8a 1278 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
maclobdell 0:f7c60d3e7b8a 1279 && ssl->session_out->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED
maclobdell 0:f7c60d3e7b8a 1280 #endif
maclobdell 0:f7c60d3e7b8a 1281 ) )
maclobdell 0:f7c60d3e7b8a 1282 {
maclobdell 0:f7c60d3e7b8a 1283 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 1284 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
maclobdell 0:f7c60d3e7b8a 1285 {
maclobdell 0:f7c60d3e7b8a 1286 ssl_mac( &ssl->transform_out->md_ctx_enc,
maclobdell 0:f7c60d3e7b8a 1287 ssl->transform_out->mac_enc,
maclobdell 0:f7c60d3e7b8a 1288 ssl->out_msg, ssl->out_msglen,
maclobdell 0:f7c60d3e7b8a 1289 ssl->out_ctr, ssl->out_msgtype );
maclobdell 0:f7c60d3e7b8a 1290 }
maclobdell 0:f7c60d3e7b8a 1291 else
maclobdell 0:f7c60d3e7b8a 1292 #endif
maclobdell 0:f7c60d3e7b8a 1293 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
maclobdell 0:f7c60d3e7b8a 1294 defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 1295 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
maclobdell 0:f7c60d3e7b8a 1296 {
maclobdell 0:f7c60d3e7b8a 1297 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_ctr, 8 );
maclobdell 0:f7c60d3e7b8a 1298 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_hdr, 3 );
maclobdell 0:f7c60d3e7b8a 1299 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, ssl->out_len, 2 );
maclobdell 0:f7c60d3e7b8a 1300 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc,
maclobdell 0:f7c60d3e7b8a 1301 ssl->out_msg, ssl->out_msglen );
maclobdell 0:f7c60d3e7b8a 1302 mbedtls_md_hmac_finish( &ssl->transform_out->md_ctx_enc,
maclobdell 0:f7c60d3e7b8a 1303 ssl->out_msg + ssl->out_msglen );
maclobdell 0:f7c60d3e7b8a 1304 mbedtls_md_hmac_reset( &ssl->transform_out->md_ctx_enc );
maclobdell 0:f7c60d3e7b8a 1305 }
maclobdell 0:f7c60d3e7b8a 1306 else
maclobdell 0:f7c60d3e7b8a 1307 #endif
maclobdell 0:f7c60d3e7b8a 1308 {
maclobdell 0:f7c60d3e7b8a 1309 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1310 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1311 }
maclobdell 0:f7c60d3e7b8a 1312
maclobdell 0:f7c60d3e7b8a 1313 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac",
maclobdell 0:f7c60d3e7b8a 1314 ssl->out_msg + ssl->out_msglen,
maclobdell 0:f7c60d3e7b8a 1315 ssl->transform_out->maclen );
maclobdell 0:f7c60d3e7b8a 1316
maclobdell 0:f7c60d3e7b8a 1317 ssl->out_msglen += ssl->transform_out->maclen;
maclobdell 0:f7c60d3e7b8a 1318 auth_done++;
maclobdell 0:f7c60d3e7b8a 1319 }
maclobdell 0:f7c60d3e7b8a 1320 #endif /* AEAD not the only option */
maclobdell 0:f7c60d3e7b8a 1321
maclobdell 0:f7c60d3e7b8a 1322 /*
maclobdell 0:f7c60d3e7b8a 1323 * Encrypt
maclobdell 0:f7c60d3e7b8a 1324 */
maclobdell 0:f7c60d3e7b8a 1325 #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
maclobdell 0:f7c60d3e7b8a 1326 if( mode == MBEDTLS_MODE_STREAM )
maclobdell 0:f7c60d3e7b8a 1327 {
maclobdell 0:f7c60d3e7b8a 1328 int ret;
maclobdell 0:f7c60d3e7b8a 1329 size_t olen = 0;
maclobdell 0:f7c60d3e7b8a 1330
maclobdell 0:f7c60d3e7b8a 1331 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
maclobdell 0:f7c60d3e7b8a 1332 "including %d bytes of padding",
maclobdell 0:f7c60d3e7b8a 1333 ssl->out_msglen, 0 ) );
maclobdell 0:f7c60d3e7b8a 1334
maclobdell 0:f7c60d3e7b8a 1335 if( ( ret = mbedtls_cipher_crypt( &ssl->transform_out->cipher_ctx_enc,
maclobdell 0:f7c60d3e7b8a 1336 ssl->transform_out->iv_enc,
maclobdell 0:f7c60d3e7b8a 1337 ssl->transform_out->ivlen,
maclobdell 0:f7c60d3e7b8a 1338 ssl->out_msg, ssl->out_msglen,
maclobdell 0:f7c60d3e7b8a 1339 ssl->out_msg, &olen ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 1340 {
maclobdell 0:f7c60d3e7b8a 1341 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
maclobdell 0:f7c60d3e7b8a 1342 return( ret );
maclobdell 0:f7c60d3e7b8a 1343 }
maclobdell 0:f7c60d3e7b8a 1344
maclobdell 0:f7c60d3e7b8a 1345 if( ssl->out_msglen != olen )
maclobdell 0:f7c60d3e7b8a 1346 {
maclobdell 0:f7c60d3e7b8a 1347 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1348 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1349 }
maclobdell 0:f7c60d3e7b8a 1350 }
maclobdell 0:f7c60d3e7b8a 1351 else
maclobdell 0:f7c60d3e7b8a 1352 #endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
maclobdell 0:f7c60d3e7b8a 1353 #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C)
maclobdell 0:f7c60d3e7b8a 1354 if( mode == MBEDTLS_MODE_GCM ||
maclobdell 0:f7c60d3e7b8a 1355 mode == MBEDTLS_MODE_CCM )
maclobdell 0:f7c60d3e7b8a 1356 {
maclobdell 0:f7c60d3e7b8a 1357 int ret;
maclobdell 0:f7c60d3e7b8a 1358 size_t enc_msglen, olen;
maclobdell 0:f7c60d3e7b8a 1359 unsigned char *enc_msg;
maclobdell 0:f7c60d3e7b8a 1360 unsigned char add_data[13];
maclobdell 0:f7c60d3e7b8a 1361 unsigned char taglen = ssl->transform_out->ciphersuite_info->flags &
maclobdell 0:f7c60d3e7b8a 1362 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
maclobdell 0:f7c60d3e7b8a 1363
maclobdell 0:f7c60d3e7b8a 1364 memcpy( add_data, ssl->out_ctr, 8 );
maclobdell 0:f7c60d3e7b8a 1365 add_data[8] = ssl->out_msgtype;
maclobdell 0:f7c60d3e7b8a 1366 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
maclobdell 0:f7c60d3e7b8a 1367 ssl->conf->transport, add_data + 9 );
maclobdell 0:f7c60d3e7b8a 1368 add_data[11] = ( ssl->out_msglen >> 8 ) & 0xFF;
maclobdell 0:f7c60d3e7b8a 1369 add_data[12] = ssl->out_msglen & 0xFF;
maclobdell 0:f7c60d3e7b8a 1370
maclobdell 0:f7c60d3e7b8a 1371 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
maclobdell 0:f7c60d3e7b8a 1372 add_data, 13 );
maclobdell 0:f7c60d3e7b8a 1373
maclobdell 0:f7c60d3e7b8a 1374 /*
maclobdell 0:f7c60d3e7b8a 1375 * Generate IV
maclobdell 0:f7c60d3e7b8a 1376 */
maclobdell 0:f7c60d3e7b8a 1377 #if defined(MBEDTLS_SSL_AEAD_RANDOM_IV)
maclobdell 0:f7c60d3e7b8a 1378 ret = ssl->conf->f_rng( ssl->conf->p_rng,
maclobdell 0:f7c60d3e7b8a 1379 ssl->transform_out->iv_enc + ssl->transform_out->fixed_ivlen,
maclobdell 0:f7c60d3e7b8a 1380 ssl->transform_out->ivlen - ssl->transform_out->fixed_ivlen );
maclobdell 0:f7c60d3e7b8a 1381 if( ret != 0 )
maclobdell 0:f7c60d3e7b8a 1382 return( ret );
maclobdell 0:f7c60d3e7b8a 1383
maclobdell 0:f7c60d3e7b8a 1384 memcpy( ssl->out_iv,
maclobdell 0:f7c60d3e7b8a 1385 ssl->transform_out->iv_enc + ssl->transform_out->fixed_ivlen,
maclobdell 0:f7c60d3e7b8a 1386 ssl->transform_out->ivlen - ssl->transform_out->fixed_ivlen );
maclobdell 0:f7c60d3e7b8a 1387 #else
maclobdell 0:f7c60d3e7b8a 1388 if( ssl->transform_out->ivlen - ssl->transform_out->fixed_ivlen != 8 )
maclobdell 0:f7c60d3e7b8a 1389 {
maclobdell 0:f7c60d3e7b8a 1390 /* Reminder if we ever add an AEAD mode with a different size */
maclobdell 0:f7c60d3e7b8a 1391 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1392 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1393 }
maclobdell 0:f7c60d3e7b8a 1394
maclobdell 0:f7c60d3e7b8a 1395 memcpy( ssl->transform_out->iv_enc + ssl->transform_out->fixed_ivlen,
maclobdell 0:f7c60d3e7b8a 1396 ssl->out_ctr, 8 );
maclobdell 0:f7c60d3e7b8a 1397 memcpy( ssl->out_iv, ssl->out_ctr, 8 );
maclobdell 0:f7c60d3e7b8a 1398 #endif
maclobdell 0:f7c60d3e7b8a 1399
maclobdell 0:f7c60d3e7b8a 1400 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", ssl->out_iv,
maclobdell 0:f7c60d3e7b8a 1401 ssl->transform_out->ivlen - ssl->transform_out->fixed_ivlen );
maclobdell 0:f7c60d3e7b8a 1402
maclobdell 0:f7c60d3e7b8a 1403 /*
maclobdell 0:f7c60d3e7b8a 1404 * Fix pointer positions and message length with added IV
maclobdell 0:f7c60d3e7b8a 1405 */
maclobdell 0:f7c60d3e7b8a 1406 enc_msg = ssl->out_msg;
maclobdell 0:f7c60d3e7b8a 1407 enc_msglen = ssl->out_msglen;
maclobdell 0:f7c60d3e7b8a 1408 ssl->out_msglen += ssl->transform_out->ivlen -
maclobdell 0:f7c60d3e7b8a 1409 ssl->transform_out->fixed_ivlen;
maclobdell 0:f7c60d3e7b8a 1410
maclobdell 0:f7c60d3e7b8a 1411 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
maclobdell 0:f7c60d3e7b8a 1412 "including %d bytes of padding",
maclobdell 0:f7c60d3e7b8a 1413 ssl->out_msglen, 0 ) );
maclobdell 0:f7c60d3e7b8a 1414
maclobdell 0:f7c60d3e7b8a 1415 /*
maclobdell 0:f7c60d3e7b8a 1416 * Encrypt and authenticate
maclobdell 0:f7c60d3e7b8a 1417 */
maclobdell 0:f7c60d3e7b8a 1418 if( ( ret = mbedtls_cipher_auth_encrypt( &ssl->transform_out->cipher_ctx_enc,
maclobdell 0:f7c60d3e7b8a 1419 ssl->transform_out->iv_enc,
maclobdell 0:f7c60d3e7b8a 1420 ssl->transform_out->ivlen,
maclobdell 0:f7c60d3e7b8a 1421 add_data, 13,
maclobdell 0:f7c60d3e7b8a 1422 enc_msg, enc_msglen,
maclobdell 0:f7c60d3e7b8a 1423 enc_msg, &olen,
maclobdell 0:f7c60d3e7b8a 1424 enc_msg + enc_msglen, taglen ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 1425 {
maclobdell 0:f7c60d3e7b8a 1426 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_encrypt", ret );
maclobdell 0:f7c60d3e7b8a 1427 return( ret );
maclobdell 0:f7c60d3e7b8a 1428 }
maclobdell 0:f7c60d3e7b8a 1429
maclobdell 0:f7c60d3e7b8a 1430 if( olen != enc_msglen )
maclobdell 0:f7c60d3e7b8a 1431 {
maclobdell 0:f7c60d3e7b8a 1432 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1433 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1434 }
maclobdell 0:f7c60d3e7b8a 1435
maclobdell 0:f7c60d3e7b8a 1436 ssl->out_msglen += taglen;
maclobdell 0:f7c60d3e7b8a 1437 auth_done++;
maclobdell 0:f7c60d3e7b8a 1438
maclobdell 0:f7c60d3e7b8a 1439 MBEDTLS_SSL_DEBUG_BUF( 4, "after encrypt: tag", enc_msg + enc_msglen, taglen );
maclobdell 0:f7c60d3e7b8a 1440 }
maclobdell 0:f7c60d3e7b8a 1441 else
maclobdell 0:f7c60d3e7b8a 1442 #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
maclobdell 0:f7c60d3e7b8a 1443 #if defined(MBEDTLS_CIPHER_MODE_CBC) && \
maclobdell 0:f7c60d3e7b8a 1444 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) )
maclobdell 0:f7c60d3e7b8a 1445 if( mode == MBEDTLS_MODE_CBC )
maclobdell 0:f7c60d3e7b8a 1446 {
maclobdell 0:f7c60d3e7b8a 1447 int ret;
maclobdell 0:f7c60d3e7b8a 1448 unsigned char *enc_msg;
maclobdell 0:f7c60d3e7b8a 1449 size_t enc_msglen, padlen, olen = 0, i;
maclobdell 0:f7c60d3e7b8a 1450
maclobdell 0:f7c60d3e7b8a 1451 padlen = ssl->transform_out->ivlen - ( ssl->out_msglen + 1 ) %
maclobdell 0:f7c60d3e7b8a 1452 ssl->transform_out->ivlen;
maclobdell 0:f7c60d3e7b8a 1453 if( padlen == ssl->transform_out->ivlen )
maclobdell 0:f7c60d3e7b8a 1454 padlen = 0;
maclobdell 0:f7c60d3e7b8a 1455
maclobdell 0:f7c60d3e7b8a 1456 for( i = 0; i <= padlen; i++ )
maclobdell 0:f7c60d3e7b8a 1457 ssl->out_msg[ssl->out_msglen + i] = (unsigned char) padlen;
maclobdell 0:f7c60d3e7b8a 1458
maclobdell 0:f7c60d3e7b8a 1459 ssl->out_msglen += padlen + 1;
maclobdell 0:f7c60d3e7b8a 1460
maclobdell 0:f7c60d3e7b8a 1461 enc_msglen = ssl->out_msglen;
maclobdell 0:f7c60d3e7b8a 1462 enc_msg = ssl->out_msg;
maclobdell 0:f7c60d3e7b8a 1463
maclobdell 0:f7c60d3e7b8a 1464 #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 1465 /*
maclobdell 0:f7c60d3e7b8a 1466 * Prepend per-record IV for block cipher in TLS v1.1 and up as per
maclobdell 0:f7c60d3e7b8a 1467 * Method 1 (6.2.3.2. in RFC4346 and RFC5246)
maclobdell 0:f7c60d3e7b8a 1468 */
maclobdell 0:f7c60d3e7b8a 1469 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
maclobdell 0:f7c60d3e7b8a 1470 {
maclobdell 0:f7c60d3e7b8a 1471 /*
maclobdell 0:f7c60d3e7b8a 1472 * Generate IV
maclobdell 0:f7c60d3e7b8a 1473 */
maclobdell 0:f7c60d3e7b8a 1474 ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->transform_out->iv_enc,
maclobdell 0:f7c60d3e7b8a 1475 ssl->transform_out->ivlen );
maclobdell 0:f7c60d3e7b8a 1476 if( ret != 0 )
maclobdell 0:f7c60d3e7b8a 1477 return( ret );
maclobdell 0:f7c60d3e7b8a 1478
maclobdell 0:f7c60d3e7b8a 1479 memcpy( ssl->out_iv, ssl->transform_out->iv_enc,
maclobdell 0:f7c60d3e7b8a 1480 ssl->transform_out->ivlen );
maclobdell 0:f7c60d3e7b8a 1481
maclobdell 0:f7c60d3e7b8a 1482 /*
maclobdell 0:f7c60d3e7b8a 1483 * Fix pointer positions and message length with added IV
maclobdell 0:f7c60d3e7b8a 1484 */
maclobdell 0:f7c60d3e7b8a 1485 enc_msg = ssl->out_msg;
maclobdell 0:f7c60d3e7b8a 1486 enc_msglen = ssl->out_msglen;
maclobdell 0:f7c60d3e7b8a 1487 ssl->out_msglen += ssl->transform_out->ivlen;
maclobdell 0:f7c60d3e7b8a 1488 }
maclobdell 0:f7c60d3e7b8a 1489 #endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 1490
maclobdell 0:f7c60d3e7b8a 1491 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
maclobdell 0:f7c60d3e7b8a 1492 "including %d bytes of IV and %d bytes of padding",
maclobdell 0:f7c60d3e7b8a 1493 ssl->out_msglen, ssl->transform_out->ivlen,
maclobdell 0:f7c60d3e7b8a 1494 padlen + 1 ) );
maclobdell 0:f7c60d3e7b8a 1495
maclobdell 0:f7c60d3e7b8a 1496 if( ( ret = mbedtls_cipher_crypt( &ssl->transform_out->cipher_ctx_enc,
maclobdell 0:f7c60d3e7b8a 1497 ssl->transform_out->iv_enc,
maclobdell 0:f7c60d3e7b8a 1498 ssl->transform_out->ivlen,
maclobdell 0:f7c60d3e7b8a 1499 enc_msg, enc_msglen,
maclobdell 0:f7c60d3e7b8a 1500 enc_msg, &olen ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 1501 {
maclobdell 0:f7c60d3e7b8a 1502 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
maclobdell 0:f7c60d3e7b8a 1503 return( ret );
maclobdell 0:f7c60d3e7b8a 1504 }
maclobdell 0:f7c60d3e7b8a 1505
maclobdell 0:f7c60d3e7b8a 1506 if( enc_msglen != olen )
maclobdell 0:f7c60d3e7b8a 1507 {
maclobdell 0:f7c60d3e7b8a 1508 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1509 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1510 }
maclobdell 0:f7c60d3e7b8a 1511
maclobdell 0:f7c60d3e7b8a 1512 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
maclobdell 0:f7c60d3e7b8a 1513 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
maclobdell 0:f7c60d3e7b8a 1514 {
maclobdell 0:f7c60d3e7b8a 1515 /*
maclobdell 0:f7c60d3e7b8a 1516 * Save IV in SSL3 and TLS1
maclobdell 0:f7c60d3e7b8a 1517 */
maclobdell 0:f7c60d3e7b8a 1518 memcpy( ssl->transform_out->iv_enc,
maclobdell 0:f7c60d3e7b8a 1519 ssl->transform_out->cipher_ctx_enc.iv,
maclobdell 0:f7c60d3e7b8a 1520 ssl->transform_out->ivlen );
maclobdell 0:f7c60d3e7b8a 1521 }
maclobdell 0:f7c60d3e7b8a 1522 #endif
maclobdell 0:f7c60d3e7b8a 1523
maclobdell 0:f7c60d3e7b8a 1524 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
maclobdell 0:f7c60d3e7b8a 1525 if( auth_done == 0 )
maclobdell 0:f7c60d3e7b8a 1526 {
maclobdell 0:f7c60d3e7b8a 1527 /*
maclobdell 0:f7c60d3e7b8a 1528 * MAC(MAC_write_key, seq_num +
maclobdell 0:f7c60d3e7b8a 1529 * TLSCipherText.type +
maclobdell 0:f7c60d3e7b8a 1530 * TLSCipherText.version +
maclobdell 0:f7c60d3e7b8a 1531 * length_of( (IV +) ENC(...) ) +
maclobdell 0:f7c60d3e7b8a 1532 * IV + // except for TLS 1.0
maclobdell 0:f7c60d3e7b8a 1533 * ENC(content + padding + padding_length));
maclobdell 0:f7c60d3e7b8a 1534 */
maclobdell 0:f7c60d3e7b8a 1535 unsigned char pseudo_hdr[13];
maclobdell 0:f7c60d3e7b8a 1536
maclobdell 0:f7c60d3e7b8a 1537 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
maclobdell 0:f7c60d3e7b8a 1538
maclobdell 0:f7c60d3e7b8a 1539 memcpy( pseudo_hdr + 0, ssl->out_ctr, 8 );
maclobdell 0:f7c60d3e7b8a 1540 memcpy( pseudo_hdr + 8, ssl->out_hdr, 3 );
maclobdell 0:f7c60d3e7b8a 1541 pseudo_hdr[11] = (unsigned char)( ( ssl->out_msglen >> 8 ) & 0xFF );
maclobdell 0:f7c60d3e7b8a 1542 pseudo_hdr[12] = (unsigned char)( ( ssl->out_msglen ) & 0xFF );
maclobdell 0:f7c60d3e7b8a 1543
maclobdell 0:f7c60d3e7b8a 1544 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", pseudo_hdr, 13 );
maclobdell 0:f7c60d3e7b8a 1545
maclobdell 0:f7c60d3e7b8a 1546 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc, pseudo_hdr, 13 );
maclobdell 0:f7c60d3e7b8a 1547 mbedtls_md_hmac_update( &ssl->transform_out->md_ctx_enc,
maclobdell 0:f7c60d3e7b8a 1548 ssl->out_iv, ssl->out_msglen );
maclobdell 0:f7c60d3e7b8a 1549 mbedtls_md_hmac_finish( &ssl->transform_out->md_ctx_enc,
maclobdell 0:f7c60d3e7b8a 1550 ssl->out_iv + ssl->out_msglen );
maclobdell 0:f7c60d3e7b8a 1551 mbedtls_md_hmac_reset( &ssl->transform_out->md_ctx_enc );
maclobdell 0:f7c60d3e7b8a 1552
maclobdell 0:f7c60d3e7b8a 1553 ssl->out_msglen += ssl->transform_out->maclen;
maclobdell 0:f7c60d3e7b8a 1554 auth_done++;
maclobdell 0:f7c60d3e7b8a 1555 }
maclobdell 0:f7c60d3e7b8a 1556 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
maclobdell 0:f7c60d3e7b8a 1557 }
maclobdell 0:f7c60d3e7b8a 1558 else
maclobdell 0:f7c60d3e7b8a 1559 #endif /* MBEDTLS_CIPHER_MODE_CBC &&
maclobdell 0:f7c60d3e7b8a 1560 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C ) */
maclobdell 0:f7c60d3e7b8a 1561 {
maclobdell 0:f7c60d3e7b8a 1562 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1563 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1564 }
maclobdell 0:f7c60d3e7b8a 1565
maclobdell 0:f7c60d3e7b8a 1566 /* Make extra sure authentication was performed, exactly once */
maclobdell 0:f7c60d3e7b8a 1567 if( auth_done != 1 )
maclobdell 0:f7c60d3e7b8a 1568 {
maclobdell 0:f7c60d3e7b8a 1569 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1570 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1571 }
maclobdell 0:f7c60d3e7b8a 1572
maclobdell 0:f7c60d3e7b8a 1573 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
maclobdell 0:f7c60d3e7b8a 1574
maclobdell 0:f7c60d3e7b8a 1575 return( 0 );
maclobdell 0:f7c60d3e7b8a 1576 }
maclobdell 0:f7c60d3e7b8a 1577
maclobdell 0:f7c60d3e7b8a 1578 #define SSL_MAX_MAC_SIZE 48
maclobdell 0:f7c60d3e7b8a 1579
maclobdell 0:f7c60d3e7b8a 1580 static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 1581 {
maclobdell 0:f7c60d3e7b8a 1582 size_t i;
maclobdell 0:f7c60d3e7b8a 1583 mbedtls_cipher_mode_t mode;
maclobdell 0:f7c60d3e7b8a 1584 int auth_done = 0;
maclobdell 0:f7c60d3e7b8a 1585 #if defined(SSL_SOME_MODES_USE_MAC)
maclobdell 0:f7c60d3e7b8a 1586 size_t padlen = 0, correct = 1;
maclobdell 0:f7c60d3e7b8a 1587 #endif
maclobdell 0:f7c60d3e7b8a 1588
maclobdell 0:f7c60d3e7b8a 1589 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
maclobdell 0:f7c60d3e7b8a 1590
maclobdell 0:f7c60d3e7b8a 1591 if( ssl->session_in == NULL || ssl->transform_in == NULL )
maclobdell 0:f7c60d3e7b8a 1592 {
maclobdell 0:f7c60d3e7b8a 1593 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1594 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1595 }
maclobdell 0:f7c60d3e7b8a 1596
maclobdell 0:f7c60d3e7b8a 1597 mode = mbedtls_cipher_get_cipher_mode( &ssl->transform_in->cipher_ctx_dec );
maclobdell 0:f7c60d3e7b8a 1598
maclobdell 0:f7c60d3e7b8a 1599 if( ssl->in_msglen < ssl->transform_in->minlen )
maclobdell 0:f7c60d3e7b8a 1600 {
maclobdell 0:f7c60d3e7b8a 1601 MBEDTLS_SSL_DEBUG_MSG( 1, ( "in_msglen (%d) < minlen (%d)",
maclobdell 0:f7c60d3e7b8a 1602 ssl->in_msglen, ssl->transform_in->minlen ) );
maclobdell 0:f7c60d3e7b8a 1603 return( MBEDTLS_ERR_SSL_INVALID_MAC );
maclobdell 0:f7c60d3e7b8a 1604 }
maclobdell 0:f7c60d3e7b8a 1605
maclobdell 0:f7c60d3e7b8a 1606 #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_NULL_CIPHER)
maclobdell 0:f7c60d3e7b8a 1607 if( mode == MBEDTLS_MODE_STREAM )
maclobdell 0:f7c60d3e7b8a 1608 {
maclobdell 0:f7c60d3e7b8a 1609 int ret;
maclobdell 0:f7c60d3e7b8a 1610 size_t olen = 0;
maclobdell 0:f7c60d3e7b8a 1611
maclobdell 0:f7c60d3e7b8a 1612 padlen = 0;
maclobdell 0:f7c60d3e7b8a 1613
maclobdell 0:f7c60d3e7b8a 1614 if( ( ret = mbedtls_cipher_crypt( &ssl->transform_in->cipher_ctx_dec,
maclobdell 0:f7c60d3e7b8a 1615 ssl->transform_in->iv_dec,
maclobdell 0:f7c60d3e7b8a 1616 ssl->transform_in->ivlen,
maclobdell 0:f7c60d3e7b8a 1617 ssl->in_msg, ssl->in_msglen,
maclobdell 0:f7c60d3e7b8a 1618 ssl->in_msg, &olen ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 1619 {
maclobdell 0:f7c60d3e7b8a 1620 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
maclobdell 0:f7c60d3e7b8a 1621 return( ret );
maclobdell 0:f7c60d3e7b8a 1622 }
maclobdell 0:f7c60d3e7b8a 1623
maclobdell 0:f7c60d3e7b8a 1624 if( ssl->in_msglen != olen )
maclobdell 0:f7c60d3e7b8a 1625 {
maclobdell 0:f7c60d3e7b8a 1626 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1627 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1628 }
maclobdell 0:f7c60d3e7b8a 1629 }
maclobdell 0:f7c60d3e7b8a 1630 else
maclobdell 0:f7c60d3e7b8a 1631 #endif /* MBEDTLS_ARC4_C || MBEDTLS_CIPHER_NULL_CIPHER */
maclobdell 0:f7c60d3e7b8a 1632 #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C)
maclobdell 0:f7c60d3e7b8a 1633 if( mode == MBEDTLS_MODE_GCM ||
maclobdell 0:f7c60d3e7b8a 1634 mode == MBEDTLS_MODE_CCM )
maclobdell 0:f7c60d3e7b8a 1635 {
maclobdell 0:f7c60d3e7b8a 1636 int ret;
maclobdell 0:f7c60d3e7b8a 1637 size_t dec_msglen, olen;
maclobdell 0:f7c60d3e7b8a 1638 unsigned char *dec_msg;
maclobdell 0:f7c60d3e7b8a 1639 unsigned char *dec_msg_result;
maclobdell 0:f7c60d3e7b8a 1640 unsigned char add_data[13];
maclobdell 0:f7c60d3e7b8a 1641 unsigned char taglen = ssl->transform_in->ciphersuite_info->flags &
maclobdell 0:f7c60d3e7b8a 1642 MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
maclobdell 0:f7c60d3e7b8a 1643 size_t explicit_iv_len = ssl->transform_in->ivlen -
maclobdell 0:f7c60d3e7b8a 1644 ssl->transform_in->fixed_ivlen;
maclobdell 0:f7c60d3e7b8a 1645
maclobdell 0:f7c60d3e7b8a 1646 if( ssl->in_msglen < explicit_iv_len + taglen )
maclobdell 0:f7c60d3e7b8a 1647 {
maclobdell 0:f7c60d3e7b8a 1648 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < explicit_iv_len (%d) "
maclobdell 0:f7c60d3e7b8a 1649 "+ taglen (%d)", ssl->in_msglen,
maclobdell 0:f7c60d3e7b8a 1650 explicit_iv_len, taglen ) );
maclobdell 0:f7c60d3e7b8a 1651 return( MBEDTLS_ERR_SSL_INVALID_MAC );
maclobdell 0:f7c60d3e7b8a 1652 }
maclobdell 0:f7c60d3e7b8a 1653 dec_msglen = ssl->in_msglen - explicit_iv_len - taglen;
maclobdell 0:f7c60d3e7b8a 1654
maclobdell 0:f7c60d3e7b8a 1655 dec_msg = ssl->in_msg;
maclobdell 0:f7c60d3e7b8a 1656 dec_msg_result = ssl->in_msg;
maclobdell 0:f7c60d3e7b8a 1657 ssl->in_msglen = dec_msglen;
maclobdell 0:f7c60d3e7b8a 1658
maclobdell 0:f7c60d3e7b8a 1659 memcpy( add_data, ssl->in_ctr, 8 );
maclobdell 0:f7c60d3e7b8a 1660 add_data[8] = ssl->in_msgtype;
maclobdell 0:f7c60d3e7b8a 1661 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
maclobdell 0:f7c60d3e7b8a 1662 ssl->conf->transport, add_data + 9 );
maclobdell 0:f7c60d3e7b8a 1663 add_data[11] = ( ssl->in_msglen >> 8 ) & 0xFF;
maclobdell 0:f7c60d3e7b8a 1664 add_data[12] = ssl->in_msglen & 0xFF;
maclobdell 0:f7c60d3e7b8a 1665
maclobdell 0:f7c60d3e7b8a 1666 MBEDTLS_SSL_DEBUG_BUF( 4, "additional data used for AEAD",
maclobdell 0:f7c60d3e7b8a 1667 add_data, 13 );
maclobdell 0:f7c60d3e7b8a 1668
maclobdell 0:f7c60d3e7b8a 1669 memcpy( ssl->transform_in->iv_dec + ssl->transform_in->fixed_ivlen,
maclobdell 0:f7c60d3e7b8a 1670 ssl->in_iv,
maclobdell 0:f7c60d3e7b8a 1671 ssl->transform_in->ivlen - ssl->transform_in->fixed_ivlen );
maclobdell 0:f7c60d3e7b8a 1672
maclobdell 0:f7c60d3e7b8a 1673 MBEDTLS_SSL_DEBUG_BUF( 4, "IV used", ssl->transform_in->iv_dec,
maclobdell 0:f7c60d3e7b8a 1674 ssl->transform_in->ivlen );
maclobdell 0:f7c60d3e7b8a 1675 MBEDTLS_SSL_DEBUG_BUF( 4, "TAG used", dec_msg + dec_msglen, taglen );
maclobdell 0:f7c60d3e7b8a 1676
maclobdell 0:f7c60d3e7b8a 1677 /*
maclobdell 0:f7c60d3e7b8a 1678 * Decrypt and authenticate
maclobdell 0:f7c60d3e7b8a 1679 */
maclobdell 0:f7c60d3e7b8a 1680 if( ( ret = mbedtls_cipher_auth_decrypt( &ssl->transform_in->cipher_ctx_dec,
maclobdell 0:f7c60d3e7b8a 1681 ssl->transform_in->iv_dec,
maclobdell 0:f7c60d3e7b8a 1682 ssl->transform_in->ivlen,
maclobdell 0:f7c60d3e7b8a 1683 add_data, 13,
maclobdell 0:f7c60d3e7b8a 1684 dec_msg, dec_msglen,
maclobdell 0:f7c60d3e7b8a 1685 dec_msg_result, &olen,
maclobdell 0:f7c60d3e7b8a 1686 dec_msg + dec_msglen, taglen ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 1687 {
maclobdell 0:f7c60d3e7b8a 1688 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_auth_decrypt", ret );
maclobdell 0:f7c60d3e7b8a 1689
maclobdell 0:f7c60d3e7b8a 1690 if( ret == MBEDTLS_ERR_CIPHER_AUTH_FAILED )
maclobdell 0:f7c60d3e7b8a 1691 return( MBEDTLS_ERR_SSL_INVALID_MAC );
maclobdell 0:f7c60d3e7b8a 1692
maclobdell 0:f7c60d3e7b8a 1693 return( ret );
maclobdell 0:f7c60d3e7b8a 1694 }
maclobdell 0:f7c60d3e7b8a 1695 auth_done++;
maclobdell 0:f7c60d3e7b8a 1696
maclobdell 0:f7c60d3e7b8a 1697 if( olen != dec_msglen )
maclobdell 0:f7c60d3e7b8a 1698 {
maclobdell 0:f7c60d3e7b8a 1699 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1700 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1701 }
maclobdell 0:f7c60d3e7b8a 1702 }
maclobdell 0:f7c60d3e7b8a 1703 else
maclobdell 0:f7c60d3e7b8a 1704 #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C */
maclobdell 0:f7c60d3e7b8a 1705 #if defined(MBEDTLS_CIPHER_MODE_CBC) && \
maclobdell 0:f7c60d3e7b8a 1706 ( defined(MBEDTLS_AES_C) || defined(MBEDTLS_CAMELLIA_C) )
maclobdell 0:f7c60d3e7b8a 1707 if( mode == MBEDTLS_MODE_CBC )
maclobdell 0:f7c60d3e7b8a 1708 {
maclobdell 0:f7c60d3e7b8a 1709 /*
maclobdell 0:f7c60d3e7b8a 1710 * Decrypt and check the padding
maclobdell 0:f7c60d3e7b8a 1711 */
maclobdell 0:f7c60d3e7b8a 1712 int ret;
maclobdell 0:f7c60d3e7b8a 1713 unsigned char *dec_msg;
maclobdell 0:f7c60d3e7b8a 1714 unsigned char *dec_msg_result;
maclobdell 0:f7c60d3e7b8a 1715 size_t dec_msglen;
maclobdell 0:f7c60d3e7b8a 1716 size_t minlen = 0;
maclobdell 0:f7c60d3e7b8a 1717 size_t olen = 0;
maclobdell 0:f7c60d3e7b8a 1718
maclobdell 0:f7c60d3e7b8a 1719 /*
maclobdell 0:f7c60d3e7b8a 1720 * Check immediate ciphertext sanity
maclobdell 0:f7c60d3e7b8a 1721 */
maclobdell 0:f7c60d3e7b8a 1722 #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 1723 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
maclobdell 0:f7c60d3e7b8a 1724 minlen += ssl->transform_in->ivlen;
maclobdell 0:f7c60d3e7b8a 1725 #endif
maclobdell 0:f7c60d3e7b8a 1726
maclobdell 0:f7c60d3e7b8a 1727 if( ssl->in_msglen < minlen + ssl->transform_in->ivlen ||
maclobdell 0:f7c60d3e7b8a 1728 ssl->in_msglen < minlen + ssl->transform_in->maclen + 1 )
maclobdell 0:f7c60d3e7b8a 1729 {
maclobdell 0:f7c60d3e7b8a 1730 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < max( ivlen(%d), maclen (%d) "
maclobdell 0:f7c60d3e7b8a 1731 "+ 1 ) ( + expl IV )", ssl->in_msglen,
maclobdell 0:f7c60d3e7b8a 1732 ssl->transform_in->ivlen,
maclobdell 0:f7c60d3e7b8a 1733 ssl->transform_in->maclen ) );
maclobdell 0:f7c60d3e7b8a 1734 return( MBEDTLS_ERR_SSL_INVALID_MAC );
maclobdell 0:f7c60d3e7b8a 1735 }
maclobdell 0:f7c60d3e7b8a 1736
maclobdell 0:f7c60d3e7b8a 1737 dec_msglen = ssl->in_msglen;
maclobdell 0:f7c60d3e7b8a 1738 dec_msg = ssl->in_msg;
maclobdell 0:f7c60d3e7b8a 1739 dec_msg_result = ssl->in_msg;
maclobdell 0:f7c60d3e7b8a 1740
maclobdell 0:f7c60d3e7b8a 1741 /*
maclobdell 0:f7c60d3e7b8a 1742 * Authenticate before decrypt if enabled
maclobdell 0:f7c60d3e7b8a 1743 */
maclobdell 0:f7c60d3e7b8a 1744 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
maclobdell 0:f7c60d3e7b8a 1745 if( ssl->session_in->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
maclobdell 0:f7c60d3e7b8a 1746 {
maclobdell 0:f7c60d3e7b8a 1747 unsigned char computed_mac[SSL_MAX_MAC_SIZE];
maclobdell 0:f7c60d3e7b8a 1748 unsigned char pseudo_hdr[13];
maclobdell 0:f7c60d3e7b8a 1749
maclobdell 0:f7c60d3e7b8a 1750 MBEDTLS_SSL_DEBUG_MSG( 3, ( "using encrypt then mac" ) );
maclobdell 0:f7c60d3e7b8a 1751
maclobdell 0:f7c60d3e7b8a 1752 dec_msglen -= ssl->transform_in->maclen;
maclobdell 0:f7c60d3e7b8a 1753 ssl->in_msglen -= ssl->transform_in->maclen;
maclobdell 0:f7c60d3e7b8a 1754
maclobdell 0:f7c60d3e7b8a 1755 memcpy( pseudo_hdr + 0, ssl->in_ctr, 8 );
maclobdell 0:f7c60d3e7b8a 1756 memcpy( pseudo_hdr + 8, ssl->in_hdr, 3 );
maclobdell 0:f7c60d3e7b8a 1757 pseudo_hdr[11] = (unsigned char)( ( ssl->in_msglen >> 8 ) & 0xFF );
maclobdell 0:f7c60d3e7b8a 1758 pseudo_hdr[12] = (unsigned char)( ( ssl->in_msglen ) & 0xFF );
maclobdell 0:f7c60d3e7b8a 1759
maclobdell 0:f7c60d3e7b8a 1760 MBEDTLS_SSL_DEBUG_BUF( 4, "MAC'd meta-data", pseudo_hdr, 13 );
maclobdell 0:f7c60d3e7b8a 1761
maclobdell 0:f7c60d3e7b8a 1762 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, pseudo_hdr, 13 );
maclobdell 0:f7c60d3e7b8a 1763 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec,
maclobdell 0:f7c60d3e7b8a 1764 ssl->in_iv, ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 1765 mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, computed_mac );
maclobdell 0:f7c60d3e7b8a 1766 mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec );
maclobdell 0:f7c60d3e7b8a 1767
maclobdell 0:f7c60d3e7b8a 1768 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", ssl->in_iv + ssl->in_msglen,
maclobdell 0:f7c60d3e7b8a 1769 ssl->transform_in->maclen );
maclobdell 0:f7c60d3e7b8a 1770 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", computed_mac,
maclobdell 0:f7c60d3e7b8a 1771 ssl->transform_in->maclen );
maclobdell 0:f7c60d3e7b8a 1772
maclobdell 0:f7c60d3e7b8a 1773 if( mbedtls_ssl_safer_memcmp( ssl->in_iv + ssl->in_msglen, computed_mac,
maclobdell 0:f7c60d3e7b8a 1774 ssl->transform_in->maclen ) != 0 )
maclobdell 0:f7c60d3e7b8a 1775 {
maclobdell 0:f7c60d3e7b8a 1776 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
maclobdell 0:f7c60d3e7b8a 1777
maclobdell 0:f7c60d3e7b8a 1778 return( MBEDTLS_ERR_SSL_INVALID_MAC );
maclobdell 0:f7c60d3e7b8a 1779 }
maclobdell 0:f7c60d3e7b8a 1780 auth_done++;
maclobdell 0:f7c60d3e7b8a 1781 }
maclobdell 0:f7c60d3e7b8a 1782 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
maclobdell 0:f7c60d3e7b8a 1783
maclobdell 0:f7c60d3e7b8a 1784 /*
maclobdell 0:f7c60d3e7b8a 1785 * Check length sanity
maclobdell 0:f7c60d3e7b8a 1786 */
maclobdell 0:f7c60d3e7b8a 1787 if( ssl->in_msglen % ssl->transform_in->ivlen != 0 )
maclobdell 0:f7c60d3e7b8a 1788 {
maclobdell 0:f7c60d3e7b8a 1789 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0",
maclobdell 0:f7c60d3e7b8a 1790 ssl->in_msglen, ssl->transform_in->ivlen ) );
maclobdell 0:f7c60d3e7b8a 1791 return( MBEDTLS_ERR_SSL_INVALID_MAC );
maclobdell 0:f7c60d3e7b8a 1792 }
maclobdell 0:f7c60d3e7b8a 1793
maclobdell 0:f7c60d3e7b8a 1794 #if defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 1795 /*
maclobdell 0:f7c60d3e7b8a 1796 * Initialize for prepended IV for block cipher in TLS v1.1 and up
maclobdell 0:f7c60d3e7b8a 1797 */
maclobdell 0:f7c60d3e7b8a 1798 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
maclobdell 0:f7c60d3e7b8a 1799 {
maclobdell 0:f7c60d3e7b8a 1800 dec_msglen -= ssl->transform_in->ivlen;
maclobdell 0:f7c60d3e7b8a 1801 ssl->in_msglen -= ssl->transform_in->ivlen;
maclobdell 0:f7c60d3e7b8a 1802
maclobdell 0:f7c60d3e7b8a 1803 for( i = 0; i < ssl->transform_in->ivlen; i++ )
maclobdell 0:f7c60d3e7b8a 1804 ssl->transform_in->iv_dec[i] = ssl->in_iv[i];
maclobdell 0:f7c60d3e7b8a 1805 }
maclobdell 0:f7c60d3e7b8a 1806 #endif /* MBEDTLS_SSL_PROTO_TLS1_1 || MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 1807
maclobdell 0:f7c60d3e7b8a 1808 if( ( ret = mbedtls_cipher_crypt( &ssl->transform_in->cipher_ctx_dec,
maclobdell 0:f7c60d3e7b8a 1809 ssl->transform_in->iv_dec,
maclobdell 0:f7c60d3e7b8a 1810 ssl->transform_in->ivlen,
maclobdell 0:f7c60d3e7b8a 1811 dec_msg, dec_msglen,
maclobdell 0:f7c60d3e7b8a 1812 dec_msg_result, &olen ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 1813 {
maclobdell 0:f7c60d3e7b8a 1814 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_crypt", ret );
maclobdell 0:f7c60d3e7b8a 1815 return( ret );
maclobdell 0:f7c60d3e7b8a 1816 }
maclobdell 0:f7c60d3e7b8a 1817
maclobdell 0:f7c60d3e7b8a 1818 if( dec_msglen != olen )
maclobdell 0:f7c60d3e7b8a 1819 {
maclobdell 0:f7c60d3e7b8a 1820 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1821 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1822 }
maclobdell 0:f7c60d3e7b8a 1823
maclobdell 0:f7c60d3e7b8a 1824 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1)
maclobdell 0:f7c60d3e7b8a 1825 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
maclobdell 0:f7c60d3e7b8a 1826 {
maclobdell 0:f7c60d3e7b8a 1827 /*
maclobdell 0:f7c60d3e7b8a 1828 * Save IV in SSL3 and TLS1
maclobdell 0:f7c60d3e7b8a 1829 */
maclobdell 0:f7c60d3e7b8a 1830 memcpy( ssl->transform_in->iv_dec,
maclobdell 0:f7c60d3e7b8a 1831 ssl->transform_in->cipher_ctx_dec.iv,
maclobdell 0:f7c60d3e7b8a 1832 ssl->transform_in->ivlen );
maclobdell 0:f7c60d3e7b8a 1833 }
maclobdell 0:f7c60d3e7b8a 1834 #endif
maclobdell 0:f7c60d3e7b8a 1835
maclobdell 0:f7c60d3e7b8a 1836 padlen = 1 + ssl->in_msg[ssl->in_msglen - 1];
maclobdell 0:f7c60d3e7b8a 1837
maclobdell 0:f7c60d3e7b8a 1838 if( ssl->in_msglen < ssl->transform_in->maclen + padlen &&
maclobdell 0:f7c60d3e7b8a 1839 auth_done == 0 )
maclobdell 0:f7c60d3e7b8a 1840 {
maclobdell 0:f7c60d3e7b8a 1841 #if defined(MBEDTLS_SSL_DEBUG_ALL)
maclobdell 0:f7c60d3e7b8a 1842 MBEDTLS_SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
maclobdell 0:f7c60d3e7b8a 1843 ssl->in_msglen, ssl->transform_in->maclen, padlen ) );
maclobdell 0:f7c60d3e7b8a 1844 #endif
maclobdell 0:f7c60d3e7b8a 1845 padlen = 0;
maclobdell 0:f7c60d3e7b8a 1846 correct = 0;
maclobdell 0:f7c60d3e7b8a 1847 }
maclobdell 0:f7c60d3e7b8a 1848
maclobdell 0:f7c60d3e7b8a 1849 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 1850 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
maclobdell 0:f7c60d3e7b8a 1851 {
maclobdell 0:f7c60d3e7b8a 1852 if( padlen > ssl->transform_in->ivlen )
maclobdell 0:f7c60d3e7b8a 1853 {
maclobdell 0:f7c60d3e7b8a 1854 #if defined(MBEDTLS_SSL_DEBUG_ALL)
maclobdell 0:f7c60d3e7b8a 1855 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
maclobdell 0:f7c60d3e7b8a 1856 "should be no more than %d",
maclobdell 0:f7c60d3e7b8a 1857 padlen, ssl->transform_in->ivlen ) );
maclobdell 0:f7c60d3e7b8a 1858 #endif
maclobdell 0:f7c60d3e7b8a 1859 correct = 0;
maclobdell 0:f7c60d3e7b8a 1860 }
maclobdell 0:f7c60d3e7b8a 1861 }
maclobdell 0:f7c60d3e7b8a 1862 else
maclobdell 0:f7c60d3e7b8a 1863 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
maclobdell 0:f7c60d3e7b8a 1864 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
maclobdell 0:f7c60d3e7b8a 1865 defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 1866 if( ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_0 )
maclobdell 0:f7c60d3e7b8a 1867 {
maclobdell 0:f7c60d3e7b8a 1868 /*
maclobdell 0:f7c60d3e7b8a 1869 * TLSv1+: always check the padding up to the first failure
maclobdell 0:f7c60d3e7b8a 1870 * and fake check up to 256 bytes of padding
maclobdell 0:f7c60d3e7b8a 1871 */
maclobdell 0:f7c60d3e7b8a 1872 size_t pad_count = 0, real_count = 1;
maclobdell 0:f7c60d3e7b8a 1873 size_t padding_idx = ssl->in_msglen - padlen - 1;
maclobdell 0:f7c60d3e7b8a 1874
maclobdell 0:f7c60d3e7b8a 1875 /*
maclobdell 0:f7c60d3e7b8a 1876 * Padding is guaranteed to be incorrect if:
maclobdell 0:f7c60d3e7b8a 1877 * 1. padlen >= ssl->in_msglen
maclobdell 0:f7c60d3e7b8a 1878 *
maclobdell 0:f7c60d3e7b8a 1879 * 2. padding_idx >= MBEDTLS_SSL_MAX_CONTENT_LEN +
maclobdell 0:f7c60d3e7b8a 1880 * ssl->transform_in->maclen
maclobdell 0:f7c60d3e7b8a 1881 *
maclobdell 0:f7c60d3e7b8a 1882 * In both cases we reset padding_idx to a safe value (0) to
maclobdell 0:f7c60d3e7b8a 1883 * prevent out-of-buffer reads.
maclobdell 0:f7c60d3e7b8a 1884 */
maclobdell 0:f7c60d3e7b8a 1885 correct &= ( ssl->in_msglen >= padlen + 1 );
maclobdell 0:f7c60d3e7b8a 1886 correct &= ( padding_idx < MBEDTLS_SSL_MAX_CONTENT_LEN +
maclobdell 0:f7c60d3e7b8a 1887 ssl->transform_in->maclen );
maclobdell 0:f7c60d3e7b8a 1888
maclobdell 0:f7c60d3e7b8a 1889 padding_idx *= correct;
maclobdell 0:f7c60d3e7b8a 1890
maclobdell 0:f7c60d3e7b8a 1891 for( i = 1; i <= 256; i++ )
maclobdell 0:f7c60d3e7b8a 1892 {
maclobdell 0:f7c60d3e7b8a 1893 real_count &= ( i <= padlen );
maclobdell 0:f7c60d3e7b8a 1894 pad_count += real_count *
maclobdell 0:f7c60d3e7b8a 1895 ( ssl->in_msg[padding_idx + i] == padlen - 1 );
maclobdell 0:f7c60d3e7b8a 1896 }
maclobdell 0:f7c60d3e7b8a 1897
maclobdell 0:f7c60d3e7b8a 1898 correct &= ( pad_count == padlen ); /* Only 1 on correct padding */
maclobdell 0:f7c60d3e7b8a 1899
maclobdell 0:f7c60d3e7b8a 1900 #if defined(MBEDTLS_SSL_DEBUG_ALL)
maclobdell 0:f7c60d3e7b8a 1901 if( padlen > 0 && correct == 0 )
maclobdell 0:f7c60d3e7b8a 1902 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
maclobdell 0:f7c60d3e7b8a 1903 #endif
maclobdell 0:f7c60d3e7b8a 1904 padlen &= correct * 0x1FF;
maclobdell 0:f7c60d3e7b8a 1905 }
maclobdell 0:f7c60d3e7b8a 1906 else
maclobdell 0:f7c60d3e7b8a 1907 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
maclobdell 0:f7c60d3e7b8a 1908 MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 1909 {
maclobdell 0:f7c60d3e7b8a 1910 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1911 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1912 }
maclobdell 0:f7c60d3e7b8a 1913
maclobdell 0:f7c60d3e7b8a 1914 ssl->in_msglen -= padlen;
maclobdell 0:f7c60d3e7b8a 1915 }
maclobdell 0:f7c60d3e7b8a 1916 else
maclobdell 0:f7c60d3e7b8a 1917 #endif /* MBEDTLS_CIPHER_MODE_CBC &&
maclobdell 0:f7c60d3e7b8a 1918 ( MBEDTLS_AES_C || MBEDTLS_CAMELLIA_C ) */
maclobdell 0:f7c60d3e7b8a 1919 {
maclobdell 0:f7c60d3e7b8a 1920 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1921 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1922 }
maclobdell 0:f7c60d3e7b8a 1923
maclobdell 0:f7c60d3e7b8a 1924 MBEDTLS_SSL_DEBUG_BUF( 4, "raw buffer after decryption",
maclobdell 0:f7c60d3e7b8a 1925 ssl->in_msg, ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 1926
maclobdell 0:f7c60d3e7b8a 1927 /*
maclobdell 0:f7c60d3e7b8a 1928 * Authenticate if not done yet.
maclobdell 0:f7c60d3e7b8a 1929 * Compute the MAC regardless of the padding result (RFC4346, CBCTIME).
maclobdell 0:f7c60d3e7b8a 1930 */
maclobdell 0:f7c60d3e7b8a 1931 #if defined(SSL_SOME_MODES_USE_MAC)
maclobdell 0:f7c60d3e7b8a 1932 if( auth_done == 0 )
maclobdell 0:f7c60d3e7b8a 1933 {
maclobdell 0:f7c60d3e7b8a 1934 unsigned char tmp[SSL_MAX_MAC_SIZE];
maclobdell 0:f7c60d3e7b8a 1935
maclobdell 0:f7c60d3e7b8a 1936 ssl->in_msglen -= ssl->transform_in->maclen;
maclobdell 0:f7c60d3e7b8a 1937
maclobdell 0:f7c60d3e7b8a 1938 ssl->in_len[0] = (unsigned char)( ssl->in_msglen >> 8 );
maclobdell 0:f7c60d3e7b8a 1939 ssl->in_len[1] = (unsigned char)( ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 1940
maclobdell 0:f7c60d3e7b8a 1941 memcpy( tmp, ssl->in_msg + ssl->in_msglen, ssl->transform_in->maclen );
maclobdell 0:f7c60d3e7b8a 1942
maclobdell 0:f7c60d3e7b8a 1943 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 1944 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
maclobdell 0:f7c60d3e7b8a 1945 {
maclobdell 0:f7c60d3e7b8a 1946 ssl_mac( &ssl->transform_in->md_ctx_dec,
maclobdell 0:f7c60d3e7b8a 1947 ssl->transform_in->mac_dec,
maclobdell 0:f7c60d3e7b8a 1948 ssl->in_msg, ssl->in_msglen,
maclobdell 0:f7c60d3e7b8a 1949 ssl->in_ctr, ssl->in_msgtype );
maclobdell 0:f7c60d3e7b8a 1950 }
maclobdell 0:f7c60d3e7b8a 1951 else
maclobdell 0:f7c60d3e7b8a 1952 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
maclobdell 0:f7c60d3e7b8a 1953 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
maclobdell 0:f7c60d3e7b8a 1954 defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 1955 if( ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_0 )
maclobdell 0:f7c60d3e7b8a 1956 {
maclobdell 0:f7c60d3e7b8a 1957 /*
maclobdell 0:f7c60d3e7b8a 1958 * Process MAC and always update for padlen afterwards to make
maclobdell 0:f7c60d3e7b8a 1959 * total time independent of padlen
maclobdell 0:f7c60d3e7b8a 1960 *
maclobdell 0:f7c60d3e7b8a 1961 * extra_run compensates MAC check for padlen
maclobdell 0:f7c60d3e7b8a 1962 *
maclobdell 0:f7c60d3e7b8a 1963 * Known timing attacks:
maclobdell 0:f7c60d3e7b8a 1964 * - Lucky Thirteen (http://www.isg.rhul.ac.uk/tls/TLStiming.pdf)
maclobdell 0:f7c60d3e7b8a 1965 *
maclobdell 0:f7c60d3e7b8a 1966 * We use ( ( Lx + 8 ) / 64 ) to handle 'negative Lx' values
maclobdell 0:f7c60d3e7b8a 1967 * correctly. (We round down instead of up, so -56 is the correct
maclobdell 0:f7c60d3e7b8a 1968 * value for our calculations instead of -55)
maclobdell 0:f7c60d3e7b8a 1969 */
maclobdell 0:f7c60d3e7b8a 1970 size_t j, extra_run = 0;
maclobdell 0:f7c60d3e7b8a 1971 extra_run = ( 13 + ssl->in_msglen + padlen + 8 ) / 64 -
maclobdell 0:f7c60d3e7b8a 1972 ( 13 + ssl->in_msglen + 8 ) / 64;
maclobdell 0:f7c60d3e7b8a 1973
maclobdell 0:f7c60d3e7b8a 1974 extra_run &= correct * 0xFF;
maclobdell 0:f7c60d3e7b8a 1975
maclobdell 0:f7c60d3e7b8a 1976 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_ctr, 8 );
maclobdell 0:f7c60d3e7b8a 1977 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_hdr, 3 );
maclobdell 0:f7c60d3e7b8a 1978 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_len, 2 );
maclobdell 0:f7c60d3e7b8a 1979 mbedtls_md_hmac_update( &ssl->transform_in->md_ctx_dec, ssl->in_msg,
maclobdell 0:f7c60d3e7b8a 1980 ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 1981 mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec,
maclobdell 0:f7c60d3e7b8a 1982 ssl->in_msg + ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 1983 /* Call mbedtls_md_process at least once due to cache attacks */
maclobdell 0:f7c60d3e7b8a 1984 for( j = 0; j < extra_run + 1; j++ )
maclobdell 0:f7c60d3e7b8a 1985 mbedtls_md_process( &ssl->transform_in->md_ctx_dec, ssl->in_msg );
maclobdell 0:f7c60d3e7b8a 1986
maclobdell 0:f7c60d3e7b8a 1987 mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec );
maclobdell 0:f7c60d3e7b8a 1988 }
maclobdell 0:f7c60d3e7b8a 1989 else
maclobdell 0:f7c60d3e7b8a 1990 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
maclobdell 0:f7c60d3e7b8a 1991 MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 1992 {
maclobdell 0:f7c60d3e7b8a 1993 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 1994 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 1995 }
maclobdell 0:f7c60d3e7b8a 1996
maclobdell 0:f7c60d3e7b8a 1997 MBEDTLS_SSL_DEBUG_BUF( 4, "message mac", tmp, ssl->transform_in->maclen );
maclobdell 0:f7c60d3e7b8a 1998 MBEDTLS_SSL_DEBUG_BUF( 4, "computed mac", ssl->in_msg + ssl->in_msglen,
maclobdell 0:f7c60d3e7b8a 1999 ssl->transform_in->maclen );
maclobdell 0:f7c60d3e7b8a 2000
maclobdell 0:f7c60d3e7b8a 2001 if( mbedtls_ssl_safer_memcmp( tmp, ssl->in_msg + ssl->in_msglen,
maclobdell 0:f7c60d3e7b8a 2002 ssl->transform_in->maclen ) != 0 )
maclobdell 0:f7c60d3e7b8a 2003 {
maclobdell 0:f7c60d3e7b8a 2004 #if defined(MBEDTLS_SSL_DEBUG_ALL)
maclobdell 0:f7c60d3e7b8a 2005 MBEDTLS_SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
maclobdell 0:f7c60d3e7b8a 2006 #endif
maclobdell 0:f7c60d3e7b8a 2007 correct = 0;
maclobdell 0:f7c60d3e7b8a 2008 }
maclobdell 0:f7c60d3e7b8a 2009 auth_done++;
maclobdell 0:f7c60d3e7b8a 2010
maclobdell 0:f7c60d3e7b8a 2011 /*
maclobdell 0:f7c60d3e7b8a 2012 * Finally check the correct flag
maclobdell 0:f7c60d3e7b8a 2013 */
maclobdell 0:f7c60d3e7b8a 2014 if( correct == 0 )
maclobdell 0:f7c60d3e7b8a 2015 return( MBEDTLS_ERR_SSL_INVALID_MAC );
maclobdell 0:f7c60d3e7b8a 2016 }
maclobdell 0:f7c60d3e7b8a 2017 #endif /* SSL_SOME_MODES_USE_MAC */
maclobdell 0:f7c60d3e7b8a 2018
maclobdell 0:f7c60d3e7b8a 2019 /* Make extra sure authentication was performed, exactly once */
maclobdell 0:f7c60d3e7b8a 2020 if( auth_done != 1 )
maclobdell 0:f7c60d3e7b8a 2021 {
maclobdell 0:f7c60d3e7b8a 2022 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 2023 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 2024 }
maclobdell 0:f7c60d3e7b8a 2025
maclobdell 0:f7c60d3e7b8a 2026 if( ssl->in_msglen == 0 )
maclobdell 0:f7c60d3e7b8a 2027 {
maclobdell 0:f7c60d3e7b8a 2028 ssl->nb_zero++;
maclobdell 0:f7c60d3e7b8a 2029
maclobdell 0:f7c60d3e7b8a 2030 /*
maclobdell 0:f7c60d3e7b8a 2031 * Three or more empty messages may be a DoS attack
maclobdell 0:f7c60d3e7b8a 2032 * (excessive CPU consumption).
maclobdell 0:f7c60d3e7b8a 2033 */
maclobdell 0:f7c60d3e7b8a 2034 if( ssl->nb_zero > 3 )
maclobdell 0:f7c60d3e7b8a 2035 {
maclobdell 0:f7c60d3e7b8a 2036 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
maclobdell 0:f7c60d3e7b8a 2037 "messages, possible DoS attack" ) );
maclobdell 0:f7c60d3e7b8a 2038 return( MBEDTLS_ERR_SSL_INVALID_MAC );
maclobdell 0:f7c60d3e7b8a 2039 }
maclobdell 0:f7c60d3e7b8a 2040 }
maclobdell 0:f7c60d3e7b8a 2041 else
maclobdell 0:f7c60d3e7b8a 2042 ssl->nb_zero = 0;
maclobdell 0:f7c60d3e7b8a 2043
maclobdell 0:f7c60d3e7b8a 2044 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 2045 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 2046 {
maclobdell 0:f7c60d3e7b8a 2047 ; /* in_ctr read from peer, not maintained internally */
maclobdell 0:f7c60d3e7b8a 2048 }
maclobdell 0:f7c60d3e7b8a 2049 else
maclobdell 0:f7c60d3e7b8a 2050 #endif
maclobdell 0:f7c60d3e7b8a 2051 {
maclobdell 0:f7c60d3e7b8a 2052 for( i = 8; i > ssl_ep_len( ssl ); i-- )
maclobdell 0:f7c60d3e7b8a 2053 if( ++ssl->in_ctr[i - 1] != 0 )
maclobdell 0:f7c60d3e7b8a 2054 break;
maclobdell 0:f7c60d3e7b8a 2055
maclobdell 0:f7c60d3e7b8a 2056 /* The loop goes to its end iff the counter is wrapping */
maclobdell 0:f7c60d3e7b8a 2057 if( i == ssl_ep_len( ssl ) )
maclobdell 0:f7c60d3e7b8a 2058 {
maclobdell 0:f7c60d3e7b8a 2059 MBEDTLS_SSL_DEBUG_MSG( 1, ( "incoming message counter would wrap" ) );
maclobdell 0:f7c60d3e7b8a 2060 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
maclobdell 0:f7c60d3e7b8a 2061 }
maclobdell 0:f7c60d3e7b8a 2062 }
maclobdell 0:f7c60d3e7b8a 2063
maclobdell 0:f7c60d3e7b8a 2064 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
maclobdell 0:f7c60d3e7b8a 2065
maclobdell 0:f7c60d3e7b8a 2066 return( 0 );
maclobdell 0:f7c60d3e7b8a 2067 }
maclobdell 0:f7c60d3e7b8a 2068
maclobdell 0:f7c60d3e7b8a 2069 #undef MAC_NONE
maclobdell 0:f7c60d3e7b8a 2070 #undef MAC_PLAINTEXT
maclobdell 0:f7c60d3e7b8a 2071 #undef MAC_CIPHERTEXT
maclobdell 0:f7c60d3e7b8a 2072
maclobdell 0:f7c60d3e7b8a 2073 #if defined(MBEDTLS_ZLIB_SUPPORT)
maclobdell 0:f7c60d3e7b8a 2074 /*
maclobdell 0:f7c60d3e7b8a 2075 * Compression/decompression functions
maclobdell 0:f7c60d3e7b8a 2076 */
maclobdell 0:f7c60d3e7b8a 2077 static int ssl_compress_buf( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 2078 {
maclobdell 0:f7c60d3e7b8a 2079 int ret;
maclobdell 0:f7c60d3e7b8a 2080 unsigned char *msg_post = ssl->out_msg;
maclobdell 0:f7c60d3e7b8a 2081 size_t len_pre = ssl->out_msglen;
maclobdell 0:f7c60d3e7b8a 2082 unsigned char *msg_pre = ssl->compress_buf;
maclobdell 0:f7c60d3e7b8a 2083
maclobdell 0:f7c60d3e7b8a 2084 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> compress buf" ) );
maclobdell 0:f7c60d3e7b8a 2085
maclobdell 0:f7c60d3e7b8a 2086 if( len_pre == 0 )
maclobdell 0:f7c60d3e7b8a 2087 return( 0 );
maclobdell 0:f7c60d3e7b8a 2088
maclobdell 0:f7c60d3e7b8a 2089 memcpy( msg_pre, ssl->out_msg, len_pre );
maclobdell 0:f7c60d3e7b8a 2090
maclobdell 0:f7c60d3e7b8a 2091 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before compression: msglen = %d, ",
maclobdell 0:f7c60d3e7b8a 2092 ssl->out_msglen ) );
maclobdell 0:f7c60d3e7b8a 2093
maclobdell 0:f7c60d3e7b8a 2094 MBEDTLS_SSL_DEBUG_BUF( 4, "before compression: output payload",
maclobdell 0:f7c60d3e7b8a 2095 ssl->out_msg, ssl->out_msglen );
maclobdell 0:f7c60d3e7b8a 2096
maclobdell 0:f7c60d3e7b8a 2097 ssl->transform_out->ctx_deflate.next_in = msg_pre;
maclobdell 0:f7c60d3e7b8a 2098 ssl->transform_out->ctx_deflate.avail_in = len_pre;
maclobdell 0:f7c60d3e7b8a 2099 ssl->transform_out->ctx_deflate.next_out = msg_post;
maclobdell 0:f7c60d3e7b8a 2100 ssl->transform_out->ctx_deflate.avail_out = MBEDTLS_SSL_BUFFER_LEN;
maclobdell 0:f7c60d3e7b8a 2101
maclobdell 0:f7c60d3e7b8a 2102 ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH );
maclobdell 0:f7c60d3e7b8a 2103 if( ret != Z_OK )
maclobdell 0:f7c60d3e7b8a 2104 {
maclobdell 0:f7c60d3e7b8a 2105 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform compression (%d)", ret ) );
maclobdell 0:f7c60d3e7b8a 2106 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
maclobdell 0:f7c60d3e7b8a 2107 }
maclobdell 0:f7c60d3e7b8a 2108
maclobdell 0:f7c60d3e7b8a 2109 ssl->out_msglen = MBEDTLS_SSL_BUFFER_LEN -
maclobdell 0:f7c60d3e7b8a 2110 ssl->transform_out->ctx_deflate.avail_out;
maclobdell 0:f7c60d3e7b8a 2111
maclobdell 0:f7c60d3e7b8a 2112 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
maclobdell 0:f7c60d3e7b8a 2113 ssl->out_msglen ) );
maclobdell 0:f7c60d3e7b8a 2114
maclobdell 0:f7c60d3e7b8a 2115 MBEDTLS_SSL_DEBUG_BUF( 4, "after compression: output payload",
maclobdell 0:f7c60d3e7b8a 2116 ssl->out_msg, ssl->out_msglen );
maclobdell 0:f7c60d3e7b8a 2117
maclobdell 0:f7c60d3e7b8a 2118 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= compress buf" ) );
maclobdell 0:f7c60d3e7b8a 2119
maclobdell 0:f7c60d3e7b8a 2120 return( 0 );
maclobdell 0:f7c60d3e7b8a 2121 }
maclobdell 0:f7c60d3e7b8a 2122
maclobdell 0:f7c60d3e7b8a 2123 static int ssl_decompress_buf( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 2124 {
maclobdell 0:f7c60d3e7b8a 2125 int ret;
maclobdell 0:f7c60d3e7b8a 2126 unsigned char *msg_post = ssl->in_msg;
maclobdell 0:f7c60d3e7b8a 2127 size_t len_pre = ssl->in_msglen;
maclobdell 0:f7c60d3e7b8a 2128 unsigned char *msg_pre = ssl->compress_buf;
maclobdell 0:f7c60d3e7b8a 2129
maclobdell 0:f7c60d3e7b8a 2130 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> decompress buf" ) );
maclobdell 0:f7c60d3e7b8a 2131
maclobdell 0:f7c60d3e7b8a 2132 if( len_pre == 0 )
maclobdell 0:f7c60d3e7b8a 2133 return( 0 );
maclobdell 0:f7c60d3e7b8a 2134
maclobdell 0:f7c60d3e7b8a 2135 memcpy( msg_pre, ssl->in_msg, len_pre );
maclobdell 0:f7c60d3e7b8a 2136
maclobdell 0:f7c60d3e7b8a 2137 MBEDTLS_SSL_DEBUG_MSG( 3, ( "before decompression: msglen = %d, ",
maclobdell 0:f7c60d3e7b8a 2138 ssl->in_msglen ) );
maclobdell 0:f7c60d3e7b8a 2139
maclobdell 0:f7c60d3e7b8a 2140 MBEDTLS_SSL_DEBUG_BUF( 4, "before decompression: input payload",
maclobdell 0:f7c60d3e7b8a 2141 ssl->in_msg, ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 2142
maclobdell 0:f7c60d3e7b8a 2143 ssl->transform_in->ctx_inflate.next_in = msg_pre;
maclobdell 0:f7c60d3e7b8a 2144 ssl->transform_in->ctx_inflate.avail_in = len_pre;
maclobdell 0:f7c60d3e7b8a 2145 ssl->transform_in->ctx_inflate.next_out = msg_post;
maclobdell 0:f7c60d3e7b8a 2146 ssl->transform_in->ctx_inflate.avail_out = MBEDTLS_SSL_MAX_CONTENT_LEN;
maclobdell 0:f7c60d3e7b8a 2147
maclobdell 0:f7c60d3e7b8a 2148 ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH );
maclobdell 0:f7c60d3e7b8a 2149 if( ret != Z_OK )
maclobdell 0:f7c60d3e7b8a 2150 {
maclobdell 0:f7c60d3e7b8a 2151 MBEDTLS_SSL_DEBUG_MSG( 1, ( "failed to perform decompression (%d)", ret ) );
maclobdell 0:f7c60d3e7b8a 2152 return( MBEDTLS_ERR_SSL_COMPRESSION_FAILED );
maclobdell 0:f7c60d3e7b8a 2153 }
maclobdell 0:f7c60d3e7b8a 2154
maclobdell 0:f7c60d3e7b8a 2155 ssl->in_msglen = MBEDTLS_SSL_MAX_CONTENT_LEN -
maclobdell 0:f7c60d3e7b8a 2156 ssl->transform_in->ctx_inflate.avail_out;
maclobdell 0:f7c60d3e7b8a 2157
maclobdell 0:f7c60d3e7b8a 2158 MBEDTLS_SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
maclobdell 0:f7c60d3e7b8a 2159 ssl->in_msglen ) );
maclobdell 0:f7c60d3e7b8a 2160
maclobdell 0:f7c60d3e7b8a 2161 MBEDTLS_SSL_DEBUG_BUF( 4, "after decompression: input payload",
maclobdell 0:f7c60d3e7b8a 2162 ssl->in_msg, ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 2163
maclobdell 0:f7c60d3e7b8a 2164 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= decompress buf" ) );
maclobdell 0:f7c60d3e7b8a 2165
maclobdell 0:f7c60d3e7b8a 2166 return( 0 );
maclobdell 0:f7c60d3e7b8a 2167 }
maclobdell 0:f7c60d3e7b8a 2168 #endif /* MBEDTLS_ZLIB_SUPPORT */
maclobdell 0:f7c60d3e7b8a 2169
maclobdell 0:f7c60d3e7b8a 2170 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 2171 static int ssl_write_hello_request( mbedtls_ssl_context *ssl );
maclobdell 0:f7c60d3e7b8a 2172
maclobdell 0:f7c60d3e7b8a 2173 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 2174 static int ssl_resend_hello_request( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 2175 {
maclobdell 0:f7c60d3e7b8a 2176 /* If renegotiation is not enforced, retransmit until we would reach max
maclobdell 0:f7c60d3e7b8a 2177 * timeout if we were using the usual handshake doubling scheme */
maclobdell 0:f7c60d3e7b8a 2178 if( ssl->conf->renego_max_records < 0 )
maclobdell 0:f7c60d3e7b8a 2179 {
maclobdell 0:f7c60d3e7b8a 2180 uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
maclobdell 0:f7c60d3e7b8a 2181 unsigned char doublings = 1;
maclobdell 0:f7c60d3e7b8a 2182
maclobdell 0:f7c60d3e7b8a 2183 while( ratio != 0 )
maclobdell 0:f7c60d3e7b8a 2184 {
maclobdell 0:f7c60d3e7b8a 2185 ++doublings;
maclobdell 0:f7c60d3e7b8a 2186 ratio >>= 1;
maclobdell 0:f7c60d3e7b8a 2187 }
maclobdell 0:f7c60d3e7b8a 2188
maclobdell 0:f7c60d3e7b8a 2189 if( ++ssl->renego_records_seen > doublings )
maclobdell 0:f7c60d3e7b8a 2190 {
maclobdell 0:f7c60d3e7b8a 2191 MBEDTLS_SSL_DEBUG_MSG( 2, ( "no longer retransmitting hello request" ) );
maclobdell 0:f7c60d3e7b8a 2192 return( 0 );
maclobdell 0:f7c60d3e7b8a 2193 }
maclobdell 0:f7c60d3e7b8a 2194 }
maclobdell 0:f7c60d3e7b8a 2195
maclobdell 0:f7c60d3e7b8a 2196 return( ssl_write_hello_request( ssl ) );
maclobdell 0:f7c60d3e7b8a 2197 }
maclobdell 0:f7c60d3e7b8a 2198 #endif
maclobdell 0:f7c60d3e7b8a 2199 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
maclobdell 0:f7c60d3e7b8a 2200
maclobdell 0:f7c60d3e7b8a 2201 /*
maclobdell 0:f7c60d3e7b8a 2202 * Fill the input message buffer by appending data to it.
maclobdell 0:f7c60d3e7b8a 2203 * The amount of data already fetched is in ssl->in_left.
maclobdell 0:f7c60d3e7b8a 2204 *
maclobdell 0:f7c60d3e7b8a 2205 * If we return 0, is it guaranteed that (at least) nb_want bytes are
maclobdell 0:f7c60d3e7b8a 2206 * available (from this read and/or a previous one). Otherwise, an error code
maclobdell 0:f7c60d3e7b8a 2207 * is returned (possibly EOF or WANT_READ).
maclobdell 0:f7c60d3e7b8a 2208 *
maclobdell 0:f7c60d3e7b8a 2209 * With stream transport (TLS) on success ssl->in_left == nb_want, but
maclobdell 0:f7c60d3e7b8a 2210 * with datagram transport (DTLS) on success ssl->in_left >= nb_want,
maclobdell 0:f7c60d3e7b8a 2211 * since we always read a whole datagram at once.
maclobdell 0:f7c60d3e7b8a 2212 *
maclobdell 0:f7c60d3e7b8a 2213 * For DTLS, it is up to the caller to set ssl->next_record_offset when
maclobdell 0:f7c60d3e7b8a 2214 * they're done reading a record.
maclobdell 0:f7c60d3e7b8a 2215 */
maclobdell 0:f7c60d3e7b8a 2216 int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want )
maclobdell 0:f7c60d3e7b8a 2217 {
maclobdell 0:f7c60d3e7b8a 2218 int ret;
maclobdell 0:f7c60d3e7b8a 2219 size_t len;
maclobdell 0:f7c60d3e7b8a 2220
maclobdell 0:f7c60d3e7b8a 2221 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
maclobdell 0:f7c60d3e7b8a 2222
maclobdell 0:f7c60d3e7b8a 2223 if( ssl->f_recv == NULL && ssl->f_recv_timeout == NULL )
maclobdell 0:f7c60d3e7b8a 2224 {
maclobdell 0:f7c60d3e7b8a 2225 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
maclobdell 0:f7c60d3e7b8a 2226 "or mbedtls_ssl_set_bio()" ) );
maclobdell 0:f7c60d3e7b8a 2227 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 2228 }
maclobdell 0:f7c60d3e7b8a 2229
maclobdell 0:f7c60d3e7b8a 2230 if( nb_want > MBEDTLS_SSL_BUFFER_LEN - (size_t)( ssl->in_hdr - ssl->in_buf ) )
maclobdell 0:f7c60d3e7b8a 2231 {
maclobdell 0:f7c60d3e7b8a 2232 MBEDTLS_SSL_DEBUG_MSG( 1, ( "requesting more data than fits" ) );
maclobdell 0:f7c60d3e7b8a 2233 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 2234 }
maclobdell 0:f7c60d3e7b8a 2235
maclobdell 0:f7c60d3e7b8a 2236 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 2237 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 2238 {
maclobdell 0:f7c60d3e7b8a 2239 uint32_t timeout;
maclobdell 0:f7c60d3e7b8a 2240
maclobdell 0:f7c60d3e7b8a 2241 /* Just to be sure */
maclobdell 0:f7c60d3e7b8a 2242 if( ssl->f_set_timer == NULL || ssl->f_get_timer == NULL )
maclobdell 0:f7c60d3e7b8a 2243 {
maclobdell 0:f7c60d3e7b8a 2244 MBEDTLS_SSL_DEBUG_MSG( 1, ( "You must use "
maclobdell 0:f7c60d3e7b8a 2245 "mbedtls_ssl_set_timer_cb() for DTLS" ) );
maclobdell 0:f7c60d3e7b8a 2246 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 2247 }
maclobdell 0:f7c60d3e7b8a 2248
maclobdell 0:f7c60d3e7b8a 2249 /*
maclobdell 0:f7c60d3e7b8a 2250 * The point is, we need to always read a full datagram at once, so we
maclobdell 0:f7c60d3e7b8a 2251 * sometimes read more then requested, and handle the additional data.
maclobdell 0:f7c60d3e7b8a 2252 * It could be the rest of the current record (while fetching the
maclobdell 0:f7c60d3e7b8a 2253 * header) and/or some other records in the same datagram.
maclobdell 0:f7c60d3e7b8a 2254 */
maclobdell 0:f7c60d3e7b8a 2255
maclobdell 0:f7c60d3e7b8a 2256 /*
maclobdell 0:f7c60d3e7b8a 2257 * Move to the next record in the already read datagram if applicable
maclobdell 0:f7c60d3e7b8a 2258 */
maclobdell 0:f7c60d3e7b8a 2259 if( ssl->next_record_offset != 0 )
maclobdell 0:f7c60d3e7b8a 2260 {
maclobdell 0:f7c60d3e7b8a 2261 if( ssl->in_left < ssl->next_record_offset )
maclobdell 0:f7c60d3e7b8a 2262 {
maclobdell 0:f7c60d3e7b8a 2263 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 2264 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 2265 }
maclobdell 0:f7c60d3e7b8a 2266
maclobdell 0:f7c60d3e7b8a 2267 ssl->in_left -= ssl->next_record_offset;
maclobdell 0:f7c60d3e7b8a 2268
maclobdell 0:f7c60d3e7b8a 2269 if( ssl->in_left != 0 )
maclobdell 0:f7c60d3e7b8a 2270 {
maclobdell 0:f7c60d3e7b8a 2271 MBEDTLS_SSL_DEBUG_MSG( 2, ( "next record in same datagram, offset: %d",
maclobdell 0:f7c60d3e7b8a 2272 ssl->next_record_offset ) );
maclobdell 0:f7c60d3e7b8a 2273 memmove( ssl->in_hdr,
maclobdell 0:f7c60d3e7b8a 2274 ssl->in_hdr + ssl->next_record_offset,
maclobdell 0:f7c60d3e7b8a 2275 ssl->in_left );
maclobdell 0:f7c60d3e7b8a 2276 }
maclobdell 0:f7c60d3e7b8a 2277
maclobdell 0:f7c60d3e7b8a 2278 ssl->next_record_offset = 0;
maclobdell 0:f7c60d3e7b8a 2279 }
maclobdell 0:f7c60d3e7b8a 2280
maclobdell 0:f7c60d3e7b8a 2281 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
maclobdell 0:f7c60d3e7b8a 2282 ssl->in_left, nb_want ) );
maclobdell 0:f7c60d3e7b8a 2283
maclobdell 0:f7c60d3e7b8a 2284 /*
maclobdell 0:f7c60d3e7b8a 2285 * Done if we already have enough data.
maclobdell 0:f7c60d3e7b8a 2286 */
maclobdell 0:f7c60d3e7b8a 2287 if( nb_want <= ssl->in_left)
maclobdell 0:f7c60d3e7b8a 2288 {
maclobdell 0:f7c60d3e7b8a 2289 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
maclobdell 0:f7c60d3e7b8a 2290 return( 0 );
maclobdell 0:f7c60d3e7b8a 2291 }
maclobdell 0:f7c60d3e7b8a 2292
maclobdell 0:f7c60d3e7b8a 2293 /*
maclobdell 0:f7c60d3e7b8a 2294 * A record can't be split accross datagrams. If we need to read but
maclobdell 0:f7c60d3e7b8a 2295 * are not at the beginning of a new record, the caller did something
maclobdell 0:f7c60d3e7b8a 2296 * wrong.
maclobdell 0:f7c60d3e7b8a 2297 */
maclobdell 0:f7c60d3e7b8a 2298 if( ssl->in_left != 0 )
maclobdell 0:f7c60d3e7b8a 2299 {
maclobdell 0:f7c60d3e7b8a 2300 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 2301 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 2302 }
maclobdell 0:f7c60d3e7b8a 2303
maclobdell 0:f7c60d3e7b8a 2304 /*
maclobdell 0:f7c60d3e7b8a 2305 * Don't even try to read if time's out already.
maclobdell 0:f7c60d3e7b8a 2306 * This avoids by-passing the timer when repeatedly receiving messages
maclobdell 0:f7c60d3e7b8a 2307 * that will end up being dropped.
maclobdell 0:f7c60d3e7b8a 2308 */
maclobdell 0:f7c60d3e7b8a 2309 if( ssl_check_timer( ssl ) != 0 )
maclobdell 0:f7c60d3e7b8a 2310 ret = MBEDTLS_ERR_SSL_TIMEOUT;
maclobdell 0:f7c60d3e7b8a 2311 else
maclobdell 0:f7c60d3e7b8a 2312 {
maclobdell 0:f7c60d3e7b8a 2313 len = MBEDTLS_SSL_BUFFER_LEN - ( ssl->in_hdr - ssl->in_buf );
maclobdell 0:f7c60d3e7b8a 2314
maclobdell 0:f7c60d3e7b8a 2315 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
maclobdell 0:f7c60d3e7b8a 2316 timeout = ssl->handshake->retransmit_timeout;
maclobdell 0:f7c60d3e7b8a 2317 else
maclobdell 0:f7c60d3e7b8a 2318 timeout = ssl->conf->read_timeout;
maclobdell 0:f7c60d3e7b8a 2319
maclobdell 0:f7c60d3e7b8a 2320 MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) );
maclobdell 0:f7c60d3e7b8a 2321
maclobdell 0:f7c60d3e7b8a 2322 if( ssl->f_recv_timeout != NULL )
maclobdell 0:f7c60d3e7b8a 2323 ret = ssl->f_recv_timeout( ssl->p_bio, ssl->in_hdr, len,
maclobdell 0:f7c60d3e7b8a 2324 timeout );
maclobdell 0:f7c60d3e7b8a 2325 else
maclobdell 0:f7c60d3e7b8a 2326 ret = ssl->f_recv( ssl->p_bio, ssl->in_hdr, len );
maclobdell 0:f7c60d3e7b8a 2327
maclobdell 0:f7c60d3e7b8a 2328 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
maclobdell 0:f7c60d3e7b8a 2329
maclobdell 0:f7c60d3e7b8a 2330 if( ret == 0 )
maclobdell 0:f7c60d3e7b8a 2331 return( MBEDTLS_ERR_SSL_CONN_EOF );
maclobdell 0:f7c60d3e7b8a 2332 }
maclobdell 0:f7c60d3e7b8a 2333
maclobdell 0:f7c60d3e7b8a 2334 if( ret == MBEDTLS_ERR_SSL_TIMEOUT )
maclobdell 0:f7c60d3e7b8a 2335 {
maclobdell 0:f7c60d3e7b8a 2336 MBEDTLS_SSL_DEBUG_MSG( 2, ( "timeout" ) );
maclobdell 0:f7c60d3e7b8a 2337 ssl_set_timer( ssl, 0 );
maclobdell 0:f7c60d3e7b8a 2338
maclobdell 0:f7c60d3e7b8a 2339 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
maclobdell 0:f7c60d3e7b8a 2340 {
maclobdell 0:f7c60d3e7b8a 2341 if( ssl_double_retransmit_timeout( ssl ) != 0 )
maclobdell 0:f7c60d3e7b8a 2342 {
maclobdell 0:f7c60d3e7b8a 2343 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake timeout" ) );
maclobdell 0:f7c60d3e7b8a 2344 return( MBEDTLS_ERR_SSL_TIMEOUT );
maclobdell 0:f7c60d3e7b8a 2345 }
maclobdell 0:f7c60d3e7b8a 2346
maclobdell 0:f7c60d3e7b8a 2347 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 2348 {
maclobdell 0:f7c60d3e7b8a 2349 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
maclobdell 0:f7c60d3e7b8a 2350 return( ret );
maclobdell 0:f7c60d3e7b8a 2351 }
maclobdell 0:f7c60d3e7b8a 2352
maclobdell 0:f7c60d3e7b8a 2353 return( MBEDTLS_ERR_SSL_WANT_READ );
maclobdell 0:f7c60d3e7b8a 2354 }
maclobdell 0:f7c60d3e7b8a 2355 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 2356 else if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
maclobdell 0:f7c60d3e7b8a 2357 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
maclobdell 0:f7c60d3e7b8a 2358 {
maclobdell 0:f7c60d3e7b8a 2359 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 2360 {
maclobdell 0:f7c60d3e7b8a 2361 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
maclobdell 0:f7c60d3e7b8a 2362 return( ret );
maclobdell 0:f7c60d3e7b8a 2363 }
maclobdell 0:f7c60d3e7b8a 2364
maclobdell 0:f7c60d3e7b8a 2365 return( MBEDTLS_ERR_SSL_WANT_READ );
maclobdell 0:f7c60d3e7b8a 2366 }
maclobdell 0:f7c60d3e7b8a 2367 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
maclobdell 0:f7c60d3e7b8a 2368 }
maclobdell 0:f7c60d3e7b8a 2369
maclobdell 0:f7c60d3e7b8a 2370 if( ret < 0 )
maclobdell 0:f7c60d3e7b8a 2371 return( ret );
maclobdell 0:f7c60d3e7b8a 2372
maclobdell 0:f7c60d3e7b8a 2373 ssl->in_left = ret;
maclobdell 0:f7c60d3e7b8a 2374 }
maclobdell 0:f7c60d3e7b8a 2375 else
maclobdell 0:f7c60d3e7b8a 2376 #endif
maclobdell 0:f7c60d3e7b8a 2377 {
maclobdell 0:f7c60d3e7b8a 2378 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
maclobdell 0:f7c60d3e7b8a 2379 ssl->in_left, nb_want ) );
maclobdell 0:f7c60d3e7b8a 2380
maclobdell 0:f7c60d3e7b8a 2381 while( ssl->in_left < nb_want )
maclobdell 0:f7c60d3e7b8a 2382 {
maclobdell 0:f7c60d3e7b8a 2383 len = nb_want - ssl->in_left;
maclobdell 0:f7c60d3e7b8a 2384
maclobdell 0:f7c60d3e7b8a 2385 if( ssl_check_timer( ssl ) != 0 )
maclobdell 0:f7c60d3e7b8a 2386 ret = MBEDTLS_ERR_SSL_TIMEOUT;
maclobdell 0:f7c60d3e7b8a 2387 else
maclobdell 0:f7c60d3e7b8a 2388 {
maclobdell 0:f7c60d3e7b8a 2389 if( ssl->f_recv_timeout != NULL )
maclobdell 0:f7c60d3e7b8a 2390 {
maclobdell 0:f7c60d3e7b8a 2391 ret = ssl->f_recv_timeout( ssl->p_bio,
maclobdell 0:f7c60d3e7b8a 2392 ssl->in_hdr + ssl->in_left, len,
maclobdell 0:f7c60d3e7b8a 2393 ssl->conf->read_timeout );
maclobdell 0:f7c60d3e7b8a 2394 }
maclobdell 0:f7c60d3e7b8a 2395 else
maclobdell 0:f7c60d3e7b8a 2396 {
maclobdell 0:f7c60d3e7b8a 2397 ret = ssl->f_recv( ssl->p_bio,
maclobdell 0:f7c60d3e7b8a 2398 ssl->in_hdr + ssl->in_left, len );
maclobdell 0:f7c60d3e7b8a 2399 }
maclobdell 0:f7c60d3e7b8a 2400 }
maclobdell 0:f7c60d3e7b8a 2401
maclobdell 0:f7c60d3e7b8a 2402 MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
maclobdell 0:f7c60d3e7b8a 2403 ssl->in_left, nb_want ) );
maclobdell 0:f7c60d3e7b8a 2404 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
maclobdell 0:f7c60d3e7b8a 2405
maclobdell 0:f7c60d3e7b8a 2406 if( ret == 0 )
maclobdell 0:f7c60d3e7b8a 2407 return( MBEDTLS_ERR_SSL_CONN_EOF );
maclobdell 0:f7c60d3e7b8a 2408
maclobdell 0:f7c60d3e7b8a 2409 if( ret < 0 )
maclobdell 0:f7c60d3e7b8a 2410 return( ret );
maclobdell 0:f7c60d3e7b8a 2411
maclobdell 0:f7c60d3e7b8a 2412 ssl->in_left += ret;
maclobdell 0:f7c60d3e7b8a 2413 }
maclobdell 0:f7c60d3e7b8a 2414 }
maclobdell 0:f7c60d3e7b8a 2415
maclobdell 0:f7c60d3e7b8a 2416 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
maclobdell 0:f7c60d3e7b8a 2417
maclobdell 0:f7c60d3e7b8a 2418 return( 0 );
maclobdell 0:f7c60d3e7b8a 2419 }
maclobdell 0:f7c60d3e7b8a 2420
maclobdell 0:f7c60d3e7b8a 2421 /*
maclobdell 0:f7c60d3e7b8a 2422 * Flush any data not yet written
maclobdell 0:f7c60d3e7b8a 2423 */
maclobdell 0:f7c60d3e7b8a 2424 int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 2425 {
maclobdell 0:f7c60d3e7b8a 2426 int ret;
maclobdell 0:f7c60d3e7b8a 2427 unsigned char *buf, i;
maclobdell 0:f7c60d3e7b8a 2428
maclobdell 0:f7c60d3e7b8a 2429 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
maclobdell 0:f7c60d3e7b8a 2430
maclobdell 0:f7c60d3e7b8a 2431 if( ssl->f_send == NULL )
maclobdell 0:f7c60d3e7b8a 2432 {
maclobdell 0:f7c60d3e7b8a 2433 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Bad usage of mbedtls_ssl_set_bio() "
maclobdell 0:f7c60d3e7b8a 2434 "or mbedtls_ssl_set_bio()" ) );
maclobdell 0:f7c60d3e7b8a 2435 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 2436 }
maclobdell 0:f7c60d3e7b8a 2437
maclobdell 0:f7c60d3e7b8a 2438 /* Avoid incrementing counter if data is flushed */
maclobdell 0:f7c60d3e7b8a 2439 if( ssl->out_left == 0 )
maclobdell 0:f7c60d3e7b8a 2440 {
maclobdell 0:f7c60d3e7b8a 2441 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
maclobdell 0:f7c60d3e7b8a 2442 return( 0 );
maclobdell 0:f7c60d3e7b8a 2443 }
maclobdell 0:f7c60d3e7b8a 2444
maclobdell 0:f7c60d3e7b8a 2445 while( ssl->out_left > 0 )
maclobdell 0:f7c60d3e7b8a 2446 {
maclobdell 0:f7c60d3e7b8a 2447 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
maclobdell 0:f7c60d3e7b8a 2448 mbedtls_ssl_hdr_len( ssl ) + ssl->out_msglen, ssl->out_left ) );
maclobdell 0:f7c60d3e7b8a 2449
maclobdell 0:f7c60d3e7b8a 2450 buf = ssl->out_hdr + mbedtls_ssl_hdr_len( ssl ) +
maclobdell 0:f7c60d3e7b8a 2451 ssl->out_msglen - ssl->out_left;
maclobdell 0:f7c60d3e7b8a 2452 ret = ssl->f_send( ssl->p_bio, buf, ssl->out_left );
maclobdell 0:f7c60d3e7b8a 2453
maclobdell 0:f7c60d3e7b8a 2454 MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_send", ret );
maclobdell 0:f7c60d3e7b8a 2455
maclobdell 0:f7c60d3e7b8a 2456 if( ret <= 0 )
maclobdell 0:f7c60d3e7b8a 2457 return( ret );
maclobdell 0:f7c60d3e7b8a 2458
maclobdell 0:f7c60d3e7b8a 2459 ssl->out_left -= ret;
maclobdell 0:f7c60d3e7b8a 2460 }
maclobdell 0:f7c60d3e7b8a 2461
maclobdell 0:f7c60d3e7b8a 2462 for( i = 8; i > ssl_ep_len( ssl ); i-- )
maclobdell 0:f7c60d3e7b8a 2463 if( ++ssl->out_ctr[i - 1] != 0 )
maclobdell 0:f7c60d3e7b8a 2464 break;
maclobdell 0:f7c60d3e7b8a 2465
maclobdell 0:f7c60d3e7b8a 2466 /* The loop goes to its end iff the counter is wrapping */
maclobdell 0:f7c60d3e7b8a 2467 if( i == ssl_ep_len( ssl ) )
maclobdell 0:f7c60d3e7b8a 2468 {
maclobdell 0:f7c60d3e7b8a 2469 MBEDTLS_SSL_DEBUG_MSG( 1, ( "outgoing message counter would wrap" ) );
maclobdell 0:f7c60d3e7b8a 2470 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
maclobdell 0:f7c60d3e7b8a 2471 }
maclobdell 0:f7c60d3e7b8a 2472
maclobdell 0:f7c60d3e7b8a 2473 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
maclobdell 0:f7c60d3e7b8a 2474
maclobdell 0:f7c60d3e7b8a 2475 return( 0 );
maclobdell 0:f7c60d3e7b8a 2476 }
maclobdell 0:f7c60d3e7b8a 2477
maclobdell 0:f7c60d3e7b8a 2478 /*
maclobdell 0:f7c60d3e7b8a 2479 * Functions to handle the DTLS retransmission state machine
maclobdell 0:f7c60d3e7b8a 2480 */
maclobdell 0:f7c60d3e7b8a 2481 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 2482 /*
maclobdell 0:f7c60d3e7b8a 2483 * Append current handshake message to current outgoing flight
maclobdell 0:f7c60d3e7b8a 2484 */
maclobdell 0:f7c60d3e7b8a 2485 static int ssl_flight_append( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 2486 {
maclobdell 0:f7c60d3e7b8a 2487 mbedtls_ssl_flight_item *msg;
maclobdell 0:f7c60d3e7b8a 2488
maclobdell 0:f7c60d3e7b8a 2489 /* Allocate space for current message */
maclobdell 0:f7c60d3e7b8a 2490 if( ( msg = mbedtls_calloc( 1, sizeof( mbedtls_ssl_flight_item ) ) ) == NULL )
maclobdell 0:f7c60d3e7b8a 2491 {
maclobdell 0:f7c60d3e7b8a 2492 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed",
maclobdell 0:f7c60d3e7b8a 2493 sizeof( mbedtls_ssl_flight_item ) ) );
maclobdell 0:f7c60d3e7b8a 2494 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 2495 }
maclobdell 0:f7c60d3e7b8a 2496
maclobdell 0:f7c60d3e7b8a 2497 if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
maclobdell 0:f7c60d3e7b8a 2498 {
maclobdell 0:f7c60d3e7b8a 2499 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl->out_msglen ) );
maclobdell 0:f7c60d3e7b8a 2500 mbedtls_free( msg );
maclobdell 0:f7c60d3e7b8a 2501 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 2502 }
maclobdell 0:f7c60d3e7b8a 2503
maclobdell 0:f7c60d3e7b8a 2504 /* Copy current handshake message with headers */
maclobdell 0:f7c60d3e7b8a 2505 memcpy( msg->p, ssl->out_msg, ssl->out_msglen );
maclobdell 0:f7c60d3e7b8a 2506 msg->len = ssl->out_msglen;
maclobdell 0:f7c60d3e7b8a 2507 msg->type = ssl->out_msgtype;
maclobdell 0:f7c60d3e7b8a 2508 msg->next = NULL;
maclobdell 0:f7c60d3e7b8a 2509
maclobdell 0:f7c60d3e7b8a 2510 /* Append to the current flight */
maclobdell 0:f7c60d3e7b8a 2511 if( ssl->handshake->flight == NULL )
maclobdell 0:f7c60d3e7b8a 2512 ssl->handshake->flight = msg;
maclobdell 0:f7c60d3e7b8a 2513 else
maclobdell 0:f7c60d3e7b8a 2514 {
maclobdell 0:f7c60d3e7b8a 2515 mbedtls_ssl_flight_item *cur = ssl->handshake->flight;
maclobdell 0:f7c60d3e7b8a 2516 while( cur->next != NULL )
maclobdell 0:f7c60d3e7b8a 2517 cur = cur->next;
maclobdell 0:f7c60d3e7b8a 2518 cur->next = msg;
maclobdell 0:f7c60d3e7b8a 2519 }
maclobdell 0:f7c60d3e7b8a 2520
maclobdell 0:f7c60d3e7b8a 2521 return( 0 );
maclobdell 0:f7c60d3e7b8a 2522 }
maclobdell 0:f7c60d3e7b8a 2523
maclobdell 0:f7c60d3e7b8a 2524 /*
maclobdell 0:f7c60d3e7b8a 2525 * Free the current flight of handshake messages
maclobdell 0:f7c60d3e7b8a 2526 */
maclobdell 0:f7c60d3e7b8a 2527 static void ssl_flight_free( mbedtls_ssl_flight_item *flight )
maclobdell 0:f7c60d3e7b8a 2528 {
maclobdell 0:f7c60d3e7b8a 2529 mbedtls_ssl_flight_item *cur = flight;
maclobdell 0:f7c60d3e7b8a 2530 mbedtls_ssl_flight_item *next;
maclobdell 0:f7c60d3e7b8a 2531
maclobdell 0:f7c60d3e7b8a 2532 while( cur != NULL )
maclobdell 0:f7c60d3e7b8a 2533 {
maclobdell 0:f7c60d3e7b8a 2534 next = cur->next;
maclobdell 0:f7c60d3e7b8a 2535
maclobdell 0:f7c60d3e7b8a 2536 mbedtls_free( cur->p );
maclobdell 0:f7c60d3e7b8a 2537 mbedtls_free( cur );
maclobdell 0:f7c60d3e7b8a 2538
maclobdell 0:f7c60d3e7b8a 2539 cur = next;
maclobdell 0:f7c60d3e7b8a 2540 }
maclobdell 0:f7c60d3e7b8a 2541 }
maclobdell 0:f7c60d3e7b8a 2542
maclobdell 0:f7c60d3e7b8a 2543 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
maclobdell 0:f7c60d3e7b8a 2544 static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl );
maclobdell 0:f7c60d3e7b8a 2545 #endif
maclobdell 0:f7c60d3e7b8a 2546
maclobdell 0:f7c60d3e7b8a 2547 /*
maclobdell 0:f7c60d3e7b8a 2548 * Swap transform_out and out_ctr with the alternative ones
maclobdell 0:f7c60d3e7b8a 2549 */
maclobdell 0:f7c60d3e7b8a 2550 static void ssl_swap_epochs( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 2551 {
maclobdell 0:f7c60d3e7b8a 2552 mbedtls_ssl_transform *tmp_transform;
maclobdell 0:f7c60d3e7b8a 2553 unsigned char tmp_out_ctr[8];
maclobdell 0:f7c60d3e7b8a 2554
maclobdell 0:f7c60d3e7b8a 2555 if( ssl->transform_out == ssl->handshake->alt_transform_out )
maclobdell 0:f7c60d3e7b8a 2556 {
maclobdell 0:f7c60d3e7b8a 2557 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip swap epochs" ) );
maclobdell 0:f7c60d3e7b8a 2558 return;
maclobdell 0:f7c60d3e7b8a 2559 }
maclobdell 0:f7c60d3e7b8a 2560
maclobdell 0:f7c60d3e7b8a 2561 MBEDTLS_SSL_DEBUG_MSG( 3, ( "swap epochs" ) );
maclobdell 0:f7c60d3e7b8a 2562
maclobdell 0:f7c60d3e7b8a 2563 /* Swap transforms */
maclobdell 0:f7c60d3e7b8a 2564 tmp_transform = ssl->transform_out;
maclobdell 0:f7c60d3e7b8a 2565 ssl->transform_out = ssl->handshake->alt_transform_out;
maclobdell 0:f7c60d3e7b8a 2566 ssl->handshake->alt_transform_out = tmp_transform;
maclobdell 0:f7c60d3e7b8a 2567
maclobdell 0:f7c60d3e7b8a 2568 /* Swap epoch + sequence_number */
maclobdell 0:f7c60d3e7b8a 2569 memcpy( tmp_out_ctr, ssl->out_ctr, 8 );
maclobdell 0:f7c60d3e7b8a 2570 memcpy( ssl->out_ctr, ssl->handshake->alt_out_ctr, 8 );
maclobdell 0:f7c60d3e7b8a 2571 memcpy( ssl->handshake->alt_out_ctr, tmp_out_ctr, 8 );
maclobdell 0:f7c60d3e7b8a 2572
maclobdell 0:f7c60d3e7b8a 2573 /* Adjust to the newly activated transform */
maclobdell 0:f7c60d3e7b8a 2574 if( ssl->transform_out != NULL &&
maclobdell 0:f7c60d3e7b8a 2575 ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
maclobdell 0:f7c60d3e7b8a 2576 {
maclobdell 0:f7c60d3e7b8a 2577 ssl->out_msg = ssl->out_iv + ssl->transform_out->ivlen -
maclobdell 0:f7c60d3e7b8a 2578 ssl->transform_out->fixed_ivlen;
maclobdell 0:f7c60d3e7b8a 2579 }
maclobdell 0:f7c60d3e7b8a 2580 else
maclobdell 0:f7c60d3e7b8a 2581 ssl->out_msg = ssl->out_iv;
maclobdell 0:f7c60d3e7b8a 2582
maclobdell 0:f7c60d3e7b8a 2583 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
maclobdell 0:f7c60d3e7b8a 2584 if( mbedtls_ssl_hw_record_activate != NULL )
maclobdell 0:f7c60d3e7b8a 2585 {
maclobdell 0:f7c60d3e7b8a 2586 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 2587 {
maclobdell 0:f7c60d3e7b8a 2588 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
maclobdell 0:f7c60d3e7b8a 2589 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
maclobdell 0:f7c60d3e7b8a 2590 }
maclobdell 0:f7c60d3e7b8a 2591 }
maclobdell 0:f7c60d3e7b8a 2592 #endif
maclobdell 0:f7c60d3e7b8a 2593 }
maclobdell 0:f7c60d3e7b8a 2594
maclobdell 0:f7c60d3e7b8a 2595 /*
maclobdell 0:f7c60d3e7b8a 2596 * Retransmit the current flight of messages.
maclobdell 0:f7c60d3e7b8a 2597 *
maclobdell 0:f7c60d3e7b8a 2598 * Need to remember the current message in case flush_output returns
maclobdell 0:f7c60d3e7b8a 2599 * WANT_WRITE, causing us to exit this function and come back later.
maclobdell 0:f7c60d3e7b8a 2600 * This function must be called until state is no longer SENDING.
maclobdell 0:f7c60d3e7b8a 2601 */
maclobdell 0:f7c60d3e7b8a 2602 int mbedtls_ssl_resend( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 2603 {
maclobdell 0:f7c60d3e7b8a 2604 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_resend" ) );
maclobdell 0:f7c60d3e7b8a 2605
maclobdell 0:f7c60d3e7b8a 2606 if( ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING )
maclobdell 0:f7c60d3e7b8a 2607 {
maclobdell 0:f7c60d3e7b8a 2608 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialise resending" ) );
maclobdell 0:f7c60d3e7b8a 2609
maclobdell 0:f7c60d3e7b8a 2610 ssl->handshake->cur_msg = ssl->handshake->flight;
maclobdell 0:f7c60d3e7b8a 2611 ssl_swap_epochs( ssl );
maclobdell 0:f7c60d3e7b8a 2612
maclobdell 0:f7c60d3e7b8a 2613 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_SENDING;
maclobdell 0:f7c60d3e7b8a 2614 }
maclobdell 0:f7c60d3e7b8a 2615
maclobdell 0:f7c60d3e7b8a 2616 while( ssl->handshake->cur_msg != NULL )
maclobdell 0:f7c60d3e7b8a 2617 {
maclobdell 0:f7c60d3e7b8a 2618 int ret;
maclobdell 0:f7c60d3e7b8a 2619 mbedtls_ssl_flight_item *cur = ssl->handshake->cur_msg;
maclobdell 0:f7c60d3e7b8a 2620
maclobdell 0:f7c60d3e7b8a 2621 /* Swap epochs before sending Finished: we can't do it after
maclobdell 0:f7c60d3e7b8a 2622 * sending ChangeCipherSpec, in case write returns WANT_READ.
maclobdell 0:f7c60d3e7b8a 2623 * Must be done before copying, may change out_msg pointer */
maclobdell 0:f7c60d3e7b8a 2624 if( cur->type == MBEDTLS_SSL_MSG_HANDSHAKE &&
maclobdell 0:f7c60d3e7b8a 2625 cur->p[0] == MBEDTLS_SSL_HS_FINISHED )
maclobdell 0:f7c60d3e7b8a 2626 {
maclobdell 0:f7c60d3e7b8a 2627 ssl_swap_epochs( ssl );
maclobdell 0:f7c60d3e7b8a 2628 }
maclobdell 0:f7c60d3e7b8a 2629
maclobdell 0:f7c60d3e7b8a 2630 memcpy( ssl->out_msg, cur->p, cur->len );
maclobdell 0:f7c60d3e7b8a 2631 ssl->out_msglen = cur->len;
maclobdell 0:f7c60d3e7b8a 2632 ssl->out_msgtype = cur->type;
maclobdell 0:f7c60d3e7b8a 2633
maclobdell 0:f7c60d3e7b8a 2634 ssl->handshake->cur_msg = cur->next;
maclobdell 0:f7c60d3e7b8a 2635
maclobdell 0:f7c60d3e7b8a 2636 MBEDTLS_SSL_DEBUG_BUF( 3, "resent handshake message header", ssl->out_msg, 12 );
maclobdell 0:f7c60d3e7b8a 2637
maclobdell 0:f7c60d3e7b8a 2638 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 2639 {
maclobdell 0:f7c60d3e7b8a 2640 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
maclobdell 0:f7c60d3e7b8a 2641 return( ret );
maclobdell 0:f7c60d3e7b8a 2642 }
maclobdell 0:f7c60d3e7b8a 2643 }
maclobdell 0:f7c60d3e7b8a 2644
maclobdell 0:f7c60d3e7b8a 2645 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
maclobdell 0:f7c60d3e7b8a 2646 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
maclobdell 0:f7c60d3e7b8a 2647 else
maclobdell 0:f7c60d3e7b8a 2648 {
maclobdell 0:f7c60d3e7b8a 2649 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
maclobdell 0:f7c60d3e7b8a 2650 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
maclobdell 0:f7c60d3e7b8a 2651 }
maclobdell 0:f7c60d3e7b8a 2652
maclobdell 0:f7c60d3e7b8a 2653 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_resend" ) );
maclobdell 0:f7c60d3e7b8a 2654
maclobdell 0:f7c60d3e7b8a 2655 return( 0 );
maclobdell 0:f7c60d3e7b8a 2656 }
maclobdell 0:f7c60d3e7b8a 2657
maclobdell 0:f7c60d3e7b8a 2658 /*
maclobdell 0:f7c60d3e7b8a 2659 * To be called when the last message of an incoming flight is received.
maclobdell 0:f7c60d3e7b8a 2660 */
maclobdell 0:f7c60d3e7b8a 2661 void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 2662 {
maclobdell 0:f7c60d3e7b8a 2663 /* We won't need to resend that one any more */
maclobdell 0:f7c60d3e7b8a 2664 ssl_flight_free( ssl->handshake->flight );
maclobdell 0:f7c60d3e7b8a 2665 ssl->handshake->flight = NULL;
maclobdell 0:f7c60d3e7b8a 2666 ssl->handshake->cur_msg = NULL;
maclobdell 0:f7c60d3e7b8a 2667
maclobdell 0:f7c60d3e7b8a 2668 /* The next incoming flight will start with this msg_seq */
maclobdell 0:f7c60d3e7b8a 2669 ssl->handshake->in_flight_start_seq = ssl->handshake->in_msg_seq;
maclobdell 0:f7c60d3e7b8a 2670
maclobdell 0:f7c60d3e7b8a 2671 /* Cancel timer */
maclobdell 0:f7c60d3e7b8a 2672 ssl_set_timer( ssl, 0 );
maclobdell 0:f7c60d3e7b8a 2673
maclobdell 0:f7c60d3e7b8a 2674 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
maclobdell 0:f7c60d3e7b8a 2675 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
maclobdell 0:f7c60d3e7b8a 2676 {
maclobdell 0:f7c60d3e7b8a 2677 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
maclobdell 0:f7c60d3e7b8a 2678 }
maclobdell 0:f7c60d3e7b8a 2679 else
maclobdell 0:f7c60d3e7b8a 2680 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
maclobdell 0:f7c60d3e7b8a 2681 }
maclobdell 0:f7c60d3e7b8a 2682
maclobdell 0:f7c60d3e7b8a 2683 /*
maclobdell 0:f7c60d3e7b8a 2684 * To be called when the last message of an outgoing flight is send.
maclobdell 0:f7c60d3e7b8a 2685 */
maclobdell 0:f7c60d3e7b8a 2686 void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 2687 {
maclobdell 0:f7c60d3e7b8a 2688 ssl_reset_retransmit_timeout( ssl );
maclobdell 0:f7c60d3e7b8a 2689 ssl_set_timer( ssl, ssl->handshake->retransmit_timeout );
maclobdell 0:f7c60d3e7b8a 2690
maclobdell 0:f7c60d3e7b8a 2691 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
maclobdell 0:f7c60d3e7b8a 2692 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
maclobdell 0:f7c60d3e7b8a 2693 {
maclobdell 0:f7c60d3e7b8a 2694 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_FINISHED;
maclobdell 0:f7c60d3e7b8a 2695 }
maclobdell 0:f7c60d3e7b8a 2696 else
maclobdell 0:f7c60d3e7b8a 2697 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
maclobdell 0:f7c60d3e7b8a 2698 }
maclobdell 0:f7c60d3e7b8a 2699 #endif /* MBEDTLS_SSL_PROTO_DTLS */
maclobdell 0:f7c60d3e7b8a 2700
maclobdell 0:f7c60d3e7b8a 2701 /*
maclobdell 0:f7c60d3e7b8a 2702 * Record layer functions
maclobdell 0:f7c60d3e7b8a 2703 */
maclobdell 0:f7c60d3e7b8a 2704
maclobdell 0:f7c60d3e7b8a 2705 /*
maclobdell 0:f7c60d3e7b8a 2706 * Write current record.
maclobdell 0:f7c60d3e7b8a 2707 * Uses ssl->out_msgtype, ssl->out_msglen and bytes at ssl->out_msg.
maclobdell 0:f7c60d3e7b8a 2708 */
maclobdell 0:f7c60d3e7b8a 2709 int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 2710 {
maclobdell 0:f7c60d3e7b8a 2711 int ret, done = 0;
maclobdell 0:f7c60d3e7b8a 2712 size_t len = ssl->out_msglen;
maclobdell 0:f7c60d3e7b8a 2713
maclobdell 0:f7c60d3e7b8a 2714 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) );
maclobdell 0:f7c60d3e7b8a 2715
maclobdell 0:f7c60d3e7b8a 2716 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 2717 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
maclobdell 0:f7c60d3e7b8a 2718 ssl->handshake != NULL &&
maclobdell 0:f7c60d3e7b8a 2719 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
maclobdell 0:f7c60d3e7b8a 2720 {
maclobdell 0:f7c60d3e7b8a 2721 ; /* Skip special handshake treatment when resending */
maclobdell 0:f7c60d3e7b8a 2722 }
maclobdell 0:f7c60d3e7b8a 2723 else
maclobdell 0:f7c60d3e7b8a 2724 #endif
maclobdell 0:f7c60d3e7b8a 2725 if( ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
maclobdell 0:f7c60d3e7b8a 2726 {
maclobdell 0:f7c60d3e7b8a 2727 if( ssl->out_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST &&
maclobdell 0:f7c60d3e7b8a 2728 ssl->handshake == NULL )
maclobdell 0:f7c60d3e7b8a 2729 {
maclobdell 0:f7c60d3e7b8a 2730 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 2731 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 2732 }
maclobdell 0:f7c60d3e7b8a 2733
maclobdell 0:f7c60d3e7b8a 2734 ssl->out_msg[1] = (unsigned char)( ( len - 4 ) >> 16 );
maclobdell 0:f7c60d3e7b8a 2735 ssl->out_msg[2] = (unsigned char)( ( len - 4 ) >> 8 );
maclobdell 0:f7c60d3e7b8a 2736 ssl->out_msg[3] = (unsigned char)( ( len - 4 ) );
maclobdell 0:f7c60d3e7b8a 2737
maclobdell 0:f7c60d3e7b8a 2738 /*
maclobdell 0:f7c60d3e7b8a 2739 * DTLS has additional fields in the Handshake layer,
maclobdell 0:f7c60d3e7b8a 2740 * between the length field and the actual payload:
maclobdell 0:f7c60d3e7b8a 2741 * uint16 message_seq;
maclobdell 0:f7c60d3e7b8a 2742 * uint24 fragment_offset;
maclobdell 0:f7c60d3e7b8a 2743 * uint24 fragment_length;
maclobdell 0:f7c60d3e7b8a 2744 */
maclobdell 0:f7c60d3e7b8a 2745 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 2746 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 2747 {
maclobdell 0:f7c60d3e7b8a 2748 /* Make room for the additional DTLS fields */
maclobdell 0:f7c60d3e7b8a 2749 memmove( ssl->out_msg + 12, ssl->out_msg + 4, len - 4 );
maclobdell 0:f7c60d3e7b8a 2750 ssl->out_msglen += 8;
maclobdell 0:f7c60d3e7b8a 2751 len += 8;
maclobdell 0:f7c60d3e7b8a 2752
maclobdell 0:f7c60d3e7b8a 2753 /* Write message_seq and update it, except for HelloRequest */
maclobdell 0:f7c60d3e7b8a 2754 if( ssl->out_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST )
maclobdell 0:f7c60d3e7b8a 2755 {
maclobdell 0:f7c60d3e7b8a 2756 ssl->out_msg[4] = ( ssl->handshake->out_msg_seq >> 8 ) & 0xFF;
maclobdell 0:f7c60d3e7b8a 2757 ssl->out_msg[5] = ( ssl->handshake->out_msg_seq ) & 0xFF;
maclobdell 0:f7c60d3e7b8a 2758 ++( ssl->handshake->out_msg_seq );
maclobdell 0:f7c60d3e7b8a 2759 }
maclobdell 0:f7c60d3e7b8a 2760 else
maclobdell 0:f7c60d3e7b8a 2761 {
maclobdell 0:f7c60d3e7b8a 2762 ssl->out_msg[4] = 0;
maclobdell 0:f7c60d3e7b8a 2763 ssl->out_msg[5] = 0;
maclobdell 0:f7c60d3e7b8a 2764 }
maclobdell 0:f7c60d3e7b8a 2765
maclobdell 0:f7c60d3e7b8a 2766 /* We don't fragment, so frag_offset = 0 and frag_len = len */
maclobdell 0:f7c60d3e7b8a 2767 memset( ssl->out_msg + 6, 0x00, 3 );
maclobdell 0:f7c60d3e7b8a 2768 memcpy( ssl->out_msg + 9, ssl->out_msg + 1, 3 );
maclobdell 0:f7c60d3e7b8a 2769 }
maclobdell 0:f7c60d3e7b8a 2770 #endif /* MBEDTLS_SSL_PROTO_DTLS */
maclobdell 0:f7c60d3e7b8a 2771
maclobdell 0:f7c60d3e7b8a 2772 if( ssl->out_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST )
maclobdell 0:f7c60d3e7b8a 2773 ssl->handshake->update_checksum( ssl, ssl->out_msg, len );
maclobdell 0:f7c60d3e7b8a 2774 }
maclobdell 0:f7c60d3e7b8a 2775
maclobdell 0:f7c60d3e7b8a 2776 /* Save handshake and CCS messages for resending */
maclobdell 0:f7c60d3e7b8a 2777 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 2778 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
maclobdell 0:f7c60d3e7b8a 2779 ssl->handshake != NULL &&
maclobdell 0:f7c60d3e7b8a 2780 ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING &&
maclobdell 0:f7c60d3e7b8a 2781 ( ssl->out_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC ||
maclobdell 0:f7c60d3e7b8a 2782 ssl->out_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) )
maclobdell 0:f7c60d3e7b8a 2783 {
maclobdell 0:f7c60d3e7b8a 2784 if( ( ret = ssl_flight_append( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 2785 {
maclobdell 0:f7c60d3e7b8a 2786 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_flight_append", ret );
maclobdell 0:f7c60d3e7b8a 2787 return( ret );
maclobdell 0:f7c60d3e7b8a 2788 }
maclobdell 0:f7c60d3e7b8a 2789 }
maclobdell 0:f7c60d3e7b8a 2790 #endif
maclobdell 0:f7c60d3e7b8a 2791
maclobdell 0:f7c60d3e7b8a 2792 #if defined(MBEDTLS_ZLIB_SUPPORT)
maclobdell 0:f7c60d3e7b8a 2793 if( ssl->transform_out != NULL &&
maclobdell 0:f7c60d3e7b8a 2794 ssl->session_out->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
maclobdell 0:f7c60d3e7b8a 2795 {
maclobdell 0:f7c60d3e7b8a 2796 if( ( ret = ssl_compress_buf( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 2797 {
maclobdell 0:f7c60d3e7b8a 2798 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_compress_buf", ret );
maclobdell 0:f7c60d3e7b8a 2799 return( ret );
maclobdell 0:f7c60d3e7b8a 2800 }
maclobdell 0:f7c60d3e7b8a 2801
maclobdell 0:f7c60d3e7b8a 2802 len = ssl->out_msglen;
maclobdell 0:f7c60d3e7b8a 2803 }
maclobdell 0:f7c60d3e7b8a 2804 #endif /*MBEDTLS_ZLIB_SUPPORT */
maclobdell 0:f7c60d3e7b8a 2805
maclobdell 0:f7c60d3e7b8a 2806 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
maclobdell 0:f7c60d3e7b8a 2807 if( mbedtls_ssl_hw_record_write != NULL )
maclobdell 0:f7c60d3e7b8a 2808 {
maclobdell 0:f7c60d3e7b8a 2809 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_write()" ) );
maclobdell 0:f7c60d3e7b8a 2810
maclobdell 0:f7c60d3e7b8a 2811 ret = mbedtls_ssl_hw_record_write( ssl );
maclobdell 0:f7c60d3e7b8a 2812 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
maclobdell 0:f7c60d3e7b8a 2813 {
maclobdell 0:f7c60d3e7b8a 2814 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_write", ret );
maclobdell 0:f7c60d3e7b8a 2815 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
maclobdell 0:f7c60d3e7b8a 2816 }
maclobdell 0:f7c60d3e7b8a 2817
maclobdell 0:f7c60d3e7b8a 2818 if( ret == 0 )
maclobdell 0:f7c60d3e7b8a 2819 done = 1;
maclobdell 0:f7c60d3e7b8a 2820 }
maclobdell 0:f7c60d3e7b8a 2821 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
maclobdell 0:f7c60d3e7b8a 2822 if( !done )
maclobdell 0:f7c60d3e7b8a 2823 {
maclobdell 0:f7c60d3e7b8a 2824 ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
maclobdell 0:f7c60d3e7b8a 2825 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
maclobdell 0:f7c60d3e7b8a 2826 ssl->conf->transport, ssl->out_hdr + 1 );
maclobdell 0:f7c60d3e7b8a 2827
maclobdell 0:f7c60d3e7b8a 2828 ssl->out_len[0] = (unsigned char)( len >> 8 );
maclobdell 0:f7c60d3e7b8a 2829 ssl->out_len[1] = (unsigned char)( len );
maclobdell 0:f7c60d3e7b8a 2830
maclobdell 0:f7c60d3e7b8a 2831 if( ssl->transform_out != NULL )
maclobdell 0:f7c60d3e7b8a 2832 {
maclobdell 0:f7c60d3e7b8a 2833 if( ( ret = ssl_encrypt_buf( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 2834 {
maclobdell 0:f7c60d3e7b8a 2835 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
maclobdell 0:f7c60d3e7b8a 2836 return( ret );
maclobdell 0:f7c60d3e7b8a 2837 }
maclobdell 0:f7c60d3e7b8a 2838
maclobdell 0:f7c60d3e7b8a 2839 len = ssl->out_msglen;
maclobdell 0:f7c60d3e7b8a 2840 ssl->out_len[0] = (unsigned char)( len >> 8 );
maclobdell 0:f7c60d3e7b8a 2841 ssl->out_len[1] = (unsigned char)( len );
maclobdell 0:f7c60d3e7b8a 2842 }
maclobdell 0:f7c60d3e7b8a 2843
maclobdell 0:f7c60d3e7b8a 2844 ssl->out_left = mbedtls_ssl_hdr_len( ssl ) + ssl->out_msglen;
maclobdell 0:f7c60d3e7b8a 2845
maclobdell 0:f7c60d3e7b8a 2846 MBEDTLS_SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
maclobdell 0:f7c60d3e7b8a 2847 "version = [%d:%d], msglen = %d",
maclobdell 0:f7c60d3e7b8a 2848 ssl->out_hdr[0], ssl->out_hdr[1], ssl->out_hdr[2],
maclobdell 0:f7c60d3e7b8a 2849 ( ssl->out_len[0] << 8 ) | ssl->out_len[1] ) );
maclobdell 0:f7c60d3e7b8a 2850
maclobdell 0:f7c60d3e7b8a 2851 MBEDTLS_SSL_DEBUG_BUF( 4, "output record sent to network",
maclobdell 0:f7c60d3e7b8a 2852 ssl->out_hdr, mbedtls_ssl_hdr_len( ssl ) + ssl->out_msglen );
maclobdell 0:f7c60d3e7b8a 2853 }
maclobdell 0:f7c60d3e7b8a 2854
maclobdell 0:f7c60d3e7b8a 2855 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 2856 {
maclobdell 0:f7c60d3e7b8a 2857 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
maclobdell 0:f7c60d3e7b8a 2858 return( ret );
maclobdell 0:f7c60d3e7b8a 2859 }
maclobdell 0:f7c60d3e7b8a 2860
maclobdell 0:f7c60d3e7b8a 2861 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write record" ) );
maclobdell 0:f7c60d3e7b8a 2862
maclobdell 0:f7c60d3e7b8a 2863 return( 0 );
maclobdell 0:f7c60d3e7b8a 2864 }
maclobdell 0:f7c60d3e7b8a 2865
maclobdell 0:f7c60d3e7b8a 2866 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 2867 /*
maclobdell 0:f7c60d3e7b8a 2868 * Mark bits in bitmask (used for DTLS HS reassembly)
maclobdell 0:f7c60d3e7b8a 2869 */
maclobdell 0:f7c60d3e7b8a 2870 static void ssl_bitmask_set( unsigned char *mask, size_t offset, size_t len )
maclobdell 0:f7c60d3e7b8a 2871 {
maclobdell 0:f7c60d3e7b8a 2872 unsigned int start_bits, end_bits;
maclobdell 0:f7c60d3e7b8a 2873
maclobdell 0:f7c60d3e7b8a 2874 start_bits = 8 - ( offset % 8 );
maclobdell 0:f7c60d3e7b8a 2875 if( start_bits != 8 )
maclobdell 0:f7c60d3e7b8a 2876 {
maclobdell 0:f7c60d3e7b8a 2877 size_t first_byte_idx = offset / 8;
maclobdell 0:f7c60d3e7b8a 2878
maclobdell 0:f7c60d3e7b8a 2879 /* Special case */
maclobdell 0:f7c60d3e7b8a 2880 if( len <= start_bits )
maclobdell 0:f7c60d3e7b8a 2881 {
maclobdell 0:f7c60d3e7b8a 2882 for( ; len != 0; len-- )
maclobdell 0:f7c60d3e7b8a 2883 mask[first_byte_idx] |= 1 << ( start_bits - len );
maclobdell 0:f7c60d3e7b8a 2884
maclobdell 0:f7c60d3e7b8a 2885 /* Avoid potential issues with offset or len becoming invalid */
maclobdell 0:f7c60d3e7b8a 2886 return;
maclobdell 0:f7c60d3e7b8a 2887 }
maclobdell 0:f7c60d3e7b8a 2888
maclobdell 0:f7c60d3e7b8a 2889 offset += start_bits; /* Now offset % 8 == 0 */
maclobdell 0:f7c60d3e7b8a 2890 len -= start_bits;
maclobdell 0:f7c60d3e7b8a 2891
maclobdell 0:f7c60d3e7b8a 2892 for( ; start_bits != 0; start_bits-- )
maclobdell 0:f7c60d3e7b8a 2893 mask[first_byte_idx] |= 1 << ( start_bits - 1 );
maclobdell 0:f7c60d3e7b8a 2894 }
maclobdell 0:f7c60d3e7b8a 2895
maclobdell 0:f7c60d3e7b8a 2896 end_bits = len % 8;
maclobdell 0:f7c60d3e7b8a 2897 if( end_bits != 0 )
maclobdell 0:f7c60d3e7b8a 2898 {
maclobdell 0:f7c60d3e7b8a 2899 size_t last_byte_idx = ( offset + len ) / 8;
maclobdell 0:f7c60d3e7b8a 2900
maclobdell 0:f7c60d3e7b8a 2901 len -= end_bits; /* Now len % 8 == 0 */
maclobdell 0:f7c60d3e7b8a 2902
maclobdell 0:f7c60d3e7b8a 2903 for( ; end_bits != 0; end_bits-- )
maclobdell 0:f7c60d3e7b8a 2904 mask[last_byte_idx] |= 1 << ( 8 - end_bits );
maclobdell 0:f7c60d3e7b8a 2905 }
maclobdell 0:f7c60d3e7b8a 2906
maclobdell 0:f7c60d3e7b8a 2907 memset( mask + offset / 8, 0xFF, len / 8 );
maclobdell 0:f7c60d3e7b8a 2908 }
maclobdell 0:f7c60d3e7b8a 2909
maclobdell 0:f7c60d3e7b8a 2910 /*
maclobdell 0:f7c60d3e7b8a 2911 * Check that bitmask is full
maclobdell 0:f7c60d3e7b8a 2912 */
maclobdell 0:f7c60d3e7b8a 2913 static int ssl_bitmask_check( unsigned char *mask, size_t len )
maclobdell 0:f7c60d3e7b8a 2914 {
maclobdell 0:f7c60d3e7b8a 2915 size_t i;
maclobdell 0:f7c60d3e7b8a 2916
maclobdell 0:f7c60d3e7b8a 2917 for( i = 0; i < len / 8; i++ )
maclobdell 0:f7c60d3e7b8a 2918 if( mask[i] != 0xFF )
maclobdell 0:f7c60d3e7b8a 2919 return( -1 );
maclobdell 0:f7c60d3e7b8a 2920
maclobdell 0:f7c60d3e7b8a 2921 for( i = 0; i < len % 8; i++ )
maclobdell 0:f7c60d3e7b8a 2922 if( ( mask[len / 8] & ( 1 << ( 7 - i ) ) ) == 0 )
maclobdell 0:f7c60d3e7b8a 2923 return( -1 );
maclobdell 0:f7c60d3e7b8a 2924
maclobdell 0:f7c60d3e7b8a 2925 return( 0 );
maclobdell 0:f7c60d3e7b8a 2926 }
maclobdell 0:f7c60d3e7b8a 2927
maclobdell 0:f7c60d3e7b8a 2928 /*
maclobdell 0:f7c60d3e7b8a 2929 * Reassemble fragmented DTLS handshake messages.
maclobdell 0:f7c60d3e7b8a 2930 *
maclobdell 0:f7c60d3e7b8a 2931 * Use a temporary buffer for reassembly, divided in two parts:
maclobdell 0:f7c60d3e7b8a 2932 * - the first holds the reassembled message (including handshake header),
maclobdell 0:f7c60d3e7b8a 2933 * - the second holds a bitmask indicating which parts of the message
maclobdell 0:f7c60d3e7b8a 2934 * (excluding headers) have been received so far.
maclobdell 0:f7c60d3e7b8a 2935 */
maclobdell 0:f7c60d3e7b8a 2936 static int ssl_reassemble_dtls_handshake( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 2937 {
maclobdell 0:f7c60d3e7b8a 2938 unsigned char *msg, *bitmask;
maclobdell 0:f7c60d3e7b8a 2939 size_t frag_len, frag_off;
maclobdell 0:f7c60d3e7b8a 2940 size_t msg_len = ssl->in_hslen - 12; /* Without headers */
maclobdell 0:f7c60d3e7b8a 2941
maclobdell 0:f7c60d3e7b8a 2942 if( ssl->handshake == NULL )
maclobdell 0:f7c60d3e7b8a 2943 {
maclobdell 0:f7c60d3e7b8a 2944 MBEDTLS_SSL_DEBUG_MSG( 1, ( "not supported outside handshake (for now)" ) );
maclobdell 0:f7c60d3e7b8a 2945 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
maclobdell 0:f7c60d3e7b8a 2946 }
maclobdell 0:f7c60d3e7b8a 2947
maclobdell 0:f7c60d3e7b8a 2948 /*
maclobdell 0:f7c60d3e7b8a 2949 * For first fragment, check size and allocate buffer
maclobdell 0:f7c60d3e7b8a 2950 */
maclobdell 0:f7c60d3e7b8a 2951 if( ssl->handshake->hs_msg == NULL )
maclobdell 0:f7c60d3e7b8a 2952 {
maclobdell 0:f7c60d3e7b8a 2953 size_t alloc_len;
maclobdell 0:f7c60d3e7b8a 2954
maclobdell 0:f7c60d3e7b8a 2955 MBEDTLS_SSL_DEBUG_MSG( 2, ( "initialize reassembly, total length = %d",
maclobdell 0:f7c60d3e7b8a 2956 msg_len ) );
maclobdell 0:f7c60d3e7b8a 2957
maclobdell 0:f7c60d3e7b8a 2958 if( ssl->in_hslen > MBEDTLS_SSL_MAX_CONTENT_LEN )
maclobdell 0:f7c60d3e7b8a 2959 {
maclobdell 0:f7c60d3e7b8a 2960 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too large" ) );
maclobdell 0:f7c60d3e7b8a 2961 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
maclobdell 0:f7c60d3e7b8a 2962 }
maclobdell 0:f7c60d3e7b8a 2963
maclobdell 0:f7c60d3e7b8a 2964 /* The bitmask needs one bit per byte of message excluding header */
maclobdell 0:f7c60d3e7b8a 2965 alloc_len = 12 + msg_len + msg_len / 8 + ( msg_len % 8 != 0 );
maclobdell 0:f7c60d3e7b8a 2966
maclobdell 0:f7c60d3e7b8a 2967 ssl->handshake->hs_msg = mbedtls_calloc( 1, alloc_len );
maclobdell 0:f7c60d3e7b8a 2968 if( ssl->handshake->hs_msg == NULL )
maclobdell 0:f7c60d3e7b8a 2969 {
maclobdell 0:f7c60d3e7b8a 2970 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", alloc_len ) );
maclobdell 0:f7c60d3e7b8a 2971 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 2972 }
maclobdell 0:f7c60d3e7b8a 2973
maclobdell 0:f7c60d3e7b8a 2974 /* Prepare final header: copy msg_type, length and message_seq,
maclobdell 0:f7c60d3e7b8a 2975 * then add standardised fragment_offset and fragment_length */
maclobdell 0:f7c60d3e7b8a 2976 memcpy( ssl->handshake->hs_msg, ssl->in_msg, 6 );
maclobdell 0:f7c60d3e7b8a 2977 memset( ssl->handshake->hs_msg + 6, 0, 3 );
maclobdell 0:f7c60d3e7b8a 2978 memcpy( ssl->handshake->hs_msg + 9,
maclobdell 0:f7c60d3e7b8a 2979 ssl->handshake->hs_msg + 1, 3 );
maclobdell 0:f7c60d3e7b8a 2980 }
maclobdell 0:f7c60d3e7b8a 2981 else
maclobdell 0:f7c60d3e7b8a 2982 {
maclobdell 0:f7c60d3e7b8a 2983 /* Make sure msg_type and length are consistent */
maclobdell 0:f7c60d3e7b8a 2984 if( memcmp( ssl->handshake->hs_msg, ssl->in_msg, 4 ) != 0 )
maclobdell 0:f7c60d3e7b8a 2985 {
maclobdell 0:f7c60d3e7b8a 2986 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment header mismatch" ) );
maclobdell 0:f7c60d3e7b8a 2987 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 2988 }
maclobdell 0:f7c60d3e7b8a 2989 }
maclobdell 0:f7c60d3e7b8a 2990
maclobdell 0:f7c60d3e7b8a 2991 msg = ssl->handshake->hs_msg + 12;
maclobdell 0:f7c60d3e7b8a 2992 bitmask = msg + msg_len;
maclobdell 0:f7c60d3e7b8a 2993
maclobdell 0:f7c60d3e7b8a 2994 /*
maclobdell 0:f7c60d3e7b8a 2995 * Check and copy current fragment
maclobdell 0:f7c60d3e7b8a 2996 */
maclobdell 0:f7c60d3e7b8a 2997 frag_off = ( ssl->in_msg[6] << 16 ) |
maclobdell 0:f7c60d3e7b8a 2998 ( ssl->in_msg[7] << 8 ) |
maclobdell 0:f7c60d3e7b8a 2999 ssl->in_msg[8];
maclobdell 0:f7c60d3e7b8a 3000 frag_len = ( ssl->in_msg[9] << 16 ) |
maclobdell 0:f7c60d3e7b8a 3001 ( ssl->in_msg[10] << 8 ) |
maclobdell 0:f7c60d3e7b8a 3002 ssl->in_msg[11];
maclobdell 0:f7c60d3e7b8a 3003
maclobdell 0:f7c60d3e7b8a 3004 if( frag_off + frag_len > msg_len )
maclobdell 0:f7c60d3e7b8a 3005 {
maclobdell 0:f7c60d3e7b8a 3006 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid fragment offset/len: %d + %d > %d",
maclobdell 0:f7c60d3e7b8a 3007 frag_off, frag_len, msg_len ) );
maclobdell 0:f7c60d3e7b8a 3008 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3009 }
maclobdell 0:f7c60d3e7b8a 3010
maclobdell 0:f7c60d3e7b8a 3011 if( frag_len + 12 > ssl->in_msglen )
maclobdell 0:f7c60d3e7b8a 3012 {
maclobdell 0:f7c60d3e7b8a 3013 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid fragment length: %d + 12 > %d",
maclobdell 0:f7c60d3e7b8a 3014 frag_len, ssl->in_msglen ) );
maclobdell 0:f7c60d3e7b8a 3015 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3016 }
maclobdell 0:f7c60d3e7b8a 3017
maclobdell 0:f7c60d3e7b8a 3018 MBEDTLS_SSL_DEBUG_MSG( 2, ( "adding fragment, offset = %d, length = %d",
maclobdell 0:f7c60d3e7b8a 3019 frag_off, frag_len ) );
maclobdell 0:f7c60d3e7b8a 3020
maclobdell 0:f7c60d3e7b8a 3021 memcpy( msg + frag_off, ssl->in_msg + 12, frag_len );
maclobdell 0:f7c60d3e7b8a 3022 ssl_bitmask_set( bitmask, frag_off, frag_len );
maclobdell 0:f7c60d3e7b8a 3023
maclobdell 0:f7c60d3e7b8a 3024 /*
maclobdell 0:f7c60d3e7b8a 3025 * Do we have the complete message by now?
maclobdell 0:f7c60d3e7b8a 3026 * If yes, finalize it, else ask to read the next record.
maclobdell 0:f7c60d3e7b8a 3027 */
maclobdell 0:f7c60d3e7b8a 3028 if( ssl_bitmask_check( bitmask, msg_len ) != 0 )
maclobdell 0:f7c60d3e7b8a 3029 {
maclobdell 0:f7c60d3e7b8a 3030 MBEDTLS_SSL_DEBUG_MSG( 2, ( "message is not complete yet" ) );
maclobdell 0:f7c60d3e7b8a 3031 return( MBEDTLS_ERR_SSL_WANT_READ );
maclobdell 0:f7c60d3e7b8a 3032 }
maclobdell 0:f7c60d3e7b8a 3033
maclobdell 0:f7c60d3e7b8a 3034 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake message completed" ) );
maclobdell 0:f7c60d3e7b8a 3035
maclobdell 0:f7c60d3e7b8a 3036 if( frag_len + 12 < ssl->in_msglen )
maclobdell 0:f7c60d3e7b8a 3037 {
maclobdell 0:f7c60d3e7b8a 3038 /*
maclobdell 0:f7c60d3e7b8a 3039 * We'got more handshake messages in the same record.
maclobdell 0:f7c60d3e7b8a 3040 * This case is not handled now because no know implementation does
maclobdell 0:f7c60d3e7b8a 3041 * that and it's hard to test, so we prefer to fail cleanly for now.
maclobdell 0:f7c60d3e7b8a 3042 */
maclobdell 0:f7c60d3e7b8a 3043 MBEDTLS_SSL_DEBUG_MSG( 1, ( "last fragment not alone in its record" ) );
maclobdell 0:f7c60d3e7b8a 3044 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
maclobdell 0:f7c60d3e7b8a 3045 }
maclobdell 0:f7c60d3e7b8a 3046
maclobdell 0:f7c60d3e7b8a 3047 if( ssl->in_left > ssl->next_record_offset )
maclobdell 0:f7c60d3e7b8a 3048 {
maclobdell 0:f7c60d3e7b8a 3049 /*
maclobdell 0:f7c60d3e7b8a 3050 * We've got more data in the buffer after the current record,
maclobdell 0:f7c60d3e7b8a 3051 * that we don't want to overwrite. Move it before writing the
maclobdell 0:f7c60d3e7b8a 3052 * reassembled message, and adjust in_left and next_record_offset.
maclobdell 0:f7c60d3e7b8a 3053 */
maclobdell 0:f7c60d3e7b8a 3054 unsigned char *cur_remain = ssl->in_hdr + ssl->next_record_offset;
maclobdell 0:f7c60d3e7b8a 3055 unsigned char *new_remain = ssl->in_msg + ssl->in_hslen;
maclobdell 0:f7c60d3e7b8a 3056 size_t remain_len = ssl->in_left - ssl->next_record_offset;
maclobdell 0:f7c60d3e7b8a 3057
maclobdell 0:f7c60d3e7b8a 3058 /* First compute and check new lengths */
maclobdell 0:f7c60d3e7b8a 3059 ssl->next_record_offset = new_remain - ssl->in_hdr;
maclobdell 0:f7c60d3e7b8a 3060 ssl->in_left = ssl->next_record_offset + remain_len;
maclobdell 0:f7c60d3e7b8a 3061
maclobdell 0:f7c60d3e7b8a 3062 if( ssl->in_left > MBEDTLS_SSL_BUFFER_LEN -
maclobdell 0:f7c60d3e7b8a 3063 (size_t)( ssl->in_hdr - ssl->in_buf ) )
maclobdell 0:f7c60d3e7b8a 3064 {
maclobdell 0:f7c60d3e7b8a 3065 MBEDTLS_SSL_DEBUG_MSG( 1, ( "reassembled message too large for buffer" ) );
maclobdell 0:f7c60d3e7b8a 3066 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
maclobdell 0:f7c60d3e7b8a 3067 }
maclobdell 0:f7c60d3e7b8a 3068
maclobdell 0:f7c60d3e7b8a 3069 memmove( new_remain, cur_remain, remain_len );
maclobdell 0:f7c60d3e7b8a 3070 }
maclobdell 0:f7c60d3e7b8a 3071
maclobdell 0:f7c60d3e7b8a 3072 memcpy( ssl->in_msg, ssl->handshake->hs_msg, ssl->in_hslen );
maclobdell 0:f7c60d3e7b8a 3073
maclobdell 0:f7c60d3e7b8a 3074 mbedtls_free( ssl->handshake->hs_msg );
maclobdell 0:f7c60d3e7b8a 3075 ssl->handshake->hs_msg = NULL;
maclobdell 0:f7c60d3e7b8a 3076
maclobdell 0:f7c60d3e7b8a 3077 MBEDTLS_SSL_DEBUG_BUF( 3, "reassembled handshake message",
maclobdell 0:f7c60d3e7b8a 3078 ssl->in_msg, ssl->in_hslen );
maclobdell 0:f7c60d3e7b8a 3079
maclobdell 0:f7c60d3e7b8a 3080 return( 0 );
maclobdell 0:f7c60d3e7b8a 3081 }
maclobdell 0:f7c60d3e7b8a 3082 #endif /* MBEDTLS_SSL_PROTO_DTLS */
maclobdell 0:f7c60d3e7b8a 3083
maclobdell 0:f7c60d3e7b8a 3084 static int ssl_prepare_handshake_record( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 3085 {
maclobdell 0:f7c60d3e7b8a 3086 if( ssl->in_msglen < mbedtls_ssl_hs_hdr_len( ssl ) )
maclobdell 0:f7c60d3e7b8a 3087 {
maclobdell 0:f7c60d3e7b8a 3088 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake message too short: %d",
maclobdell 0:f7c60d3e7b8a 3089 ssl->in_msglen ) );
maclobdell 0:f7c60d3e7b8a 3090 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3091 }
maclobdell 0:f7c60d3e7b8a 3092
maclobdell 0:f7c60d3e7b8a 3093 ssl->in_hslen = mbedtls_ssl_hs_hdr_len( ssl ) + (
maclobdell 0:f7c60d3e7b8a 3094 ( ssl->in_msg[1] << 16 ) |
maclobdell 0:f7c60d3e7b8a 3095 ( ssl->in_msg[2] << 8 ) |
maclobdell 0:f7c60d3e7b8a 3096 ssl->in_msg[3] );
maclobdell 0:f7c60d3e7b8a 3097
maclobdell 0:f7c60d3e7b8a 3098 MBEDTLS_SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
maclobdell 0:f7c60d3e7b8a 3099 " %d, type = %d, hslen = %d",
maclobdell 0:f7c60d3e7b8a 3100 ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
maclobdell 0:f7c60d3e7b8a 3101
maclobdell 0:f7c60d3e7b8a 3102 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 3103 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 3104 {
maclobdell 0:f7c60d3e7b8a 3105 int ret;
maclobdell 0:f7c60d3e7b8a 3106 unsigned int recv_msg_seq = ( ssl->in_msg[4] << 8 ) | ssl->in_msg[5];
maclobdell 0:f7c60d3e7b8a 3107
maclobdell 0:f7c60d3e7b8a 3108 /* ssl->handshake is NULL when receiving ClientHello for renego */
maclobdell 0:f7c60d3e7b8a 3109 if( ssl->handshake != NULL &&
maclobdell 0:f7c60d3e7b8a 3110 recv_msg_seq != ssl->handshake->in_msg_seq )
maclobdell 0:f7c60d3e7b8a 3111 {
maclobdell 0:f7c60d3e7b8a 3112 /* Retransmit only on last message from previous flight, to avoid
maclobdell 0:f7c60d3e7b8a 3113 * too many retransmissions.
maclobdell 0:f7c60d3e7b8a 3114 * Besides, No sane server ever retransmits HelloVerifyRequest */
maclobdell 0:f7c60d3e7b8a 3115 if( recv_msg_seq == ssl->handshake->in_flight_start_seq - 1 &&
maclobdell 0:f7c60d3e7b8a 3116 ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
maclobdell 0:f7c60d3e7b8a 3117 {
maclobdell 0:f7c60d3e7b8a 3118 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received message from last flight, "
maclobdell 0:f7c60d3e7b8a 3119 "message_seq = %d, start_of_flight = %d",
maclobdell 0:f7c60d3e7b8a 3120 recv_msg_seq,
maclobdell 0:f7c60d3e7b8a 3121 ssl->handshake->in_flight_start_seq ) );
maclobdell 0:f7c60d3e7b8a 3122
maclobdell 0:f7c60d3e7b8a 3123 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3124 {
maclobdell 0:f7c60d3e7b8a 3125 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
maclobdell 0:f7c60d3e7b8a 3126 return( ret );
maclobdell 0:f7c60d3e7b8a 3127 }
maclobdell 0:f7c60d3e7b8a 3128 }
maclobdell 0:f7c60d3e7b8a 3129 else
maclobdell 0:f7c60d3e7b8a 3130 {
maclobdell 0:f7c60d3e7b8a 3131 MBEDTLS_SSL_DEBUG_MSG( 2, ( "dropping out-of-sequence message: "
maclobdell 0:f7c60d3e7b8a 3132 "message_seq = %d, expected = %d",
maclobdell 0:f7c60d3e7b8a 3133 recv_msg_seq,
maclobdell 0:f7c60d3e7b8a 3134 ssl->handshake->in_msg_seq ) );
maclobdell 0:f7c60d3e7b8a 3135 }
maclobdell 0:f7c60d3e7b8a 3136
maclobdell 0:f7c60d3e7b8a 3137 return( MBEDTLS_ERR_SSL_WANT_READ );
maclobdell 0:f7c60d3e7b8a 3138 }
maclobdell 0:f7c60d3e7b8a 3139 /* Wait until message completion to increment in_msg_seq */
maclobdell 0:f7c60d3e7b8a 3140
maclobdell 0:f7c60d3e7b8a 3141 /* Reassemble if current message is fragmented or reassembly is
maclobdell 0:f7c60d3e7b8a 3142 * already in progress */
maclobdell 0:f7c60d3e7b8a 3143 if( ssl->in_msglen < ssl->in_hslen ||
maclobdell 0:f7c60d3e7b8a 3144 memcmp( ssl->in_msg + 6, "\0\0\0", 3 ) != 0 ||
maclobdell 0:f7c60d3e7b8a 3145 memcmp( ssl->in_msg + 9, ssl->in_msg + 1, 3 ) != 0 ||
maclobdell 0:f7c60d3e7b8a 3146 ( ssl->handshake != NULL && ssl->handshake->hs_msg != NULL ) )
maclobdell 0:f7c60d3e7b8a 3147 {
maclobdell 0:f7c60d3e7b8a 3148 MBEDTLS_SSL_DEBUG_MSG( 2, ( "found fragmented DTLS handshake message" ) );
maclobdell 0:f7c60d3e7b8a 3149
maclobdell 0:f7c60d3e7b8a 3150 if( ( ret = ssl_reassemble_dtls_handshake( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3151 {
maclobdell 0:f7c60d3e7b8a 3152 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_reassemble_dtls_handshake", ret );
maclobdell 0:f7c60d3e7b8a 3153 return( ret );
maclobdell 0:f7c60d3e7b8a 3154 }
maclobdell 0:f7c60d3e7b8a 3155 }
maclobdell 0:f7c60d3e7b8a 3156 }
maclobdell 0:f7c60d3e7b8a 3157 else
maclobdell 0:f7c60d3e7b8a 3158 #endif /* MBEDTLS_SSL_PROTO_DTLS */
maclobdell 0:f7c60d3e7b8a 3159 /* With TLS we don't handle fragmentation (for now) */
maclobdell 0:f7c60d3e7b8a 3160 if( ssl->in_msglen < ssl->in_hslen )
maclobdell 0:f7c60d3e7b8a 3161 {
maclobdell 0:f7c60d3e7b8a 3162 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS handshake fragmentation not supported" ) );
maclobdell 0:f7c60d3e7b8a 3163 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
maclobdell 0:f7c60d3e7b8a 3164 }
maclobdell 0:f7c60d3e7b8a 3165
maclobdell 0:f7c60d3e7b8a 3166 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER &&
maclobdell 0:f7c60d3e7b8a 3167 ssl->handshake != NULL )
maclobdell 0:f7c60d3e7b8a 3168 {
maclobdell 0:f7c60d3e7b8a 3169 ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
maclobdell 0:f7c60d3e7b8a 3170 }
maclobdell 0:f7c60d3e7b8a 3171
maclobdell 0:f7c60d3e7b8a 3172 /* Handshake message is complete, increment counter */
maclobdell 0:f7c60d3e7b8a 3173 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 3174 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
maclobdell 0:f7c60d3e7b8a 3175 ssl->handshake != NULL )
maclobdell 0:f7c60d3e7b8a 3176 {
maclobdell 0:f7c60d3e7b8a 3177 ssl->handshake->in_msg_seq++;
maclobdell 0:f7c60d3e7b8a 3178 }
maclobdell 0:f7c60d3e7b8a 3179 #endif
maclobdell 0:f7c60d3e7b8a 3180
maclobdell 0:f7c60d3e7b8a 3181 return( 0 );
maclobdell 0:f7c60d3e7b8a 3182 }
maclobdell 0:f7c60d3e7b8a 3183
maclobdell 0:f7c60d3e7b8a 3184 /*
maclobdell 0:f7c60d3e7b8a 3185 * DTLS anti-replay: RFC 6347 4.1.2.6
maclobdell 0:f7c60d3e7b8a 3186 *
maclobdell 0:f7c60d3e7b8a 3187 * in_window is a field of bits numbered from 0 (lsb) to 63 (msb).
maclobdell 0:f7c60d3e7b8a 3188 * Bit n is set iff record number in_window_top - n has been seen.
maclobdell 0:f7c60d3e7b8a 3189 *
maclobdell 0:f7c60d3e7b8a 3190 * Usually, in_window_top is the last record number seen and the lsb of
maclobdell 0:f7c60d3e7b8a 3191 * in_window is set. The only exception is the initial state (record number 0
maclobdell 0:f7c60d3e7b8a 3192 * not seen yet).
maclobdell 0:f7c60d3e7b8a 3193 */
maclobdell 0:f7c60d3e7b8a 3194 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
maclobdell 0:f7c60d3e7b8a 3195 static void ssl_dtls_replay_reset( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 3196 {
maclobdell 0:f7c60d3e7b8a 3197 ssl->in_window_top = 0;
maclobdell 0:f7c60d3e7b8a 3198 ssl->in_window = 0;
maclobdell 0:f7c60d3e7b8a 3199 }
maclobdell 0:f7c60d3e7b8a 3200
maclobdell 0:f7c60d3e7b8a 3201 static inline uint64_t ssl_load_six_bytes( unsigned char *buf )
maclobdell 0:f7c60d3e7b8a 3202 {
maclobdell 0:f7c60d3e7b8a 3203 return( ( (uint64_t) buf[0] << 40 ) |
maclobdell 0:f7c60d3e7b8a 3204 ( (uint64_t) buf[1] << 32 ) |
maclobdell 0:f7c60d3e7b8a 3205 ( (uint64_t) buf[2] << 24 ) |
maclobdell 0:f7c60d3e7b8a 3206 ( (uint64_t) buf[3] << 16 ) |
maclobdell 0:f7c60d3e7b8a 3207 ( (uint64_t) buf[4] << 8 ) |
maclobdell 0:f7c60d3e7b8a 3208 ( (uint64_t) buf[5] ) );
maclobdell 0:f7c60d3e7b8a 3209 }
maclobdell 0:f7c60d3e7b8a 3210
maclobdell 0:f7c60d3e7b8a 3211 /*
maclobdell 0:f7c60d3e7b8a 3212 * Return 0 if sequence number is acceptable, -1 otherwise
maclobdell 0:f7c60d3e7b8a 3213 */
maclobdell 0:f7c60d3e7b8a 3214 int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 3215 {
maclobdell 0:f7c60d3e7b8a 3216 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
maclobdell 0:f7c60d3e7b8a 3217 uint64_t bit;
maclobdell 0:f7c60d3e7b8a 3218
maclobdell 0:f7c60d3e7b8a 3219 if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
maclobdell 0:f7c60d3e7b8a 3220 return( 0 );
maclobdell 0:f7c60d3e7b8a 3221
maclobdell 0:f7c60d3e7b8a 3222 if( rec_seqnum > ssl->in_window_top )
maclobdell 0:f7c60d3e7b8a 3223 return( 0 );
maclobdell 0:f7c60d3e7b8a 3224
maclobdell 0:f7c60d3e7b8a 3225 bit = ssl->in_window_top - rec_seqnum;
maclobdell 0:f7c60d3e7b8a 3226
maclobdell 0:f7c60d3e7b8a 3227 if( bit >= 64 )
maclobdell 0:f7c60d3e7b8a 3228 return( -1 );
maclobdell 0:f7c60d3e7b8a 3229
maclobdell 0:f7c60d3e7b8a 3230 if( ( ssl->in_window & ( (uint64_t) 1 << bit ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3231 return( -1 );
maclobdell 0:f7c60d3e7b8a 3232
maclobdell 0:f7c60d3e7b8a 3233 return( 0 );
maclobdell 0:f7c60d3e7b8a 3234 }
maclobdell 0:f7c60d3e7b8a 3235
maclobdell 0:f7c60d3e7b8a 3236 /*
maclobdell 0:f7c60d3e7b8a 3237 * Update replay window on new validated record
maclobdell 0:f7c60d3e7b8a 3238 */
maclobdell 0:f7c60d3e7b8a 3239 void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 3240 {
maclobdell 0:f7c60d3e7b8a 3241 uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
maclobdell 0:f7c60d3e7b8a 3242
maclobdell 0:f7c60d3e7b8a 3243 if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
maclobdell 0:f7c60d3e7b8a 3244 return;
maclobdell 0:f7c60d3e7b8a 3245
maclobdell 0:f7c60d3e7b8a 3246 if( rec_seqnum > ssl->in_window_top )
maclobdell 0:f7c60d3e7b8a 3247 {
maclobdell 0:f7c60d3e7b8a 3248 /* Update window_top and the contents of the window */
maclobdell 0:f7c60d3e7b8a 3249 uint64_t shift = rec_seqnum - ssl->in_window_top;
maclobdell 0:f7c60d3e7b8a 3250
maclobdell 0:f7c60d3e7b8a 3251 if( shift >= 64 )
maclobdell 0:f7c60d3e7b8a 3252 ssl->in_window = 1;
maclobdell 0:f7c60d3e7b8a 3253 else
maclobdell 0:f7c60d3e7b8a 3254 {
maclobdell 0:f7c60d3e7b8a 3255 ssl->in_window <<= shift;
maclobdell 0:f7c60d3e7b8a 3256 ssl->in_window |= 1;
maclobdell 0:f7c60d3e7b8a 3257 }
maclobdell 0:f7c60d3e7b8a 3258
maclobdell 0:f7c60d3e7b8a 3259 ssl->in_window_top = rec_seqnum;
maclobdell 0:f7c60d3e7b8a 3260 }
maclobdell 0:f7c60d3e7b8a 3261 else
maclobdell 0:f7c60d3e7b8a 3262 {
maclobdell 0:f7c60d3e7b8a 3263 /* Mark that number as seen in the current window */
maclobdell 0:f7c60d3e7b8a 3264 uint64_t bit = ssl->in_window_top - rec_seqnum;
maclobdell 0:f7c60d3e7b8a 3265
maclobdell 0:f7c60d3e7b8a 3266 if( bit < 64 ) /* Always true, but be extra sure */
maclobdell 0:f7c60d3e7b8a 3267 ssl->in_window |= (uint64_t) 1 << bit;
maclobdell 0:f7c60d3e7b8a 3268 }
maclobdell 0:f7c60d3e7b8a 3269 }
maclobdell 0:f7c60d3e7b8a 3270 #endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */
maclobdell 0:f7c60d3e7b8a 3271
maclobdell 0:f7c60d3e7b8a 3272 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 3273 /* Forward declaration */
maclobdell 0:f7c60d3e7b8a 3274 static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial );
maclobdell 0:f7c60d3e7b8a 3275
maclobdell 0:f7c60d3e7b8a 3276 /*
maclobdell 0:f7c60d3e7b8a 3277 * Without any SSL context, check if a datagram looks like a ClientHello with
maclobdell 0:f7c60d3e7b8a 3278 * a valid cookie, and if it doesn't, generate a HelloVerifyRequest message.
maclobdell 0:f7c60d3e7b8a 3279 * Both input and output include full DTLS headers.
maclobdell 0:f7c60d3e7b8a 3280 *
maclobdell 0:f7c60d3e7b8a 3281 * - if cookie is valid, return 0
maclobdell 0:f7c60d3e7b8a 3282 * - if ClientHello looks superficially valid but cookie is not,
maclobdell 0:f7c60d3e7b8a 3283 * fill obuf and set olen, then
maclobdell 0:f7c60d3e7b8a 3284 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
maclobdell 0:f7c60d3e7b8a 3285 * - otherwise return a specific error code
maclobdell 0:f7c60d3e7b8a 3286 */
maclobdell 0:f7c60d3e7b8a 3287 static int ssl_check_dtls_clihlo_cookie(
maclobdell 0:f7c60d3e7b8a 3288 mbedtls_ssl_cookie_write_t *f_cookie_write,
maclobdell 0:f7c60d3e7b8a 3289 mbedtls_ssl_cookie_check_t *f_cookie_check,
maclobdell 0:f7c60d3e7b8a 3290 void *p_cookie,
maclobdell 0:f7c60d3e7b8a 3291 const unsigned char *cli_id, size_t cli_id_len,
maclobdell 0:f7c60d3e7b8a 3292 const unsigned char *in, size_t in_len,
maclobdell 0:f7c60d3e7b8a 3293 unsigned char *obuf, size_t buf_len, size_t *olen )
maclobdell 0:f7c60d3e7b8a 3294 {
maclobdell 0:f7c60d3e7b8a 3295 size_t sid_len, cookie_len;
maclobdell 0:f7c60d3e7b8a 3296 unsigned char *p;
maclobdell 0:f7c60d3e7b8a 3297
maclobdell 0:f7c60d3e7b8a 3298 if( f_cookie_write == NULL || f_cookie_check == NULL )
maclobdell 0:f7c60d3e7b8a 3299 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 3300
maclobdell 0:f7c60d3e7b8a 3301 /*
maclobdell 0:f7c60d3e7b8a 3302 * Structure of ClientHello with record and handshake headers,
maclobdell 0:f7c60d3e7b8a 3303 * and expected values. We don't need to check a lot, more checks will be
maclobdell 0:f7c60d3e7b8a 3304 * done when actually parsing the ClientHello - skipping those checks
maclobdell 0:f7c60d3e7b8a 3305 * avoids code duplication and does not make cookie forging any easier.
maclobdell 0:f7c60d3e7b8a 3306 *
maclobdell 0:f7c60d3e7b8a 3307 * 0-0 ContentType type; copied, must be handshake
maclobdell 0:f7c60d3e7b8a 3308 * 1-2 ProtocolVersion version; copied
maclobdell 0:f7c60d3e7b8a 3309 * 3-4 uint16 epoch; copied, must be 0
maclobdell 0:f7c60d3e7b8a 3310 * 5-10 uint48 sequence_number; copied
maclobdell 0:f7c60d3e7b8a 3311 * 11-12 uint16 length; (ignored)
maclobdell 0:f7c60d3e7b8a 3312 *
maclobdell 0:f7c60d3e7b8a 3313 * 13-13 HandshakeType msg_type; (ignored)
maclobdell 0:f7c60d3e7b8a 3314 * 14-16 uint24 length; (ignored)
maclobdell 0:f7c60d3e7b8a 3315 * 17-18 uint16 message_seq; copied
maclobdell 0:f7c60d3e7b8a 3316 * 19-21 uint24 fragment_offset; copied, must be 0
maclobdell 0:f7c60d3e7b8a 3317 * 22-24 uint24 fragment_length; (ignored)
maclobdell 0:f7c60d3e7b8a 3318 *
maclobdell 0:f7c60d3e7b8a 3319 * 25-26 ProtocolVersion client_version; (ignored)
maclobdell 0:f7c60d3e7b8a 3320 * 27-58 Random random; (ignored)
maclobdell 0:f7c60d3e7b8a 3321 * 59-xx SessionID session_id; 1 byte len + sid_len content
maclobdell 0:f7c60d3e7b8a 3322 * 60+ opaque cookie<0..2^8-1>; 1 byte len + content
maclobdell 0:f7c60d3e7b8a 3323 * ...
maclobdell 0:f7c60d3e7b8a 3324 *
maclobdell 0:f7c60d3e7b8a 3325 * Minimum length is 61 bytes.
maclobdell 0:f7c60d3e7b8a 3326 */
maclobdell 0:f7c60d3e7b8a 3327 if( in_len < 61 ||
maclobdell 0:f7c60d3e7b8a 3328 in[0] != MBEDTLS_SSL_MSG_HANDSHAKE ||
maclobdell 0:f7c60d3e7b8a 3329 in[3] != 0 || in[4] != 0 ||
maclobdell 0:f7c60d3e7b8a 3330 in[19] != 0 || in[20] != 0 || in[21] != 0 )
maclobdell 0:f7c60d3e7b8a 3331 {
maclobdell 0:f7c60d3e7b8a 3332 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
maclobdell 0:f7c60d3e7b8a 3333 }
maclobdell 0:f7c60d3e7b8a 3334
maclobdell 0:f7c60d3e7b8a 3335 sid_len = in[59];
maclobdell 0:f7c60d3e7b8a 3336 if( sid_len > in_len - 61 )
maclobdell 0:f7c60d3e7b8a 3337 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
maclobdell 0:f7c60d3e7b8a 3338
maclobdell 0:f7c60d3e7b8a 3339 cookie_len = in[60 + sid_len];
maclobdell 0:f7c60d3e7b8a 3340 if( cookie_len > in_len - 60 )
maclobdell 0:f7c60d3e7b8a 3341 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
maclobdell 0:f7c60d3e7b8a 3342
maclobdell 0:f7c60d3e7b8a 3343 if( f_cookie_check( p_cookie, in + sid_len + 61, cookie_len,
maclobdell 0:f7c60d3e7b8a 3344 cli_id, cli_id_len ) == 0 )
maclobdell 0:f7c60d3e7b8a 3345 {
maclobdell 0:f7c60d3e7b8a 3346 /* Valid cookie */
maclobdell 0:f7c60d3e7b8a 3347 return( 0 );
maclobdell 0:f7c60d3e7b8a 3348 }
maclobdell 0:f7c60d3e7b8a 3349
maclobdell 0:f7c60d3e7b8a 3350 /*
maclobdell 0:f7c60d3e7b8a 3351 * If we get here, we've got an invalid cookie, let's prepare HVR.
maclobdell 0:f7c60d3e7b8a 3352 *
maclobdell 0:f7c60d3e7b8a 3353 * 0-0 ContentType type; copied
maclobdell 0:f7c60d3e7b8a 3354 * 1-2 ProtocolVersion version; copied
maclobdell 0:f7c60d3e7b8a 3355 * 3-4 uint16 epoch; copied
maclobdell 0:f7c60d3e7b8a 3356 * 5-10 uint48 sequence_number; copied
maclobdell 0:f7c60d3e7b8a 3357 * 11-12 uint16 length; olen - 13
maclobdell 0:f7c60d3e7b8a 3358 *
maclobdell 0:f7c60d3e7b8a 3359 * 13-13 HandshakeType msg_type; hello_verify_request
maclobdell 0:f7c60d3e7b8a 3360 * 14-16 uint24 length; olen - 25
maclobdell 0:f7c60d3e7b8a 3361 * 17-18 uint16 message_seq; copied
maclobdell 0:f7c60d3e7b8a 3362 * 19-21 uint24 fragment_offset; copied
maclobdell 0:f7c60d3e7b8a 3363 * 22-24 uint24 fragment_length; olen - 25
maclobdell 0:f7c60d3e7b8a 3364 *
maclobdell 0:f7c60d3e7b8a 3365 * 25-26 ProtocolVersion server_version; 0xfe 0xff
maclobdell 0:f7c60d3e7b8a 3366 * 27-27 opaque cookie<0..2^8-1>; cookie_len = olen - 27, cookie
maclobdell 0:f7c60d3e7b8a 3367 *
maclobdell 0:f7c60d3e7b8a 3368 * Minimum length is 28.
maclobdell 0:f7c60d3e7b8a 3369 */
maclobdell 0:f7c60d3e7b8a 3370 if( buf_len < 28 )
maclobdell 0:f7c60d3e7b8a 3371 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
maclobdell 0:f7c60d3e7b8a 3372
maclobdell 0:f7c60d3e7b8a 3373 /* Copy most fields and adapt others */
maclobdell 0:f7c60d3e7b8a 3374 memcpy( obuf, in, 25 );
maclobdell 0:f7c60d3e7b8a 3375 obuf[13] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
maclobdell 0:f7c60d3e7b8a 3376 obuf[25] = 0xfe;
maclobdell 0:f7c60d3e7b8a 3377 obuf[26] = 0xff;
maclobdell 0:f7c60d3e7b8a 3378
maclobdell 0:f7c60d3e7b8a 3379 /* Generate and write actual cookie */
maclobdell 0:f7c60d3e7b8a 3380 p = obuf + 28;
maclobdell 0:f7c60d3e7b8a 3381 if( f_cookie_write( p_cookie,
maclobdell 0:f7c60d3e7b8a 3382 &p, obuf + buf_len, cli_id, cli_id_len ) != 0 )
maclobdell 0:f7c60d3e7b8a 3383 {
maclobdell 0:f7c60d3e7b8a 3384 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 3385 }
maclobdell 0:f7c60d3e7b8a 3386
maclobdell 0:f7c60d3e7b8a 3387 *olen = p - obuf;
maclobdell 0:f7c60d3e7b8a 3388
maclobdell 0:f7c60d3e7b8a 3389 /* Go back and fill length fields */
maclobdell 0:f7c60d3e7b8a 3390 obuf[27] = (unsigned char)( *olen - 28 );
maclobdell 0:f7c60d3e7b8a 3391
maclobdell 0:f7c60d3e7b8a 3392 obuf[14] = obuf[22] = (unsigned char)( ( *olen - 25 ) >> 16 );
maclobdell 0:f7c60d3e7b8a 3393 obuf[15] = obuf[23] = (unsigned char)( ( *olen - 25 ) >> 8 );
maclobdell 0:f7c60d3e7b8a 3394 obuf[16] = obuf[24] = (unsigned char)( ( *olen - 25 ) );
maclobdell 0:f7c60d3e7b8a 3395
maclobdell 0:f7c60d3e7b8a 3396 obuf[11] = (unsigned char)( ( *olen - 13 ) >> 8 );
maclobdell 0:f7c60d3e7b8a 3397 obuf[12] = (unsigned char)( ( *olen - 13 ) );
maclobdell 0:f7c60d3e7b8a 3398
maclobdell 0:f7c60d3e7b8a 3399 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
maclobdell 0:f7c60d3e7b8a 3400 }
maclobdell 0:f7c60d3e7b8a 3401
maclobdell 0:f7c60d3e7b8a 3402 /*
maclobdell 0:f7c60d3e7b8a 3403 * Handle possible client reconnect with the same UDP quadruplet
maclobdell 0:f7c60d3e7b8a 3404 * (RFC 6347 Section 4.2.8).
maclobdell 0:f7c60d3e7b8a 3405 *
maclobdell 0:f7c60d3e7b8a 3406 * Called by ssl_parse_record_header() in case we receive an epoch 0 record
maclobdell 0:f7c60d3e7b8a 3407 * that looks like a ClientHello.
maclobdell 0:f7c60d3e7b8a 3408 *
maclobdell 0:f7c60d3e7b8a 3409 * - if the input looks like a ClientHello without cookies,
maclobdell 0:f7c60d3e7b8a 3410 * send back HelloVerifyRequest, then
maclobdell 0:f7c60d3e7b8a 3411 * return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED
maclobdell 0:f7c60d3e7b8a 3412 * - if the input looks like a ClientHello with a valid cookie,
maclobdell 0:f7c60d3e7b8a 3413 * reset the session of the current context, and
maclobdell 0:f7c60d3e7b8a 3414 * return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
maclobdell 0:f7c60d3e7b8a 3415 * - if anything goes wrong, return a specific error code
maclobdell 0:f7c60d3e7b8a 3416 *
maclobdell 0:f7c60d3e7b8a 3417 * mbedtls_ssl_read_record() will ignore the record if anything else than
maclobdell 0:f7c60d3e7b8a 3418 * MBEDTLS_ERR_SSL_CLIENT_RECONNECT or 0 is returned, although this function
maclobdell 0:f7c60d3e7b8a 3419 * cannot not return 0.
maclobdell 0:f7c60d3e7b8a 3420 */
maclobdell 0:f7c60d3e7b8a 3421 static int ssl_handle_possible_reconnect( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 3422 {
maclobdell 0:f7c60d3e7b8a 3423 int ret;
maclobdell 0:f7c60d3e7b8a 3424 size_t len;
maclobdell 0:f7c60d3e7b8a 3425
maclobdell 0:f7c60d3e7b8a 3426 ret = ssl_check_dtls_clihlo_cookie(
maclobdell 0:f7c60d3e7b8a 3427 ssl->conf->f_cookie_write,
maclobdell 0:f7c60d3e7b8a 3428 ssl->conf->f_cookie_check,
maclobdell 0:f7c60d3e7b8a 3429 ssl->conf->p_cookie,
maclobdell 0:f7c60d3e7b8a 3430 ssl->cli_id, ssl->cli_id_len,
maclobdell 0:f7c60d3e7b8a 3431 ssl->in_buf, ssl->in_left,
maclobdell 0:f7c60d3e7b8a 3432 ssl->out_buf, MBEDTLS_SSL_MAX_CONTENT_LEN, &len );
maclobdell 0:f7c60d3e7b8a 3433
maclobdell 0:f7c60d3e7b8a 3434 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_check_dtls_clihlo_cookie", ret );
maclobdell 0:f7c60d3e7b8a 3435
maclobdell 0:f7c60d3e7b8a 3436 if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED )
maclobdell 0:f7c60d3e7b8a 3437 {
maclobdell 0:f7c60d3e7b8a 3438 /* Dont check write errors as we can't do anything here.
maclobdell 0:f7c60d3e7b8a 3439 * If the error is permanent we'll catch it later,
maclobdell 0:f7c60d3e7b8a 3440 * if it's not, then hopefully it'll work next time. */
maclobdell 0:f7c60d3e7b8a 3441 (void) ssl->f_send( ssl->p_bio, ssl->out_buf, len );
maclobdell 0:f7c60d3e7b8a 3442
maclobdell 0:f7c60d3e7b8a 3443 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
maclobdell 0:f7c60d3e7b8a 3444 }
maclobdell 0:f7c60d3e7b8a 3445
maclobdell 0:f7c60d3e7b8a 3446 if( ret == 0 )
maclobdell 0:f7c60d3e7b8a 3447 {
maclobdell 0:f7c60d3e7b8a 3448 /* Got a valid cookie, partially reset context */
maclobdell 0:f7c60d3e7b8a 3449 if( ( ret = ssl_session_reset_int( ssl, 1 ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3450 {
maclobdell 0:f7c60d3e7b8a 3451 MBEDTLS_SSL_DEBUG_RET( 1, "reset", ret );
maclobdell 0:f7c60d3e7b8a 3452 return( ret );
maclobdell 0:f7c60d3e7b8a 3453 }
maclobdell 0:f7c60d3e7b8a 3454
maclobdell 0:f7c60d3e7b8a 3455 return( MBEDTLS_ERR_SSL_CLIENT_RECONNECT );
maclobdell 0:f7c60d3e7b8a 3456 }
maclobdell 0:f7c60d3e7b8a 3457
maclobdell 0:f7c60d3e7b8a 3458 return( ret );
maclobdell 0:f7c60d3e7b8a 3459 }
maclobdell 0:f7c60d3e7b8a 3460 #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
maclobdell 0:f7c60d3e7b8a 3461
maclobdell 0:f7c60d3e7b8a 3462 /*
maclobdell 0:f7c60d3e7b8a 3463 * ContentType type;
maclobdell 0:f7c60d3e7b8a 3464 * ProtocolVersion version;
maclobdell 0:f7c60d3e7b8a 3465 * uint16 epoch; // DTLS only
maclobdell 0:f7c60d3e7b8a 3466 * uint48 sequence_number; // DTLS only
maclobdell 0:f7c60d3e7b8a 3467 * uint16 length;
maclobdell 0:f7c60d3e7b8a 3468 */
maclobdell 0:f7c60d3e7b8a 3469 static int ssl_parse_record_header( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 3470 {
maclobdell 0:f7c60d3e7b8a 3471 int ret;
maclobdell 0:f7c60d3e7b8a 3472 int major_ver, minor_ver;
maclobdell 0:f7c60d3e7b8a 3473
maclobdell 0:f7c60d3e7b8a 3474 MBEDTLS_SSL_DEBUG_BUF( 4, "input record header", ssl->in_hdr, mbedtls_ssl_hdr_len( ssl ) );
maclobdell 0:f7c60d3e7b8a 3475
maclobdell 0:f7c60d3e7b8a 3476 ssl->in_msgtype = ssl->in_hdr[0];
maclobdell 0:f7c60d3e7b8a 3477 ssl->in_msglen = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
maclobdell 0:f7c60d3e7b8a 3478 mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, ssl->in_hdr + 1 );
maclobdell 0:f7c60d3e7b8a 3479
maclobdell 0:f7c60d3e7b8a 3480 MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
maclobdell 0:f7c60d3e7b8a 3481 "version = [%d:%d], msglen = %d",
maclobdell 0:f7c60d3e7b8a 3482 ssl->in_msgtype,
maclobdell 0:f7c60d3e7b8a 3483 major_ver, minor_ver, ssl->in_msglen ) );
maclobdell 0:f7c60d3e7b8a 3484
maclobdell 0:f7c60d3e7b8a 3485 /* Check record type */
maclobdell 0:f7c60d3e7b8a 3486 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE &&
maclobdell 0:f7c60d3e7b8a 3487 ssl->in_msgtype != MBEDTLS_SSL_MSG_ALERT &&
maclobdell 0:f7c60d3e7b8a 3488 ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
maclobdell 0:f7c60d3e7b8a 3489 ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
maclobdell 0:f7c60d3e7b8a 3490 {
maclobdell 0:f7c60d3e7b8a 3491 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
maclobdell 0:f7c60d3e7b8a 3492
maclobdell 0:f7c60d3e7b8a 3493 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
maclobdell 0:f7c60d3e7b8a 3494 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
maclobdell 0:f7c60d3e7b8a 3495 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3496 {
maclobdell 0:f7c60d3e7b8a 3497 return( ret );
maclobdell 0:f7c60d3e7b8a 3498 }
maclobdell 0:f7c60d3e7b8a 3499
maclobdell 0:f7c60d3e7b8a 3500 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3501 }
maclobdell 0:f7c60d3e7b8a 3502
maclobdell 0:f7c60d3e7b8a 3503 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 3504 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 3505 {
maclobdell 0:f7c60d3e7b8a 3506 /* Drop unexpected ChangeCipherSpec messages */
maclobdell 0:f7c60d3e7b8a 3507 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
maclobdell 0:f7c60d3e7b8a 3508 ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
maclobdell 0:f7c60d3e7b8a 3509 ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
maclobdell 0:f7c60d3e7b8a 3510 {
maclobdell 0:f7c60d3e7b8a 3511 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ChangeCipherSpec" ) );
maclobdell 0:f7c60d3e7b8a 3512 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3513 }
maclobdell 0:f7c60d3e7b8a 3514
maclobdell 0:f7c60d3e7b8a 3515 /* Drop unexpected ApplicationData records,
maclobdell 0:f7c60d3e7b8a 3516 * except at the beginning of renegotiations */
maclobdell 0:f7c60d3e7b8a 3517 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA &&
maclobdell 0:f7c60d3e7b8a 3518 ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER
maclobdell 0:f7c60d3e7b8a 3519 #if defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 3520 && ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
maclobdell 0:f7c60d3e7b8a 3521 ssl->state == MBEDTLS_SSL_SERVER_HELLO )
maclobdell 0:f7c60d3e7b8a 3522 #endif
maclobdell 0:f7c60d3e7b8a 3523 )
maclobdell 0:f7c60d3e7b8a 3524 {
maclobdell 0:f7c60d3e7b8a 3525 MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
maclobdell 0:f7c60d3e7b8a 3526 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3527 }
maclobdell 0:f7c60d3e7b8a 3528 }
maclobdell 0:f7c60d3e7b8a 3529 #endif
maclobdell 0:f7c60d3e7b8a 3530
maclobdell 0:f7c60d3e7b8a 3531 /* Check version */
maclobdell 0:f7c60d3e7b8a 3532 if( major_ver != ssl->major_ver )
maclobdell 0:f7c60d3e7b8a 3533 {
maclobdell 0:f7c60d3e7b8a 3534 MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
maclobdell 0:f7c60d3e7b8a 3535 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3536 }
maclobdell 0:f7c60d3e7b8a 3537
maclobdell 0:f7c60d3e7b8a 3538 if( minor_ver > ssl->conf->max_minor_ver )
maclobdell 0:f7c60d3e7b8a 3539 {
maclobdell 0:f7c60d3e7b8a 3540 MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
maclobdell 0:f7c60d3e7b8a 3541 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3542 }
maclobdell 0:f7c60d3e7b8a 3543
maclobdell 0:f7c60d3e7b8a 3544 /* Check epoch (and sequence number) with DTLS */
maclobdell 0:f7c60d3e7b8a 3545 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 3546 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 3547 {
maclobdell 0:f7c60d3e7b8a 3548 unsigned int rec_epoch = ( ssl->in_ctr[0] << 8 ) | ssl->in_ctr[1];
maclobdell 0:f7c60d3e7b8a 3549
maclobdell 0:f7c60d3e7b8a 3550 if( rec_epoch != ssl->in_epoch )
maclobdell 0:f7c60d3e7b8a 3551 {
maclobdell 0:f7c60d3e7b8a 3552 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: "
maclobdell 0:f7c60d3e7b8a 3553 "expected %d, received %d",
maclobdell 0:f7c60d3e7b8a 3554 ssl->in_epoch, rec_epoch ) );
maclobdell 0:f7c60d3e7b8a 3555
maclobdell 0:f7c60d3e7b8a 3556 #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 3557 /*
maclobdell 0:f7c60d3e7b8a 3558 * Check for an epoch 0 ClientHello. We can't use in_msg here to
maclobdell 0:f7c60d3e7b8a 3559 * access the first byte of record content (handshake type), as we
maclobdell 0:f7c60d3e7b8a 3560 * have an active transform (possibly iv_len != 0), so use the
maclobdell 0:f7c60d3e7b8a 3561 * fact that the record header len is 13 instead.
maclobdell 0:f7c60d3e7b8a 3562 */
maclobdell 0:f7c60d3e7b8a 3563 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
maclobdell 0:f7c60d3e7b8a 3564 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER &&
maclobdell 0:f7c60d3e7b8a 3565 rec_epoch == 0 &&
maclobdell 0:f7c60d3e7b8a 3566 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
maclobdell 0:f7c60d3e7b8a 3567 ssl->in_left > 13 &&
maclobdell 0:f7c60d3e7b8a 3568 ssl->in_buf[13] == MBEDTLS_SSL_HS_CLIENT_HELLO )
maclobdell 0:f7c60d3e7b8a 3569 {
maclobdell 0:f7c60d3e7b8a 3570 MBEDTLS_SSL_DEBUG_MSG( 1, ( "possible client reconnect "
maclobdell 0:f7c60d3e7b8a 3571 "from the same port" ) );
maclobdell 0:f7c60d3e7b8a 3572 return( ssl_handle_possible_reconnect( ssl ) );
maclobdell 0:f7c60d3e7b8a 3573 }
maclobdell 0:f7c60d3e7b8a 3574 else
maclobdell 0:f7c60d3e7b8a 3575 #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
maclobdell 0:f7c60d3e7b8a 3576 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3577 }
maclobdell 0:f7c60d3e7b8a 3578
maclobdell 0:f7c60d3e7b8a 3579 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
maclobdell 0:f7c60d3e7b8a 3580 /* Replay detection only works for the current epoch */
maclobdell 0:f7c60d3e7b8a 3581 if( rec_epoch == ssl->in_epoch &&
maclobdell 0:f7c60d3e7b8a 3582 mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
maclobdell 0:f7c60d3e7b8a 3583 {
maclobdell 0:f7c60d3e7b8a 3584 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
maclobdell 0:f7c60d3e7b8a 3585 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3586 }
maclobdell 0:f7c60d3e7b8a 3587 #endif
maclobdell 0:f7c60d3e7b8a 3588 }
maclobdell 0:f7c60d3e7b8a 3589 #endif /* MBEDTLS_SSL_PROTO_DTLS */
maclobdell 0:f7c60d3e7b8a 3590
maclobdell 0:f7c60d3e7b8a 3591 /* Check length against the size of our buffer */
maclobdell 0:f7c60d3e7b8a 3592 if( ssl->in_msglen > MBEDTLS_SSL_BUFFER_LEN
maclobdell 0:f7c60d3e7b8a 3593 - (size_t)( ssl->in_msg - ssl->in_buf ) )
maclobdell 0:f7c60d3e7b8a 3594 {
maclobdell 0:f7c60d3e7b8a 3595 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
maclobdell 0:f7c60d3e7b8a 3596 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3597 }
maclobdell 0:f7c60d3e7b8a 3598
maclobdell 0:f7c60d3e7b8a 3599 /* Check length against bounds of the current transform and version */
maclobdell 0:f7c60d3e7b8a 3600 if( ssl->transform_in == NULL )
maclobdell 0:f7c60d3e7b8a 3601 {
maclobdell 0:f7c60d3e7b8a 3602 if( ssl->in_msglen < 1 ||
maclobdell 0:f7c60d3e7b8a 3603 ssl->in_msglen > MBEDTLS_SSL_MAX_CONTENT_LEN )
maclobdell 0:f7c60d3e7b8a 3604 {
maclobdell 0:f7c60d3e7b8a 3605 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
maclobdell 0:f7c60d3e7b8a 3606 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3607 }
maclobdell 0:f7c60d3e7b8a 3608 }
maclobdell 0:f7c60d3e7b8a 3609 else
maclobdell 0:f7c60d3e7b8a 3610 {
maclobdell 0:f7c60d3e7b8a 3611 if( ssl->in_msglen < ssl->transform_in->minlen )
maclobdell 0:f7c60d3e7b8a 3612 {
maclobdell 0:f7c60d3e7b8a 3613 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
maclobdell 0:f7c60d3e7b8a 3614 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3615 }
maclobdell 0:f7c60d3e7b8a 3616
maclobdell 0:f7c60d3e7b8a 3617 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 3618 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
maclobdell 0:f7c60d3e7b8a 3619 ssl->in_msglen > ssl->transform_in->minlen + MBEDTLS_SSL_MAX_CONTENT_LEN )
maclobdell 0:f7c60d3e7b8a 3620 {
maclobdell 0:f7c60d3e7b8a 3621 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
maclobdell 0:f7c60d3e7b8a 3622 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3623 }
maclobdell 0:f7c60d3e7b8a 3624 #endif
maclobdell 0:f7c60d3e7b8a 3625 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
maclobdell 0:f7c60d3e7b8a 3626 defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 3627 /*
maclobdell 0:f7c60d3e7b8a 3628 * TLS encrypted messages can have up to 256 bytes of padding
maclobdell 0:f7c60d3e7b8a 3629 */
maclobdell 0:f7c60d3e7b8a 3630 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 &&
maclobdell 0:f7c60d3e7b8a 3631 ssl->in_msglen > ssl->transform_in->minlen +
maclobdell 0:f7c60d3e7b8a 3632 MBEDTLS_SSL_MAX_CONTENT_LEN + 256 )
maclobdell 0:f7c60d3e7b8a 3633 {
maclobdell 0:f7c60d3e7b8a 3634 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
maclobdell 0:f7c60d3e7b8a 3635 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3636 }
maclobdell 0:f7c60d3e7b8a 3637 #endif
maclobdell 0:f7c60d3e7b8a 3638 }
maclobdell 0:f7c60d3e7b8a 3639
maclobdell 0:f7c60d3e7b8a 3640 return( 0 );
maclobdell 0:f7c60d3e7b8a 3641 }
maclobdell 0:f7c60d3e7b8a 3642
maclobdell 0:f7c60d3e7b8a 3643 /*
maclobdell 0:f7c60d3e7b8a 3644 * If applicable, decrypt (and decompress) record content
maclobdell 0:f7c60d3e7b8a 3645 */
maclobdell 0:f7c60d3e7b8a 3646 static int ssl_prepare_record_content( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 3647 {
maclobdell 0:f7c60d3e7b8a 3648 int ret, done = 0;
maclobdell 0:f7c60d3e7b8a 3649
maclobdell 0:f7c60d3e7b8a 3650 MBEDTLS_SSL_DEBUG_BUF( 4, "input record from network",
maclobdell 0:f7c60d3e7b8a 3651 ssl->in_hdr, mbedtls_ssl_hdr_len( ssl ) + ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 3652
maclobdell 0:f7c60d3e7b8a 3653 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
maclobdell 0:f7c60d3e7b8a 3654 if( mbedtls_ssl_hw_record_read != NULL )
maclobdell 0:f7c60d3e7b8a 3655 {
maclobdell 0:f7c60d3e7b8a 3656 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_read()" ) );
maclobdell 0:f7c60d3e7b8a 3657
maclobdell 0:f7c60d3e7b8a 3658 ret = mbedtls_ssl_hw_record_read( ssl );
maclobdell 0:f7c60d3e7b8a 3659 if( ret != 0 && ret != MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH )
maclobdell 0:f7c60d3e7b8a 3660 {
maclobdell 0:f7c60d3e7b8a 3661 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_read", ret );
maclobdell 0:f7c60d3e7b8a 3662 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
maclobdell 0:f7c60d3e7b8a 3663 }
maclobdell 0:f7c60d3e7b8a 3664
maclobdell 0:f7c60d3e7b8a 3665 if( ret == 0 )
maclobdell 0:f7c60d3e7b8a 3666 done = 1;
maclobdell 0:f7c60d3e7b8a 3667 }
maclobdell 0:f7c60d3e7b8a 3668 #endif /* MBEDTLS_SSL_HW_RECORD_ACCEL */
maclobdell 0:f7c60d3e7b8a 3669 if( !done && ssl->transform_in != NULL )
maclobdell 0:f7c60d3e7b8a 3670 {
maclobdell 0:f7c60d3e7b8a 3671 if( ( ret = ssl_decrypt_buf( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3672 {
maclobdell 0:f7c60d3e7b8a 3673 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
maclobdell 0:f7c60d3e7b8a 3674 return( ret );
maclobdell 0:f7c60d3e7b8a 3675 }
maclobdell 0:f7c60d3e7b8a 3676
maclobdell 0:f7c60d3e7b8a 3677 MBEDTLS_SSL_DEBUG_BUF( 4, "input payload after decrypt",
maclobdell 0:f7c60d3e7b8a 3678 ssl->in_msg, ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 3679
maclobdell 0:f7c60d3e7b8a 3680 if( ssl->in_msglen > MBEDTLS_SSL_MAX_CONTENT_LEN )
maclobdell 0:f7c60d3e7b8a 3681 {
maclobdell 0:f7c60d3e7b8a 3682 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
maclobdell 0:f7c60d3e7b8a 3683 return( MBEDTLS_ERR_SSL_INVALID_RECORD );
maclobdell 0:f7c60d3e7b8a 3684 }
maclobdell 0:f7c60d3e7b8a 3685 }
maclobdell 0:f7c60d3e7b8a 3686
maclobdell 0:f7c60d3e7b8a 3687 #if defined(MBEDTLS_ZLIB_SUPPORT)
maclobdell 0:f7c60d3e7b8a 3688 if( ssl->transform_in != NULL &&
maclobdell 0:f7c60d3e7b8a 3689 ssl->session_in->compression == MBEDTLS_SSL_COMPRESS_DEFLATE )
maclobdell 0:f7c60d3e7b8a 3690 {
maclobdell 0:f7c60d3e7b8a 3691 if( ( ret = ssl_decompress_buf( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3692 {
maclobdell 0:f7c60d3e7b8a 3693 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret );
maclobdell 0:f7c60d3e7b8a 3694 return( ret );
maclobdell 0:f7c60d3e7b8a 3695 }
maclobdell 0:f7c60d3e7b8a 3696
maclobdell 0:f7c60d3e7b8a 3697 // TODO: what's the purpose of these lines? is in_len used?
maclobdell 0:f7c60d3e7b8a 3698 ssl->in_len[0] = (unsigned char)( ssl->in_msglen >> 8 );
maclobdell 0:f7c60d3e7b8a 3699 ssl->in_len[1] = (unsigned char)( ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 3700 }
maclobdell 0:f7c60d3e7b8a 3701 #endif /* MBEDTLS_ZLIB_SUPPORT */
maclobdell 0:f7c60d3e7b8a 3702
maclobdell 0:f7c60d3e7b8a 3703 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
maclobdell 0:f7c60d3e7b8a 3704 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 3705 {
maclobdell 0:f7c60d3e7b8a 3706 mbedtls_ssl_dtls_replay_update( ssl );
maclobdell 0:f7c60d3e7b8a 3707 }
maclobdell 0:f7c60d3e7b8a 3708 #endif
maclobdell 0:f7c60d3e7b8a 3709
maclobdell 0:f7c60d3e7b8a 3710 return( 0 );
maclobdell 0:f7c60d3e7b8a 3711 }
maclobdell 0:f7c60d3e7b8a 3712
maclobdell 0:f7c60d3e7b8a 3713 static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl );
maclobdell 0:f7c60d3e7b8a 3714
maclobdell 0:f7c60d3e7b8a 3715 /*
maclobdell 0:f7c60d3e7b8a 3716 * Read a record.
maclobdell 0:f7c60d3e7b8a 3717 *
maclobdell 0:f7c60d3e7b8a 3718 * Silently ignore non-fatal alert (and for DTLS, invalid records as well,
maclobdell 0:f7c60d3e7b8a 3719 * RFC 6347 4.1.2.7) and continue reading until a valid record is found.
maclobdell 0:f7c60d3e7b8a 3720 *
maclobdell 0:f7c60d3e7b8a 3721 */
maclobdell 0:f7c60d3e7b8a 3722 int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 3723 {
maclobdell 0:f7c60d3e7b8a 3724 int ret;
maclobdell 0:f7c60d3e7b8a 3725
maclobdell 0:f7c60d3e7b8a 3726 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read record" ) );
maclobdell 0:f7c60d3e7b8a 3727
maclobdell 0:f7c60d3e7b8a 3728 if( ssl->in_hslen != 0 && ssl->in_hslen < ssl->in_msglen )
maclobdell 0:f7c60d3e7b8a 3729 {
maclobdell 0:f7c60d3e7b8a 3730 /*
maclobdell 0:f7c60d3e7b8a 3731 * Get next Handshake message in the current record
maclobdell 0:f7c60d3e7b8a 3732 */
maclobdell 0:f7c60d3e7b8a 3733 ssl->in_msglen -= ssl->in_hslen;
maclobdell 0:f7c60d3e7b8a 3734
maclobdell 0:f7c60d3e7b8a 3735 memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
maclobdell 0:f7c60d3e7b8a 3736 ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 3737
maclobdell 0:f7c60d3e7b8a 3738 MBEDTLS_SSL_DEBUG_BUF( 4, "remaining content in record",
maclobdell 0:f7c60d3e7b8a 3739 ssl->in_msg, ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 3740
maclobdell 0:f7c60d3e7b8a 3741 if( ( ret = ssl_prepare_handshake_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3742 return( ret );
maclobdell 0:f7c60d3e7b8a 3743
maclobdell 0:f7c60d3e7b8a 3744 return( 0 );
maclobdell 0:f7c60d3e7b8a 3745 }
maclobdell 0:f7c60d3e7b8a 3746
maclobdell 0:f7c60d3e7b8a 3747 ssl->in_hslen = 0;
maclobdell 0:f7c60d3e7b8a 3748
maclobdell 0:f7c60d3e7b8a 3749 /*
maclobdell 0:f7c60d3e7b8a 3750 * Read the record header and parse it
maclobdell 0:f7c60d3e7b8a 3751 */
maclobdell 0:f7c60d3e7b8a 3752 read_record_header:
maclobdell 0:f7c60d3e7b8a 3753 if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3754 {
maclobdell 0:f7c60d3e7b8a 3755 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
maclobdell 0:f7c60d3e7b8a 3756 return( ret );
maclobdell 0:f7c60d3e7b8a 3757 }
maclobdell 0:f7c60d3e7b8a 3758
maclobdell 0:f7c60d3e7b8a 3759 if( ( ret = ssl_parse_record_header( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3760 {
maclobdell 0:f7c60d3e7b8a 3761 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 3762 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
maclobdell 0:f7c60d3e7b8a 3763 ret != MBEDTLS_ERR_SSL_CLIENT_RECONNECT )
maclobdell 0:f7c60d3e7b8a 3764 {
maclobdell 0:f7c60d3e7b8a 3765 /* Ignore bad record and get next one; drop the whole datagram
maclobdell 0:f7c60d3e7b8a 3766 * since current header cannot be trusted to find the next record
maclobdell 0:f7c60d3e7b8a 3767 * in current datagram */
maclobdell 0:f7c60d3e7b8a 3768 ssl->next_record_offset = 0;
maclobdell 0:f7c60d3e7b8a 3769 ssl->in_left = 0;
maclobdell 0:f7c60d3e7b8a 3770
maclobdell 0:f7c60d3e7b8a 3771 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (header)" ) );
maclobdell 0:f7c60d3e7b8a 3772 goto read_record_header;
maclobdell 0:f7c60d3e7b8a 3773 }
maclobdell 0:f7c60d3e7b8a 3774 #endif
maclobdell 0:f7c60d3e7b8a 3775 return( ret );
maclobdell 0:f7c60d3e7b8a 3776 }
maclobdell 0:f7c60d3e7b8a 3777
maclobdell 0:f7c60d3e7b8a 3778 /*
maclobdell 0:f7c60d3e7b8a 3779 * Read and optionally decrypt the message contents
maclobdell 0:f7c60d3e7b8a 3780 */
maclobdell 0:f7c60d3e7b8a 3781 if( ( ret = mbedtls_ssl_fetch_input( ssl,
maclobdell 0:f7c60d3e7b8a 3782 mbedtls_ssl_hdr_len( ssl ) + ssl->in_msglen ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3783 {
maclobdell 0:f7c60d3e7b8a 3784 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
maclobdell 0:f7c60d3e7b8a 3785 return( ret );
maclobdell 0:f7c60d3e7b8a 3786 }
maclobdell 0:f7c60d3e7b8a 3787
maclobdell 0:f7c60d3e7b8a 3788 /* Done reading this record, get ready for the next one */
maclobdell 0:f7c60d3e7b8a 3789 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 3790 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 3791 ssl->next_record_offset = ssl->in_msglen + mbedtls_ssl_hdr_len( ssl );
maclobdell 0:f7c60d3e7b8a 3792 else
maclobdell 0:f7c60d3e7b8a 3793 #endif
maclobdell 0:f7c60d3e7b8a 3794 ssl->in_left = 0;
maclobdell 0:f7c60d3e7b8a 3795
maclobdell 0:f7c60d3e7b8a 3796 if( ( ret = ssl_prepare_record_content( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3797 {
maclobdell 0:f7c60d3e7b8a 3798 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 3799 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 3800 {
maclobdell 0:f7c60d3e7b8a 3801 /* Silently discard invalid records */
maclobdell 0:f7c60d3e7b8a 3802 if( ret == MBEDTLS_ERR_SSL_INVALID_RECORD ||
maclobdell 0:f7c60d3e7b8a 3803 ret == MBEDTLS_ERR_SSL_INVALID_MAC )
maclobdell 0:f7c60d3e7b8a 3804 {
maclobdell 0:f7c60d3e7b8a 3805 /* Except when waiting for Finished as a bad mac here
maclobdell 0:f7c60d3e7b8a 3806 * probably means something went wrong in the handshake
maclobdell 0:f7c60d3e7b8a 3807 * (eg wrong psk used, mitm downgrade attempt, etc.) */
maclobdell 0:f7c60d3e7b8a 3808 if( ssl->state == MBEDTLS_SSL_CLIENT_FINISHED ||
maclobdell 0:f7c60d3e7b8a 3809 ssl->state == MBEDTLS_SSL_SERVER_FINISHED )
maclobdell 0:f7c60d3e7b8a 3810 {
maclobdell 0:f7c60d3e7b8a 3811 #if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
maclobdell 0:f7c60d3e7b8a 3812 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
maclobdell 0:f7c60d3e7b8a 3813 {
maclobdell 0:f7c60d3e7b8a 3814 mbedtls_ssl_send_alert_message( ssl,
maclobdell 0:f7c60d3e7b8a 3815 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
maclobdell 0:f7c60d3e7b8a 3816 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
maclobdell 0:f7c60d3e7b8a 3817 }
maclobdell 0:f7c60d3e7b8a 3818 #endif
maclobdell 0:f7c60d3e7b8a 3819 return( ret );
maclobdell 0:f7c60d3e7b8a 3820 }
maclobdell 0:f7c60d3e7b8a 3821
maclobdell 0:f7c60d3e7b8a 3822 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
maclobdell 0:f7c60d3e7b8a 3823 if( ssl->conf->badmac_limit != 0 &&
maclobdell 0:f7c60d3e7b8a 3824 ++ssl->badmac_seen >= ssl->conf->badmac_limit )
maclobdell 0:f7c60d3e7b8a 3825 {
maclobdell 0:f7c60d3e7b8a 3826 MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
maclobdell 0:f7c60d3e7b8a 3827 return( MBEDTLS_ERR_SSL_INVALID_MAC );
maclobdell 0:f7c60d3e7b8a 3828 }
maclobdell 0:f7c60d3e7b8a 3829 #endif
maclobdell 0:f7c60d3e7b8a 3830
maclobdell 0:f7c60d3e7b8a 3831 MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (mac)" ) );
maclobdell 0:f7c60d3e7b8a 3832 goto read_record_header;
maclobdell 0:f7c60d3e7b8a 3833 }
maclobdell 0:f7c60d3e7b8a 3834
maclobdell 0:f7c60d3e7b8a 3835 return( ret );
maclobdell 0:f7c60d3e7b8a 3836 }
maclobdell 0:f7c60d3e7b8a 3837 else
maclobdell 0:f7c60d3e7b8a 3838 #endif
maclobdell 0:f7c60d3e7b8a 3839 {
maclobdell 0:f7c60d3e7b8a 3840 /* Error out (and send alert) on invalid records */
maclobdell 0:f7c60d3e7b8a 3841 #if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES)
maclobdell 0:f7c60d3e7b8a 3842 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
maclobdell 0:f7c60d3e7b8a 3843 {
maclobdell 0:f7c60d3e7b8a 3844 mbedtls_ssl_send_alert_message( ssl,
maclobdell 0:f7c60d3e7b8a 3845 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
maclobdell 0:f7c60d3e7b8a 3846 MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC );
maclobdell 0:f7c60d3e7b8a 3847 }
maclobdell 0:f7c60d3e7b8a 3848 #endif
maclobdell 0:f7c60d3e7b8a 3849 return( ret );
maclobdell 0:f7c60d3e7b8a 3850 }
maclobdell 0:f7c60d3e7b8a 3851 }
maclobdell 0:f7c60d3e7b8a 3852
maclobdell 0:f7c60d3e7b8a 3853 /*
maclobdell 0:f7c60d3e7b8a 3854 * When we sent the last flight of the handshake, we MUST respond to a
maclobdell 0:f7c60d3e7b8a 3855 * retransmit of the peer's previous flight with a retransmit. (In
maclobdell 0:f7c60d3e7b8a 3856 * practice, only the Finished message will make it, other messages
maclobdell 0:f7c60d3e7b8a 3857 * including CCS use the old transform so they're dropped as invalid.)
maclobdell 0:f7c60d3e7b8a 3858 *
maclobdell 0:f7c60d3e7b8a 3859 * If the record we received is not a handshake message, however, it
maclobdell 0:f7c60d3e7b8a 3860 * means the peer received our last flight so we can clean up
maclobdell 0:f7c60d3e7b8a 3861 * handshake info.
maclobdell 0:f7c60d3e7b8a 3862 *
maclobdell 0:f7c60d3e7b8a 3863 * This check needs to be done before prepare_handshake() due to an edge
maclobdell 0:f7c60d3e7b8a 3864 * case: if the client immediately requests renegotiation, this
maclobdell 0:f7c60d3e7b8a 3865 * finishes the current handshake first, avoiding the new ClientHello
maclobdell 0:f7c60d3e7b8a 3866 * being mistaken for an ancient message in the current handshake.
maclobdell 0:f7c60d3e7b8a 3867 */
maclobdell 0:f7c60d3e7b8a 3868 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 3869 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
maclobdell 0:f7c60d3e7b8a 3870 ssl->handshake != NULL &&
maclobdell 0:f7c60d3e7b8a 3871 ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
maclobdell 0:f7c60d3e7b8a 3872 {
maclobdell 0:f7c60d3e7b8a 3873 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
maclobdell 0:f7c60d3e7b8a 3874 ssl->in_msg[0] == MBEDTLS_SSL_HS_FINISHED )
maclobdell 0:f7c60d3e7b8a 3875 {
maclobdell 0:f7c60d3e7b8a 3876 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received retransmit of last flight" ) );
maclobdell 0:f7c60d3e7b8a 3877
maclobdell 0:f7c60d3e7b8a 3878 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3879 {
maclobdell 0:f7c60d3e7b8a 3880 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_resend", ret );
maclobdell 0:f7c60d3e7b8a 3881 return( ret );
maclobdell 0:f7c60d3e7b8a 3882 }
maclobdell 0:f7c60d3e7b8a 3883
maclobdell 0:f7c60d3e7b8a 3884 return( MBEDTLS_ERR_SSL_WANT_READ );
maclobdell 0:f7c60d3e7b8a 3885 }
maclobdell 0:f7c60d3e7b8a 3886 else
maclobdell 0:f7c60d3e7b8a 3887 {
maclobdell 0:f7c60d3e7b8a 3888 ssl_handshake_wrapup_free_hs_transform( ssl );
maclobdell 0:f7c60d3e7b8a 3889 }
maclobdell 0:f7c60d3e7b8a 3890 }
maclobdell 0:f7c60d3e7b8a 3891 #endif
maclobdell 0:f7c60d3e7b8a 3892
maclobdell 0:f7c60d3e7b8a 3893 /*
maclobdell 0:f7c60d3e7b8a 3894 * Handle particular types of records
maclobdell 0:f7c60d3e7b8a 3895 */
maclobdell 0:f7c60d3e7b8a 3896 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
maclobdell 0:f7c60d3e7b8a 3897 {
maclobdell 0:f7c60d3e7b8a 3898 if( ( ret = ssl_prepare_handshake_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3899 return( ret );
maclobdell 0:f7c60d3e7b8a 3900 }
maclobdell 0:f7c60d3e7b8a 3901
maclobdell 0:f7c60d3e7b8a 3902 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
maclobdell 0:f7c60d3e7b8a 3903 {
maclobdell 0:f7c60d3e7b8a 3904 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]",
maclobdell 0:f7c60d3e7b8a 3905 ssl->in_msg[0], ssl->in_msg[1] ) );
maclobdell 0:f7c60d3e7b8a 3906
maclobdell 0:f7c60d3e7b8a 3907 /*
maclobdell 0:f7c60d3e7b8a 3908 * Ignore non-fatal alerts, except close_notify and no_renegotiation
maclobdell 0:f7c60d3e7b8a 3909 */
maclobdell 0:f7c60d3e7b8a 3910 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_FATAL )
maclobdell 0:f7c60d3e7b8a 3911 {
maclobdell 0:f7c60d3e7b8a 3912 MBEDTLS_SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
maclobdell 0:f7c60d3e7b8a 3913 ssl->in_msg[1] ) );
maclobdell 0:f7c60d3e7b8a 3914 return( MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE );
maclobdell 0:f7c60d3e7b8a 3915 }
maclobdell 0:f7c60d3e7b8a 3916
maclobdell 0:f7c60d3e7b8a 3917 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
maclobdell 0:f7c60d3e7b8a 3918 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY )
maclobdell 0:f7c60d3e7b8a 3919 {
maclobdell 0:f7c60d3e7b8a 3920 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
maclobdell 0:f7c60d3e7b8a 3921 return( MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY );
maclobdell 0:f7c60d3e7b8a 3922 }
maclobdell 0:f7c60d3e7b8a 3923
maclobdell 0:f7c60d3e7b8a 3924 #if defined(MBEDTLS_SSL_RENEGOTIATION_ENABLED)
maclobdell 0:f7c60d3e7b8a 3925 if( ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
maclobdell 0:f7c60d3e7b8a 3926 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION )
maclobdell 0:f7c60d3e7b8a 3927 {
maclobdell 0:f7c60d3e7b8a 3928 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
maclobdell 0:f7c60d3e7b8a 3929 /* Will be handled when trying to parse ServerHello */
maclobdell 0:f7c60d3e7b8a 3930 return( 0 );
maclobdell 0:f7c60d3e7b8a 3931 }
maclobdell 0:f7c60d3e7b8a 3932 #endif
maclobdell 0:f7c60d3e7b8a 3933
maclobdell 0:f7c60d3e7b8a 3934 #if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 3935 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
maclobdell 0:f7c60d3e7b8a 3936 ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
maclobdell 0:f7c60d3e7b8a 3937 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
maclobdell 0:f7c60d3e7b8a 3938 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
maclobdell 0:f7c60d3e7b8a 3939 {
maclobdell 0:f7c60d3e7b8a 3940 MBEDTLS_SSL_DEBUG_MSG( 2, ( "is a SSLv3 no_cert" ) );
maclobdell 0:f7c60d3e7b8a 3941 /* Will be handled in mbedtls_ssl_parse_certificate() */
maclobdell 0:f7c60d3e7b8a 3942 return( 0 );
maclobdell 0:f7c60d3e7b8a 3943 }
maclobdell 0:f7c60d3e7b8a 3944 #endif /* MBEDTLS_SSL_PROTO_SSL3 && MBEDTLS_SSL_SRV_C */
maclobdell 0:f7c60d3e7b8a 3945
maclobdell 0:f7c60d3e7b8a 3946 /* Silently ignore: fetch new message */
maclobdell 0:f7c60d3e7b8a 3947 goto read_record_header;
maclobdell 0:f7c60d3e7b8a 3948 }
maclobdell 0:f7c60d3e7b8a 3949
maclobdell 0:f7c60d3e7b8a 3950 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read record" ) );
maclobdell 0:f7c60d3e7b8a 3951
maclobdell 0:f7c60d3e7b8a 3952 return( 0 );
maclobdell 0:f7c60d3e7b8a 3953 }
maclobdell 0:f7c60d3e7b8a 3954
maclobdell 0:f7c60d3e7b8a 3955 int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 3956 {
maclobdell 0:f7c60d3e7b8a 3957 int ret;
maclobdell 0:f7c60d3e7b8a 3958
maclobdell 0:f7c60d3e7b8a 3959 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
maclobdell 0:f7c60d3e7b8a 3960 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
maclobdell 0:f7c60d3e7b8a 3961 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3962 {
maclobdell 0:f7c60d3e7b8a 3963 return( ret );
maclobdell 0:f7c60d3e7b8a 3964 }
maclobdell 0:f7c60d3e7b8a 3965
maclobdell 0:f7c60d3e7b8a 3966 return( 0 );
maclobdell 0:f7c60d3e7b8a 3967 }
maclobdell 0:f7c60d3e7b8a 3968
maclobdell 0:f7c60d3e7b8a 3969 int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 3970 unsigned char level,
maclobdell 0:f7c60d3e7b8a 3971 unsigned char message )
maclobdell 0:f7c60d3e7b8a 3972 {
maclobdell 0:f7c60d3e7b8a 3973 int ret;
maclobdell 0:f7c60d3e7b8a 3974
maclobdell 0:f7c60d3e7b8a 3975 if( ssl == NULL || ssl->conf == NULL )
maclobdell 0:f7c60d3e7b8a 3976 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 3977
maclobdell 0:f7c60d3e7b8a 3978 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
maclobdell 0:f7c60d3e7b8a 3979
maclobdell 0:f7c60d3e7b8a 3980 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
maclobdell 0:f7c60d3e7b8a 3981 ssl->out_msglen = 2;
maclobdell 0:f7c60d3e7b8a 3982 ssl->out_msg[0] = level;
maclobdell 0:f7c60d3e7b8a 3983 ssl->out_msg[1] = message;
maclobdell 0:f7c60d3e7b8a 3984
maclobdell 0:f7c60d3e7b8a 3985 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 3986 {
maclobdell 0:f7c60d3e7b8a 3987 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
maclobdell 0:f7c60d3e7b8a 3988 return( ret );
maclobdell 0:f7c60d3e7b8a 3989 }
maclobdell 0:f7c60d3e7b8a 3990
maclobdell 0:f7c60d3e7b8a 3991 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
maclobdell 0:f7c60d3e7b8a 3992
maclobdell 0:f7c60d3e7b8a 3993 return( 0 );
maclobdell 0:f7c60d3e7b8a 3994 }
maclobdell 0:f7c60d3e7b8a 3995
maclobdell 0:f7c60d3e7b8a 3996 /*
maclobdell 0:f7c60d3e7b8a 3997 * Handshake functions
maclobdell 0:f7c60d3e7b8a 3998 */
maclobdell 0:f7c60d3e7b8a 3999 #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
maclobdell 0:f7c60d3e7b8a 4000 !defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) && \
maclobdell 0:f7c60d3e7b8a 4001 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
maclobdell 0:f7c60d3e7b8a 4002 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
maclobdell 0:f7c60d3e7b8a 4003 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \
maclobdell 0:f7c60d3e7b8a 4004 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
maclobdell 0:f7c60d3e7b8a 4005 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
maclobdell 0:f7c60d3e7b8a 4006 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 4007 {
maclobdell 0:f7c60d3e7b8a 4008 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
maclobdell 0:f7c60d3e7b8a 4009
maclobdell 0:f7c60d3e7b8a 4010 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
maclobdell 0:f7c60d3e7b8a 4011
maclobdell 0:f7c60d3e7b8a 4012 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
maclobdell 0:f7c60d3e7b8a 4013 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
maclobdell 0:f7c60d3e7b8a 4014 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
maclobdell 0:f7c60d3e7b8a 4015 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
maclobdell 0:f7c60d3e7b8a 4016 {
maclobdell 0:f7c60d3e7b8a 4017 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
maclobdell 0:f7c60d3e7b8a 4018 ssl->state++;
maclobdell 0:f7c60d3e7b8a 4019 return( 0 );
maclobdell 0:f7c60d3e7b8a 4020 }
maclobdell 0:f7c60d3e7b8a 4021
maclobdell 0:f7c60d3e7b8a 4022 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 4023 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 4024 }
maclobdell 0:f7c60d3e7b8a 4025
maclobdell 0:f7c60d3e7b8a 4026 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 4027 {
maclobdell 0:f7c60d3e7b8a 4028 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
maclobdell 0:f7c60d3e7b8a 4029
maclobdell 0:f7c60d3e7b8a 4030 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
maclobdell 0:f7c60d3e7b8a 4031
maclobdell 0:f7c60d3e7b8a 4032 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
maclobdell 0:f7c60d3e7b8a 4033 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
maclobdell 0:f7c60d3e7b8a 4034 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
maclobdell 0:f7c60d3e7b8a 4035 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
maclobdell 0:f7c60d3e7b8a 4036 {
maclobdell 0:f7c60d3e7b8a 4037 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
maclobdell 0:f7c60d3e7b8a 4038 ssl->state++;
maclobdell 0:f7c60d3e7b8a 4039 return( 0 );
maclobdell 0:f7c60d3e7b8a 4040 }
maclobdell 0:f7c60d3e7b8a 4041
maclobdell 0:f7c60d3e7b8a 4042 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 4043 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 4044 }
maclobdell 0:f7c60d3e7b8a 4045 #else
maclobdell 0:f7c60d3e7b8a 4046 int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 4047 {
maclobdell 0:f7c60d3e7b8a 4048 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
maclobdell 0:f7c60d3e7b8a 4049 size_t i, n;
maclobdell 0:f7c60d3e7b8a 4050 const mbedtls_x509_crt *crt;
maclobdell 0:f7c60d3e7b8a 4051 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
maclobdell 0:f7c60d3e7b8a 4052
maclobdell 0:f7c60d3e7b8a 4053 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
maclobdell 0:f7c60d3e7b8a 4054
maclobdell 0:f7c60d3e7b8a 4055 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
maclobdell 0:f7c60d3e7b8a 4056 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
maclobdell 0:f7c60d3e7b8a 4057 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
maclobdell 0:f7c60d3e7b8a 4058 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
maclobdell 0:f7c60d3e7b8a 4059 {
maclobdell 0:f7c60d3e7b8a 4060 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
maclobdell 0:f7c60d3e7b8a 4061 ssl->state++;
maclobdell 0:f7c60d3e7b8a 4062 return( 0 );
maclobdell 0:f7c60d3e7b8a 4063 }
maclobdell 0:f7c60d3e7b8a 4064
maclobdell 0:f7c60d3e7b8a 4065 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 4066 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 4067 {
maclobdell 0:f7c60d3e7b8a 4068 if( ssl->client_auth == 0 )
maclobdell 0:f7c60d3e7b8a 4069 {
maclobdell 0:f7c60d3e7b8a 4070 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
maclobdell 0:f7c60d3e7b8a 4071 ssl->state++;
maclobdell 0:f7c60d3e7b8a 4072 return( 0 );
maclobdell 0:f7c60d3e7b8a 4073 }
maclobdell 0:f7c60d3e7b8a 4074
maclobdell 0:f7c60d3e7b8a 4075 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 4076 /*
maclobdell 0:f7c60d3e7b8a 4077 * If using SSLv3 and got no cert, send an Alert message
maclobdell 0:f7c60d3e7b8a 4078 * (otherwise an empty Certificate message will be sent).
maclobdell 0:f7c60d3e7b8a 4079 */
maclobdell 0:f7c60d3e7b8a 4080 if( mbedtls_ssl_own_cert( ssl ) == NULL &&
maclobdell 0:f7c60d3e7b8a 4081 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
maclobdell 0:f7c60d3e7b8a 4082 {
maclobdell 0:f7c60d3e7b8a 4083 ssl->out_msglen = 2;
maclobdell 0:f7c60d3e7b8a 4084 ssl->out_msgtype = MBEDTLS_SSL_MSG_ALERT;
maclobdell 0:f7c60d3e7b8a 4085 ssl->out_msg[0] = MBEDTLS_SSL_ALERT_LEVEL_WARNING;
maclobdell 0:f7c60d3e7b8a 4086 ssl->out_msg[1] = MBEDTLS_SSL_ALERT_MSG_NO_CERT;
maclobdell 0:f7c60d3e7b8a 4087
maclobdell 0:f7c60d3e7b8a 4088 MBEDTLS_SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
maclobdell 0:f7c60d3e7b8a 4089 goto write_msg;
maclobdell 0:f7c60d3e7b8a 4090 }
maclobdell 0:f7c60d3e7b8a 4091 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
maclobdell 0:f7c60d3e7b8a 4092 }
maclobdell 0:f7c60d3e7b8a 4093 #endif /* MBEDTLS_SSL_CLI_C */
maclobdell 0:f7c60d3e7b8a 4094 #if defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 4095 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
maclobdell 0:f7c60d3e7b8a 4096 {
maclobdell 0:f7c60d3e7b8a 4097 if( mbedtls_ssl_own_cert( ssl ) == NULL )
maclobdell 0:f7c60d3e7b8a 4098 {
maclobdell 0:f7c60d3e7b8a 4099 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
maclobdell 0:f7c60d3e7b8a 4100 return( MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED );
maclobdell 0:f7c60d3e7b8a 4101 }
maclobdell 0:f7c60d3e7b8a 4102 }
maclobdell 0:f7c60d3e7b8a 4103 #endif
maclobdell 0:f7c60d3e7b8a 4104
maclobdell 0:f7c60d3e7b8a 4105 MBEDTLS_SSL_DEBUG_CRT( 3, "own certificate", mbedtls_ssl_own_cert( ssl ) );
maclobdell 0:f7c60d3e7b8a 4106
maclobdell 0:f7c60d3e7b8a 4107 /*
maclobdell 0:f7c60d3e7b8a 4108 * 0 . 0 handshake type
maclobdell 0:f7c60d3e7b8a 4109 * 1 . 3 handshake length
maclobdell 0:f7c60d3e7b8a 4110 * 4 . 6 length of all certs
maclobdell 0:f7c60d3e7b8a 4111 * 7 . 9 length of cert. 1
maclobdell 0:f7c60d3e7b8a 4112 * 10 . n-1 peer certificate
maclobdell 0:f7c60d3e7b8a 4113 * n . n+2 length of cert. 2
maclobdell 0:f7c60d3e7b8a 4114 * n+3 . ... upper level cert, etc.
maclobdell 0:f7c60d3e7b8a 4115 */
maclobdell 0:f7c60d3e7b8a 4116 i = 7;
maclobdell 0:f7c60d3e7b8a 4117 crt = mbedtls_ssl_own_cert( ssl );
maclobdell 0:f7c60d3e7b8a 4118
maclobdell 0:f7c60d3e7b8a 4119 while( crt != NULL )
maclobdell 0:f7c60d3e7b8a 4120 {
maclobdell 0:f7c60d3e7b8a 4121 n = crt->raw.len;
maclobdell 0:f7c60d3e7b8a 4122 if( n > MBEDTLS_SSL_MAX_CONTENT_LEN - 3 - i )
maclobdell 0:f7c60d3e7b8a 4123 {
maclobdell 0:f7c60d3e7b8a 4124 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
maclobdell 0:f7c60d3e7b8a 4125 i + 3 + n, MBEDTLS_SSL_MAX_CONTENT_LEN ) );
maclobdell 0:f7c60d3e7b8a 4126 return( MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE );
maclobdell 0:f7c60d3e7b8a 4127 }
maclobdell 0:f7c60d3e7b8a 4128
maclobdell 0:f7c60d3e7b8a 4129 ssl->out_msg[i ] = (unsigned char)( n >> 16 );
maclobdell 0:f7c60d3e7b8a 4130 ssl->out_msg[i + 1] = (unsigned char)( n >> 8 );
maclobdell 0:f7c60d3e7b8a 4131 ssl->out_msg[i + 2] = (unsigned char)( n );
maclobdell 0:f7c60d3e7b8a 4132
maclobdell 0:f7c60d3e7b8a 4133 i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
maclobdell 0:f7c60d3e7b8a 4134 i += n; crt = crt->next;
maclobdell 0:f7c60d3e7b8a 4135 }
maclobdell 0:f7c60d3e7b8a 4136
maclobdell 0:f7c60d3e7b8a 4137 ssl->out_msg[4] = (unsigned char)( ( i - 7 ) >> 16 );
maclobdell 0:f7c60d3e7b8a 4138 ssl->out_msg[5] = (unsigned char)( ( i - 7 ) >> 8 );
maclobdell 0:f7c60d3e7b8a 4139 ssl->out_msg[6] = (unsigned char)( ( i - 7 ) );
maclobdell 0:f7c60d3e7b8a 4140
maclobdell 0:f7c60d3e7b8a 4141 ssl->out_msglen = i;
maclobdell 0:f7c60d3e7b8a 4142 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
maclobdell 0:f7c60d3e7b8a 4143 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
maclobdell 0:f7c60d3e7b8a 4144
maclobdell 0:f7c60d3e7b8a 4145 #if defined(MBEDTLS_SSL_PROTO_SSL3) && defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 4146 write_msg:
maclobdell 0:f7c60d3e7b8a 4147 #endif
maclobdell 0:f7c60d3e7b8a 4148
maclobdell 0:f7c60d3e7b8a 4149 ssl->state++;
maclobdell 0:f7c60d3e7b8a 4150
maclobdell 0:f7c60d3e7b8a 4151 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 4152 {
maclobdell 0:f7c60d3e7b8a 4153 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
maclobdell 0:f7c60d3e7b8a 4154 return( ret );
maclobdell 0:f7c60d3e7b8a 4155 }
maclobdell 0:f7c60d3e7b8a 4156
maclobdell 0:f7c60d3e7b8a 4157 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
maclobdell 0:f7c60d3e7b8a 4158
maclobdell 0:f7c60d3e7b8a 4159 return( ret );
maclobdell 0:f7c60d3e7b8a 4160 }
maclobdell 0:f7c60d3e7b8a 4161
maclobdell 0:f7c60d3e7b8a 4162 int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 4163 {
maclobdell 0:f7c60d3e7b8a 4164 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
maclobdell 0:f7c60d3e7b8a 4165 size_t i, n;
maclobdell 0:f7c60d3e7b8a 4166 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
maclobdell 0:f7c60d3e7b8a 4167 int authmode = ssl->conf->authmode;
maclobdell 0:f7c60d3e7b8a 4168
maclobdell 0:f7c60d3e7b8a 4169 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
maclobdell 0:f7c60d3e7b8a 4170
maclobdell 0:f7c60d3e7b8a 4171 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
maclobdell 0:f7c60d3e7b8a 4172 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
maclobdell 0:f7c60d3e7b8a 4173 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
maclobdell 0:f7c60d3e7b8a 4174 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
maclobdell 0:f7c60d3e7b8a 4175 {
maclobdell 0:f7c60d3e7b8a 4176 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
maclobdell 0:f7c60d3e7b8a 4177 ssl->state++;
maclobdell 0:f7c60d3e7b8a 4178 return( 0 );
maclobdell 0:f7c60d3e7b8a 4179 }
maclobdell 0:f7c60d3e7b8a 4180
maclobdell 0:f7c60d3e7b8a 4181 #if defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 4182 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
maclobdell 0:f7c60d3e7b8a 4183 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
maclobdell 0:f7c60d3e7b8a 4184 {
maclobdell 0:f7c60d3e7b8a 4185 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
maclobdell 0:f7c60d3e7b8a 4186 ssl->state++;
maclobdell 0:f7c60d3e7b8a 4187 return( 0 );
maclobdell 0:f7c60d3e7b8a 4188 }
maclobdell 0:f7c60d3e7b8a 4189
maclobdell 0:f7c60d3e7b8a 4190 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
maclobdell 0:f7c60d3e7b8a 4191 if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
maclobdell 0:f7c60d3e7b8a 4192 authmode = ssl->handshake->sni_authmode;
maclobdell 0:f7c60d3e7b8a 4193 #endif
maclobdell 0:f7c60d3e7b8a 4194
maclobdell 0:f7c60d3e7b8a 4195 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
maclobdell 0:f7c60d3e7b8a 4196 authmode == MBEDTLS_SSL_VERIFY_NONE )
maclobdell 0:f7c60d3e7b8a 4197 {
maclobdell 0:f7c60d3e7b8a 4198 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
maclobdell 0:f7c60d3e7b8a 4199 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
maclobdell 0:f7c60d3e7b8a 4200 ssl->state++;
maclobdell 0:f7c60d3e7b8a 4201 return( 0 );
maclobdell 0:f7c60d3e7b8a 4202 }
maclobdell 0:f7c60d3e7b8a 4203 #endif
maclobdell 0:f7c60d3e7b8a 4204
maclobdell 0:f7c60d3e7b8a 4205 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 4206 {
maclobdell 0:f7c60d3e7b8a 4207 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
maclobdell 0:f7c60d3e7b8a 4208 return( ret );
maclobdell 0:f7c60d3e7b8a 4209 }
maclobdell 0:f7c60d3e7b8a 4210
maclobdell 0:f7c60d3e7b8a 4211 ssl->state++;
maclobdell 0:f7c60d3e7b8a 4212
maclobdell 0:f7c60d3e7b8a 4213 #if defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 4214 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 4215 /*
maclobdell 0:f7c60d3e7b8a 4216 * Check if the client sent an empty certificate
maclobdell 0:f7c60d3e7b8a 4217 */
maclobdell 0:f7c60d3e7b8a 4218 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
maclobdell 0:f7c60d3e7b8a 4219 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
maclobdell 0:f7c60d3e7b8a 4220 {
maclobdell 0:f7c60d3e7b8a 4221 if( ssl->in_msglen == 2 &&
maclobdell 0:f7c60d3e7b8a 4222 ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT &&
maclobdell 0:f7c60d3e7b8a 4223 ssl->in_msg[0] == MBEDTLS_SSL_ALERT_LEVEL_WARNING &&
maclobdell 0:f7c60d3e7b8a 4224 ssl->in_msg[1] == MBEDTLS_SSL_ALERT_MSG_NO_CERT )
maclobdell 0:f7c60d3e7b8a 4225 {
maclobdell 0:f7c60d3e7b8a 4226 MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
maclobdell 0:f7c60d3e7b8a 4227
maclobdell 0:f7c60d3e7b8a 4228 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
maclobdell 0:f7c60d3e7b8a 4229 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
maclobdell 0:f7c60d3e7b8a 4230 return( 0 );
maclobdell 0:f7c60d3e7b8a 4231 else
maclobdell 0:f7c60d3e7b8a 4232 return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE );
maclobdell 0:f7c60d3e7b8a 4233 }
maclobdell 0:f7c60d3e7b8a 4234 }
maclobdell 0:f7c60d3e7b8a 4235 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
maclobdell 0:f7c60d3e7b8a 4236
maclobdell 0:f7c60d3e7b8a 4237 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
maclobdell 0:f7c60d3e7b8a 4238 defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 4239 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
maclobdell 0:f7c60d3e7b8a 4240 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
maclobdell 0:f7c60d3e7b8a 4241 {
maclobdell 0:f7c60d3e7b8a 4242 if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
maclobdell 0:f7c60d3e7b8a 4243 ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
maclobdell 0:f7c60d3e7b8a 4244 ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE &&
maclobdell 0:f7c60d3e7b8a 4245 memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ), "\0\0\0", 3 ) == 0 )
maclobdell 0:f7c60d3e7b8a 4246 {
maclobdell 0:f7c60d3e7b8a 4247 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
maclobdell 0:f7c60d3e7b8a 4248
maclobdell 0:f7c60d3e7b8a 4249 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
maclobdell 0:f7c60d3e7b8a 4250 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
maclobdell 0:f7c60d3e7b8a 4251 return( 0 );
maclobdell 0:f7c60d3e7b8a 4252 else
maclobdell 0:f7c60d3e7b8a 4253 return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE );
maclobdell 0:f7c60d3e7b8a 4254 }
maclobdell 0:f7c60d3e7b8a 4255 }
maclobdell 0:f7c60d3e7b8a 4256 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
maclobdell 0:f7c60d3e7b8a 4257 MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 4258 #endif /* MBEDTLS_SSL_SRV_C */
maclobdell 0:f7c60d3e7b8a 4259
maclobdell 0:f7c60d3e7b8a 4260 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
maclobdell 0:f7c60d3e7b8a 4261 {
maclobdell 0:f7c60d3e7b8a 4262 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
maclobdell 0:f7c60d3e7b8a 4263 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
maclobdell 0:f7c60d3e7b8a 4264 }
maclobdell 0:f7c60d3e7b8a 4265
maclobdell 0:f7c60d3e7b8a 4266 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE ||
maclobdell 0:f7c60d3e7b8a 4267 ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 3 + 3 )
maclobdell 0:f7c60d3e7b8a 4268 {
maclobdell 0:f7c60d3e7b8a 4269 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
maclobdell 0:f7c60d3e7b8a 4270 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
maclobdell 0:f7c60d3e7b8a 4271 }
maclobdell 0:f7c60d3e7b8a 4272
maclobdell 0:f7c60d3e7b8a 4273 i = mbedtls_ssl_hs_hdr_len( ssl );
maclobdell 0:f7c60d3e7b8a 4274
maclobdell 0:f7c60d3e7b8a 4275 /*
maclobdell 0:f7c60d3e7b8a 4276 * Same message structure as in mbedtls_ssl_write_certificate()
maclobdell 0:f7c60d3e7b8a 4277 */
maclobdell 0:f7c60d3e7b8a 4278 n = ( ssl->in_msg[i+1] << 8 ) | ssl->in_msg[i+2];
maclobdell 0:f7c60d3e7b8a 4279
maclobdell 0:f7c60d3e7b8a 4280 if( ssl->in_msg[i] != 0 ||
maclobdell 0:f7c60d3e7b8a 4281 ssl->in_hslen != n + 3 + mbedtls_ssl_hs_hdr_len( ssl ) )
maclobdell 0:f7c60d3e7b8a 4282 {
maclobdell 0:f7c60d3e7b8a 4283 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
maclobdell 0:f7c60d3e7b8a 4284 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
maclobdell 0:f7c60d3e7b8a 4285 }
maclobdell 0:f7c60d3e7b8a 4286
maclobdell 0:f7c60d3e7b8a 4287 /* In case we tried to reuse a session but it failed */
maclobdell 0:f7c60d3e7b8a 4288 if( ssl->session_negotiate->peer_cert != NULL )
maclobdell 0:f7c60d3e7b8a 4289 {
maclobdell 0:f7c60d3e7b8a 4290 mbedtls_x509_crt_free( ssl->session_negotiate->peer_cert );
maclobdell 0:f7c60d3e7b8a 4291 mbedtls_free( ssl->session_negotiate->peer_cert );
maclobdell 0:f7c60d3e7b8a 4292 }
maclobdell 0:f7c60d3e7b8a 4293
maclobdell 0:f7c60d3e7b8a 4294 if( ( ssl->session_negotiate->peer_cert = mbedtls_calloc( 1,
maclobdell 0:f7c60d3e7b8a 4295 sizeof( mbedtls_x509_crt ) ) ) == NULL )
maclobdell 0:f7c60d3e7b8a 4296 {
maclobdell 0:f7c60d3e7b8a 4297 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
maclobdell 0:f7c60d3e7b8a 4298 sizeof( mbedtls_x509_crt ) ) );
maclobdell 0:f7c60d3e7b8a 4299 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 4300 }
maclobdell 0:f7c60d3e7b8a 4301
maclobdell 0:f7c60d3e7b8a 4302 mbedtls_x509_crt_init( ssl->session_negotiate->peer_cert );
maclobdell 0:f7c60d3e7b8a 4303
maclobdell 0:f7c60d3e7b8a 4304 i += 3;
maclobdell 0:f7c60d3e7b8a 4305
maclobdell 0:f7c60d3e7b8a 4306 while( i < ssl->in_hslen )
maclobdell 0:f7c60d3e7b8a 4307 {
maclobdell 0:f7c60d3e7b8a 4308 if( ssl->in_msg[i] != 0 )
maclobdell 0:f7c60d3e7b8a 4309 {
maclobdell 0:f7c60d3e7b8a 4310 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
maclobdell 0:f7c60d3e7b8a 4311 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
maclobdell 0:f7c60d3e7b8a 4312 }
maclobdell 0:f7c60d3e7b8a 4313
maclobdell 0:f7c60d3e7b8a 4314 n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
maclobdell 0:f7c60d3e7b8a 4315 | (unsigned int) ssl->in_msg[i + 2];
maclobdell 0:f7c60d3e7b8a 4316 i += 3;
maclobdell 0:f7c60d3e7b8a 4317
maclobdell 0:f7c60d3e7b8a 4318 if( n < 128 || i + n > ssl->in_hslen )
maclobdell 0:f7c60d3e7b8a 4319 {
maclobdell 0:f7c60d3e7b8a 4320 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
maclobdell 0:f7c60d3e7b8a 4321 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
maclobdell 0:f7c60d3e7b8a 4322 }
maclobdell 0:f7c60d3e7b8a 4323
maclobdell 0:f7c60d3e7b8a 4324 ret = mbedtls_x509_crt_parse_der( ssl->session_negotiate->peer_cert,
maclobdell 0:f7c60d3e7b8a 4325 ssl->in_msg + i, n );
maclobdell 0:f7c60d3e7b8a 4326 if( ret != 0 )
maclobdell 0:f7c60d3e7b8a 4327 {
maclobdell 0:f7c60d3e7b8a 4328 MBEDTLS_SSL_DEBUG_RET( 1, " mbedtls_x509_crt_parse_der", ret );
maclobdell 0:f7c60d3e7b8a 4329 return( ret );
maclobdell 0:f7c60d3e7b8a 4330 }
maclobdell 0:f7c60d3e7b8a 4331
maclobdell 0:f7c60d3e7b8a 4332 i += n;
maclobdell 0:f7c60d3e7b8a 4333 }
maclobdell 0:f7c60d3e7b8a 4334
maclobdell 0:f7c60d3e7b8a 4335 MBEDTLS_SSL_DEBUG_CRT( 3, "peer certificate", ssl->session_negotiate->peer_cert );
maclobdell 0:f7c60d3e7b8a 4336
maclobdell 0:f7c60d3e7b8a 4337 /*
maclobdell 0:f7c60d3e7b8a 4338 * On client, make sure the server cert doesn't change during renego to
maclobdell 0:f7c60d3e7b8a 4339 * avoid "triple handshake" attack: https://secure-resumption.com/
maclobdell 0:f7c60d3e7b8a 4340 */
maclobdell 0:f7c60d3e7b8a 4341 #if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 4342 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
maclobdell 0:f7c60d3e7b8a 4343 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
maclobdell 0:f7c60d3e7b8a 4344 {
maclobdell 0:f7c60d3e7b8a 4345 if( ssl->session->peer_cert == NULL )
maclobdell 0:f7c60d3e7b8a 4346 {
maclobdell 0:f7c60d3e7b8a 4347 MBEDTLS_SSL_DEBUG_MSG( 1, ( "new server cert during renegotiation" ) );
maclobdell 0:f7c60d3e7b8a 4348 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
maclobdell 0:f7c60d3e7b8a 4349 }
maclobdell 0:f7c60d3e7b8a 4350
maclobdell 0:f7c60d3e7b8a 4351 if( ssl->session->peer_cert->raw.len !=
maclobdell 0:f7c60d3e7b8a 4352 ssl->session_negotiate->peer_cert->raw.len ||
maclobdell 0:f7c60d3e7b8a 4353 memcmp( ssl->session->peer_cert->raw.p,
maclobdell 0:f7c60d3e7b8a 4354 ssl->session_negotiate->peer_cert->raw.p,
maclobdell 0:f7c60d3e7b8a 4355 ssl->session->peer_cert->raw.len ) != 0 )
maclobdell 0:f7c60d3e7b8a 4356 {
maclobdell 0:f7c60d3e7b8a 4357 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server cert changed during renegotiation" ) );
maclobdell 0:f7c60d3e7b8a 4358 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
maclobdell 0:f7c60d3e7b8a 4359 }
maclobdell 0:f7c60d3e7b8a 4360 }
maclobdell 0:f7c60d3e7b8a 4361 #endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
maclobdell 0:f7c60d3e7b8a 4362
maclobdell 0:f7c60d3e7b8a 4363 if( authmode != MBEDTLS_SSL_VERIFY_NONE )
maclobdell 0:f7c60d3e7b8a 4364 {
maclobdell 0:f7c60d3e7b8a 4365 mbedtls_x509_crt *ca_chain;
maclobdell 0:f7c60d3e7b8a 4366 mbedtls_x509_crl *ca_crl;
maclobdell 0:f7c60d3e7b8a 4367
maclobdell 0:f7c60d3e7b8a 4368 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
maclobdell 0:f7c60d3e7b8a 4369 if( ssl->handshake->sni_ca_chain != NULL )
maclobdell 0:f7c60d3e7b8a 4370 {
maclobdell 0:f7c60d3e7b8a 4371 ca_chain = ssl->handshake->sni_ca_chain;
maclobdell 0:f7c60d3e7b8a 4372 ca_crl = ssl->handshake->sni_ca_crl;
maclobdell 0:f7c60d3e7b8a 4373 }
maclobdell 0:f7c60d3e7b8a 4374 else
maclobdell 0:f7c60d3e7b8a 4375 #endif
maclobdell 0:f7c60d3e7b8a 4376 {
maclobdell 0:f7c60d3e7b8a 4377 ca_chain = ssl->conf->ca_chain;
maclobdell 0:f7c60d3e7b8a 4378 ca_crl = ssl->conf->ca_crl;
maclobdell 0:f7c60d3e7b8a 4379 }
maclobdell 0:f7c60d3e7b8a 4380
maclobdell 0:f7c60d3e7b8a 4381 if( ca_chain == NULL )
maclobdell 0:f7c60d3e7b8a 4382 {
maclobdell 0:f7c60d3e7b8a 4383 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
maclobdell 0:f7c60d3e7b8a 4384 return( MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED );
maclobdell 0:f7c60d3e7b8a 4385 }
maclobdell 0:f7c60d3e7b8a 4386
maclobdell 0:f7c60d3e7b8a 4387 /*
maclobdell 0:f7c60d3e7b8a 4388 * Main check: verify certificate
maclobdell 0:f7c60d3e7b8a 4389 */
maclobdell 0:f7c60d3e7b8a 4390 ret = mbedtls_x509_crt_verify_with_profile(
maclobdell 0:f7c60d3e7b8a 4391 ssl->session_negotiate->peer_cert,
maclobdell 0:f7c60d3e7b8a 4392 ca_chain, ca_crl,
maclobdell 0:f7c60d3e7b8a 4393 ssl->conf->cert_profile,
maclobdell 0:f7c60d3e7b8a 4394 ssl->hostname,
maclobdell 0:f7c60d3e7b8a 4395 &ssl->session_negotiate->verify_result,
maclobdell 0:f7c60d3e7b8a 4396 ssl->conf->f_vrfy, ssl->conf->p_vrfy );
maclobdell 0:f7c60d3e7b8a 4397
maclobdell 0:f7c60d3e7b8a 4398 if( ret != 0 )
maclobdell 0:f7c60d3e7b8a 4399 {
maclobdell 0:f7c60d3e7b8a 4400 MBEDTLS_SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
maclobdell 0:f7c60d3e7b8a 4401 }
maclobdell 0:f7c60d3e7b8a 4402
maclobdell 0:f7c60d3e7b8a 4403 /*
maclobdell 0:f7c60d3e7b8a 4404 * Secondary checks: always done, but change 'ret' only if it was 0
maclobdell 0:f7c60d3e7b8a 4405 */
maclobdell 0:f7c60d3e7b8a 4406
maclobdell 0:f7c60d3e7b8a 4407 #if defined(MBEDTLS_ECP_C)
maclobdell 0:f7c60d3e7b8a 4408 {
maclobdell 0:f7c60d3e7b8a 4409 const mbedtls_pk_context *pk = &ssl->session_negotiate->peer_cert->pk;
maclobdell 0:f7c60d3e7b8a 4410
maclobdell 0:f7c60d3e7b8a 4411 /* If certificate uses an EC key, make sure the curve is OK */
maclobdell 0:f7c60d3e7b8a 4412 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
maclobdell 0:f7c60d3e7b8a 4413 mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
maclobdell 0:f7c60d3e7b8a 4414 {
maclobdell 0:f7c60d3e7b8a 4415 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (EC key curve)" ) );
maclobdell 0:f7c60d3e7b8a 4416 if( ret == 0 )
maclobdell 0:f7c60d3e7b8a 4417 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
maclobdell 0:f7c60d3e7b8a 4418 }
maclobdell 0:f7c60d3e7b8a 4419 }
maclobdell 0:f7c60d3e7b8a 4420 #endif /* MBEDTLS_ECP_C */
maclobdell 0:f7c60d3e7b8a 4421
maclobdell 0:f7c60d3e7b8a 4422 if( mbedtls_ssl_check_cert_usage( ssl->session_negotiate->peer_cert,
maclobdell 0:f7c60d3e7b8a 4423 ciphersuite_info,
maclobdell 0:f7c60d3e7b8a 4424 ! ssl->conf->endpoint,
maclobdell 0:f7c60d3e7b8a 4425 &ssl->session_negotiate->verify_result ) != 0 )
maclobdell 0:f7c60d3e7b8a 4426 {
maclobdell 0:f7c60d3e7b8a 4427 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
maclobdell 0:f7c60d3e7b8a 4428 if( ret == 0 )
maclobdell 0:f7c60d3e7b8a 4429 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
maclobdell 0:f7c60d3e7b8a 4430 }
maclobdell 0:f7c60d3e7b8a 4431
maclobdell 0:f7c60d3e7b8a 4432 if( authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
maclobdell 0:f7c60d3e7b8a 4433 ret = 0;
maclobdell 0:f7c60d3e7b8a 4434 }
maclobdell 0:f7c60d3e7b8a 4435
maclobdell 0:f7c60d3e7b8a 4436 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
maclobdell 0:f7c60d3e7b8a 4437
maclobdell 0:f7c60d3e7b8a 4438 return( ret );
maclobdell 0:f7c60d3e7b8a 4439 }
maclobdell 0:f7c60d3e7b8a 4440 #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
maclobdell 0:f7c60d3e7b8a 4441 !MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
maclobdell 0:f7c60d3e7b8a 4442 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
maclobdell 0:f7c60d3e7b8a 4443 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
maclobdell 0:f7c60d3e7b8a 4444 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
maclobdell 0:f7c60d3e7b8a 4445 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
maclobdell 0:f7c60d3e7b8a 4446 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
maclobdell 0:f7c60d3e7b8a 4447
maclobdell 0:f7c60d3e7b8a 4448 int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 4449 {
maclobdell 0:f7c60d3e7b8a 4450 int ret;
maclobdell 0:f7c60d3e7b8a 4451
maclobdell 0:f7c60d3e7b8a 4452 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
maclobdell 0:f7c60d3e7b8a 4453
maclobdell 0:f7c60d3e7b8a 4454 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
maclobdell 0:f7c60d3e7b8a 4455 ssl->out_msglen = 1;
maclobdell 0:f7c60d3e7b8a 4456 ssl->out_msg[0] = 1;
maclobdell 0:f7c60d3e7b8a 4457
maclobdell 0:f7c60d3e7b8a 4458 ssl->state++;
maclobdell 0:f7c60d3e7b8a 4459
maclobdell 0:f7c60d3e7b8a 4460 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 4461 {
maclobdell 0:f7c60d3e7b8a 4462 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
maclobdell 0:f7c60d3e7b8a 4463 return( ret );
maclobdell 0:f7c60d3e7b8a 4464 }
maclobdell 0:f7c60d3e7b8a 4465
maclobdell 0:f7c60d3e7b8a 4466 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
maclobdell 0:f7c60d3e7b8a 4467
maclobdell 0:f7c60d3e7b8a 4468 return( 0 );
maclobdell 0:f7c60d3e7b8a 4469 }
maclobdell 0:f7c60d3e7b8a 4470
maclobdell 0:f7c60d3e7b8a 4471 int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 4472 {
maclobdell 0:f7c60d3e7b8a 4473 int ret;
maclobdell 0:f7c60d3e7b8a 4474
maclobdell 0:f7c60d3e7b8a 4475 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
maclobdell 0:f7c60d3e7b8a 4476
maclobdell 0:f7c60d3e7b8a 4477 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 4478 {
maclobdell 0:f7c60d3e7b8a 4479 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
maclobdell 0:f7c60d3e7b8a 4480 return( ret );
maclobdell 0:f7c60d3e7b8a 4481 }
maclobdell 0:f7c60d3e7b8a 4482
maclobdell 0:f7c60d3e7b8a 4483 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC )
maclobdell 0:f7c60d3e7b8a 4484 {
maclobdell 0:f7c60d3e7b8a 4485 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
maclobdell 0:f7c60d3e7b8a 4486 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
maclobdell 0:f7c60d3e7b8a 4487 }
maclobdell 0:f7c60d3e7b8a 4488
maclobdell 0:f7c60d3e7b8a 4489 if( ssl->in_msglen != 1 || ssl->in_msg[0] != 1 )
maclobdell 0:f7c60d3e7b8a 4490 {
maclobdell 0:f7c60d3e7b8a 4491 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
maclobdell 0:f7c60d3e7b8a 4492 return( MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC );
maclobdell 0:f7c60d3e7b8a 4493 }
maclobdell 0:f7c60d3e7b8a 4494
maclobdell 0:f7c60d3e7b8a 4495 /*
maclobdell 0:f7c60d3e7b8a 4496 * Switch to our negotiated transform and session parameters for inbound
maclobdell 0:f7c60d3e7b8a 4497 * data.
maclobdell 0:f7c60d3e7b8a 4498 */
maclobdell 0:f7c60d3e7b8a 4499 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
maclobdell 0:f7c60d3e7b8a 4500 ssl->transform_in = ssl->transform_negotiate;
maclobdell 0:f7c60d3e7b8a 4501 ssl->session_in = ssl->session_negotiate;
maclobdell 0:f7c60d3e7b8a 4502
maclobdell 0:f7c60d3e7b8a 4503 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 4504 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 4505 {
maclobdell 0:f7c60d3e7b8a 4506 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
maclobdell 0:f7c60d3e7b8a 4507 ssl_dtls_replay_reset( ssl );
maclobdell 0:f7c60d3e7b8a 4508 #endif
maclobdell 0:f7c60d3e7b8a 4509
maclobdell 0:f7c60d3e7b8a 4510 /* Increment epoch */
maclobdell 0:f7c60d3e7b8a 4511 if( ++ssl->in_epoch == 0 )
maclobdell 0:f7c60d3e7b8a 4512 {
maclobdell 0:f7c60d3e7b8a 4513 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
maclobdell 0:f7c60d3e7b8a 4514 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
maclobdell 0:f7c60d3e7b8a 4515 }
maclobdell 0:f7c60d3e7b8a 4516 }
maclobdell 0:f7c60d3e7b8a 4517 else
maclobdell 0:f7c60d3e7b8a 4518 #endif /* MBEDTLS_SSL_PROTO_DTLS */
maclobdell 0:f7c60d3e7b8a 4519 memset( ssl->in_ctr, 0, 8 );
maclobdell 0:f7c60d3e7b8a 4520
maclobdell 0:f7c60d3e7b8a 4521 /*
maclobdell 0:f7c60d3e7b8a 4522 * Set the in_msg pointer to the correct location based on IV length
maclobdell 0:f7c60d3e7b8a 4523 */
maclobdell 0:f7c60d3e7b8a 4524 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
maclobdell 0:f7c60d3e7b8a 4525 {
maclobdell 0:f7c60d3e7b8a 4526 ssl->in_msg = ssl->in_iv + ssl->transform_negotiate->ivlen -
maclobdell 0:f7c60d3e7b8a 4527 ssl->transform_negotiate->fixed_ivlen;
maclobdell 0:f7c60d3e7b8a 4528 }
maclobdell 0:f7c60d3e7b8a 4529 else
maclobdell 0:f7c60d3e7b8a 4530 ssl->in_msg = ssl->in_iv;
maclobdell 0:f7c60d3e7b8a 4531
maclobdell 0:f7c60d3e7b8a 4532 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
maclobdell 0:f7c60d3e7b8a 4533 if( mbedtls_ssl_hw_record_activate != NULL )
maclobdell 0:f7c60d3e7b8a 4534 {
maclobdell 0:f7c60d3e7b8a 4535 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_INBOUND ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 4536 {
maclobdell 0:f7c60d3e7b8a 4537 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
maclobdell 0:f7c60d3e7b8a 4538 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
maclobdell 0:f7c60d3e7b8a 4539 }
maclobdell 0:f7c60d3e7b8a 4540 }
maclobdell 0:f7c60d3e7b8a 4541 #endif
maclobdell 0:f7c60d3e7b8a 4542
maclobdell 0:f7c60d3e7b8a 4543 ssl->state++;
maclobdell 0:f7c60d3e7b8a 4544
maclobdell 0:f7c60d3e7b8a 4545 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
maclobdell 0:f7c60d3e7b8a 4546
maclobdell 0:f7c60d3e7b8a 4547 return( 0 );
maclobdell 0:f7c60d3e7b8a 4548 }
maclobdell 0:f7c60d3e7b8a 4549
maclobdell 0:f7c60d3e7b8a 4550 void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 4551 const mbedtls_ssl_ciphersuite_t *ciphersuite_info )
maclobdell 0:f7c60d3e7b8a 4552 {
maclobdell 0:f7c60d3e7b8a 4553 ((void) ciphersuite_info);
maclobdell 0:f7c60d3e7b8a 4554
maclobdell 0:f7c60d3e7b8a 4555 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
maclobdell 0:f7c60d3e7b8a 4556 defined(MBEDTLS_SSL_PROTO_TLS1_1)
maclobdell 0:f7c60d3e7b8a 4557 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
maclobdell 0:f7c60d3e7b8a 4558 ssl->handshake->update_checksum = ssl_update_checksum_md5sha1;
maclobdell 0:f7c60d3e7b8a 4559 else
maclobdell 0:f7c60d3e7b8a 4560 #endif
maclobdell 0:f7c60d3e7b8a 4561 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 4562 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 4563 if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
maclobdell 0:f7c60d3e7b8a 4564 ssl->handshake->update_checksum = ssl_update_checksum_sha384;
maclobdell 0:f7c60d3e7b8a 4565 else
maclobdell 0:f7c60d3e7b8a 4566 #endif
maclobdell 0:f7c60d3e7b8a 4567 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 4568 if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
maclobdell 0:f7c60d3e7b8a 4569 ssl->handshake->update_checksum = ssl_update_checksum_sha256;
maclobdell 0:f7c60d3e7b8a 4570 else
maclobdell 0:f7c60d3e7b8a 4571 #endif
maclobdell 0:f7c60d3e7b8a 4572 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 4573 {
maclobdell 0:f7c60d3e7b8a 4574 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 4575 return;
maclobdell 0:f7c60d3e7b8a 4576 }
maclobdell 0:f7c60d3e7b8a 4577 }
maclobdell 0:f7c60d3e7b8a 4578
maclobdell 0:f7c60d3e7b8a 4579 void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 4580 {
maclobdell 0:f7c60d3e7b8a 4581 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
maclobdell 0:f7c60d3e7b8a 4582 defined(MBEDTLS_SSL_PROTO_TLS1_1)
maclobdell 0:f7c60d3e7b8a 4583 mbedtls_md5_starts( &ssl->handshake->fin_md5 );
maclobdell 0:f7c60d3e7b8a 4584 mbedtls_sha1_starts( &ssl->handshake->fin_sha1 );
maclobdell 0:f7c60d3e7b8a 4585 #endif
maclobdell 0:f7c60d3e7b8a 4586 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 4587 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 4588 mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 );
maclobdell 0:f7c60d3e7b8a 4589 #endif
maclobdell 0:f7c60d3e7b8a 4590 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 4591 mbedtls_sha512_starts( &ssl->handshake->fin_sha512, 1 );
maclobdell 0:f7c60d3e7b8a 4592 #endif
maclobdell 0:f7c60d3e7b8a 4593 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 4594 }
maclobdell 0:f7c60d3e7b8a 4595
maclobdell 0:f7c60d3e7b8a 4596 static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 4597 const unsigned char *buf, size_t len )
maclobdell 0:f7c60d3e7b8a 4598 {
maclobdell 0:f7c60d3e7b8a 4599 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
maclobdell 0:f7c60d3e7b8a 4600 defined(MBEDTLS_SSL_PROTO_TLS1_1)
maclobdell 0:f7c60d3e7b8a 4601 mbedtls_md5_update( &ssl->handshake->fin_md5 , buf, len );
maclobdell 0:f7c60d3e7b8a 4602 mbedtls_sha1_update( &ssl->handshake->fin_sha1, buf, len );
maclobdell 0:f7c60d3e7b8a 4603 #endif
maclobdell 0:f7c60d3e7b8a 4604 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 4605 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 4606 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
maclobdell 0:f7c60d3e7b8a 4607 #endif
maclobdell 0:f7c60d3e7b8a 4608 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 4609 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
maclobdell 0:f7c60d3e7b8a 4610 #endif
maclobdell 0:f7c60d3e7b8a 4611 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 4612 }
maclobdell 0:f7c60d3e7b8a 4613
maclobdell 0:f7c60d3e7b8a 4614 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
maclobdell 0:f7c60d3e7b8a 4615 defined(MBEDTLS_SSL_PROTO_TLS1_1)
maclobdell 0:f7c60d3e7b8a 4616 static void ssl_update_checksum_md5sha1( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 4617 const unsigned char *buf, size_t len )
maclobdell 0:f7c60d3e7b8a 4618 {
maclobdell 0:f7c60d3e7b8a 4619 mbedtls_md5_update( &ssl->handshake->fin_md5 , buf, len );
maclobdell 0:f7c60d3e7b8a 4620 mbedtls_sha1_update( &ssl->handshake->fin_sha1, buf, len );
maclobdell 0:f7c60d3e7b8a 4621 }
maclobdell 0:f7c60d3e7b8a 4622 #endif
maclobdell 0:f7c60d3e7b8a 4623
maclobdell 0:f7c60d3e7b8a 4624 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 4625 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 4626 static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 4627 const unsigned char *buf, size_t len )
maclobdell 0:f7c60d3e7b8a 4628 {
maclobdell 0:f7c60d3e7b8a 4629 mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
maclobdell 0:f7c60d3e7b8a 4630 }
maclobdell 0:f7c60d3e7b8a 4631 #endif
maclobdell 0:f7c60d3e7b8a 4632
maclobdell 0:f7c60d3e7b8a 4633 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 4634 static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 4635 const unsigned char *buf, size_t len )
maclobdell 0:f7c60d3e7b8a 4636 {
maclobdell 0:f7c60d3e7b8a 4637 mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
maclobdell 0:f7c60d3e7b8a 4638 }
maclobdell 0:f7c60d3e7b8a 4639 #endif
maclobdell 0:f7c60d3e7b8a 4640 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 4641
maclobdell 0:f7c60d3e7b8a 4642 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 4643 static void ssl_calc_finished_ssl(
maclobdell 0:f7c60d3e7b8a 4644 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
maclobdell 0:f7c60d3e7b8a 4645 {
maclobdell 0:f7c60d3e7b8a 4646 const char *sender;
maclobdell 0:f7c60d3e7b8a 4647 mbedtls_md5_context md5;
maclobdell 0:f7c60d3e7b8a 4648 mbedtls_sha1_context sha1;
maclobdell 0:f7c60d3e7b8a 4649
maclobdell 0:f7c60d3e7b8a 4650 unsigned char padbuf[48];
maclobdell 0:f7c60d3e7b8a 4651 unsigned char md5sum[16];
maclobdell 0:f7c60d3e7b8a 4652 unsigned char sha1sum[20];
maclobdell 0:f7c60d3e7b8a 4653
maclobdell 0:f7c60d3e7b8a 4654 mbedtls_ssl_session *session = ssl->session_negotiate;
maclobdell 0:f7c60d3e7b8a 4655 if( !session )
maclobdell 0:f7c60d3e7b8a 4656 session = ssl->session;
maclobdell 0:f7c60d3e7b8a 4657
maclobdell 0:f7c60d3e7b8a 4658 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
maclobdell 0:f7c60d3e7b8a 4659
maclobdell 0:f7c60d3e7b8a 4660 mbedtls_md5_init( &md5 );
maclobdell 0:f7c60d3e7b8a 4661 mbedtls_sha1_init( &sha1 );
maclobdell 0:f7c60d3e7b8a 4662
maclobdell 0:f7c60d3e7b8a 4663 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
maclobdell 0:f7c60d3e7b8a 4664 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
maclobdell 0:f7c60d3e7b8a 4665
maclobdell 0:f7c60d3e7b8a 4666 /*
maclobdell 0:f7c60d3e7b8a 4667 * SSLv3:
maclobdell 0:f7c60d3e7b8a 4668 * hash =
maclobdell 0:f7c60d3e7b8a 4669 * MD5( master + pad2 +
maclobdell 0:f7c60d3e7b8a 4670 * MD5( handshake + sender + master + pad1 ) )
maclobdell 0:f7c60d3e7b8a 4671 * + SHA1( master + pad2 +
maclobdell 0:f7c60d3e7b8a 4672 * SHA1( handshake + sender + master + pad1 ) )
maclobdell 0:f7c60d3e7b8a 4673 */
maclobdell 0:f7c60d3e7b8a 4674
maclobdell 0:f7c60d3e7b8a 4675 #if !defined(MBEDTLS_MD5_ALT)
maclobdell 0:f7c60d3e7b8a 4676 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
maclobdell 0:f7c60d3e7b8a 4677 md5.state, sizeof( md5.state ) );
maclobdell 0:f7c60d3e7b8a 4678 #endif
maclobdell 0:f7c60d3e7b8a 4679
maclobdell 0:f7c60d3e7b8a 4680 #if !defined(MBEDTLS_SHA1_ALT)
maclobdell 0:f7c60d3e7b8a 4681 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
maclobdell 0:f7c60d3e7b8a 4682 sha1.state, sizeof( sha1.state ) );
maclobdell 0:f7c60d3e7b8a 4683 #endif
maclobdell 0:f7c60d3e7b8a 4684
maclobdell 0:f7c60d3e7b8a 4685 sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "CLNT"
maclobdell 0:f7c60d3e7b8a 4686 : "SRVR";
maclobdell 0:f7c60d3e7b8a 4687
maclobdell 0:f7c60d3e7b8a 4688 memset( padbuf, 0x36, 48 );
maclobdell 0:f7c60d3e7b8a 4689
maclobdell 0:f7c60d3e7b8a 4690 mbedtls_md5_update( &md5, (const unsigned char *) sender, 4 );
maclobdell 0:f7c60d3e7b8a 4691 mbedtls_md5_update( &md5, session->master, 48 );
maclobdell 0:f7c60d3e7b8a 4692 mbedtls_md5_update( &md5, padbuf, 48 );
maclobdell 0:f7c60d3e7b8a 4693 mbedtls_md5_finish( &md5, md5sum );
maclobdell 0:f7c60d3e7b8a 4694
maclobdell 0:f7c60d3e7b8a 4695 mbedtls_sha1_update( &sha1, (const unsigned char *) sender, 4 );
maclobdell 0:f7c60d3e7b8a 4696 mbedtls_sha1_update( &sha1, session->master, 48 );
maclobdell 0:f7c60d3e7b8a 4697 mbedtls_sha1_update( &sha1, padbuf, 40 );
maclobdell 0:f7c60d3e7b8a 4698 mbedtls_sha1_finish( &sha1, sha1sum );
maclobdell 0:f7c60d3e7b8a 4699
maclobdell 0:f7c60d3e7b8a 4700 memset( padbuf, 0x5C, 48 );
maclobdell 0:f7c60d3e7b8a 4701
maclobdell 0:f7c60d3e7b8a 4702 mbedtls_md5_starts( &md5 );
maclobdell 0:f7c60d3e7b8a 4703 mbedtls_md5_update( &md5, session->master, 48 );
maclobdell 0:f7c60d3e7b8a 4704 mbedtls_md5_update( &md5, padbuf, 48 );
maclobdell 0:f7c60d3e7b8a 4705 mbedtls_md5_update( &md5, md5sum, 16 );
maclobdell 0:f7c60d3e7b8a 4706 mbedtls_md5_finish( &md5, buf );
maclobdell 0:f7c60d3e7b8a 4707
maclobdell 0:f7c60d3e7b8a 4708 mbedtls_sha1_starts( &sha1 );
maclobdell 0:f7c60d3e7b8a 4709 mbedtls_sha1_update( &sha1, session->master, 48 );
maclobdell 0:f7c60d3e7b8a 4710 mbedtls_sha1_update( &sha1, padbuf , 40 );
maclobdell 0:f7c60d3e7b8a 4711 mbedtls_sha1_update( &sha1, sha1sum, 20 );
maclobdell 0:f7c60d3e7b8a 4712 mbedtls_sha1_finish( &sha1, buf + 16 );
maclobdell 0:f7c60d3e7b8a 4713
maclobdell 0:f7c60d3e7b8a 4714 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 );
maclobdell 0:f7c60d3e7b8a 4715
maclobdell 0:f7c60d3e7b8a 4716 mbedtls_md5_free( &md5 );
maclobdell 0:f7c60d3e7b8a 4717 mbedtls_sha1_free( &sha1 );
maclobdell 0:f7c60d3e7b8a 4718
maclobdell 0:f7c60d3e7b8a 4719 mbedtls_zeroize( padbuf, sizeof( padbuf ) );
maclobdell 0:f7c60d3e7b8a 4720 mbedtls_zeroize( md5sum, sizeof( md5sum ) );
maclobdell 0:f7c60d3e7b8a 4721 mbedtls_zeroize( sha1sum, sizeof( sha1sum ) );
maclobdell 0:f7c60d3e7b8a 4722
maclobdell 0:f7c60d3e7b8a 4723 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
maclobdell 0:f7c60d3e7b8a 4724 }
maclobdell 0:f7c60d3e7b8a 4725 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
maclobdell 0:f7c60d3e7b8a 4726
maclobdell 0:f7c60d3e7b8a 4727 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
maclobdell 0:f7c60d3e7b8a 4728 static void ssl_calc_finished_tls(
maclobdell 0:f7c60d3e7b8a 4729 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
maclobdell 0:f7c60d3e7b8a 4730 {
maclobdell 0:f7c60d3e7b8a 4731 int len = 12;
maclobdell 0:f7c60d3e7b8a 4732 const char *sender;
maclobdell 0:f7c60d3e7b8a 4733 mbedtls_md5_context md5;
maclobdell 0:f7c60d3e7b8a 4734 mbedtls_sha1_context sha1;
maclobdell 0:f7c60d3e7b8a 4735 unsigned char padbuf[36];
maclobdell 0:f7c60d3e7b8a 4736
maclobdell 0:f7c60d3e7b8a 4737 mbedtls_ssl_session *session = ssl->session_negotiate;
maclobdell 0:f7c60d3e7b8a 4738 if( !session )
maclobdell 0:f7c60d3e7b8a 4739 session = ssl->session;
maclobdell 0:f7c60d3e7b8a 4740
maclobdell 0:f7c60d3e7b8a 4741 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
maclobdell 0:f7c60d3e7b8a 4742
maclobdell 0:f7c60d3e7b8a 4743 mbedtls_md5_init( &md5 );
maclobdell 0:f7c60d3e7b8a 4744 mbedtls_sha1_init( &sha1 );
maclobdell 0:f7c60d3e7b8a 4745
maclobdell 0:f7c60d3e7b8a 4746 mbedtls_md5_clone( &md5, &ssl->handshake->fin_md5 );
maclobdell 0:f7c60d3e7b8a 4747 mbedtls_sha1_clone( &sha1, &ssl->handshake->fin_sha1 );
maclobdell 0:f7c60d3e7b8a 4748
maclobdell 0:f7c60d3e7b8a 4749 /*
maclobdell 0:f7c60d3e7b8a 4750 * TLSv1:
maclobdell 0:f7c60d3e7b8a 4751 * hash = PRF( master, finished_label,
maclobdell 0:f7c60d3e7b8a 4752 * MD5( handshake ) + SHA1( handshake ) )[0..11]
maclobdell 0:f7c60d3e7b8a 4753 */
maclobdell 0:f7c60d3e7b8a 4754
maclobdell 0:f7c60d3e7b8a 4755 #if !defined(MBEDTLS_MD5_ALT)
maclobdell 0:f7c60d3e7b8a 4756 MBEDTLS_SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
maclobdell 0:f7c60d3e7b8a 4757 md5.state, sizeof( md5.state ) );
maclobdell 0:f7c60d3e7b8a 4758 #endif
maclobdell 0:f7c60d3e7b8a 4759
maclobdell 0:f7c60d3e7b8a 4760 #if !defined(MBEDTLS_SHA1_ALT)
maclobdell 0:f7c60d3e7b8a 4761 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
maclobdell 0:f7c60d3e7b8a 4762 sha1.state, sizeof( sha1.state ) );
maclobdell 0:f7c60d3e7b8a 4763 #endif
maclobdell 0:f7c60d3e7b8a 4764
maclobdell 0:f7c60d3e7b8a 4765 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 4766 ? "client finished"
maclobdell 0:f7c60d3e7b8a 4767 : "server finished";
maclobdell 0:f7c60d3e7b8a 4768
maclobdell 0:f7c60d3e7b8a 4769 mbedtls_md5_finish( &md5, padbuf );
maclobdell 0:f7c60d3e7b8a 4770 mbedtls_sha1_finish( &sha1, padbuf + 16 );
maclobdell 0:f7c60d3e7b8a 4771
maclobdell 0:f7c60d3e7b8a 4772 ssl->handshake->tls_prf( session->master, 48, sender,
maclobdell 0:f7c60d3e7b8a 4773 padbuf, 36, buf, len );
maclobdell 0:f7c60d3e7b8a 4774
maclobdell 0:f7c60d3e7b8a 4775 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
maclobdell 0:f7c60d3e7b8a 4776
maclobdell 0:f7c60d3e7b8a 4777 mbedtls_md5_free( &md5 );
maclobdell 0:f7c60d3e7b8a 4778 mbedtls_sha1_free( &sha1 );
maclobdell 0:f7c60d3e7b8a 4779
maclobdell 0:f7c60d3e7b8a 4780 mbedtls_zeroize( padbuf, sizeof( padbuf ) );
maclobdell 0:f7c60d3e7b8a 4781
maclobdell 0:f7c60d3e7b8a 4782 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
maclobdell 0:f7c60d3e7b8a 4783 }
maclobdell 0:f7c60d3e7b8a 4784 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
maclobdell 0:f7c60d3e7b8a 4785
maclobdell 0:f7c60d3e7b8a 4786 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 4787 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 4788 static void ssl_calc_finished_tls_sha256(
maclobdell 0:f7c60d3e7b8a 4789 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
maclobdell 0:f7c60d3e7b8a 4790 {
maclobdell 0:f7c60d3e7b8a 4791 int len = 12;
maclobdell 0:f7c60d3e7b8a 4792 const char *sender;
maclobdell 0:f7c60d3e7b8a 4793 mbedtls_sha256_context sha256;
maclobdell 0:f7c60d3e7b8a 4794 unsigned char padbuf[32];
maclobdell 0:f7c60d3e7b8a 4795
maclobdell 0:f7c60d3e7b8a 4796 mbedtls_ssl_session *session = ssl->session_negotiate;
maclobdell 0:f7c60d3e7b8a 4797 if( !session )
maclobdell 0:f7c60d3e7b8a 4798 session = ssl->session;
maclobdell 0:f7c60d3e7b8a 4799
maclobdell 0:f7c60d3e7b8a 4800 mbedtls_sha256_init( &sha256 );
maclobdell 0:f7c60d3e7b8a 4801
maclobdell 0:f7c60d3e7b8a 4802 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
maclobdell 0:f7c60d3e7b8a 4803
maclobdell 0:f7c60d3e7b8a 4804 mbedtls_sha256_clone( &sha256, &ssl->handshake->fin_sha256 );
maclobdell 0:f7c60d3e7b8a 4805
maclobdell 0:f7c60d3e7b8a 4806 /*
maclobdell 0:f7c60d3e7b8a 4807 * TLSv1.2:
maclobdell 0:f7c60d3e7b8a 4808 * hash = PRF( master, finished_label,
maclobdell 0:f7c60d3e7b8a 4809 * Hash( handshake ) )[0.11]
maclobdell 0:f7c60d3e7b8a 4810 */
maclobdell 0:f7c60d3e7b8a 4811
maclobdell 0:f7c60d3e7b8a 4812 #if !defined(MBEDTLS_SHA256_ALT)
maclobdell 0:f7c60d3e7b8a 4813 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
maclobdell 0:f7c60d3e7b8a 4814 sha256.state, sizeof( sha256.state ) );
maclobdell 0:f7c60d3e7b8a 4815 #endif
maclobdell 0:f7c60d3e7b8a 4816
maclobdell 0:f7c60d3e7b8a 4817 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 4818 ? "client finished"
maclobdell 0:f7c60d3e7b8a 4819 : "server finished";
maclobdell 0:f7c60d3e7b8a 4820
maclobdell 0:f7c60d3e7b8a 4821 mbedtls_sha256_finish( &sha256, padbuf );
maclobdell 0:f7c60d3e7b8a 4822
maclobdell 0:f7c60d3e7b8a 4823 ssl->handshake->tls_prf( session->master, 48, sender,
maclobdell 0:f7c60d3e7b8a 4824 padbuf, 32, buf, len );
maclobdell 0:f7c60d3e7b8a 4825
maclobdell 0:f7c60d3e7b8a 4826 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
maclobdell 0:f7c60d3e7b8a 4827
maclobdell 0:f7c60d3e7b8a 4828 mbedtls_sha256_free( &sha256 );
maclobdell 0:f7c60d3e7b8a 4829
maclobdell 0:f7c60d3e7b8a 4830 mbedtls_zeroize( padbuf, sizeof( padbuf ) );
maclobdell 0:f7c60d3e7b8a 4831
maclobdell 0:f7c60d3e7b8a 4832 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
maclobdell 0:f7c60d3e7b8a 4833 }
maclobdell 0:f7c60d3e7b8a 4834 #endif /* MBEDTLS_SHA256_C */
maclobdell 0:f7c60d3e7b8a 4835
maclobdell 0:f7c60d3e7b8a 4836 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 4837 static void ssl_calc_finished_tls_sha384(
maclobdell 0:f7c60d3e7b8a 4838 mbedtls_ssl_context *ssl, unsigned char *buf, int from )
maclobdell 0:f7c60d3e7b8a 4839 {
maclobdell 0:f7c60d3e7b8a 4840 int len = 12;
maclobdell 0:f7c60d3e7b8a 4841 const char *sender;
maclobdell 0:f7c60d3e7b8a 4842 mbedtls_sha512_context sha512;
maclobdell 0:f7c60d3e7b8a 4843 unsigned char padbuf[48];
maclobdell 0:f7c60d3e7b8a 4844
maclobdell 0:f7c60d3e7b8a 4845 mbedtls_ssl_session *session = ssl->session_negotiate;
maclobdell 0:f7c60d3e7b8a 4846 if( !session )
maclobdell 0:f7c60d3e7b8a 4847 session = ssl->session;
maclobdell 0:f7c60d3e7b8a 4848
maclobdell 0:f7c60d3e7b8a 4849 mbedtls_sha512_init( &sha512 );
maclobdell 0:f7c60d3e7b8a 4850
maclobdell 0:f7c60d3e7b8a 4851 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
maclobdell 0:f7c60d3e7b8a 4852
maclobdell 0:f7c60d3e7b8a 4853 mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 );
maclobdell 0:f7c60d3e7b8a 4854
maclobdell 0:f7c60d3e7b8a 4855 /*
maclobdell 0:f7c60d3e7b8a 4856 * TLSv1.2:
maclobdell 0:f7c60d3e7b8a 4857 * hash = PRF( master, finished_label,
maclobdell 0:f7c60d3e7b8a 4858 * Hash( handshake ) )[0.11]
maclobdell 0:f7c60d3e7b8a 4859 */
maclobdell 0:f7c60d3e7b8a 4860
maclobdell 0:f7c60d3e7b8a 4861 #if !defined(MBEDTLS_SHA512_ALT)
maclobdell 0:f7c60d3e7b8a 4862 MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
maclobdell 0:f7c60d3e7b8a 4863 sha512.state, sizeof( sha512.state ) );
maclobdell 0:f7c60d3e7b8a 4864 #endif
maclobdell 0:f7c60d3e7b8a 4865
maclobdell 0:f7c60d3e7b8a 4866 sender = ( from == MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 4867 ? "client finished"
maclobdell 0:f7c60d3e7b8a 4868 : "server finished";
maclobdell 0:f7c60d3e7b8a 4869
maclobdell 0:f7c60d3e7b8a 4870 mbedtls_sha512_finish( &sha512, padbuf );
maclobdell 0:f7c60d3e7b8a 4871
maclobdell 0:f7c60d3e7b8a 4872 ssl->handshake->tls_prf( session->master, 48, sender,
maclobdell 0:f7c60d3e7b8a 4873 padbuf, 48, buf, len );
maclobdell 0:f7c60d3e7b8a 4874
maclobdell 0:f7c60d3e7b8a 4875 MBEDTLS_SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
maclobdell 0:f7c60d3e7b8a 4876
maclobdell 0:f7c60d3e7b8a 4877 mbedtls_sha512_free( &sha512 );
maclobdell 0:f7c60d3e7b8a 4878
maclobdell 0:f7c60d3e7b8a 4879 mbedtls_zeroize( padbuf, sizeof( padbuf ) );
maclobdell 0:f7c60d3e7b8a 4880
maclobdell 0:f7c60d3e7b8a 4881 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
maclobdell 0:f7c60d3e7b8a 4882 }
maclobdell 0:f7c60d3e7b8a 4883 #endif /* MBEDTLS_SHA512_C */
maclobdell 0:f7c60d3e7b8a 4884 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 4885
maclobdell 0:f7c60d3e7b8a 4886 static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 4887 {
maclobdell 0:f7c60d3e7b8a 4888 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup: final free" ) );
maclobdell 0:f7c60d3e7b8a 4889
maclobdell 0:f7c60d3e7b8a 4890 /*
maclobdell 0:f7c60d3e7b8a 4891 * Free our handshake params
maclobdell 0:f7c60d3e7b8a 4892 */
maclobdell 0:f7c60d3e7b8a 4893 mbedtls_ssl_handshake_free( ssl->handshake );
maclobdell 0:f7c60d3e7b8a 4894 mbedtls_free( ssl->handshake );
maclobdell 0:f7c60d3e7b8a 4895 ssl->handshake = NULL;
maclobdell 0:f7c60d3e7b8a 4896
maclobdell 0:f7c60d3e7b8a 4897 /*
maclobdell 0:f7c60d3e7b8a 4898 * Free the previous transform and swith in the current one
maclobdell 0:f7c60d3e7b8a 4899 */
maclobdell 0:f7c60d3e7b8a 4900 if( ssl->transform )
maclobdell 0:f7c60d3e7b8a 4901 {
maclobdell 0:f7c60d3e7b8a 4902 mbedtls_ssl_transform_free( ssl->transform );
maclobdell 0:f7c60d3e7b8a 4903 mbedtls_free( ssl->transform );
maclobdell 0:f7c60d3e7b8a 4904 }
maclobdell 0:f7c60d3e7b8a 4905 ssl->transform = ssl->transform_negotiate;
maclobdell 0:f7c60d3e7b8a 4906 ssl->transform_negotiate = NULL;
maclobdell 0:f7c60d3e7b8a 4907
maclobdell 0:f7c60d3e7b8a 4908 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup: final free" ) );
maclobdell 0:f7c60d3e7b8a 4909 }
maclobdell 0:f7c60d3e7b8a 4910
maclobdell 0:f7c60d3e7b8a 4911 void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 4912 {
maclobdell 0:f7c60d3e7b8a 4913 int resume = ssl->handshake->resume;
maclobdell 0:f7c60d3e7b8a 4914
maclobdell 0:f7c60d3e7b8a 4915 MBEDTLS_SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
maclobdell 0:f7c60d3e7b8a 4916
maclobdell 0:f7c60d3e7b8a 4917 #if defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 4918 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
maclobdell 0:f7c60d3e7b8a 4919 {
maclobdell 0:f7c60d3e7b8a 4920 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_DONE;
maclobdell 0:f7c60d3e7b8a 4921 ssl->renego_records_seen = 0;
maclobdell 0:f7c60d3e7b8a 4922 }
maclobdell 0:f7c60d3e7b8a 4923 #endif
maclobdell 0:f7c60d3e7b8a 4924
maclobdell 0:f7c60d3e7b8a 4925 /*
maclobdell 0:f7c60d3e7b8a 4926 * Free the previous session and switch in the current one
maclobdell 0:f7c60d3e7b8a 4927 */
maclobdell 0:f7c60d3e7b8a 4928 if( ssl->session )
maclobdell 0:f7c60d3e7b8a 4929 {
maclobdell 0:f7c60d3e7b8a 4930 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
maclobdell 0:f7c60d3e7b8a 4931 /* RFC 7366 3.1: keep the EtM state */
maclobdell 0:f7c60d3e7b8a 4932 ssl->session_negotiate->encrypt_then_mac =
maclobdell 0:f7c60d3e7b8a 4933 ssl->session->encrypt_then_mac;
maclobdell 0:f7c60d3e7b8a 4934 #endif
maclobdell 0:f7c60d3e7b8a 4935
maclobdell 0:f7c60d3e7b8a 4936 mbedtls_ssl_session_free( ssl->session );
maclobdell 0:f7c60d3e7b8a 4937 mbedtls_free( ssl->session );
maclobdell 0:f7c60d3e7b8a 4938 }
maclobdell 0:f7c60d3e7b8a 4939 ssl->session = ssl->session_negotiate;
maclobdell 0:f7c60d3e7b8a 4940 ssl->session_negotiate = NULL;
maclobdell 0:f7c60d3e7b8a 4941
maclobdell 0:f7c60d3e7b8a 4942 /*
maclobdell 0:f7c60d3e7b8a 4943 * Add cache entry
maclobdell 0:f7c60d3e7b8a 4944 */
maclobdell 0:f7c60d3e7b8a 4945 if( ssl->conf->f_set_cache != NULL &&
maclobdell 0:f7c60d3e7b8a 4946 ssl->session->id_len != 0 &&
maclobdell 0:f7c60d3e7b8a 4947 resume == 0 )
maclobdell 0:f7c60d3e7b8a 4948 {
maclobdell 0:f7c60d3e7b8a 4949 if( ssl->conf->f_set_cache( ssl->conf->p_cache, ssl->session ) != 0 )
maclobdell 0:f7c60d3e7b8a 4950 MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
maclobdell 0:f7c60d3e7b8a 4951 }
maclobdell 0:f7c60d3e7b8a 4952
maclobdell 0:f7c60d3e7b8a 4953 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 4954 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
maclobdell 0:f7c60d3e7b8a 4955 ssl->handshake->flight != NULL )
maclobdell 0:f7c60d3e7b8a 4956 {
maclobdell 0:f7c60d3e7b8a 4957 /* Cancel handshake timer */
maclobdell 0:f7c60d3e7b8a 4958 ssl_set_timer( ssl, 0 );
maclobdell 0:f7c60d3e7b8a 4959
maclobdell 0:f7c60d3e7b8a 4960 /* Keep last flight around in case we need to resend it:
maclobdell 0:f7c60d3e7b8a 4961 * we need the handshake and transform structures for that */
maclobdell 0:f7c60d3e7b8a 4962 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip freeing handshake and transform" ) );
maclobdell 0:f7c60d3e7b8a 4963 }
maclobdell 0:f7c60d3e7b8a 4964 else
maclobdell 0:f7c60d3e7b8a 4965 #endif
maclobdell 0:f7c60d3e7b8a 4966 ssl_handshake_wrapup_free_hs_transform( ssl );
maclobdell 0:f7c60d3e7b8a 4967
maclobdell 0:f7c60d3e7b8a 4968 ssl->state++;
maclobdell 0:f7c60d3e7b8a 4969
maclobdell 0:f7c60d3e7b8a 4970 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
maclobdell 0:f7c60d3e7b8a 4971 }
maclobdell 0:f7c60d3e7b8a 4972
maclobdell 0:f7c60d3e7b8a 4973 int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 4974 {
maclobdell 0:f7c60d3e7b8a 4975 int ret, hash_len;
maclobdell 0:f7c60d3e7b8a 4976
maclobdell 0:f7c60d3e7b8a 4977 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
maclobdell 0:f7c60d3e7b8a 4978
maclobdell 0:f7c60d3e7b8a 4979 /*
maclobdell 0:f7c60d3e7b8a 4980 * Set the out_msg pointer to the correct location based on IV length
maclobdell 0:f7c60d3e7b8a 4981 */
maclobdell 0:f7c60d3e7b8a 4982 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_2 )
maclobdell 0:f7c60d3e7b8a 4983 {
maclobdell 0:f7c60d3e7b8a 4984 ssl->out_msg = ssl->out_iv + ssl->transform_negotiate->ivlen -
maclobdell 0:f7c60d3e7b8a 4985 ssl->transform_negotiate->fixed_ivlen;
maclobdell 0:f7c60d3e7b8a 4986 }
maclobdell 0:f7c60d3e7b8a 4987 else
maclobdell 0:f7c60d3e7b8a 4988 ssl->out_msg = ssl->out_iv;
maclobdell 0:f7c60d3e7b8a 4989
maclobdell 0:f7c60d3e7b8a 4990 ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
maclobdell 0:f7c60d3e7b8a 4991
maclobdell 0:f7c60d3e7b8a 4992 // TODO TLS/1.2 Hash length is determined by cipher suite (Page 63)
maclobdell 0:f7c60d3e7b8a 4993 hash_len = ( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12;
maclobdell 0:f7c60d3e7b8a 4994
maclobdell 0:f7c60d3e7b8a 4995 #if defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 4996 ssl->verify_data_len = hash_len;
maclobdell 0:f7c60d3e7b8a 4997 memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
maclobdell 0:f7c60d3e7b8a 4998 #endif
maclobdell 0:f7c60d3e7b8a 4999
maclobdell 0:f7c60d3e7b8a 5000 ssl->out_msglen = 4 + hash_len;
maclobdell 0:f7c60d3e7b8a 5001 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
maclobdell 0:f7c60d3e7b8a 5002 ssl->out_msg[0] = MBEDTLS_SSL_HS_FINISHED;
maclobdell 0:f7c60d3e7b8a 5003
maclobdell 0:f7c60d3e7b8a 5004 /*
maclobdell 0:f7c60d3e7b8a 5005 * In case of session resuming, invert the client and server
maclobdell 0:f7c60d3e7b8a 5006 * ChangeCipherSpec messages order.
maclobdell 0:f7c60d3e7b8a 5007 */
maclobdell 0:f7c60d3e7b8a 5008 if( ssl->handshake->resume != 0 )
maclobdell 0:f7c60d3e7b8a 5009 {
maclobdell 0:f7c60d3e7b8a 5010 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 5011 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 5012 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
maclobdell 0:f7c60d3e7b8a 5013 #endif
maclobdell 0:f7c60d3e7b8a 5014 #if defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 5015 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
maclobdell 0:f7c60d3e7b8a 5016 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
maclobdell 0:f7c60d3e7b8a 5017 #endif
maclobdell 0:f7c60d3e7b8a 5018 }
maclobdell 0:f7c60d3e7b8a 5019 else
maclobdell 0:f7c60d3e7b8a 5020 ssl->state++;
maclobdell 0:f7c60d3e7b8a 5021
maclobdell 0:f7c60d3e7b8a 5022 /*
maclobdell 0:f7c60d3e7b8a 5023 * Switch to our negotiated transform and session parameters for outbound
maclobdell 0:f7c60d3e7b8a 5024 * data.
maclobdell 0:f7c60d3e7b8a 5025 */
maclobdell 0:f7c60d3e7b8a 5026 MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
maclobdell 0:f7c60d3e7b8a 5027
maclobdell 0:f7c60d3e7b8a 5028 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 5029 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 5030 {
maclobdell 0:f7c60d3e7b8a 5031 unsigned char i;
maclobdell 0:f7c60d3e7b8a 5032
maclobdell 0:f7c60d3e7b8a 5033 /* Remember current epoch settings for resending */
maclobdell 0:f7c60d3e7b8a 5034 ssl->handshake->alt_transform_out = ssl->transform_out;
maclobdell 0:f7c60d3e7b8a 5035 memcpy( ssl->handshake->alt_out_ctr, ssl->out_ctr, 8 );
maclobdell 0:f7c60d3e7b8a 5036
maclobdell 0:f7c60d3e7b8a 5037 /* Set sequence_number to zero */
maclobdell 0:f7c60d3e7b8a 5038 memset( ssl->out_ctr + 2, 0, 6 );
maclobdell 0:f7c60d3e7b8a 5039
maclobdell 0:f7c60d3e7b8a 5040 /* Increment epoch */
maclobdell 0:f7c60d3e7b8a 5041 for( i = 2; i > 0; i-- )
maclobdell 0:f7c60d3e7b8a 5042 if( ++ssl->out_ctr[i - 1] != 0 )
maclobdell 0:f7c60d3e7b8a 5043 break;
maclobdell 0:f7c60d3e7b8a 5044
maclobdell 0:f7c60d3e7b8a 5045 /* The loop goes to its end iff the counter is wrapping */
maclobdell 0:f7c60d3e7b8a 5046 if( i == 0 )
maclobdell 0:f7c60d3e7b8a 5047 {
maclobdell 0:f7c60d3e7b8a 5048 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DTLS epoch would wrap" ) );
maclobdell 0:f7c60d3e7b8a 5049 return( MBEDTLS_ERR_SSL_COUNTER_WRAPPING );
maclobdell 0:f7c60d3e7b8a 5050 }
maclobdell 0:f7c60d3e7b8a 5051 }
maclobdell 0:f7c60d3e7b8a 5052 else
maclobdell 0:f7c60d3e7b8a 5053 #endif /* MBEDTLS_SSL_PROTO_DTLS */
maclobdell 0:f7c60d3e7b8a 5054 memset( ssl->out_ctr, 0, 8 );
maclobdell 0:f7c60d3e7b8a 5055
maclobdell 0:f7c60d3e7b8a 5056 ssl->transform_out = ssl->transform_negotiate;
maclobdell 0:f7c60d3e7b8a 5057 ssl->session_out = ssl->session_negotiate;
maclobdell 0:f7c60d3e7b8a 5058
maclobdell 0:f7c60d3e7b8a 5059 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
maclobdell 0:f7c60d3e7b8a 5060 if( mbedtls_ssl_hw_record_activate != NULL )
maclobdell 0:f7c60d3e7b8a 5061 {
maclobdell 0:f7c60d3e7b8a 5062 if( ( ret = mbedtls_ssl_hw_record_activate( ssl, MBEDTLS_SSL_CHANNEL_OUTBOUND ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 5063 {
maclobdell 0:f7c60d3e7b8a 5064 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_activate", ret );
maclobdell 0:f7c60d3e7b8a 5065 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
maclobdell 0:f7c60d3e7b8a 5066 }
maclobdell 0:f7c60d3e7b8a 5067 }
maclobdell 0:f7c60d3e7b8a 5068 #endif
maclobdell 0:f7c60d3e7b8a 5069
maclobdell 0:f7c60d3e7b8a 5070 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 5071 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 5072 mbedtls_ssl_send_flight_completed( ssl );
maclobdell 0:f7c60d3e7b8a 5073 #endif
maclobdell 0:f7c60d3e7b8a 5074
maclobdell 0:f7c60d3e7b8a 5075 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 5076 {
maclobdell 0:f7c60d3e7b8a 5077 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
maclobdell 0:f7c60d3e7b8a 5078 return( ret );
maclobdell 0:f7c60d3e7b8a 5079 }
maclobdell 0:f7c60d3e7b8a 5080
maclobdell 0:f7c60d3e7b8a 5081 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
maclobdell 0:f7c60d3e7b8a 5082
maclobdell 0:f7c60d3e7b8a 5083 return( 0 );
maclobdell 0:f7c60d3e7b8a 5084 }
maclobdell 0:f7c60d3e7b8a 5085
maclobdell 0:f7c60d3e7b8a 5086 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 5087 #define SSL_MAX_HASH_LEN 36
maclobdell 0:f7c60d3e7b8a 5088 #else
maclobdell 0:f7c60d3e7b8a 5089 #define SSL_MAX_HASH_LEN 12
maclobdell 0:f7c60d3e7b8a 5090 #endif
maclobdell 0:f7c60d3e7b8a 5091
maclobdell 0:f7c60d3e7b8a 5092 int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 5093 {
maclobdell 0:f7c60d3e7b8a 5094 int ret;
maclobdell 0:f7c60d3e7b8a 5095 unsigned int hash_len;
maclobdell 0:f7c60d3e7b8a 5096 unsigned char buf[SSL_MAX_HASH_LEN];
maclobdell 0:f7c60d3e7b8a 5097
maclobdell 0:f7c60d3e7b8a 5098 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
maclobdell 0:f7c60d3e7b8a 5099
maclobdell 0:f7c60d3e7b8a 5100 ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
maclobdell 0:f7c60d3e7b8a 5101
maclobdell 0:f7c60d3e7b8a 5102 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 5103 {
maclobdell 0:f7c60d3e7b8a 5104 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
maclobdell 0:f7c60d3e7b8a 5105 return( ret );
maclobdell 0:f7c60d3e7b8a 5106 }
maclobdell 0:f7c60d3e7b8a 5107
maclobdell 0:f7c60d3e7b8a 5108 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
maclobdell 0:f7c60d3e7b8a 5109 {
maclobdell 0:f7c60d3e7b8a 5110 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
maclobdell 0:f7c60d3e7b8a 5111 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
maclobdell 0:f7c60d3e7b8a 5112 }
maclobdell 0:f7c60d3e7b8a 5113
maclobdell 0:f7c60d3e7b8a 5114 /* There is currently no ciphersuite using another length with TLS 1.2 */
maclobdell 0:f7c60d3e7b8a 5115 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 5116 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
maclobdell 0:f7c60d3e7b8a 5117 hash_len = 36;
maclobdell 0:f7c60d3e7b8a 5118 else
maclobdell 0:f7c60d3e7b8a 5119 #endif
maclobdell 0:f7c60d3e7b8a 5120 hash_len = 12;
maclobdell 0:f7c60d3e7b8a 5121
maclobdell 0:f7c60d3e7b8a 5122 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_FINISHED ||
maclobdell 0:f7c60d3e7b8a 5123 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + hash_len )
maclobdell 0:f7c60d3e7b8a 5124 {
maclobdell 0:f7c60d3e7b8a 5125 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
maclobdell 0:f7c60d3e7b8a 5126 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
maclobdell 0:f7c60d3e7b8a 5127 }
maclobdell 0:f7c60d3e7b8a 5128
maclobdell 0:f7c60d3e7b8a 5129 if( mbedtls_ssl_safer_memcmp( ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ),
maclobdell 0:f7c60d3e7b8a 5130 buf, hash_len ) != 0 )
maclobdell 0:f7c60d3e7b8a 5131 {
maclobdell 0:f7c60d3e7b8a 5132 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
maclobdell 0:f7c60d3e7b8a 5133 return( MBEDTLS_ERR_SSL_BAD_HS_FINISHED );
maclobdell 0:f7c60d3e7b8a 5134 }
maclobdell 0:f7c60d3e7b8a 5135
maclobdell 0:f7c60d3e7b8a 5136 #if defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 5137 ssl->verify_data_len = hash_len;
maclobdell 0:f7c60d3e7b8a 5138 memcpy( ssl->peer_verify_data, buf, hash_len );
maclobdell 0:f7c60d3e7b8a 5139 #endif
maclobdell 0:f7c60d3e7b8a 5140
maclobdell 0:f7c60d3e7b8a 5141 if( ssl->handshake->resume != 0 )
maclobdell 0:f7c60d3e7b8a 5142 {
maclobdell 0:f7c60d3e7b8a 5143 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 5144 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 5145 ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
maclobdell 0:f7c60d3e7b8a 5146 #endif
maclobdell 0:f7c60d3e7b8a 5147 #if defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 5148 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
maclobdell 0:f7c60d3e7b8a 5149 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
maclobdell 0:f7c60d3e7b8a 5150 #endif
maclobdell 0:f7c60d3e7b8a 5151 }
maclobdell 0:f7c60d3e7b8a 5152 else
maclobdell 0:f7c60d3e7b8a 5153 ssl->state++;
maclobdell 0:f7c60d3e7b8a 5154
maclobdell 0:f7c60d3e7b8a 5155 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 5156 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 5157 mbedtls_ssl_recv_flight_completed( ssl );
maclobdell 0:f7c60d3e7b8a 5158 #endif
maclobdell 0:f7c60d3e7b8a 5159
maclobdell 0:f7c60d3e7b8a 5160 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
maclobdell 0:f7c60d3e7b8a 5161
maclobdell 0:f7c60d3e7b8a 5162 return( 0 );
maclobdell 0:f7c60d3e7b8a 5163 }
maclobdell 0:f7c60d3e7b8a 5164
maclobdell 0:f7c60d3e7b8a 5165 static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
maclobdell 0:f7c60d3e7b8a 5166 {
maclobdell 0:f7c60d3e7b8a 5167 memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
maclobdell 0:f7c60d3e7b8a 5168
maclobdell 0:f7c60d3e7b8a 5169 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
maclobdell 0:f7c60d3e7b8a 5170 defined(MBEDTLS_SSL_PROTO_TLS1_1)
maclobdell 0:f7c60d3e7b8a 5171 mbedtls_md5_init( &handshake->fin_md5 );
maclobdell 0:f7c60d3e7b8a 5172 mbedtls_sha1_init( &handshake->fin_sha1 );
maclobdell 0:f7c60d3e7b8a 5173 mbedtls_md5_starts( &handshake->fin_md5 );
maclobdell 0:f7c60d3e7b8a 5174 mbedtls_sha1_starts( &handshake->fin_sha1 );
maclobdell 0:f7c60d3e7b8a 5175 #endif
maclobdell 0:f7c60d3e7b8a 5176 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 5177 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 5178 mbedtls_sha256_init( &handshake->fin_sha256 );
maclobdell 0:f7c60d3e7b8a 5179 mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
maclobdell 0:f7c60d3e7b8a 5180 #endif
maclobdell 0:f7c60d3e7b8a 5181 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 5182 mbedtls_sha512_init( &handshake->fin_sha512 );
maclobdell 0:f7c60d3e7b8a 5183 mbedtls_sha512_starts( &handshake->fin_sha512, 1 );
maclobdell 0:f7c60d3e7b8a 5184 #endif
maclobdell 0:f7c60d3e7b8a 5185 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 5186
maclobdell 0:f7c60d3e7b8a 5187 handshake->update_checksum = ssl_update_checksum_start;
maclobdell 0:f7c60d3e7b8a 5188 handshake->sig_alg = MBEDTLS_SSL_HASH_SHA1;
maclobdell 0:f7c60d3e7b8a 5189
maclobdell 0:f7c60d3e7b8a 5190 #if defined(MBEDTLS_DHM_C)
maclobdell 0:f7c60d3e7b8a 5191 mbedtls_dhm_init( &handshake->dhm_ctx );
maclobdell 0:f7c60d3e7b8a 5192 #endif
maclobdell 0:f7c60d3e7b8a 5193 #if defined(MBEDTLS_ECDH_C)
maclobdell 0:f7c60d3e7b8a 5194 mbedtls_ecdh_init( &handshake->ecdh_ctx );
maclobdell 0:f7c60d3e7b8a 5195 #endif
maclobdell 0:f7c60d3e7b8a 5196 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
maclobdell 0:f7c60d3e7b8a 5197 mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
maclobdell 0:f7c60d3e7b8a 5198 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 5199 handshake->ecjpake_cache = NULL;
maclobdell 0:f7c60d3e7b8a 5200 handshake->ecjpake_cache_len = 0;
maclobdell 0:f7c60d3e7b8a 5201 #endif
maclobdell 0:f7c60d3e7b8a 5202 #endif
maclobdell 0:f7c60d3e7b8a 5203
maclobdell 0:f7c60d3e7b8a 5204 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
maclobdell 0:f7c60d3e7b8a 5205 handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
maclobdell 0:f7c60d3e7b8a 5206 #endif
maclobdell 0:f7c60d3e7b8a 5207 }
maclobdell 0:f7c60d3e7b8a 5208
maclobdell 0:f7c60d3e7b8a 5209 static void ssl_transform_init( mbedtls_ssl_transform *transform )
maclobdell 0:f7c60d3e7b8a 5210 {
maclobdell 0:f7c60d3e7b8a 5211 memset( transform, 0, sizeof(mbedtls_ssl_transform) );
maclobdell 0:f7c60d3e7b8a 5212
maclobdell 0:f7c60d3e7b8a 5213 mbedtls_cipher_init( &transform->cipher_ctx_enc );
maclobdell 0:f7c60d3e7b8a 5214 mbedtls_cipher_init( &transform->cipher_ctx_dec );
maclobdell 0:f7c60d3e7b8a 5215
maclobdell 0:f7c60d3e7b8a 5216 mbedtls_md_init( &transform->md_ctx_enc );
maclobdell 0:f7c60d3e7b8a 5217 mbedtls_md_init( &transform->md_ctx_dec );
maclobdell 0:f7c60d3e7b8a 5218 }
maclobdell 0:f7c60d3e7b8a 5219
maclobdell 0:f7c60d3e7b8a 5220 void mbedtls_ssl_session_init( mbedtls_ssl_session *session )
maclobdell 0:f7c60d3e7b8a 5221 {
maclobdell 0:f7c60d3e7b8a 5222 memset( session, 0, sizeof(mbedtls_ssl_session) );
maclobdell 0:f7c60d3e7b8a 5223 }
maclobdell 0:f7c60d3e7b8a 5224
maclobdell 0:f7c60d3e7b8a 5225 static int ssl_handshake_init( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 5226 {
maclobdell 0:f7c60d3e7b8a 5227 /* Clear old handshake information if present */
maclobdell 0:f7c60d3e7b8a 5228 if( ssl->transform_negotiate )
maclobdell 0:f7c60d3e7b8a 5229 mbedtls_ssl_transform_free( ssl->transform_negotiate );
maclobdell 0:f7c60d3e7b8a 5230 if( ssl->session_negotiate )
maclobdell 0:f7c60d3e7b8a 5231 mbedtls_ssl_session_free( ssl->session_negotiate );
maclobdell 0:f7c60d3e7b8a 5232 if( ssl->handshake )
maclobdell 0:f7c60d3e7b8a 5233 mbedtls_ssl_handshake_free( ssl->handshake );
maclobdell 0:f7c60d3e7b8a 5234
maclobdell 0:f7c60d3e7b8a 5235 /*
maclobdell 0:f7c60d3e7b8a 5236 * Either the pointers are now NULL or cleared properly and can be freed.
maclobdell 0:f7c60d3e7b8a 5237 * Now allocate missing structures.
maclobdell 0:f7c60d3e7b8a 5238 */
maclobdell 0:f7c60d3e7b8a 5239 if( ssl->transform_negotiate == NULL )
maclobdell 0:f7c60d3e7b8a 5240 {
maclobdell 0:f7c60d3e7b8a 5241 ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
maclobdell 0:f7c60d3e7b8a 5242 }
maclobdell 0:f7c60d3e7b8a 5243
maclobdell 0:f7c60d3e7b8a 5244 if( ssl->session_negotiate == NULL )
maclobdell 0:f7c60d3e7b8a 5245 {
maclobdell 0:f7c60d3e7b8a 5246 ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
maclobdell 0:f7c60d3e7b8a 5247 }
maclobdell 0:f7c60d3e7b8a 5248
maclobdell 0:f7c60d3e7b8a 5249 if( ssl->handshake == NULL )
maclobdell 0:f7c60d3e7b8a 5250 {
maclobdell 0:f7c60d3e7b8a 5251 ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
maclobdell 0:f7c60d3e7b8a 5252 }
maclobdell 0:f7c60d3e7b8a 5253
maclobdell 0:f7c60d3e7b8a 5254 /* All pointers should exist and can be directly freed without issue */
maclobdell 0:f7c60d3e7b8a 5255 if( ssl->handshake == NULL ||
maclobdell 0:f7c60d3e7b8a 5256 ssl->transform_negotiate == NULL ||
maclobdell 0:f7c60d3e7b8a 5257 ssl->session_negotiate == NULL )
maclobdell 0:f7c60d3e7b8a 5258 {
maclobdell 0:f7c60d3e7b8a 5259 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
maclobdell 0:f7c60d3e7b8a 5260
maclobdell 0:f7c60d3e7b8a 5261 mbedtls_free( ssl->handshake );
maclobdell 0:f7c60d3e7b8a 5262 mbedtls_free( ssl->transform_negotiate );
maclobdell 0:f7c60d3e7b8a 5263 mbedtls_free( ssl->session_negotiate );
maclobdell 0:f7c60d3e7b8a 5264
maclobdell 0:f7c60d3e7b8a 5265 ssl->handshake = NULL;
maclobdell 0:f7c60d3e7b8a 5266 ssl->transform_negotiate = NULL;
maclobdell 0:f7c60d3e7b8a 5267 ssl->session_negotiate = NULL;
maclobdell 0:f7c60d3e7b8a 5268
maclobdell 0:f7c60d3e7b8a 5269 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 5270 }
maclobdell 0:f7c60d3e7b8a 5271
maclobdell 0:f7c60d3e7b8a 5272 /* Initialize structures */
maclobdell 0:f7c60d3e7b8a 5273 mbedtls_ssl_session_init( ssl->session_negotiate );
maclobdell 0:f7c60d3e7b8a 5274 ssl_transform_init( ssl->transform_negotiate );
maclobdell 0:f7c60d3e7b8a 5275 ssl_handshake_params_init( ssl->handshake );
maclobdell 0:f7c60d3e7b8a 5276
maclobdell 0:f7c60d3e7b8a 5277 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 5278 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 5279 {
maclobdell 0:f7c60d3e7b8a 5280 ssl->handshake->alt_transform_out = ssl->transform_out;
maclobdell 0:f7c60d3e7b8a 5281
maclobdell 0:f7c60d3e7b8a 5282 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 5283 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
maclobdell 0:f7c60d3e7b8a 5284 else
maclobdell 0:f7c60d3e7b8a 5285 ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
maclobdell 0:f7c60d3e7b8a 5286
maclobdell 0:f7c60d3e7b8a 5287 ssl_set_timer( ssl, 0 );
maclobdell 0:f7c60d3e7b8a 5288 }
maclobdell 0:f7c60d3e7b8a 5289 #endif
maclobdell 0:f7c60d3e7b8a 5290
maclobdell 0:f7c60d3e7b8a 5291 return( 0 );
maclobdell 0:f7c60d3e7b8a 5292 }
maclobdell 0:f7c60d3e7b8a 5293
maclobdell 0:f7c60d3e7b8a 5294 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 5295 /* Dummy cookie callbacks for defaults */
maclobdell 0:f7c60d3e7b8a 5296 static int ssl_cookie_write_dummy( void *ctx,
maclobdell 0:f7c60d3e7b8a 5297 unsigned char **p, unsigned char *end,
maclobdell 0:f7c60d3e7b8a 5298 const unsigned char *cli_id, size_t cli_id_len )
maclobdell 0:f7c60d3e7b8a 5299 {
maclobdell 0:f7c60d3e7b8a 5300 ((void) ctx);
maclobdell 0:f7c60d3e7b8a 5301 ((void) p);
maclobdell 0:f7c60d3e7b8a 5302 ((void) end);
maclobdell 0:f7c60d3e7b8a 5303 ((void) cli_id);
maclobdell 0:f7c60d3e7b8a 5304 ((void) cli_id_len);
maclobdell 0:f7c60d3e7b8a 5305
maclobdell 0:f7c60d3e7b8a 5306 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
maclobdell 0:f7c60d3e7b8a 5307 }
maclobdell 0:f7c60d3e7b8a 5308
maclobdell 0:f7c60d3e7b8a 5309 static int ssl_cookie_check_dummy( void *ctx,
maclobdell 0:f7c60d3e7b8a 5310 const unsigned char *cookie, size_t cookie_len,
maclobdell 0:f7c60d3e7b8a 5311 const unsigned char *cli_id, size_t cli_id_len )
maclobdell 0:f7c60d3e7b8a 5312 {
maclobdell 0:f7c60d3e7b8a 5313 ((void) ctx);
maclobdell 0:f7c60d3e7b8a 5314 ((void) cookie);
maclobdell 0:f7c60d3e7b8a 5315 ((void) cookie_len);
maclobdell 0:f7c60d3e7b8a 5316 ((void) cli_id);
maclobdell 0:f7c60d3e7b8a 5317 ((void) cli_id_len);
maclobdell 0:f7c60d3e7b8a 5318
maclobdell 0:f7c60d3e7b8a 5319 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
maclobdell 0:f7c60d3e7b8a 5320 }
maclobdell 0:f7c60d3e7b8a 5321 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY && MBEDTLS_SSL_SRV_C */
maclobdell 0:f7c60d3e7b8a 5322
maclobdell 0:f7c60d3e7b8a 5323 /*
maclobdell 0:f7c60d3e7b8a 5324 * Initialize an SSL context
maclobdell 0:f7c60d3e7b8a 5325 */
maclobdell 0:f7c60d3e7b8a 5326 void mbedtls_ssl_init( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 5327 {
maclobdell 0:f7c60d3e7b8a 5328 memset( ssl, 0, sizeof( mbedtls_ssl_context ) );
maclobdell 0:f7c60d3e7b8a 5329 }
maclobdell 0:f7c60d3e7b8a 5330
maclobdell 0:f7c60d3e7b8a 5331 /*
maclobdell 0:f7c60d3e7b8a 5332 * Setup an SSL context
maclobdell 0:f7c60d3e7b8a 5333 */
maclobdell 0:f7c60d3e7b8a 5334 int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 5335 const mbedtls_ssl_config *conf )
maclobdell 0:f7c60d3e7b8a 5336 {
maclobdell 0:f7c60d3e7b8a 5337 int ret;
maclobdell 0:f7c60d3e7b8a 5338 const size_t len = MBEDTLS_SSL_BUFFER_LEN;
maclobdell 0:f7c60d3e7b8a 5339
maclobdell 0:f7c60d3e7b8a 5340 ssl->conf = conf;
maclobdell 0:f7c60d3e7b8a 5341
maclobdell 0:f7c60d3e7b8a 5342 /*
maclobdell 0:f7c60d3e7b8a 5343 * Prepare base structures
maclobdell 0:f7c60d3e7b8a 5344 */
maclobdell 0:f7c60d3e7b8a 5345 if( ( ssl-> in_buf = mbedtls_calloc( 1, len ) ) == NULL ||
maclobdell 0:f7c60d3e7b8a 5346 ( ssl->out_buf = mbedtls_calloc( 1, len ) ) == NULL )
maclobdell 0:f7c60d3e7b8a 5347 {
maclobdell 0:f7c60d3e7b8a 5348 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", len ) );
maclobdell 0:f7c60d3e7b8a 5349 mbedtls_free( ssl->in_buf );
maclobdell 0:f7c60d3e7b8a 5350 ssl->in_buf = NULL;
maclobdell 0:f7c60d3e7b8a 5351 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 5352 }
maclobdell 0:f7c60d3e7b8a 5353
maclobdell 0:f7c60d3e7b8a 5354 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 5355 if( conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 5356 {
maclobdell 0:f7c60d3e7b8a 5357 ssl->out_hdr = ssl->out_buf;
maclobdell 0:f7c60d3e7b8a 5358 ssl->out_ctr = ssl->out_buf + 3;
maclobdell 0:f7c60d3e7b8a 5359 ssl->out_len = ssl->out_buf + 11;
maclobdell 0:f7c60d3e7b8a 5360 ssl->out_iv = ssl->out_buf + 13;
maclobdell 0:f7c60d3e7b8a 5361 ssl->out_msg = ssl->out_buf + 13;
maclobdell 0:f7c60d3e7b8a 5362
maclobdell 0:f7c60d3e7b8a 5363 ssl->in_hdr = ssl->in_buf;
maclobdell 0:f7c60d3e7b8a 5364 ssl->in_ctr = ssl->in_buf + 3;
maclobdell 0:f7c60d3e7b8a 5365 ssl->in_len = ssl->in_buf + 11;
maclobdell 0:f7c60d3e7b8a 5366 ssl->in_iv = ssl->in_buf + 13;
maclobdell 0:f7c60d3e7b8a 5367 ssl->in_msg = ssl->in_buf + 13;
maclobdell 0:f7c60d3e7b8a 5368 }
maclobdell 0:f7c60d3e7b8a 5369 else
maclobdell 0:f7c60d3e7b8a 5370 #endif
maclobdell 0:f7c60d3e7b8a 5371 {
maclobdell 0:f7c60d3e7b8a 5372 ssl->out_ctr = ssl->out_buf;
maclobdell 0:f7c60d3e7b8a 5373 ssl->out_hdr = ssl->out_buf + 8;
maclobdell 0:f7c60d3e7b8a 5374 ssl->out_len = ssl->out_buf + 11;
maclobdell 0:f7c60d3e7b8a 5375 ssl->out_iv = ssl->out_buf + 13;
maclobdell 0:f7c60d3e7b8a 5376 ssl->out_msg = ssl->out_buf + 13;
maclobdell 0:f7c60d3e7b8a 5377
maclobdell 0:f7c60d3e7b8a 5378 ssl->in_ctr = ssl->in_buf;
maclobdell 0:f7c60d3e7b8a 5379 ssl->in_hdr = ssl->in_buf + 8;
maclobdell 0:f7c60d3e7b8a 5380 ssl->in_len = ssl->in_buf + 11;
maclobdell 0:f7c60d3e7b8a 5381 ssl->in_iv = ssl->in_buf + 13;
maclobdell 0:f7c60d3e7b8a 5382 ssl->in_msg = ssl->in_buf + 13;
maclobdell 0:f7c60d3e7b8a 5383 }
maclobdell 0:f7c60d3e7b8a 5384
maclobdell 0:f7c60d3e7b8a 5385 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 5386 return( ret );
maclobdell 0:f7c60d3e7b8a 5387
maclobdell 0:f7c60d3e7b8a 5388 return( 0 );
maclobdell 0:f7c60d3e7b8a 5389 }
maclobdell 0:f7c60d3e7b8a 5390
maclobdell 0:f7c60d3e7b8a 5391 /*
maclobdell 0:f7c60d3e7b8a 5392 * Reset an initialized and used SSL context for re-use while retaining
maclobdell 0:f7c60d3e7b8a 5393 * all application-set variables, function pointers and data.
maclobdell 0:f7c60d3e7b8a 5394 *
maclobdell 0:f7c60d3e7b8a 5395 * If partial is non-zero, keep data in the input buffer and client ID.
maclobdell 0:f7c60d3e7b8a 5396 * (Use when a DTLS client reconnects from the same port.)
maclobdell 0:f7c60d3e7b8a 5397 */
maclobdell 0:f7c60d3e7b8a 5398 static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial )
maclobdell 0:f7c60d3e7b8a 5399 {
maclobdell 0:f7c60d3e7b8a 5400 int ret;
maclobdell 0:f7c60d3e7b8a 5401
maclobdell 0:f7c60d3e7b8a 5402 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
maclobdell 0:f7c60d3e7b8a 5403
maclobdell 0:f7c60d3e7b8a 5404 /* Cancel any possibly running timer */
maclobdell 0:f7c60d3e7b8a 5405 ssl_set_timer( ssl, 0 );
maclobdell 0:f7c60d3e7b8a 5406
maclobdell 0:f7c60d3e7b8a 5407 #if defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 5408 ssl->renego_status = MBEDTLS_SSL_INITIAL_HANDSHAKE;
maclobdell 0:f7c60d3e7b8a 5409 ssl->renego_records_seen = 0;
maclobdell 0:f7c60d3e7b8a 5410
maclobdell 0:f7c60d3e7b8a 5411 ssl->verify_data_len = 0;
maclobdell 0:f7c60d3e7b8a 5412 memset( ssl->own_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
maclobdell 0:f7c60d3e7b8a 5413 memset( ssl->peer_verify_data, 0, MBEDTLS_SSL_VERIFY_DATA_MAX_LEN );
maclobdell 0:f7c60d3e7b8a 5414 #endif
maclobdell 0:f7c60d3e7b8a 5415 ssl->secure_renegotiation = MBEDTLS_SSL_LEGACY_RENEGOTIATION;
maclobdell 0:f7c60d3e7b8a 5416
maclobdell 0:f7c60d3e7b8a 5417 ssl->in_offt = NULL;
maclobdell 0:f7c60d3e7b8a 5418
maclobdell 0:f7c60d3e7b8a 5419 ssl->in_msg = ssl->in_buf + 13;
maclobdell 0:f7c60d3e7b8a 5420 ssl->in_msgtype = 0;
maclobdell 0:f7c60d3e7b8a 5421 ssl->in_msglen = 0;
maclobdell 0:f7c60d3e7b8a 5422 if( partial == 0 )
maclobdell 0:f7c60d3e7b8a 5423 ssl->in_left = 0;
maclobdell 0:f7c60d3e7b8a 5424 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 5425 ssl->next_record_offset = 0;
maclobdell 0:f7c60d3e7b8a 5426 ssl->in_epoch = 0;
maclobdell 0:f7c60d3e7b8a 5427 #endif
maclobdell 0:f7c60d3e7b8a 5428 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
maclobdell 0:f7c60d3e7b8a 5429 ssl_dtls_replay_reset( ssl );
maclobdell 0:f7c60d3e7b8a 5430 #endif
maclobdell 0:f7c60d3e7b8a 5431
maclobdell 0:f7c60d3e7b8a 5432 ssl->in_hslen = 0;
maclobdell 0:f7c60d3e7b8a 5433 ssl->nb_zero = 0;
maclobdell 0:f7c60d3e7b8a 5434 ssl->record_read = 0;
maclobdell 0:f7c60d3e7b8a 5435
maclobdell 0:f7c60d3e7b8a 5436 ssl->out_msg = ssl->out_buf + 13;
maclobdell 0:f7c60d3e7b8a 5437 ssl->out_msgtype = 0;
maclobdell 0:f7c60d3e7b8a 5438 ssl->out_msglen = 0;
maclobdell 0:f7c60d3e7b8a 5439 ssl->out_left = 0;
maclobdell 0:f7c60d3e7b8a 5440 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
maclobdell 0:f7c60d3e7b8a 5441 if( ssl->split_done != MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED )
maclobdell 0:f7c60d3e7b8a 5442 ssl->split_done = 0;
maclobdell 0:f7c60d3e7b8a 5443 #endif
maclobdell 0:f7c60d3e7b8a 5444
maclobdell 0:f7c60d3e7b8a 5445 ssl->transform_in = NULL;
maclobdell 0:f7c60d3e7b8a 5446 ssl->transform_out = NULL;
maclobdell 0:f7c60d3e7b8a 5447
maclobdell 0:f7c60d3e7b8a 5448 memset( ssl->out_buf, 0, MBEDTLS_SSL_BUFFER_LEN );
maclobdell 0:f7c60d3e7b8a 5449 if( partial == 0 )
maclobdell 0:f7c60d3e7b8a 5450 memset( ssl->in_buf, 0, MBEDTLS_SSL_BUFFER_LEN );
maclobdell 0:f7c60d3e7b8a 5451
maclobdell 0:f7c60d3e7b8a 5452 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
maclobdell 0:f7c60d3e7b8a 5453 if( mbedtls_ssl_hw_record_reset != NULL )
maclobdell 0:f7c60d3e7b8a 5454 {
maclobdell 0:f7c60d3e7b8a 5455 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_reset()" ) );
maclobdell 0:f7c60d3e7b8a 5456 if( ( ret = mbedtls_ssl_hw_record_reset( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 5457 {
maclobdell 0:f7c60d3e7b8a 5458 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_hw_record_reset", ret );
maclobdell 0:f7c60d3e7b8a 5459 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
maclobdell 0:f7c60d3e7b8a 5460 }
maclobdell 0:f7c60d3e7b8a 5461 }
maclobdell 0:f7c60d3e7b8a 5462 #endif
maclobdell 0:f7c60d3e7b8a 5463
maclobdell 0:f7c60d3e7b8a 5464 if( ssl->transform )
maclobdell 0:f7c60d3e7b8a 5465 {
maclobdell 0:f7c60d3e7b8a 5466 mbedtls_ssl_transform_free( ssl->transform );
maclobdell 0:f7c60d3e7b8a 5467 mbedtls_free( ssl->transform );
maclobdell 0:f7c60d3e7b8a 5468 ssl->transform = NULL;
maclobdell 0:f7c60d3e7b8a 5469 }
maclobdell 0:f7c60d3e7b8a 5470
maclobdell 0:f7c60d3e7b8a 5471 if( ssl->session )
maclobdell 0:f7c60d3e7b8a 5472 {
maclobdell 0:f7c60d3e7b8a 5473 mbedtls_ssl_session_free( ssl->session );
maclobdell 0:f7c60d3e7b8a 5474 mbedtls_free( ssl->session );
maclobdell 0:f7c60d3e7b8a 5475 ssl->session = NULL;
maclobdell 0:f7c60d3e7b8a 5476 }
maclobdell 0:f7c60d3e7b8a 5477
maclobdell 0:f7c60d3e7b8a 5478 #if defined(MBEDTLS_SSL_ALPN)
maclobdell 0:f7c60d3e7b8a 5479 ssl->alpn_chosen = NULL;
maclobdell 0:f7c60d3e7b8a 5480 #endif
maclobdell 0:f7c60d3e7b8a 5481
maclobdell 0:f7c60d3e7b8a 5482 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 5483 if( partial == 0 )
maclobdell 0:f7c60d3e7b8a 5484 {
maclobdell 0:f7c60d3e7b8a 5485 mbedtls_free( ssl->cli_id );
maclobdell 0:f7c60d3e7b8a 5486 ssl->cli_id = NULL;
maclobdell 0:f7c60d3e7b8a 5487 ssl->cli_id_len = 0;
maclobdell 0:f7c60d3e7b8a 5488 }
maclobdell 0:f7c60d3e7b8a 5489 #endif
maclobdell 0:f7c60d3e7b8a 5490
maclobdell 0:f7c60d3e7b8a 5491 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 5492 return( ret );
maclobdell 0:f7c60d3e7b8a 5493
maclobdell 0:f7c60d3e7b8a 5494 return( 0 );
maclobdell 0:f7c60d3e7b8a 5495 }
maclobdell 0:f7c60d3e7b8a 5496
maclobdell 0:f7c60d3e7b8a 5497 /*
maclobdell 0:f7c60d3e7b8a 5498 * Reset an initialized and used SSL context for re-use while retaining
maclobdell 0:f7c60d3e7b8a 5499 * all application-set variables, function pointers and data.
maclobdell 0:f7c60d3e7b8a 5500 */
maclobdell 0:f7c60d3e7b8a 5501 int mbedtls_ssl_session_reset( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 5502 {
maclobdell 0:f7c60d3e7b8a 5503 return( ssl_session_reset_int( ssl, 0 ) );
maclobdell 0:f7c60d3e7b8a 5504 }
maclobdell 0:f7c60d3e7b8a 5505
maclobdell 0:f7c60d3e7b8a 5506 /*
maclobdell 0:f7c60d3e7b8a 5507 * SSL set accessors
maclobdell 0:f7c60d3e7b8a 5508 */
maclobdell 0:f7c60d3e7b8a 5509 void mbedtls_ssl_conf_endpoint( mbedtls_ssl_config *conf, int endpoint )
maclobdell 0:f7c60d3e7b8a 5510 {
maclobdell 0:f7c60d3e7b8a 5511 conf->endpoint = endpoint;
maclobdell 0:f7c60d3e7b8a 5512 }
maclobdell 0:f7c60d3e7b8a 5513
maclobdell 0:f7c60d3e7b8a 5514 void mbedtls_ssl_conf_transport( mbedtls_ssl_config *conf, int transport )
maclobdell 0:f7c60d3e7b8a 5515 {
maclobdell 0:f7c60d3e7b8a 5516 conf->transport = transport;
maclobdell 0:f7c60d3e7b8a 5517 }
maclobdell 0:f7c60d3e7b8a 5518
maclobdell 0:f7c60d3e7b8a 5519 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
maclobdell 0:f7c60d3e7b8a 5520 void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
maclobdell 0:f7c60d3e7b8a 5521 {
maclobdell 0:f7c60d3e7b8a 5522 conf->anti_replay = mode;
maclobdell 0:f7c60d3e7b8a 5523 }
maclobdell 0:f7c60d3e7b8a 5524 #endif
maclobdell 0:f7c60d3e7b8a 5525
maclobdell 0:f7c60d3e7b8a 5526 #if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
maclobdell 0:f7c60d3e7b8a 5527 void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
maclobdell 0:f7c60d3e7b8a 5528 {
maclobdell 0:f7c60d3e7b8a 5529 conf->badmac_limit = limit;
maclobdell 0:f7c60d3e7b8a 5530 }
maclobdell 0:f7c60d3e7b8a 5531 #endif
maclobdell 0:f7c60d3e7b8a 5532
maclobdell 0:f7c60d3e7b8a 5533 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 5534 void mbedtls_ssl_conf_handshake_timeout( mbedtls_ssl_config *conf, uint32_t min, uint32_t max )
maclobdell 0:f7c60d3e7b8a 5535 {
maclobdell 0:f7c60d3e7b8a 5536 conf->hs_timeout_min = min;
maclobdell 0:f7c60d3e7b8a 5537 conf->hs_timeout_max = max;
maclobdell 0:f7c60d3e7b8a 5538 }
maclobdell 0:f7c60d3e7b8a 5539 #endif
maclobdell 0:f7c60d3e7b8a 5540
maclobdell 0:f7c60d3e7b8a 5541 void mbedtls_ssl_conf_authmode( mbedtls_ssl_config *conf, int authmode )
maclobdell 0:f7c60d3e7b8a 5542 {
maclobdell 0:f7c60d3e7b8a 5543 conf->authmode = authmode;
maclobdell 0:f7c60d3e7b8a 5544 }
maclobdell 0:f7c60d3e7b8a 5545
maclobdell 0:f7c60d3e7b8a 5546 #if defined(MBEDTLS_X509_CRT_PARSE_C)
maclobdell 0:f7c60d3e7b8a 5547 void mbedtls_ssl_conf_verify( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5548 int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
maclobdell 0:f7c60d3e7b8a 5549 void *p_vrfy )
maclobdell 0:f7c60d3e7b8a 5550 {
maclobdell 0:f7c60d3e7b8a 5551 conf->f_vrfy = f_vrfy;
maclobdell 0:f7c60d3e7b8a 5552 conf->p_vrfy = p_vrfy;
maclobdell 0:f7c60d3e7b8a 5553 }
maclobdell 0:f7c60d3e7b8a 5554 #endif /* MBEDTLS_X509_CRT_PARSE_C */
maclobdell 0:f7c60d3e7b8a 5555
maclobdell 0:f7c60d3e7b8a 5556 void mbedtls_ssl_conf_rng( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5557 int (*f_rng)(void *, unsigned char *, size_t),
maclobdell 0:f7c60d3e7b8a 5558 void *p_rng )
maclobdell 0:f7c60d3e7b8a 5559 {
maclobdell 0:f7c60d3e7b8a 5560 conf->f_rng = f_rng;
maclobdell 0:f7c60d3e7b8a 5561 conf->p_rng = p_rng;
maclobdell 0:f7c60d3e7b8a 5562 }
maclobdell 0:f7c60d3e7b8a 5563
maclobdell 0:f7c60d3e7b8a 5564 void mbedtls_ssl_conf_dbg( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5565 void (*f_dbg)(void *, int, const char *, int, const char *),
maclobdell 0:f7c60d3e7b8a 5566 void *p_dbg )
maclobdell 0:f7c60d3e7b8a 5567 {
maclobdell 0:f7c60d3e7b8a 5568 conf->f_dbg = f_dbg;
maclobdell 0:f7c60d3e7b8a 5569 conf->p_dbg = p_dbg;
maclobdell 0:f7c60d3e7b8a 5570 }
maclobdell 0:f7c60d3e7b8a 5571
maclobdell 0:f7c60d3e7b8a 5572 void mbedtls_ssl_set_bio( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 5573 void *p_bio,
maclobdell 0:f7c60d3e7b8a 5574 int (*f_send)(void *, const unsigned char *, size_t),
maclobdell 0:f7c60d3e7b8a 5575 int (*f_recv)(void *, unsigned char *, size_t),
maclobdell 0:f7c60d3e7b8a 5576 int (*f_recv_timeout)(void *, unsigned char *, size_t, uint32_t) )
maclobdell 0:f7c60d3e7b8a 5577 {
maclobdell 0:f7c60d3e7b8a 5578 ssl->p_bio = p_bio;
maclobdell 0:f7c60d3e7b8a 5579 ssl->f_send = f_send;
maclobdell 0:f7c60d3e7b8a 5580 ssl->f_recv = f_recv;
maclobdell 0:f7c60d3e7b8a 5581 ssl->f_recv_timeout = f_recv_timeout;
maclobdell 0:f7c60d3e7b8a 5582 }
maclobdell 0:f7c60d3e7b8a 5583
maclobdell 0:f7c60d3e7b8a 5584 void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout )
maclobdell 0:f7c60d3e7b8a 5585 {
maclobdell 0:f7c60d3e7b8a 5586 conf->read_timeout = timeout;
maclobdell 0:f7c60d3e7b8a 5587 }
maclobdell 0:f7c60d3e7b8a 5588
maclobdell 0:f7c60d3e7b8a 5589 void mbedtls_ssl_set_timer_cb( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 5590 void *p_timer,
maclobdell 0:f7c60d3e7b8a 5591 void (*f_set_timer)(void *, uint32_t int_ms, uint32_t fin_ms),
maclobdell 0:f7c60d3e7b8a 5592 int (*f_get_timer)(void *) )
maclobdell 0:f7c60d3e7b8a 5593 {
maclobdell 0:f7c60d3e7b8a 5594 ssl->p_timer = p_timer;
maclobdell 0:f7c60d3e7b8a 5595 ssl->f_set_timer = f_set_timer;
maclobdell 0:f7c60d3e7b8a 5596 ssl->f_get_timer = f_get_timer;
maclobdell 0:f7c60d3e7b8a 5597
maclobdell 0:f7c60d3e7b8a 5598 /* Make sure we start with no timer running */
maclobdell 0:f7c60d3e7b8a 5599 ssl_set_timer( ssl, 0 );
maclobdell 0:f7c60d3e7b8a 5600 }
maclobdell 0:f7c60d3e7b8a 5601
maclobdell 0:f7c60d3e7b8a 5602 #if defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 5603 void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5604 void *p_cache,
maclobdell 0:f7c60d3e7b8a 5605 int (*f_get_cache)(void *, mbedtls_ssl_session *),
maclobdell 0:f7c60d3e7b8a 5606 int (*f_set_cache)(void *, const mbedtls_ssl_session *) )
maclobdell 0:f7c60d3e7b8a 5607 {
maclobdell 0:f7c60d3e7b8a 5608 conf->p_cache = p_cache;
maclobdell 0:f7c60d3e7b8a 5609 conf->f_get_cache = f_get_cache;
maclobdell 0:f7c60d3e7b8a 5610 conf->f_set_cache = f_set_cache;
maclobdell 0:f7c60d3e7b8a 5611 }
maclobdell 0:f7c60d3e7b8a 5612 #endif /* MBEDTLS_SSL_SRV_C */
maclobdell 0:f7c60d3e7b8a 5613
maclobdell 0:f7c60d3e7b8a 5614 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 5615 int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session )
maclobdell 0:f7c60d3e7b8a 5616 {
maclobdell 0:f7c60d3e7b8a 5617 int ret;
maclobdell 0:f7c60d3e7b8a 5618
maclobdell 0:f7c60d3e7b8a 5619 if( ssl == NULL ||
maclobdell 0:f7c60d3e7b8a 5620 session == NULL ||
maclobdell 0:f7c60d3e7b8a 5621 ssl->session_negotiate == NULL ||
maclobdell 0:f7c60d3e7b8a 5622 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 5623 {
maclobdell 0:f7c60d3e7b8a 5624 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 5625 }
maclobdell 0:f7c60d3e7b8a 5626
maclobdell 0:f7c60d3e7b8a 5627 if( ( ret = ssl_session_copy( ssl->session_negotiate, session ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 5628 return( ret );
maclobdell 0:f7c60d3e7b8a 5629
maclobdell 0:f7c60d3e7b8a 5630 ssl->handshake->resume = 1;
maclobdell 0:f7c60d3e7b8a 5631
maclobdell 0:f7c60d3e7b8a 5632 return( 0 );
maclobdell 0:f7c60d3e7b8a 5633 }
maclobdell 0:f7c60d3e7b8a 5634 #endif /* MBEDTLS_SSL_CLI_C */
maclobdell 0:f7c60d3e7b8a 5635
maclobdell 0:f7c60d3e7b8a 5636 void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5637 const int *ciphersuites )
maclobdell 0:f7c60d3e7b8a 5638 {
maclobdell 0:f7c60d3e7b8a 5639 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = ciphersuites;
maclobdell 0:f7c60d3e7b8a 5640 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = ciphersuites;
maclobdell 0:f7c60d3e7b8a 5641 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = ciphersuites;
maclobdell 0:f7c60d3e7b8a 5642 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = ciphersuites;
maclobdell 0:f7c60d3e7b8a 5643 }
maclobdell 0:f7c60d3e7b8a 5644
maclobdell 0:f7c60d3e7b8a 5645 void mbedtls_ssl_conf_ciphersuites_for_version( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5646 const int *ciphersuites,
maclobdell 0:f7c60d3e7b8a 5647 int major, int minor )
maclobdell 0:f7c60d3e7b8a 5648 {
maclobdell 0:f7c60d3e7b8a 5649 if( major != MBEDTLS_SSL_MAJOR_VERSION_3 )
maclobdell 0:f7c60d3e7b8a 5650 return;
maclobdell 0:f7c60d3e7b8a 5651
maclobdell 0:f7c60d3e7b8a 5652 if( minor < MBEDTLS_SSL_MINOR_VERSION_0 || minor > MBEDTLS_SSL_MINOR_VERSION_3 )
maclobdell 0:f7c60d3e7b8a 5653 return;
maclobdell 0:f7c60d3e7b8a 5654
maclobdell 0:f7c60d3e7b8a 5655 conf->ciphersuite_list[minor] = ciphersuites;
maclobdell 0:f7c60d3e7b8a 5656 }
maclobdell 0:f7c60d3e7b8a 5657
maclobdell 0:f7c60d3e7b8a 5658 #if defined(MBEDTLS_X509_CRT_PARSE_C)
maclobdell 0:f7c60d3e7b8a 5659 void mbedtls_ssl_conf_cert_profile( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5660 const mbedtls_x509_crt_profile *profile )
maclobdell 0:f7c60d3e7b8a 5661 {
maclobdell 0:f7c60d3e7b8a 5662 conf->cert_profile = profile;
maclobdell 0:f7c60d3e7b8a 5663 }
maclobdell 0:f7c60d3e7b8a 5664
maclobdell 0:f7c60d3e7b8a 5665 /* Append a new keycert entry to a (possibly empty) list */
maclobdell 0:f7c60d3e7b8a 5666 static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
maclobdell 0:f7c60d3e7b8a 5667 mbedtls_x509_crt *cert,
maclobdell 0:f7c60d3e7b8a 5668 mbedtls_pk_context *key )
maclobdell 0:f7c60d3e7b8a 5669 {
maclobdell 0:f7c60d3e7b8a 5670 mbedtls_ssl_key_cert *new;
maclobdell 0:f7c60d3e7b8a 5671
maclobdell 0:f7c60d3e7b8a 5672 new = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
maclobdell 0:f7c60d3e7b8a 5673 if( new == NULL )
maclobdell 0:f7c60d3e7b8a 5674 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 5675
maclobdell 0:f7c60d3e7b8a 5676 new->cert = cert;
maclobdell 0:f7c60d3e7b8a 5677 new->key = key;
maclobdell 0:f7c60d3e7b8a 5678 new->next = NULL;
maclobdell 0:f7c60d3e7b8a 5679
maclobdell 0:f7c60d3e7b8a 5680 /* Update head is the list was null, else add to the end */
maclobdell 0:f7c60d3e7b8a 5681 if( *head == NULL )
maclobdell 0:f7c60d3e7b8a 5682 {
maclobdell 0:f7c60d3e7b8a 5683 *head = new;
maclobdell 0:f7c60d3e7b8a 5684 }
maclobdell 0:f7c60d3e7b8a 5685 else
maclobdell 0:f7c60d3e7b8a 5686 {
maclobdell 0:f7c60d3e7b8a 5687 mbedtls_ssl_key_cert *cur = *head;
maclobdell 0:f7c60d3e7b8a 5688 while( cur->next != NULL )
maclobdell 0:f7c60d3e7b8a 5689 cur = cur->next;
maclobdell 0:f7c60d3e7b8a 5690 cur->next = new;
maclobdell 0:f7c60d3e7b8a 5691 }
maclobdell 0:f7c60d3e7b8a 5692
maclobdell 0:f7c60d3e7b8a 5693 return( 0 );
maclobdell 0:f7c60d3e7b8a 5694 }
maclobdell 0:f7c60d3e7b8a 5695
maclobdell 0:f7c60d3e7b8a 5696 int mbedtls_ssl_conf_own_cert( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5697 mbedtls_x509_crt *own_cert,
maclobdell 0:f7c60d3e7b8a 5698 mbedtls_pk_context *pk_key )
maclobdell 0:f7c60d3e7b8a 5699 {
maclobdell 0:f7c60d3e7b8a 5700 return( ssl_append_key_cert( &conf->key_cert, own_cert, pk_key ) );
maclobdell 0:f7c60d3e7b8a 5701 }
maclobdell 0:f7c60d3e7b8a 5702
maclobdell 0:f7c60d3e7b8a 5703 void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5704 mbedtls_x509_crt *ca_chain,
maclobdell 0:f7c60d3e7b8a 5705 mbedtls_x509_crl *ca_crl )
maclobdell 0:f7c60d3e7b8a 5706 {
maclobdell 0:f7c60d3e7b8a 5707 conf->ca_chain = ca_chain;
maclobdell 0:f7c60d3e7b8a 5708 conf->ca_crl = ca_crl;
maclobdell 0:f7c60d3e7b8a 5709 }
maclobdell 0:f7c60d3e7b8a 5710 #endif /* MBEDTLS_X509_CRT_PARSE_C */
maclobdell 0:f7c60d3e7b8a 5711
maclobdell 0:f7c60d3e7b8a 5712 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
maclobdell 0:f7c60d3e7b8a 5713 int mbedtls_ssl_set_hs_own_cert( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 5714 mbedtls_x509_crt *own_cert,
maclobdell 0:f7c60d3e7b8a 5715 mbedtls_pk_context *pk_key )
maclobdell 0:f7c60d3e7b8a 5716 {
maclobdell 0:f7c60d3e7b8a 5717 return( ssl_append_key_cert( &ssl->handshake->sni_key_cert,
maclobdell 0:f7c60d3e7b8a 5718 own_cert, pk_key ) );
maclobdell 0:f7c60d3e7b8a 5719 }
maclobdell 0:f7c60d3e7b8a 5720
maclobdell 0:f7c60d3e7b8a 5721 void mbedtls_ssl_set_hs_ca_chain( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 5722 mbedtls_x509_crt *ca_chain,
maclobdell 0:f7c60d3e7b8a 5723 mbedtls_x509_crl *ca_crl )
maclobdell 0:f7c60d3e7b8a 5724 {
maclobdell 0:f7c60d3e7b8a 5725 ssl->handshake->sni_ca_chain = ca_chain;
maclobdell 0:f7c60d3e7b8a 5726 ssl->handshake->sni_ca_crl = ca_crl;
maclobdell 0:f7c60d3e7b8a 5727 }
maclobdell 0:f7c60d3e7b8a 5728
maclobdell 0:f7c60d3e7b8a 5729 void mbedtls_ssl_set_hs_authmode( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 5730 int authmode )
maclobdell 0:f7c60d3e7b8a 5731 {
maclobdell 0:f7c60d3e7b8a 5732 ssl->handshake->sni_authmode = authmode;
maclobdell 0:f7c60d3e7b8a 5733 }
maclobdell 0:f7c60d3e7b8a 5734 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
maclobdell 0:f7c60d3e7b8a 5735
maclobdell 0:f7c60d3e7b8a 5736 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
maclobdell 0:f7c60d3e7b8a 5737 /*
maclobdell 0:f7c60d3e7b8a 5738 * Set EC J-PAKE password for current handshake
maclobdell 0:f7c60d3e7b8a 5739 */
maclobdell 0:f7c60d3e7b8a 5740 int mbedtls_ssl_set_hs_ecjpake_password( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 5741 const unsigned char *pw,
maclobdell 0:f7c60d3e7b8a 5742 size_t pw_len )
maclobdell 0:f7c60d3e7b8a 5743 {
maclobdell 0:f7c60d3e7b8a 5744 mbedtls_ecjpake_role role;
maclobdell 0:f7c60d3e7b8a 5745
maclobdell 0:f7c60d3e7b8a 5746 if( ssl->handshake == NULL && ssl->conf == NULL )
maclobdell 0:f7c60d3e7b8a 5747 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 5748
maclobdell 0:f7c60d3e7b8a 5749 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
maclobdell 0:f7c60d3e7b8a 5750 role = MBEDTLS_ECJPAKE_SERVER;
maclobdell 0:f7c60d3e7b8a 5751 else
maclobdell 0:f7c60d3e7b8a 5752 role = MBEDTLS_ECJPAKE_CLIENT;
maclobdell 0:f7c60d3e7b8a 5753
maclobdell 0:f7c60d3e7b8a 5754 return( mbedtls_ecjpake_setup( &ssl->handshake->ecjpake_ctx,
maclobdell 0:f7c60d3e7b8a 5755 role,
maclobdell 0:f7c60d3e7b8a 5756 MBEDTLS_MD_SHA256,
maclobdell 0:f7c60d3e7b8a 5757 MBEDTLS_ECP_DP_SECP256R1,
maclobdell 0:f7c60d3e7b8a 5758 pw, pw_len ) );
maclobdell 0:f7c60d3e7b8a 5759 }
maclobdell 0:f7c60d3e7b8a 5760 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
maclobdell 0:f7c60d3e7b8a 5761
maclobdell 0:f7c60d3e7b8a 5762 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
maclobdell 0:f7c60d3e7b8a 5763 int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5764 const unsigned char *psk, size_t psk_len,
maclobdell 0:f7c60d3e7b8a 5765 const unsigned char *psk_identity, size_t psk_identity_len )
maclobdell 0:f7c60d3e7b8a 5766 {
maclobdell 0:f7c60d3e7b8a 5767 if( psk == NULL || psk_identity == NULL )
maclobdell 0:f7c60d3e7b8a 5768 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 5769
maclobdell 0:f7c60d3e7b8a 5770 if( psk_len > MBEDTLS_PSK_MAX_LEN )
maclobdell 0:f7c60d3e7b8a 5771 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 5772
maclobdell 0:f7c60d3e7b8a 5773 /* Identity len will be encoded on two bytes */
maclobdell 0:f7c60d3e7b8a 5774 if( ( psk_identity_len >> 16 ) != 0 ||
maclobdell 0:f7c60d3e7b8a 5775 psk_identity_len > MBEDTLS_SSL_MAX_CONTENT_LEN )
maclobdell 0:f7c60d3e7b8a 5776 {
maclobdell 0:f7c60d3e7b8a 5777 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 5778 }
maclobdell 0:f7c60d3e7b8a 5779
maclobdell 0:f7c60d3e7b8a 5780 if( conf->psk != NULL || conf->psk_identity != NULL )
maclobdell 0:f7c60d3e7b8a 5781 {
maclobdell 0:f7c60d3e7b8a 5782 mbedtls_free( conf->psk );
maclobdell 0:f7c60d3e7b8a 5783 mbedtls_free( conf->psk_identity );
maclobdell 0:f7c60d3e7b8a 5784 conf->psk = NULL;
maclobdell 0:f7c60d3e7b8a 5785 conf->psk_identity = NULL;
maclobdell 0:f7c60d3e7b8a 5786 }
maclobdell 0:f7c60d3e7b8a 5787
maclobdell 0:f7c60d3e7b8a 5788 if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
maclobdell 0:f7c60d3e7b8a 5789 ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
maclobdell 0:f7c60d3e7b8a 5790 {
maclobdell 0:f7c60d3e7b8a 5791 mbedtls_free( conf->psk );
maclobdell 0:f7c60d3e7b8a 5792 mbedtls_free( conf->psk_identity );
maclobdell 0:f7c60d3e7b8a 5793 conf->psk = NULL;
maclobdell 0:f7c60d3e7b8a 5794 conf->psk_identity = NULL;
maclobdell 0:f7c60d3e7b8a 5795 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 5796 }
maclobdell 0:f7c60d3e7b8a 5797
maclobdell 0:f7c60d3e7b8a 5798 conf->psk_len = psk_len;
maclobdell 0:f7c60d3e7b8a 5799 conf->psk_identity_len = psk_identity_len;
maclobdell 0:f7c60d3e7b8a 5800
maclobdell 0:f7c60d3e7b8a 5801 memcpy( conf->psk, psk, conf->psk_len );
maclobdell 0:f7c60d3e7b8a 5802 memcpy( conf->psk_identity, psk_identity, conf->psk_identity_len );
maclobdell 0:f7c60d3e7b8a 5803
maclobdell 0:f7c60d3e7b8a 5804 return( 0 );
maclobdell 0:f7c60d3e7b8a 5805 }
maclobdell 0:f7c60d3e7b8a 5806
maclobdell 0:f7c60d3e7b8a 5807 int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 5808 const unsigned char *psk, size_t psk_len )
maclobdell 0:f7c60d3e7b8a 5809 {
maclobdell 0:f7c60d3e7b8a 5810 if( psk == NULL || ssl->handshake == NULL )
maclobdell 0:f7c60d3e7b8a 5811 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 5812
maclobdell 0:f7c60d3e7b8a 5813 if( psk_len > MBEDTLS_PSK_MAX_LEN )
maclobdell 0:f7c60d3e7b8a 5814 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 5815
maclobdell 0:f7c60d3e7b8a 5816 if( ssl->handshake->psk != NULL )
maclobdell 0:f7c60d3e7b8a 5817 mbedtls_free( ssl->handshake->psk );
maclobdell 0:f7c60d3e7b8a 5818
maclobdell 0:f7c60d3e7b8a 5819 if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
maclobdell 0:f7c60d3e7b8a 5820 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 5821
maclobdell 0:f7c60d3e7b8a 5822 ssl->handshake->psk_len = psk_len;
maclobdell 0:f7c60d3e7b8a 5823 memcpy( ssl->handshake->psk, psk, ssl->handshake->psk_len );
maclobdell 0:f7c60d3e7b8a 5824
maclobdell 0:f7c60d3e7b8a 5825 return( 0 );
maclobdell 0:f7c60d3e7b8a 5826 }
maclobdell 0:f7c60d3e7b8a 5827
maclobdell 0:f7c60d3e7b8a 5828 void mbedtls_ssl_conf_psk_cb( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5829 int (*f_psk)(void *, mbedtls_ssl_context *, const unsigned char *,
maclobdell 0:f7c60d3e7b8a 5830 size_t),
maclobdell 0:f7c60d3e7b8a 5831 void *p_psk )
maclobdell 0:f7c60d3e7b8a 5832 {
maclobdell 0:f7c60d3e7b8a 5833 conf->f_psk = f_psk;
maclobdell 0:f7c60d3e7b8a 5834 conf->p_psk = p_psk;
maclobdell 0:f7c60d3e7b8a 5835 }
maclobdell 0:f7c60d3e7b8a 5836 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
maclobdell 0:f7c60d3e7b8a 5837
maclobdell 0:f7c60d3e7b8a 5838 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 5839 int mbedtls_ssl_conf_dh_param( mbedtls_ssl_config *conf, const char *dhm_P, const char *dhm_G )
maclobdell 0:f7c60d3e7b8a 5840 {
maclobdell 0:f7c60d3e7b8a 5841 int ret;
maclobdell 0:f7c60d3e7b8a 5842
maclobdell 0:f7c60d3e7b8a 5843 if( ( ret = mbedtls_mpi_read_string( &conf->dhm_P, 16, dhm_P ) ) != 0 ||
maclobdell 0:f7c60d3e7b8a 5844 ( ret = mbedtls_mpi_read_string( &conf->dhm_G, 16, dhm_G ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 5845 {
maclobdell 0:f7c60d3e7b8a 5846 mbedtls_mpi_free( &conf->dhm_P );
maclobdell 0:f7c60d3e7b8a 5847 mbedtls_mpi_free( &conf->dhm_G );
maclobdell 0:f7c60d3e7b8a 5848 return( ret );
maclobdell 0:f7c60d3e7b8a 5849 }
maclobdell 0:f7c60d3e7b8a 5850
maclobdell 0:f7c60d3e7b8a 5851 return( 0 );
maclobdell 0:f7c60d3e7b8a 5852 }
maclobdell 0:f7c60d3e7b8a 5853
maclobdell 0:f7c60d3e7b8a 5854 int mbedtls_ssl_conf_dh_param_ctx( mbedtls_ssl_config *conf, mbedtls_dhm_context *dhm_ctx )
maclobdell 0:f7c60d3e7b8a 5855 {
maclobdell 0:f7c60d3e7b8a 5856 int ret;
maclobdell 0:f7c60d3e7b8a 5857
maclobdell 0:f7c60d3e7b8a 5858 if( ( ret = mbedtls_mpi_copy( &conf->dhm_P, &dhm_ctx->P ) ) != 0 ||
maclobdell 0:f7c60d3e7b8a 5859 ( ret = mbedtls_mpi_copy( &conf->dhm_G, &dhm_ctx->G ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 5860 {
maclobdell 0:f7c60d3e7b8a 5861 mbedtls_mpi_free( &conf->dhm_P );
maclobdell 0:f7c60d3e7b8a 5862 mbedtls_mpi_free( &conf->dhm_G );
maclobdell 0:f7c60d3e7b8a 5863 return( ret );
maclobdell 0:f7c60d3e7b8a 5864 }
maclobdell 0:f7c60d3e7b8a 5865
maclobdell 0:f7c60d3e7b8a 5866 return( 0 );
maclobdell 0:f7c60d3e7b8a 5867 }
maclobdell 0:f7c60d3e7b8a 5868 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_SRV_C */
maclobdell 0:f7c60d3e7b8a 5869
maclobdell 0:f7c60d3e7b8a 5870 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 5871 /*
maclobdell 0:f7c60d3e7b8a 5872 * Set the minimum length for Diffie-Hellman parameters
maclobdell 0:f7c60d3e7b8a 5873 */
maclobdell 0:f7c60d3e7b8a 5874 void mbedtls_ssl_conf_dhm_min_bitlen( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5875 unsigned int bitlen )
maclobdell 0:f7c60d3e7b8a 5876 {
maclobdell 0:f7c60d3e7b8a 5877 conf->dhm_min_bitlen = bitlen;
maclobdell 0:f7c60d3e7b8a 5878 }
maclobdell 0:f7c60d3e7b8a 5879 #endif /* MBEDTLS_DHM_C && MBEDTLS_SSL_CLI_C */
maclobdell 0:f7c60d3e7b8a 5880
maclobdell 0:f7c60d3e7b8a 5881 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
maclobdell 0:f7c60d3e7b8a 5882 /*
maclobdell 0:f7c60d3e7b8a 5883 * Set allowed/preferred hashes for handshake signatures
maclobdell 0:f7c60d3e7b8a 5884 */
maclobdell 0:f7c60d3e7b8a 5885 void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5886 const int *hashes )
maclobdell 0:f7c60d3e7b8a 5887 {
maclobdell 0:f7c60d3e7b8a 5888 conf->sig_hashes = hashes;
maclobdell 0:f7c60d3e7b8a 5889 }
maclobdell 0:f7c60d3e7b8a 5890 #endif
maclobdell 0:f7c60d3e7b8a 5891
maclobdell 0:f7c60d3e7b8a 5892 #if defined(MBEDTLS_ECP_C)
maclobdell 0:f7c60d3e7b8a 5893 /*
maclobdell 0:f7c60d3e7b8a 5894 * Set the allowed elliptic curves
maclobdell 0:f7c60d3e7b8a 5895 */
maclobdell 0:f7c60d3e7b8a 5896 void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5897 const mbedtls_ecp_group_id *curve_list )
maclobdell 0:f7c60d3e7b8a 5898 {
maclobdell 0:f7c60d3e7b8a 5899 conf->curve_list = curve_list;
maclobdell 0:f7c60d3e7b8a 5900 }
maclobdell 0:f7c60d3e7b8a 5901 #endif
maclobdell 0:f7c60d3e7b8a 5902
maclobdell 0:f7c60d3e7b8a 5903 #if defined(MBEDTLS_X509_CRT_PARSE_C)
maclobdell 0:f7c60d3e7b8a 5904 int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
maclobdell 0:f7c60d3e7b8a 5905 {
maclobdell 0:f7c60d3e7b8a 5906 size_t hostname_len;
maclobdell 0:f7c60d3e7b8a 5907
maclobdell 0:f7c60d3e7b8a 5908 if( hostname == NULL )
maclobdell 0:f7c60d3e7b8a 5909 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 5910
maclobdell 0:f7c60d3e7b8a 5911 hostname_len = strlen( hostname );
maclobdell 0:f7c60d3e7b8a 5912
maclobdell 0:f7c60d3e7b8a 5913 if( hostname_len + 1 == 0 )
maclobdell 0:f7c60d3e7b8a 5914 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 5915
maclobdell 0:f7c60d3e7b8a 5916 if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
maclobdell 0:f7c60d3e7b8a 5917 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 5918
maclobdell 0:f7c60d3e7b8a 5919 ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
maclobdell 0:f7c60d3e7b8a 5920
maclobdell 0:f7c60d3e7b8a 5921 if( ssl->hostname == NULL )
maclobdell 0:f7c60d3e7b8a 5922 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
maclobdell 0:f7c60d3e7b8a 5923
maclobdell 0:f7c60d3e7b8a 5924 memcpy( ssl->hostname, hostname, hostname_len );
maclobdell 0:f7c60d3e7b8a 5925
maclobdell 0:f7c60d3e7b8a 5926 ssl->hostname[hostname_len] = '\0';
maclobdell 0:f7c60d3e7b8a 5927
maclobdell 0:f7c60d3e7b8a 5928 return( 0 );
maclobdell 0:f7c60d3e7b8a 5929 }
maclobdell 0:f7c60d3e7b8a 5930 #endif
maclobdell 0:f7c60d3e7b8a 5931
maclobdell 0:f7c60d3e7b8a 5932 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
maclobdell 0:f7c60d3e7b8a 5933 void mbedtls_ssl_conf_sni( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 5934 int (*f_sni)(void *, mbedtls_ssl_context *,
maclobdell 0:f7c60d3e7b8a 5935 const unsigned char *, size_t),
maclobdell 0:f7c60d3e7b8a 5936 void *p_sni )
maclobdell 0:f7c60d3e7b8a 5937 {
maclobdell 0:f7c60d3e7b8a 5938 conf->f_sni = f_sni;
maclobdell 0:f7c60d3e7b8a 5939 conf->p_sni = p_sni;
maclobdell 0:f7c60d3e7b8a 5940 }
maclobdell 0:f7c60d3e7b8a 5941 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
maclobdell 0:f7c60d3e7b8a 5942
maclobdell 0:f7c60d3e7b8a 5943 #if defined(MBEDTLS_SSL_ALPN)
maclobdell 0:f7c60d3e7b8a 5944 int mbedtls_ssl_conf_alpn_protocols( mbedtls_ssl_config *conf, const char **protos )
maclobdell 0:f7c60d3e7b8a 5945 {
maclobdell 0:f7c60d3e7b8a 5946 size_t cur_len, tot_len;
maclobdell 0:f7c60d3e7b8a 5947 const char **p;
maclobdell 0:f7c60d3e7b8a 5948
maclobdell 0:f7c60d3e7b8a 5949 /*
maclobdell 0:f7c60d3e7b8a 5950 * "Empty strings MUST NOT be included and byte strings MUST NOT be
maclobdell 0:f7c60d3e7b8a 5951 * truncated". Check lengths now rather than later.
maclobdell 0:f7c60d3e7b8a 5952 */
maclobdell 0:f7c60d3e7b8a 5953 tot_len = 0;
maclobdell 0:f7c60d3e7b8a 5954 for( p = protos; *p != NULL; p++ )
maclobdell 0:f7c60d3e7b8a 5955 {
maclobdell 0:f7c60d3e7b8a 5956 cur_len = strlen( *p );
maclobdell 0:f7c60d3e7b8a 5957 tot_len += cur_len;
maclobdell 0:f7c60d3e7b8a 5958
maclobdell 0:f7c60d3e7b8a 5959 if( cur_len == 0 || cur_len > 255 || tot_len > 65535 )
maclobdell 0:f7c60d3e7b8a 5960 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 5961 }
maclobdell 0:f7c60d3e7b8a 5962
maclobdell 0:f7c60d3e7b8a 5963 conf->alpn_list = protos;
maclobdell 0:f7c60d3e7b8a 5964
maclobdell 0:f7c60d3e7b8a 5965 return( 0 );
maclobdell 0:f7c60d3e7b8a 5966 }
maclobdell 0:f7c60d3e7b8a 5967
maclobdell 0:f7c60d3e7b8a 5968 const char *mbedtls_ssl_get_alpn_protocol( const mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 5969 {
maclobdell 0:f7c60d3e7b8a 5970 return( ssl->alpn_chosen );
maclobdell 0:f7c60d3e7b8a 5971 }
maclobdell 0:f7c60d3e7b8a 5972 #endif /* MBEDTLS_SSL_ALPN */
maclobdell 0:f7c60d3e7b8a 5973
maclobdell 0:f7c60d3e7b8a 5974 void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor )
maclobdell 0:f7c60d3e7b8a 5975 {
maclobdell 0:f7c60d3e7b8a 5976 conf->max_major_ver = major;
maclobdell 0:f7c60d3e7b8a 5977 conf->max_minor_ver = minor;
maclobdell 0:f7c60d3e7b8a 5978 }
maclobdell 0:f7c60d3e7b8a 5979
maclobdell 0:f7c60d3e7b8a 5980 void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor )
maclobdell 0:f7c60d3e7b8a 5981 {
maclobdell 0:f7c60d3e7b8a 5982 conf->min_major_ver = major;
maclobdell 0:f7c60d3e7b8a 5983 conf->min_minor_ver = minor;
maclobdell 0:f7c60d3e7b8a 5984 }
maclobdell 0:f7c60d3e7b8a 5985
maclobdell 0:f7c60d3e7b8a 5986 #if defined(MBEDTLS_SSL_FALLBACK_SCSV) && defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 5987 void mbedtls_ssl_conf_fallback( mbedtls_ssl_config *conf, char fallback )
maclobdell 0:f7c60d3e7b8a 5988 {
maclobdell 0:f7c60d3e7b8a 5989 conf->fallback = fallback;
maclobdell 0:f7c60d3e7b8a 5990 }
maclobdell 0:f7c60d3e7b8a 5991 #endif
maclobdell 0:f7c60d3e7b8a 5992
maclobdell 0:f7c60d3e7b8a 5993 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
maclobdell 0:f7c60d3e7b8a 5994 void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm )
maclobdell 0:f7c60d3e7b8a 5995 {
maclobdell 0:f7c60d3e7b8a 5996 conf->encrypt_then_mac = etm;
maclobdell 0:f7c60d3e7b8a 5997 }
maclobdell 0:f7c60d3e7b8a 5998 #endif
maclobdell 0:f7c60d3e7b8a 5999
maclobdell 0:f7c60d3e7b8a 6000 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
maclobdell 0:f7c60d3e7b8a 6001 void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems )
maclobdell 0:f7c60d3e7b8a 6002 {
maclobdell 0:f7c60d3e7b8a 6003 conf->extended_ms = ems;
maclobdell 0:f7c60d3e7b8a 6004 }
maclobdell 0:f7c60d3e7b8a 6005 #endif
maclobdell 0:f7c60d3e7b8a 6006
maclobdell 0:f7c60d3e7b8a 6007 #if defined(MBEDTLS_ARC4_C)
maclobdell 0:f7c60d3e7b8a 6008 void mbedtls_ssl_conf_arc4_support( mbedtls_ssl_config *conf, char arc4 )
maclobdell 0:f7c60d3e7b8a 6009 {
maclobdell 0:f7c60d3e7b8a 6010 conf->arc4_disabled = arc4;
maclobdell 0:f7c60d3e7b8a 6011 }
maclobdell 0:f7c60d3e7b8a 6012 #endif
maclobdell 0:f7c60d3e7b8a 6013
maclobdell 0:f7c60d3e7b8a 6014 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
maclobdell 0:f7c60d3e7b8a 6015 int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code )
maclobdell 0:f7c60d3e7b8a 6016 {
maclobdell 0:f7c60d3e7b8a 6017 if( mfl_code >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ||
maclobdell 0:f7c60d3e7b8a 6018 mfl_code_to_length[mfl_code] > MBEDTLS_SSL_MAX_CONTENT_LEN )
maclobdell 0:f7c60d3e7b8a 6019 {
maclobdell 0:f7c60d3e7b8a 6020 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 6021 }
maclobdell 0:f7c60d3e7b8a 6022
maclobdell 0:f7c60d3e7b8a 6023 conf->mfl_code = mfl_code;
maclobdell 0:f7c60d3e7b8a 6024
maclobdell 0:f7c60d3e7b8a 6025 return( 0 );
maclobdell 0:f7c60d3e7b8a 6026 }
maclobdell 0:f7c60d3e7b8a 6027 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
maclobdell 0:f7c60d3e7b8a 6028
maclobdell 0:f7c60d3e7b8a 6029 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
maclobdell 0:f7c60d3e7b8a 6030 void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate )
maclobdell 0:f7c60d3e7b8a 6031 {
maclobdell 0:f7c60d3e7b8a 6032 conf->trunc_hmac = truncate;
maclobdell 0:f7c60d3e7b8a 6033 }
maclobdell 0:f7c60d3e7b8a 6034 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
maclobdell 0:f7c60d3e7b8a 6035
maclobdell 0:f7c60d3e7b8a 6036 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
maclobdell 0:f7c60d3e7b8a 6037 void mbedtls_ssl_conf_cbc_record_splitting( mbedtls_ssl_config *conf, char split )
maclobdell 0:f7c60d3e7b8a 6038 {
maclobdell 0:f7c60d3e7b8a 6039 conf->cbc_record_splitting = split;
maclobdell 0:f7c60d3e7b8a 6040 }
maclobdell 0:f7c60d3e7b8a 6041 #endif
maclobdell 0:f7c60d3e7b8a 6042
maclobdell 0:f7c60d3e7b8a 6043 void mbedtls_ssl_conf_legacy_renegotiation( mbedtls_ssl_config *conf, int allow_legacy )
maclobdell 0:f7c60d3e7b8a 6044 {
maclobdell 0:f7c60d3e7b8a 6045 conf->allow_legacy_renegotiation = allow_legacy;
maclobdell 0:f7c60d3e7b8a 6046 }
maclobdell 0:f7c60d3e7b8a 6047
maclobdell 0:f7c60d3e7b8a 6048 #if defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 6049 void mbedtls_ssl_conf_renegotiation( mbedtls_ssl_config *conf, int renegotiation )
maclobdell 0:f7c60d3e7b8a 6050 {
maclobdell 0:f7c60d3e7b8a 6051 conf->disable_renegotiation = renegotiation;
maclobdell 0:f7c60d3e7b8a 6052 }
maclobdell 0:f7c60d3e7b8a 6053
maclobdell 0:f7c60d3e7b8a 6054 void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_records )
maclobdell 0:f7c60d3e7b8a 6055 {
maclobdell 0:f7c60d3e7b8a 6056 conf->renego_max_records = max_records;
maclobdell 0:f7c60d3e7b8a 6057 }
maclobdell 0:f7c60d3e7b8a 6058
maclobdell 0:f7c60d3e7b8a 6059 void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 6060 const unsigned char period[8] )
maclobdell 0:f7c60d3e7b8a 6061 {
maclobdell 0:f7c60d3e7b8a 6062 memcpy( conf->renego_period, period, 8 );
maclobdell 0:f7c60d3e7b8a 6063 }
maclobdell 0:f7c60d3e7b8a 6064 #endif /* MBEDTLS_SSL_RENEGOTIATION */
maclobdell 0:f7c60d3e7b8a 6065
maclobdell 0:f7c60d3e7b8a 6066 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
maclobdell 0:f7c60d3e7b8a 6067 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 6068 void mbedtls_ssl_conf_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
maclobdell 0:f7c60d3e7b8a 6069 {
maclobdell 0:f7c60d3e7b8a 6070 conf->session_tickets = use_tickets;
maclobdell 0:f7c60d3e7b8a 6071 }
maclobdell 0:f7c60d3e7b8a 6072 #endif
maclobdell 0:f7c60d3e7b8a 6073
maclobdell 0:f7c60d3e7b8a 6074 #if defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 6075 void mbedtls_ssl_conf_session_tickets_cb( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 6076 mbedtls_ssl_ticket_write_t *f_ticket_write,
maclobdell 0:f7c60d3e7b8a 6077 mbedtls_ssl_ticket_parse_t *f_ticket_parse,
maclobdell 0:f7c60d3e7b8a 6078 void *p_ticket )
maclobdell 0:f7c60d3e7b8a 6079 {
maclobdell 0:f7c60d3e7b8a 6080 conf->f_ticket_write = f_ticket_write;
maclobdell 0:f7c60d3e7b8a 6081 conf->f_ticket_parse = f_ticket_parse;
maclobdell 0:f7c60d3e7b8a 6082 conf->p_ticket = p_ticket;
maclobdell 0:f7c60d3e7b8a 6083 }
maclobdell 0:f7c60d3e7b8a 6084 #endif
maclobdell 0:f7c60d3e7b8a 6085 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
maclobdell 0:f7c60d3e7b8a 6086
maclobdell 0:f7c60d3e7b8a 6087 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
maclobdell 0:f7c60d3e7b8a 6088 void mbedtls_ssl_conf_export_keys_cb( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 6089 mbedtls_ssl_export_keys_t *f_export_keys,
maclobdell 0:f7c60d3e7b8a 6090 void *p_export_keys )
maclobdell 0:f7c60d3e7b8a 6091 {
maclobdell 0:f7c60d3e7b8a 6092 conf->f_export_keys = f_export_keys;
maclobdell 0:f7c60d3e7b8a 6093 conf->p_export_keys = p_export_keys;
maclobdell 0:f7c60d3e7b8a 6094 }
maclobdell 0:f7c60d3e7b8a 6095 #endif
maclobdell 0:f7c60d3e7b8a 6096
maclobdell 0:f7c60d3e7b8a 6097 /*
maclobdell 0:f7c60d3e7b8a 6098 * SSL get accessors
maclobdell 0:f7c60d3e7b8a 6099 */
maclobdell 0:f7c60d3e7b8a 6100 size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6101 {
maclobdell 0:f7c60d3e7b8a 6102 return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
maclobdell 0:f7c60d3e7b8a 6103 }
maclobdell 0:f7c60d3e7b8a 6104
maclobdell 0:f7c60d3e7b8a 6105 uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6106 {
maclobdell 0:f7c60d3e7b8a 6107 if( ssl->session != NULL )
maclobdell 0:f7c60d3e7b8a 6108 return( ssl->session->verify_result );
maclobdell 0:f7c60d3e7b8a 6109
maclobdell 0:f7c60d3e7b8a 6110 if( ssl->session_negotiate != NULL )
maclobdell 0:f7c60d3e7b8a 6111 return( ssl->session_negotiate->verify_result );
maclobdell 0:f7c60d3e7b8a 6112
maclobdell 0:f7c60d3e7b8a 6113 return( 0xFFFFFFFF );
maclobdell 0:f7c60d3e7b8a 6114 }
maclobdell 0:f7c60d3e7b8a 6115
maclobdell 0:f7c60d3e7b8a 6116 const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6117 {
maclobdell 0:f7c60d3e7b8a 6118 if( ssl == NULL || ssl->session == NULL )
maclobdell 0:f7c60d3e7b8a 6119 return( NULL );
maclobdell 0:f7c60d3e7b8a 6120
maclobdell 0:f7c60d3e7b8a 6121 return mbedtls_ssl_get_ciphersuite_name( ssl->session->ciphersuite );
maclobdell 0:f7c60d3e7b8a 6122 }
maclobdell 0:f7c60d3e7b8a 6123
maclobdell 0:f7c60d3e7b8a 6124 const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6125 {
maclobdell 0:f7c60d3e7b8a 6126 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 6127 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 6128 {
maclobdell 0:f7c60d3e7b8a 6129 switch( ssl->minor_ver )
maclobdell 0:f7c60d3e7b8a 6130 {
maclobdell 0:f7c60d3e7b8a 6131 case MBEDTLS_SSL_MINOR_VERSION_2:
maclobdell 0:f7c60d3e7b8a 6132 return( "DTLSv1.0" );
maclobdell 0:f7c60d3e7b8a 6133
maclobdell 0:f7c60d3e7b8a 6134 case MBEDTLS_SSL_MINOR_VERSION_3:
maclobdell 0:f7c60d3e7b8a 6135 return( "DTLSv1.2" );
maclobdell 0:f7c60d3e7b8a 6136
maclobdell 0:f7c60d3e7b8a 6137 default:
maclobdell 0:f7c60d3e7b8a 6138 return( "unknown (DTLS)" );
maclobdell 0:f7c60d3e7b8a 6139 }
maclobdell 0:f7c60d3e7b8a 6140 }
maclobdell 0:f7c60d3e7b8a 6141 #endif
maclobdell 0:f7c60d3e7b8a 6142
maclobdell 0:f7c60d3e7b8a 6143 switch( ssl->minor_ver )
maclobdell 0:f7c60d3e7b8a 6144 {
maclobdell 0:f7c60d3e7b8a 6145 case MBEDTLS_SSL_MINOR_VERSION_0:
maclobdell 0:f7c60d3e7b8a 6146 return( "SSLv3.0" );
maclobdell 0:f7c60d3e7b8a 6147
maclobdell 0:f7c60d3e7b8a 6148 case MBEDTLS_SSL_MINOR_VERSION_1:
maclobdell 0:f7c60d3e7b8a 6149 return( "TLSv1.0" );
maclobdell 0:f7c60d3e7b8a 6150
maclobdell 0:f7c60d3e7b8a 6151 case MBEDTLS_SSL_MINOR_VERSION_2:
maclobdell 0:f7c60d3e7b8a 6152 return( "TLSv1.1" );
maclobdell 0:f7c60d3e7b8a 6153
maclobdell 0:f7c60d3e7b8a 6154 case MBEDTLS_SSL_MINOR_VERSION_3:
maclobdell 0:f7c60d3e7b8a 6155 return( "TLSv1.2" );
maclobdell 0:f7c60d3e7b8a 6156
maclobdell 0:f7c60d3e7b8a 6157 default:
maclobdell 0:f7c60d3e7b8a 6158 return( "unknown" );
maclobdell 0:f7c60d3e7b8a 6159 }
maclobdell 0:f7c60d3e7b8a 6160 }
maclobdell 0:f7c60d3e7b8a 6161
maclobdell 0:f7c60d3e7b8a 6162 int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6163 {
maclobdell 0:f7c60d3e7b8a 6164 size_t transform_expansion;
maclobdell 0:f7c60d3e7b8a 6165 const mbedtls_ssl_transform *transform = ssl->transform_out;
maclobdell 0:f7c60d3e7b8a 6166
maclobdell 0:f7c60d3e7b8a 6167 #if defined(MBEDTLS_ZLIB_SUPPORT)
maclobdell 0:f7c60d3e7b8a 6168 if( ssl->session_out->compression != MBEDTLS_SSL_COMPRESS_NULL )
maclobdell 0:f7c60d3e7b8a 6169 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
maclobdell 0:f7c60d3e7b8a 6170 #endif
maclobdell 0:f7c60d3e7b8a 6171
maclobdell 0:f7c60d3e7b8a 6172 if( transform == NULL )
maclobdell 0:f7c60d3e7b8a 6173 return( (int) mbedtls_ssl_hdr_len( ssl ) );
maclobdell 0:f7c60d3e7b8a 6174
maclobdell 0:f7c60d3e7b8a 6175 switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) )
maclobdell 0:f7c60d3e7b8a 6176 {
maclobdell 0:f7c60d3e7b8a 6177 case MBEDTLS_MODE_GCM:
maclobdell 0:f7c60d3e7b8a 6178 case MBEDTLS_MODE_CCM:
maclobdell 0:f7c60d3e7b8a 6179 case MBEDTLS_MODE_STREAM:
maclobdell 0:f7c60d3e7b8a 6180 transform_expansion = transform->minlen;
maclobdell 0:f7c60d3e7b8a 6181 break;
maclobdell 0:f7c60d3e7b8a 6182
maclobdell 0:f7c60d3e7b8a 6183 case MBEDTLS_MODE_CBC:
maclobdell 0:f7c60d3e7b8a 6184 transform_expansion = transform->maclen
maclobdell 0:f7c60d3e7b8a 6185 + mbedtls_cipher_get_block_size( &transform->cipher_ctx_enc );
maclobdell 0:f7c60d3e7b8a 6186 break;
maclobdell 0:f7c60d3e7b8a 6187
maclobdell 0:f7c60d3e7b8a 6188 default:
maclobdell 0:f7c60d3e7b8a 6189 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 6190 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 6191 }
maclobdell 0:f7c60d3e7b8a 6192
maclobdell 0:f7c60d3e7b8a 6193 return( (int)( mbedtls_ssl_hdr_len( ssl ) + transform_expansion ) );
maclobdell 0:f7c60d3e7b8a 6194 }
maclobdell 0:f7c60d3e7b8a 6195
maclobdell 0:f7c60d3e7b8a 6196 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
maclobdell 0:f7c60d3e7b8a 6197 size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6198 {
maclobdell 0:f7c60d3e7b8a 6199 size_t max_len;
maclobdell 0:f7c60d3e7b8a 6200
maclobdell 0:f7c60d3e7b8a 6201 /*
maclobdell 0:f7c60d3e7b8a 6202 * Assume mfl_code is correct since it was checked when set
maclobdell 0:f7c60d3e7b8a 6203 */
maclobdell 0:f7c60d3e7b8a 6204 max_len = mfl_code_to_length[ssl->conf->mfl_code];
maclobdell 0:f7c60d3e7b8a 6205
maclobdell 0:f7c60d3e7b8a 6206 /*
maclobdell 0:f7c60d3e7b8a 6207 * Check if a smaller max length was negotiated
maclobdell 0:f7c60d3e7b8a 6208 */
maclobdell 0:f7c60d3e7b8a 6209 if( ssl->session_out != NULL &&
maclobdell 0:f7c60d3e7b8a 6210 mfl_code_to_length[ssl->session_out->mfl_code] < max_len )
maclobdell 0:f7c60d3e7b8a 6211 {
maclobdell 0:f7c60d3e7b8a 6212 max_len = mfl_code_to_length[ssl->session_out->mfl_code];
maclobdell 0:f7c60d3e7b8a 6213 }
maclobdell 0:f7c60d3e7b8a 6214
maclobdell 0:f7c60d3e7b8a 6215 return max_len;
maclobdell 0:f7c60d3e7b8a 6216 }
maclobdell 0:f7c60d3e7b8a 6217 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
maclobdell 0:f7c60d3e7b8a 6218
maclobdell 0:f7c60d3e7b8a 6219 #if defined(MBEDTLS_X509_CRT_PARSE_C)
maclobdell 0:f7c60d3e7b8a 6220 const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6221 {
maclobdell 0:f7c60d3e7b8a 6222 if( ssl == NULL || ssl->session == NULL )
maclobdell 0:f7c60d3e7b8a 6223 return( NULL );
maclobdell 0:f7c60d3e7b8a 6224
maclobdell 0:f7c60d3e7b8a 6225 return( ssl->session->peer_cert );
maclobdell 0:f7c60d3e7b8a 6226 }
maclobdell 0:f7c60d3e7b8a 6227 #endif /* MBEDTLS_X509_CRT_PARSE_C */
maclobdell 0:f7c60d3e7b8a 6228
maclobdell 0:f7c60d3e7b8a 6229 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 6230 int mbedtls_ssl_get_session( const mbedtls_ssl_context *ssl, mbedtls_ssl_session *dst )
maclobdell 0:f7c60d3e7b8a 6231 {
maclobdell 0:f7c60d3e7b8a 6232 if( ssl == NULL ||
maclobdell 0:f7c60d3e7b8a 6233 dst == NULL ||
maclobdell 0:f7c60d3e7b8a 6234 ssl->session == NULL ||
maclobdell 0:f7c60d3e7b8a 6235 ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 6236 {
maclobdell 0:f7c60d3e7b8a 6237 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 6238 }
maclobdell 0:f7c60d3e7b8a 6239
maclobdell 0:f7c60d3e7b8a 6240 return( ssl_session_copy( dst, ssl->session ) );
maclobdell 0:f7c60d3e7b8a 6241 }
maclobdell 0:f7c60d3e7b8a 6242 #endif /* MBEDTLS_SSL_CLI_C */
maclobdell 0:f7c60d3e7b8a 6243
maclobdell 0:f7c60d3e7b8a 6244 /*
maclobdell 0:f7c60d3e7b8a 6245 * Perform a single step of the SSL handshake
maclobdell 0:f7c60d3e7b8a 6246 */
maclobdell 0:f7c60d3e7b8a 6247 int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6248 {
maclobdell 0:f7c60d3e7b8a 6249 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
maclobdell 0:f7c60d3e7b8a 6250
maclobdell 0:f7c60d3e7b8a 6251 if( ssl == NULL || ssl->conf == NULL )
maclobdell 0:f7c60d3e7b8a 6252 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 6253
maclobdell 0:f7c60d3e7b8a 6254 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 6255 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 6256 ret = mbedtls_ssl_handshake_client_step( ssl );
maclobdell 0:f7c60d3e7b8a 6257 #endif
maclobdell 0:f7c60d3e7b8a 6258 #if defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 6259 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
maclobdell 0:f7c60d3e7b8a 6260 ret = mbedtls_ssl_handshake_server_step( ssl );
maclobdell 0:f7c60d3e7b8a 6261 #endif
maclobdell 0:f7c60d3e7b8a 6262
maclobdell 0:f7c60d3e7b8a 6263 return( ret );
maclobdell 0:f7c60d3e7b8a 6264 }
maclobdell 0:f7c60d3e7b8a 6265
maclobdell 0:f7c60d3e7b8a 6266 /*
maclobdell 0:f7c60d3e7b8a 6267 * Perform the SSL handshake
maclobdell 0:f7c60d3e7b8a 6268 */
maclobdell 0:f7c60d3e7b8a 6269 int mbedtls_ssl_handshake( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6270 {
maclobdell 0:f7c60d3e7b8a 6271 int ret = 0;
maclobdell 0:f7c60d3e7b8a 6272
maclobdell 0:f7c60d3e7b8a 6273 if( ssl == NULL || ssl->conf == NULL )
maclobdell 0:f7c60d3e7b8a 6274 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 6275
maclobdell 0:f7c60d3e7b8a 6276 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
maclobdell 0:f7c60d3e7b8a 6277
maclobdell 0:f7c60d3e7b8a 6278 while( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
maclobdell 0:f7c60d3e7b8a 6279 {
maclobdell 0:f7c60d3e7b8a 6280 ret = mbedtls_ssl_handshake_step( ssl );
maclobdell 0:f7c60d3e7b8a 6281
maclobdell 0:f7c60d3e7b8a 6282 if( ret != 0 )
maclobdell 0:f7c60d3e7b8a 6283 break;
maclobdell 0:f7c60d3e7b8a 6284 }
maclobdell 0:f7c60d3e7b8a 6285
maclobdell 0:f7c60d3e7b8a 6286 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
maclobdell 0:f7c60d3e7b8a 6287
maclobdell 0:f7c60d3e7b8a 6288 return( ret );
maclobdell 0:f7c60d3e7b8a 6289 }
maclobdell 0:f7c60d3e7b8a 6290
maclobdell 0:f7c60d3e7b8a 6291 #if defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 6292 #if defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 6293 /*
maclobdell 0:f7c60d3e7b8a 6294 * Write HelloRequest to request renegotiation on server
maclobdell 0:f7c60d3e7b8a 6295 */
maclobdell 0:f7c60d3e7b8a 6296 static int ssl_write_hello_request( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6297 {
maclobdell 0:f7c60d3e7b8a 6298 int ret;
maclobdell 0:f7c60d3e7b8a 6299
maclobdell 0:f7c60d3e7b8a 6300 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello request" ) );
maclobdell 0:f7c60d3e7b8a 6301
maclobdell 0:f7c60d3e7b8a 6302 ssl->out_msglen = 4;
maclobdell 0:f7c60d3e7b8a 6303 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
maclobdell 0:f7c60d3e7b8a 6304 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_REQUEST;
maclobdell 0:f7c60d3e7b8a 6305
maclobdell 0:f7c60d3e7b8a 6306 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6307 {
maclobdell 0:f7c60d3e7b8a 6308 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
maclobdell 0:f7c60d3e7b8a 6309 return( ret );
maclobdell 0:f7c60d3e7b8a 6310 }
maclobdell 0:f7c60d3e7b8a 6311
maclobdell 0:f7c60d3e7b8a 6312 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello request" ) );
maclobdell 0:f7c60d3e7b8a 6313
maclobdell 0:f7c60d3e7b8a 6314 return( 0 );
maclobdell 0:f7c60d3e7b8a 6315 }
maclobdell 0:f7c60d3e7b8a 6316 #endif /* MBEDTLS_SSL_SRV_C */
maclobdell 0:f7c60d3e7b8a 6317
maclobdell 0:f7c60d3e7b8a 6318 /*
maclobdell 0:f7c60d3e7b8a 6319 * Actually renegotiate current connection, triggered by either:
maclobdell 0:f7c60d3e7b8a 6320 * - any side: calling mbedtls_ssl_renegotiate(),
maclobdell 0:f7c60d3e7b8a 6321 * - client: receiving a HelloRequest during mbedtls_ssl_read(),
maclobdell 0:f7c60d3e7b8a 6322 * - server: receiving any handshake message on server during mbedtls_ssl_read() after
maclobdell 0:f7c60d3e7b8a 6323 * the initial handshake is completed.
maclobdell 0:f7c60d3e7b8a 6324 * If the handshake doesn't complete due to waiting for I/O, it will continue
maclobdell 0:f7c60d3e7b8a 6325 * during the next calls to mbedtls_ssl_renegotiate() or mbedtls_ssl_read() respectively.
maclobdell 0:f7c60d3e7b8a 6326 */
maclobdell 0:f7c60d3e7b8a 6327 static int ssl_start_renegotiation( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6328 {
maclobdell 0:f7c60d3e7b8a 6329 int ret;
maclobdell 0:f7c60d3e7b8a 6330
maclobdell 0:f7c60d3e7b8a 6331 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
maclobdell 0:f7c60d3e7b8a 6332
maclobdell 0:f7c60d3e7b8a 6333 if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6334 return( ret );
maclobdell 0:f7c60d3e7b8a 6335
maclobdell 0:f7c60d3e7b8a 6336 /* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
maclobdell 0:f7c60d3e7b8a 6337 * the ServerHello will have message_seq = 1" */
maclobdell 0:f7c60d3e7b8a 6338 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 6339 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
maclobdell 0:f7c60d3e7b8a 6340 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
maclobdell 0:f7c60d3e7b8a 6341 {
maclobdell 0:f7c60d3e7b8a 6342 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
maclobdell 0:f7c60d3e7b8a 6343 ssl->handshake->out_msg_seq = 1;
maclobdell 0:f7c60d3e7b8a 6344 else
maclobdell 0:f7c60d3e7b8a 6345 ssl->handshake->in_msg_seq = 1;
maclobdell 0:f7c60d3e7b8a 6346 }
maclobdell 0:f7c60d3e7b8a 6347 #endif
maclobdell 0:f7c60d3e7b8a 6348
maclobdell 0:f7c60d3e7b8a 6349 ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
maclobdell 0:f7c60d3e7b8a 6350 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS;
maclobdell 0:f7c60d3e7b8a 6351
maclobdell 0:f7c60d3e7b8a 6352 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6353 {
maclobdell 0:f7c60d3e7b8a 6354 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
maclobdell 0:f7c60d3e7b8a 6355 return( ret );
maclobdell 0:f7c60d3e7b8a 6356 }
maclobdell 0:f7c60d3e7b8a 6357
maclobdell 0:f7c60d3e7b8a 6358 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
maclobdell 0:f7c60d3e7b8a 6359
maclobdell 0:f7c60d3e7b8a 6360 return( 0 );
maclobdell 0:f7c60d3e7b8a 6361 }
maclobdell 0:f7c60d3e7b8a 6362
maclobdell 0:f7c60d3e7b8a 6363 /*
maclobdell 0:f7c60d3e7b8a 6364 * Renegotiate current connection on client,
maclobdell 0:f7c60d3e7b8a 6365 * or request renegotiation on server
maclobdell 0:f7c60d3e7b8a 6366 */
maclobdell 0:f7c60d3e7b8a 6367 int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6368 {
maclobdell 0:f7c60d3e7b8a 6369 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
maclobdell 0:f7c60d3e7b8a 6370
maclobdell 0:f7c60d3e7b8a 6371 if( ssl == NULL || ssl->conf == NULL )
maclobdell 0:f7c60d3e7b8a 6372 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 6373
maclobdell 0:f7c60d3e7b8a 6374 #if defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 6375 /* On server, just send the request */
maclobdell 0:f7c60d3e7b8a 6376 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
maclobdell 0:f7c60d3e7b8a 6377 {
maclobdell 0:f7c60d3e7b8a 6378 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
maclobdell 0:f7c60d3e7b8a 6379 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 6380
maclobdell 0:f7c60d3e7b8a 6381 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
maclobdell 0:f7c60d3e7b8a 6382
maclobdell 0:f7c60d3e7b8a 6383 /* Did we already try/start sending HelloRequest? */
maclobdell 0:f7c60d3e7b8a 6384 if( ssl->out_left != 0 )
maclobdell 0:f7c60d3e7b8a 6385 return( mbedtls_ssl_flush_output( ssl ) );
maclobdell 0:f7c60d3e7b8a 6386
maclobdell 0:f7c60d3e7b8a 6387 return( ssl_write_hello_request( ssl ) );
maclobdell 0:f7c60d3e7b8a 6388 }
maclobdell 0:f7c60d3e7b8a 6389 #endif /* MBEDTLS_SSL_SRV_C */
maclobdell 0:f7c60d3e7b8a 6390
maclobdell 0:f7c60d3e7b8a 6391 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 6392 /*
maclobdell 0:f7c60d3e7b8a 6393 * On client, either start the renegotiation process or,
maclobdell 0:f7c60d3e7b8a 6394 * if already in progress, continue the handshake
maclobdell 0:f7c60d3e7b8a 6395 */
maclobdell 0:f7c60d3e7b8a 6396 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
maclobdell 0:f7c60d3e7b8a 6397 {
maclobdell 0:f7c60d3e7b8a 6398 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
maclobdell 0:f7c60d3e7b8a 6399 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 6400
maclobdell 0:f7c60d3e7b8a 6401 if( ( ret = ssl_start_renegotiation( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6402 {
maclobdell 0:f7c60d3e7b8a 6403 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
maclobdell 0:f7c60d3e7b8a 6404 return( ret );
maclobdell 0:f7c60d3e7b8a 6405 }
maclobdell 0:f7c60d3e7b8a 6406 }
maclobdell 0:f7c60d3e7b8a 6407 else
maclobdell 0:f7c60d3e7b8a 6408 {
maclobdell 0:f7c60d3e7b8a 6409 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6410 {
maclobdell 0:f7c60d3e7b8a 6411 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
maclobdell 0:f7c60d3e7b8a 6412 return( ret );
maclobdell 0:f7c60d3e7b8a 6413 }
maclobdell 0:f7c60d3e7b8a 6414 }
maclobdell 0:f7c60d3e7b8a 6415 #endif /* MBEDTLS_SSL_CLI_C */
maclobdell 0:f7c60d3e7b8a 6416
maclobdell 0:f7c60d3e7b8a 6417 return( ret );
maclobdell 0:f7c60d3e7b8a 6418 }
maclobdell 0:f7c60d3e7b8a 6419
maclobdell 0:f7c60d3e7b8a 6420 /*
maclobdell 0:f7c60d3e7b8a 6421 * Check record counters and renegotiate if they're above the limit.
maclobdell 0:f7c60d3e7b8a 6422 */
maclobdell 0:f7c60d3e7b8a 6423 static int ssl_check_ctr_renegotiate( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6424 {
maclobdell 0:f7c60d3e7b8a 6425 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ||
maclobdell 0:f7c60d3e7b8a 6426 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ||
maclobdell 0:f7c60d3e7b8a 6427 ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED )
maclobdell 0:f7c60d3e7b8a 6428 {
maclobdell 0:f7c60d3e7b8a 6429 return( 0 );
maclobdell 0:f7c60d3e7b8a 6430 }
maclobdell 0:f7c60d3e7b8a 6431
maclobdell 0:f7c60d3e7b8a 6432 if( memcmp( ssl->in_ctr, ssl->conf->renego_period, 8 ) <= 0 &&
maclobdell 0:f7c60d3e7b8a 6433 memcmp( ssl->out_ctr, ssl->conf->renego_period, 8 ) <= 0 )
maclobdell 0:f7c60d3e7b8a 6434 {
maclobdell 0:f7c60d3e7b8a 6435 return( 0 );
maclobdell 0:f7c60d3e7b8a 6436 }
maclobdell 0:f7c60d3e7b8a 6437
maclobdell 0:f7c60d3e7b8a 6438 MBEDTLS_SSL_DEBUG_MSG( 1, ( "record counter limit reached: renegotiate" ) );
maclobdell 0:f7c60d3e7b8a 6439 return( mbedtls_ssl_renegotiate( ssl ) );
maclobdell 0:f7c60d3e7b8a 6440 }
maclobdell 0:f7c60d3e7b8a 6441 #endif /* MBEDTLS_SSL_RENEGOTIATION */
maclobdell 0:f7c60d3e7b8a 6442
maclobdell 0:f7c60d3e7b8a 6443 /*
maclobdell 0:f7c60d3e7b8a 6444 * Receive application data decrypted from the SSL layer
maclobdell 0:f7c60d3e7b8a 6445 */
maclobdell 0:f7c60d3e7b8a 6446 int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
maclobdell 0:f7c60d3e7b8a 6447 {
maclobdell 0:f7c60d3e7b8a 6448 int ret, record_read = 0;
maclobdell 0:f7c60d3e7b8a 6449 size_t n;
maclobdell 0:f7c60d3e7b8a 6450
maclobdell 0:f7c60d3e7b8a 6451 if( ssl == NULL || ssl->conf == NULL )
maclobdell 0:f7c60d3e7b8a 6452 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 6453
maclobdell 0:f7c60d3e7b8a 6454 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
maclobdell 0:f7c60d3e7b8a 6455
maclobdell 0:f7c60d3e7b8a 6456 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 6457 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 6458 {
maclobdell 0:f7c60d3e7b8a 6459 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6460 return( ret );
maclobdell 0:f7c60d3e7b8a 6461
maclobdell 0:f7c60d3e7b8a 6462 if( ssl->handshake != NULL &&
maclobdell 0:f7c60d3e7b8a 6463 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
maclobdell 0:f7c60d3e7b8a 6464 {
maclobdell 0:f7c60d3e7b8a 6465 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6466 return( ret );
maclobdell 0:f7c60d3e7b8a 6467 }
maclobdell 0:f7c60d3e7b8a 6468 }
maclobdell 0:f7c60d3e7b8a 6469 #endif
maclobdell 0:f7c60d3e7b8a 6470
maclobdell 0:f7c60d3e7b8a 6471 #if defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 6472 if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6473 {
maclobdell 0:f7c60d3e7b8a 6474 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
maclobdell 0:f7c60d3e7b8a 6475 return( ret );
maclobdell 0:f7c60d3e7b8a 6476 }
maclobdell 0:f7c60d3e7b8a 6477 #endif
maclobdell 0:f7c60d3e7b8a 6478
maclobdell 0:f7c60d3e7b8a 6479 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
maclobdell 0:f7c60d3e7b8a 6480 {
maclobdell 0:f7c60d3e7b8a 6481 ret = mbedtls_ssl_handshake( ssl );
maclobdell 0:f7c60d3e7b8a 6482 if( ret == MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO )
maclobdell 0:f7c60d3e7b8a 6483 {
maclobdell 0:f7c60d3e7b8a 6484 record_read = 1;
maclobdell 0:f7c60d3e7b8a 6485 }
maclobdell 0:f7c60d3e7b8a 6486 else if( ret != 0 )
maclobdell 0:f7c60d3e7b8a 6487 {
maclobdell 0:f7c60d3e7b8a 6488 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
maclobdell 0:f7c60d3e7b8a 6489 return( ret );
maclobdell 0:f7c60d3e7b8a 6490 }
maclobdell 0:f7c60d3e7b8a 6491 }
maclobdell 0:f7c60d3e7b8a 6492
maclobdell 0:f7c60d3e7b8a 6493 if( ssl->in_offt == NULL )
maclobdell 0:f7c60d3e7b8a 6494 {
maclobdell 0:f7c60d3e7b8a 6495 /* Start timer if not already running */
maclobdell 0:f7c60d3e7b8a 6496 if( ssl->f_get_timer != NULL &&
maclobdell 0:f7c60d3e7b8a 6497 ssl->f_get_timer( ssl->p_timer ) == -1 )
maclobdell 0:f7c60d3e7b8a 6498 {
maclobdell 0:f7c60d3e7b8a 6499 ssl_set_timer( ssl, ssl->conf->read_timeout );
maclobdell 0:f7c60d3e7b8a 6500 }
maclobdell 0:f7c60d3e7b8a 6501
maclobdell 0:f7c60d3e7b8a 6502 if( ! record_read )
maclobdell 0:f7c60d3e7b8a 6503 {
maclobdell 0:f7c60d3e7b8a 6504 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6505 {
maclobdell 0:f7c60d3e7b8a 6506 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
maclobdell 0:f7c60d3e7b8a 6507 return( 0 );
maclobdell 0:f7c60d3e7b8a 6508
maclobdell 0:f7c60d3e7b8a 6509 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
maclobdell 0:f7c60d3e7b8a 6510 return( ret );
maclobdell 0:f7c60d3e7b8a 6511 }
maclobdell 0:f7c60d3e7b8a 6512 }
maclobdell 0:f7c60d3e7b8a 6513
maclobdell 0:f7c60d3e7b8a 6514 if( ssl->in_msglen == 0 &&
maclobdell 0:f7c60d3e7b8a 6515 ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA )
maclobdell 0:f7c60d3e7b8a 6516 {
maclobdell 0:f7c60d3e7b8a 6517 /*
maclobdell 0:f7c60d3e7b8a 6518 * OpenSSL sends empty messages to randomize the IV
maclobdell 0:f7c60d3e7b8a 6519 */
maclobdell 0:f7c60d3e7b8a 6520 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6521 {
maclobdell 0:f7c60d3e7b8a 6522 if( ret == MBEDTLS_ERR_SSL_CONN_EOF )
maclobdell 0:f7c60d3e7b8a 6523 return( 0 );
maclobdell 0:f7c60d3e7b8a 6524
maclobdell 0:f7c60d3e7b8a 6525 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
maclobdell 0:f7c60d3e7b8a 6526 return( ret );
maclobdell 0:f7c60d3e7b8a 6527 }
maclobdell 0:f7c60d3e7b8a 6528 }
maclobdell 0:f7c60d3e7b8a 6529
maclobdell 0:f7c60d3e7b8a 6530 #if defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 6531 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE )
maclobdell 0:f7c60d3e7b8a 6532 {
maclobdell 0:f7c60d3e7b8a 6533 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received handshake message" ) );
maclobdell 0:f7c60d3e7b8a 6534
maclobdell 0:f7c60d3e7b8a 6535 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 6536 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
maclobdell 0:f7c60d3e7b8a 6537 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST ||
maclobdell 0:f7c60d3e7b8a 6538 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ) )
maclobdell 0:f7c60d3e7b8a 6539 {
maclobdell 0:f7c60d3e7b8a 6540 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
maclobdell 0:f7c60d3e7b8a 6541
maclobdell 0:f7c60d3e7b8a 6542 /* With DTLS, drop the packet (probably from last handshake) */
maclobdell 0:f7c60d3e7b8a 6543 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 6544 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 6545 return( MBEDTLS_ERR_SSL_WANT_READ );
maclobdell 0:f7c60d3e7b8a 6546 #endif
maclobdell 0:f7c60d3e7b8a 6547 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
maclobdell 0:f7c60d3e7b8a 6548 }
maclobdell 0:f7c60d3e7b8a 6549
maclobdell 0:f7c60d3e7b8a 6550 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
maclobdell 0:f7c60d3e7b8a 6551 ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
maclobdell 0:f7c60d3e7b8a 6552 {
maclobdell 0:f7c60d3e7b8a 6553 MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
maclobdell 0:f7c60d3e7b8a 6554
maclobdell 0:f7c60d3e7b8a 6555 /* With DTLS, drop the packet (probably from last handshake) */
maclobdell 0:f7c60d3e7b8a 6556 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 6557 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 6558 return( MBEDTLS_ERR_SSL_WANT_READ );
maclobdell 0:f7c60d3e7b8a 6559 #endif
maclobdell 0:f7c60d3e7b8a 6560 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
maclobdell 0:f7c60d3e7b8a 6561 }
maclobdell 0:f7c60d3e7b8a 6562 #endif
maclobdell 0:f7c60d3e7b8a 6563
maclobdell 0:f7c60d3e7b8a 6564 if( ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
maclobdell 0:f7c60d3e7b8a 6565 ( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
maclobdell 0:f7c60d3e7b8a 6566 ssl->conf->allow_legacy_renegotiation ==
maclobdell 0:f7c60d3e7b8a 6567 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) )
maclobdell 0:f7c60d3e7b8a 6568 {
maclobdell 0:f7c60d3e7b8a 6569 MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
maclobdell 0:f7c60d3e7b8a 6570
maclobdell 0:f7c60d3e7b8a 6571 #if defined(MBEDTLS_SSL_PROTO_SSL3)
maclobdell 0:f7c60d3e7b8a 6572 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
maclobdell 0:f7c60d3e7b8a 6573 {
maclobdell 0:f7c60d3e7b8a 6574 /*
maclobdell 0:f7c60d3e7b8a 6575 * SSLv3 does not have a "no_renegotiation" alert
maclobdell 0:f7c60d3e7b8a 6576 */
maclobdell 0:f7c60d3e7b8a 6577 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6578 return( ret );
maclobdell 0:f7c60d3e7b8a 6579 }
maclobdell 0:f7c60d3e7b8a 6580 else
maclobdell 0:f7c60d3e7b8a 6581 #endif /* MBEDTLS_SSL_PROTO_SSL3 */
maclobdell 0:f7c60d3e7b8a 6582 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
maclobdell 0:f7c60d3e7b8a 6583 defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 6584 if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 )
maclobdell 0:f7c60d3e7b8a 6585 {
maclobdell 0:f7c60d3e7b8a 6586 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
maclobdell 0:f7c60d3e7b8a 6587 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
maclobdell 0:f7c60d3e7b8a 6588 MBEDTLS_SSL_ALERT_MSG_NO_RENEGOTIATION ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6589 {
maclobdell 0:f7c60d3e7b8a 6590 return( ret );
maclobdell 0:f7c60d3e7b8a 6591 }
maclobdell 0:f7c60d3e7b8a 6592 }
maclobdell 0:f7c60d3e7b8a 6593 else
maclobdell 0:f7c60d3e7b8a 6594 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 ||
maclobdell 0:f7c60d3e7b8a 6595 MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 6596 {
maclobdell 0:f7c60d3e7b8a 6597 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
maclobdell 0:f7c60d3e7b8a 6598 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
maclobdell 0:f7c60d3e7b8a 6599 }
maclobdell 0:f7c60d3e7b8a 6600 }
maclobdell 0:f7c60d3e7b8a 6601 else
maclobdell 0:f7c60d3e7b8a 6602 {
maclobdell 0:f7c60d3e7b8a 6603 /* DTLS clients need to know renego is server-initiated */
maclobdell 0:f7c60d3e7b8a 6604 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 6605 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
maclobdell 0:f7c60d3e7b8a 6606 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 6607 {
maclobdell 0:f7c60d3e7b8a 6608 ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
maclobdell 0:f7c60d3e7b8a 6609 }
maclobdell 0:f7c60d3e7b8a 6610 #endif
maclobdell 0:f7c60d3e7b8a 6611 ret = ssl_start_renegotiation( ssl );
maclobdell 0:f7c60d3e7b8a 6612 if( ret == MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO )
maclobdell 0:f7c60d3e7b8a 6613 {
maclobdell 0:f7c60d3e7b8a 6614 record_read = 1;
maclobdell 0:f7c60d3e7b8a 6615 }
maclobdell 0:f7c60d3e7b8a 6616 else if( ret != 0 )
maclobdell 0:f7c60d3e7b8a 6617 {
maclobdell 0:f7c60d3e7b8a 6618 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_start_renegotiation", ret );
maclobdell 0:f7c60d3e7b8a 6619 return( ret );
maclobdell 0:f7c60d3e7b8a 6620 }
maclobdell 0:f7c60d3e7b8a 6621 }
maclobdell 0:f7c60d3e7b8a 6622
maclobdell 0:f7c60d3e7b8a 6623 /* If a non-handshake record was read during renego, fallthrough,
maclobdell 0:f7c60d3e7b8a 6624 * else tell the user they should call mbedtls_ssl_read() again */
maclobdell 0:f7c60d3e7b8a 6625 if( ! record_read )
maclobdell 0:f7c60d3e7b8a 6626 return( MBEDTLS_ERR_SSL_WANT_READ );
maclobdell 0:f7c60d3e7b8a 6627 }
maclobdell 0:f7c60d3e7b8a 6628 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
maclobdell 0:f7c60d3e7b8a 6629 {
maclobdell 0:f7c60d3e7b8a 6630
maclobdell 0:f7c60d3e7b8a 6631 if( ssl->conf->renego_max_records >= 0 )
maclobdell 0:f7c60d3e7b8a 6632 {
maclobdell 0:f7c60d3e7b8a 6633 if( ++ssl->renego_records_seen > ssl->conf->renego_max_records )
maclobdell 0:f7c60d3e7b8a 6634 {
maclobdell 0:f7c60d3e7b8a 6635 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
maclobdell 0:f7c60d3e7b8a 6636 "but not honored by client" ) );
maclobdell 0:f7c60d3e7b8a 6637 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
maclobdell 0:f7c60d3e7b8a 6638 }
maclobdell 0:f7c60d3e7b8a 6639 }
maclobdell 0:f7c60d3e7b8a 6640 }
maclobdell 0:f7c60d3e7b8a 6641 #endif /* MBEDTLS_SSL_RENEGOTIATION */
maclobdell 0:f7c60d3e7b8a 6642
maclobdell 0:f7c60d3e7b8a 6643 /* Fatal and closure alerts handled by mbedtls_ssl_read_record() */
maclobdell 0:f7c60d3e7b8a 6644 if( ssl->in_msgtype == MBEDTLS_SSL_MSG_ALERT )
maclobdell 0:f7c60d3e7b8a 6645 {
maclobdell 0:f7c60d3e7b8a 6646 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ignoring non-fatal non-closure alert" ) );
maclobdell 0:f7c60d3e7b8a 6647 return( MBEDTLS_ERR_SSL_WANT_READ );
maclobdell 0:f7c60d3e7b8a 6648 }
maclobdell 0:f7c60d3e7b8a 6649
maclobdell 0:f7c60d3e7b8a 6650 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
maclobdell 0:f7c60d3e7b8a 6651 {
maclobdell 0:f7c60d3e7b8a 6652 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
maclobdell 0:f7c60d3e7b8a 6653 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
maclobdell 0:f7c60d3e7b8a 6654 }
maclobdell 0:f7c60d3e7b8a 6655
maclobdell 0:f7c60d3e7b8a 6656 ssl->in_offt = ssl->in_msg;
maclobdell 0:f7c60d3e7b8a 6657
maclobdell 0:f7c60d3e7b8a 6658 /* We're going to return something now, cancel timer,
maclobdell 0:f7c60d3e7b8a 6659 * except if handshake (renegotiation) is in progress */
maclobdell 0:f7c60d3e7b8a 6660 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
maclobdell 0:f7c60d3e7b8a 6661 ssl_set_timer( ssl, 0 );
maclobdell 0:f7c60d3e7b8a 6662
maclobdell 0:f7c60d3e7b8a 6663 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 6664 /* If we requested renego but received AppData, resend HelloRequest.
maclobdell 0:f7c60d3e7b8a 6665 * Do it now, after setting in_offt, to avoid taking this branch
maclobdell 0:f7c60d3e7b8a 6666 * again if ssl_write_hello_request() returns WANT_WRITE */
maclobdell 0:f7c60d3e7b8a 6667 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 6668 if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
maclobdell 0:f7c60d3e7b8a 6669 ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
maclobdell 0:f7c60d3e7b8a 6670 {
maclobdell 0:f7c60d3e7b8a 6671 if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6672 {
maclobdell 0:f7c60d3e7b8a 6673 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_resend_hello_request", ret );
maclobdell 0:f7c60d3e7b8a 6674 return( ret );
maclobdell 0:f7c60d3e7b8a 6675 }
maclobdell 0:f7c60d3e7b8a 6676 }
maclobdell 0:f7c60d3e7b8a 6677 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_RENEGOTIATION */
maclobdell 0:f7c60d3e7b8a 6678 #endif
maclobdell 0:f7c60d3e7b8a 6679 }
maclobdell 0:f7c60d3e7b8a 6680
maclobdell 0:f7c60d3e7b8a 6681 n = ( len < ssl->in_msglen )
maclobdell 0:f7c60d3e7b8a 6682 ? len : ssl->in_msglen;
maclobdell 0:f7c60d3e7b8a 6683
maclobdell 0:f7c60d3e7b8a 6684 memcpy( buf, ssl->in_offt, n );
maclobdell 0:f7c60d3e7b8a 6685 ssl->in_msglen -= n;
maclobdell 0:f7c60d3e7b8a 6686
maclobdell 0:f7c60d3e7b8a 6687 if( ssl->in_msglen == 0 )
maclobdell 0:f7c60d3e7b8a 6688 /* all bytes consumed */
maclobdell 0:f7c60d3e7b8a 6689 ssl->in_offt = NULL;
maclobdell 0:f7c60d3e7b8a 6690 else
maclobdell 0:f7c60d3e7b8a 6691 /* more data available */
maclobdell 0:f7c60d3e7b8a 6692 ssl->in_offt += n;
maclobdell 0:f7c60d3e7b8a 6693
maclobdell 0:f7c60d3e7b8a 6694 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= read" ) );
maclobdell 0:f7c60d3e7b8a 6695
maclobdell 0:f7c60d3e7b8a 6696 return( (int) n );
maclobdell 0:f7c60d3e7b8a 6697 }
maclobdell 0:f7c60d3e7b8a 6698
maclobdell 0:f7c60d3e7b8a 6699 /*
maclobdell 0:f7c60d3e7b8a 6700 * Send application data to be encrypted by the SSL layer,
maclobdell 0:f7c60d3e7b8a 6701 * taking care of max fragment length and buffer size
maclobdell 0:f7c60d3e7b8a 6702 */
maclobdell 0:f7c60d3e7b8a 6703 static int ssl_write_real( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 6704 const unsigned char *buf, size_t len )
maclobdell 0:f7c60d3e7b8a 6705 {
maclobdell 0:f7c60d3e7b8a 6706 int ret;
maclobdell 0:f7c60d3e7b8a 6707 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
maclobdell 0:f7c60d3e7b8a 6708 size_t max_len = mbedtls_ssl_get_max_frag_len( ssl );
maclobdell 0:f7c60d3e7b8a 6709
maclobdell 0:f7c60d3e7b8a 6710 if( len > max_len )
maclobdell 0:f7c60d3e7b8a 6711 {
maclobdell 0:f7c60d3e7b8a 6712 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 6713 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 6714 {
maclobdell 0:f7c60d3e7b8a 6715 MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
maclobdell 0:f7c60d3e7b8a 6716 "maximum fragment length: %d > %d",
maclobdell 0:f7c60d3e7b8a 6717 len, max_len ) );
maclobdell 0:f7c60d3e7b8a 6718 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 6719 }
maclobdell 0:f7c60d3e7b8a 6720 else
maclobdell 0:f7c60d3e7b8a 6721 #endif
maclobdell 0:f7c60d3e7b8a 6722 len = max_len;
maclobdell 0:f7c60d3e7b8a 6723 }
maclobdell 0:f7c60d3e7b8a 6724 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
maclobdell 0:f7c60d3e7b8a 6725
maclobdell 0:f7c60d3e7b8a 6726 if( ssl->out_left != 0 )
maclobdell 0:f7c60d3e7b8a 6727 {
maclobdell 0:f7c60d3e7b8a 6728 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6729 {
maclobdell 0:f7c60d3e7b8a 6730 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flush_output", ret );
maclobdell 0:f7c60d3e7b8a 6731 return( ret );
maclobdell 0:f7c60d3e7b8a 6732 }
maclobdell 0:f7c60d3e7b8a 6733 }
maclobdell 0:f7c60d3e7b8a 6734 else
maclobdell 0:f7c60d3e7b8a 6735 {
maclobdell 0:f7c60d3e7b8a 6736 ssl->out_msglen = len;
maclobdell 0:f7c60d3e7b8a 6737 ssl->out_msgtype = MBEDTLS_SSL_MSG_APPLICATION_DATA;
maclobdell 0:f7c60d3e7b8a 6738 memcpy( ssl->out_msg, buf, len );
maclobdell 0:f7c60d3e7b8a 6739
maclobdell 0:f7c60d3e7b8a 6740 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6741 {
maclobdell 0:f7c60d3e7b8a 6742 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
maclobdell 0:f7c60d3e7b8a 6743 return( ret );
maclobdell 0:f7c60d3e7b8a 6744 }
maclobdell 0:f7c60d3e7b8a 6745 }
maclobdell 0:f7c60d3e7b8a 6746
maclobdell 0:f7c60d3e7b8a 6747 return( (int) len );
maclobdell 0:f7c60d3e7b8a 6748 }
maclobdell 0:f7c60d3e7b8a 6749
maclobdell 0:f7c60d3e7b8a 6750 /*
maclobdell 0:f7c60d3e7b8a 6751 * Write application data, doing 1/n-1 splitting if necessary.
maclobdell 0:f7c60d3e7b8a 6752 *
maclobdell 0:f7c60d3e7b8a 6753 * With non-blocking I/O, ssl_write_real() may return WANT_WRITE,
maclobdell 0:f7c60d3e7b8a 6754 * then the caller will call us again with the same arguments, so
maclobdell 0:f7c60d3e7b8a 6755 * remember wether we already did the split or not.
maclobdell 0:f7c60d3e7b8a 6756 */
maclobdell 0:f7c60d3e7b8a 6757 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
maclobdell 0:f7c60d3e7b8a 6758 static int ssl_write_split( mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 6759 const unsigned char *buf, size_t len )
maclobdell 0:f7c60d3e7b8a 6760 {
maclobdell 0:f7c60d3e7b8a 6761 int ret;
maclobdell 0:f7c60d3e7b8a 6762
maclobdell 0:f7c60d3e7b8a 6763 if( ssl->conf->cbc_record_splitting ==
maclobdell 0:f7c60d3e7b8a 6764 MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED ||
maclobdell 0:f7c60d3e7b8a 6765 len <= 1 ||
maclobdell 0:f7c60d3e7b8a 6766 ssl->minor_ver > MBEDTLS_SSL_MINOR_VERSION_1 ||
maclobdell 0:f7c60d3e7b8a 6767 mbedtls_cipher_get_cipher_mode( &ssl->transform_out->cipher_ctx_enc )
maclobdell 0:f7c60d3e7b8a 6768 != MBEDTLS_MODE_CBC )
maclobdell 0:f7c60d3e7b8a 6769 {
maclobdell 0:f7c60d3e7b8a 6770 return( ssl_write_real( ssl, buf, len ) );
maclobdell 0:f7c60d3e7b8a 6771 }
maclobdell 0:f7c60d3e7b8a 6772
maclobdell 0:f7c60d3e7b8a 6773 if( ssl->split_done == 0 )
maclobdell 0:f7c60d3e7b8a 6774 {
maclobdell 0:f7c60d3e7b8a 6775 if( ( ret = ssl_write_real( ssl, buf, 1 ) ) <= 0 )
maclobdell 0:f7c60d3e7b8a 6776 return( ret );
maclobdell 0:f7c60d3e7b8a 6777 ssl->split_done = 1;
maclobdell 0:f7c60d3e7b8a 6778 }
maclobdell 0:f7c60d3e7b8a 6779
maclobdell 0:f7c60d3e7b8a 6780 if( ( ret = ssl_write_real( ssl, buf + 1, len - 1 ) ) <= 0 )
maclobdell 0:f7c60d3e7b8a 6781 return( ret );
maclobdell 0:f7c60d3e7b8a 6782 ssl->split_done = 0;
maclobdell 0:f7c60d3e7b8a 6783
maclobdell 0:f7c60d3e7b8a 6784 return( ret + 1 );
maclobdell 0:f7c60d3e7b8a 6785 }
maclobdell 0:f7c60d3e7b8a 6786 #endif /* MBEDTLS_SSL_CBC_RECORD_SPLITTING */
maclobdell 0:f7c60d3e7b8a 6787
maclobdell 0:f7c60d3e7b8a 6788 /*
maclobdell 0:f7c60d3e7b8a 6789 * Write application data (public-facing wrapper)
maclobdell 0:f7c60d3e7b8a 6790 */
maclobdell 0:f7c60d3e7b8a 6791 int mbedtls_ssl_write( mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len )
maclobdell 0:f7c60d3e7b8a 6792 {
maclobdell 0:f7c60d3e7b8a 6793 int ret;
maclobdell 0:f7c60d3e7b8a 6794
maclobdell 0:f7c60d3e7b8a 6795 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write" ) );
maclobdell 0:f7c60d3e7b8a 6796
maclobdell 0:f7c60d3e7b8a 6797 if( ssl == NULL || ssl->conf == NULL )
maclobdell 0:f7c60d3e7b8a 6798 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 6799
maclobdell 0:f7c60d3e7b8a 6800 #if defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 6801 if( ( ret = ssl_check_ctr_renegotiate( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6802 {
maclobdell 0:f7c60d3e7b8a 6803 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_check_ctr_renegotiate", ret );
maclobdell 0:f7c60d3e7b8a 6804 return( ret );
maclobdell 0:f7c60d3e7b8a 6805 }
maclobdell 0:f7c60d3e7b8a 6806 #endif
maclobdell 0:f7c60d3e7b8a 6807
maclobdell 0:f7c60d3e7b8a 6808 if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
maclobdell 0:f7c60d3e7b8a 6809 {
maclobdell 0:f7c60d3e7b8a 6810 if( ( ret = mbedtls_ssl_handshake( ssl ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6811 {
maclobdell 0:f7c60d3e7b8a 6812 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_handshake", ret );
maclobdell 0:f7c60d3e7b8a 6813 return( ret );
maclobdell 0:f7c60d3e7b8a 6814 }
maclobdell 0:f7c60d3e7b8a 6815 }
maclobdell 0:f7c60d3e7b8a 6816
maclobdell 0:f7c60d3e7b8a 6817 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
maclobdell 0:f7c60d3e7b8a 6818 ret = ssl_write_split( ssl, buf, len );
maclobdell 0:f7c60d3e7b8a 6819 #else
maclobdell 0:f7c60d3e7b8a 6820 ret = ssl_write_real( ssl, buf, len );
maclobdell 0:f7c60d3e7b8a 6821 #endif
maclobdell 0:f7c60d3e7b8a 6822
maclobdell 0:f7c60d3e7b8a 6823 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write" ) );
maclobdell 0:f7c60d3e7b8a 6824
maclobdell 0:f7c60d3e7b8a 6825 return( ret );
maclobdell 0:f7c60d3e7b8a 6826 }
maclobdell 0:f7c60d3e7b8a 6827
maclobdell 0:f7c60d3e7b8a 6828 /*
maclobdell 0:f7c60d3e7b8a 6829 * Notify the peer that the connection is being closed
maclobdell 0:f7c60d3e7b8a 6830 */
maclobdell 0:f7c60d3e7b8a 6831 int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6832 {
maclobdell 0:f7c60d3e7b8a 6833 int ret;
maclobdell 0:f7c60d3e7b8a 6834
maclobdell 0:f7c60d3e7b8a 6835 if( ssl == NULL || ssl->conf == NULL )
maclobdell 0:f7c60d3e7b8a 6836 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
maclobdell 0:f7c60d3e7b8a 6837
maclobdell 0:f7c60d3e7b8a 6838 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
maclobdell 0:f7c60d3e7b8a 6839
maclobdell 0:f7c60d3e7b8a 6840 if( ssl->out_left != 0 )
maclobdell 0:f7c60d3e7b8a 6841 return( mbedtls_ssl_flush_output( ssl ) );
maclobdell 0:f7c60d3e7b8a 6842
maclobdell 0:f7c60d3e7b8a 6843 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
maclobdell 0:f7c60d3e7b8a 6844 {
maclobdell 0:f7c60d3e7b8a 6845 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
maclobdell 0:f7c60d3e7b8a 6846 MBEDTLS_SSL_ALERT_LEVEL_WARNING,
maclobdell 0:f7c60d3e7b8a 6847 MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 6848 {
maclobdell 0:f7c60d3e7b8a 6849 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_send_alert_message", ret );
maclobdell 0:f7c60d3e7b8a 6850 return( ret );
maclobdell 0:f7c60d3e7b8a 6851 }
maclobdell 0:f7c60d3e7b8a 6852 }
maclobdell 0:f7c60d3e7b8a 6853
maclobdell 0:f7c60d3e7b8a 6854 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
maclobdell 0:f7c60d3e7b8a 6855
maclobdell 0:f7c60d3e7b8a 6856 return( 0 );
maclobdell 0:f7c60d3e7b8a 6857 }
maclobdell 0:f7c60d3e7b8a 6858
maclobdell 0:f7c60d3e7b8a 6859 void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform )
maclobdell 0:f7c60d3e7b8a 6860 {
maclobdell 0:f7c60d3e7b8a 6861 if( transform == NULL )
maclobdell 0:f7c60d3e7b8a 6862 return;
maclobdell 0:f7c60d3e7b8a 6863
maclobdell 0:f7c60d3e7b8a 6864 #if defined(MBEDTLS_ZLIB_SUPPORT)
maclobdell 0:f7c60d3e7b8a 6865 deflateEnd( &transform->ctx_deflate );
maclobdell 0:f7c60d3e7b8a 6866 inflateEnd( &transform->ctx_inflate );
maclobdell 0:f7c60d3e7b8a 6867 #endif
maclobdell 0:f7c60d3e7b8a 6868
maclobdell 0:f7c60d3e7b8a 6869 mbedtls_cipher_free( &transform->cipher_ctx_enc );
maclobdell 0:f7c60d3e7b8a 6870 mbedtls_cipher_free( &transform->cipher_ctx_dec );
maclobdell 0:f7c60d3e7b8a 6871
maclobdell 0:f7c60d3e7b8a 6872 mbedtls_md_free( &transform->md_ctx_enc );
maclobdell 0:f7c60d3e7b8a 6873 mbedtls_md_free( &transform->md_ctx_dec );
maclobdell 0:f7c60d3e7b8a 6874
maclobdell 0:f7c60d3e7b8a 6875 mbedtls_zeroize( transform, sizeof( mbedtls_ssl_transform ) );
maclobdell 0:f7c60d3e7b8a 6876 }
maclobdell 0:f7c60d3e7b8a 6877
maclobdell 0:f7c60d3e7b8a 6878 #if defined(MBEDTLS_X509_CRT_PARSE_C)
maclobdell 0:f7c60d3e7b8a 6879 static void ssl_key_cert_free( mbedtls_ssl_key_cert *key_cert )
maclobdell 0:f7c60d3e7b8a 6880 {
maclobdell 0:f7c60d3e7b8a 6881 mbedtls_ssl_key_cert *cur = key_cert, *next;
maclobdell 0:f7c60d3e7b8a 6882
maclobdell 0:f7c60d3e7b8a 6883 while( cur != NULL )
maclobdell 0:f7c60d3e7b8a 6884 {
maclobdell 0:f7c60d3e7b8a 6885 next = cur->next;
maclobdell 0:f7c60d3e7b8a 6886 mbedtls_free( cur );
maclobdell 0:f7c60d3e7b8a 6887 cur = next;
maclobdell 0:f7c60d3e7b8a 6888 }
maclobdell 0:f7c60d3e7b8a 6889 }
maclobdell 0:f7c60d3e7b8a 6890 #endif /* MBEDTLS_X509_CRT_PARSE_C */
maclobdell 0:f7c60d3e7b8a 6891
maclobdell 0:f7c60d3e7b8a 6892 void mbedtls_ssl_handshake_free( mbedtls_ssl_handshake_params *handshake )
maclobdell 0:f7c60d3e7b8a 6893 {
maclobdell 0:f7c60d3e7b8a 6894 if( handshake == NULL )
maclobdell 0:f7c60d3e7b8a 6895 return;
maclobdell 0:f7c60d3e7b8a 6896
maclobdell 0:f7c60d3e7b8a 6897 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
maclobdell 0:f7c60d3e7b8a 6898 defined(MBEDTLS_SSL_PROTO_TLS1_1)
maclobdell 0:f7c60d3e7b8a 6899 mbedtls_md5_free( &handshake->fin_md5 );
maclobdell 0:f7c60d3e7b8a 6900 mbedtls_sha1_free( &handshake->fin_sha1 );
maclobdell 0:f7c60d3e7b8a 6901 #endif
maclobdell 0:f7c60d3e7b8a 6902 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
maclobdell 0:f7c60d3e7b8a 6903 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 6904 mbedtls_sha256_free( &handshake->fin_sha256 );
maclobdell 0:f7c60d3e7b8a 6905 #endif
maclobdell 0:f7c60d3e7b8a 6906 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 6907 mbedtls_sha512_free( &handshake->fin_sha512 );
maclobdell 0:f7c60d3e7b8a 6908 #endif
maclobdell 0:f7c60d3e7b8a 6909 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
maclobdell 0:f7c60d3e7b8a 6910
maclobdell 0:f7c60d3e7b8a 6911 #if defined(MBEDTLS_DHM_C)
maclobdell 0:f7c60d3e7b8a 6912 mbedtls_dhm_free( &handshake->dhm_ctx );
maclobdell 0:f7c60d3e7b8a 6913 #endif
maclobdell 0:f7c60d3e7b8a 6914 #if defined(MBEDTLS_ECDH_C)
maclobdell 0:f7c60d3e7b8a 6915 mbedtls_ecdh_free( &handshake->ecdh_ctx );
maclobdell 0:f7c60d3e7b8a 6916 #endif
maclobdell 0:f7c60d3e7b8a 6917 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
maclobdell 0:f7c60d3e7b8a 6918 mbedtls_ecjpake_free( &handshake->ecjpake_ctx );
maclobdell 0:f7c60d3e7b8a 6919 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 6920 mbedtls_free( handshake->ecjpake_cache );
maclobdell 0:f7c60d3e7b8a 6921 handshake->ecjpake_cache = NULL;
maclobdell 0:f7c60d3e7b8a 6922 handshake->ecjpake_cache_len = 0;
maclobdell 0:f7c60d3e7b8a 6923 #endif
maclobdell 0:f7c60d3e7b8a 6924 #endif
maclobdell 0:f7c60d3e7b8a 6925
maclobdell 0:f7c60d3e7b8a 6926 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
maclobdell 0:f7c60d3e7b8a 6927 /* explicit void pointer cast for buggy MS compiler */
maclobdell 0:f7c60d3e7b8a 6928 mbedtls_free( (void *) handshake->curves );
maclobdell 0:f7c60d3e7b8a 6929 #endif
maclobdell 0:f7c60d3e7b8a 6930
maclobdell 0:f7c60d3e7b8a 6931 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
maclobdell 0:f7c60d3e7b8a 6932 if( handshake->psk != NULL )
maclobdell 0:f7c60d3e7b8a 6933 {
maclobdell 0:f7c60d3e7b8a 6934 mbedtls_zeroize( handshake->psk, handshake->psk_len );
maclobdell 0:f7c60d3e7b8a 6935 mbedtls_free( handshake->psk );
maclobdell 0:f7c60d3e7b8a 6936 }
maclobdell 0:f7c60d3e7b8a 6937 #endif
maclobdell 0:f7c60d3e7b8a 6938
maclobdell 0:f7c60d3e7b8a 6939 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
maclobdell 0:f7c60d3e7b8a 6940 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
maclobdell 0:f7c60d3e7b8a 6941 /*
maclobdell 0:f7c60d3e7b8a 6942 * Free only the linked list wrapper, not the keys themselves
maclobdell 0:f7c60d3e7b8a 6943 * since the belong to the SNI callback
maclobdell 0:f7c60d3e7b8a 6944 */
maclobdell 0:f7c60d3e7b8a 6945 if( handshake->sni_key_cert != NULL )
maclobdell 0:f7c60d3e7b8a 6946 {
maclobdell 0:f7c60d3e7b8a 6947 mbedtls_ssl_key_cert *cur = handshake->sni_key_cert, *next;
maclobdell 0:f7c60d3e7b8a 6948
maclobdell 0:f7c60d3e7b8a 6949 while( cur != NULL )
maclobdell 0:f7c60d3e7b8a 6950 {
maclobdell 0:f7c60d3e7b8a 6951 next = cur->next;
maclobdell 0:f7c60d3e7b8a 6952 mbedtls_free( cur );
maclobdell 0:f7c60d3e7b8a 6953 cur = next;
maclobdell 0:f7c60d3e7b8a 6954 }
maclobdell 0:f7c60d3e7b8a 6955 }
maclobdell 0:f7c60d3e7b8a 6956 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_SERVER_NAME_INDICATION */
maclobdell 0:f7c60d3e7b8a 6957
maclobdell 0:f7c60d3e7b8a 6958 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 6959 mbedtls_free( handshake->verify_cookie );
maclobdell 0:f7c60d3e7b8a 6960 mbedtls_free( handshake->hs_msg );
maclobdell 0:f7c60d3e7b8a 6961 ssl_flight_free( handshake->flight );
maclobdell 0:f7c60d3e7b8a 6962 #endif
maclobdell 0:f7c60d3e7b8a 6963
maclobdell 0:f7c60d3e7b8a 6964 mbedtls_zeroize( handshake, sizeof( mbedtls_ssl_handshake_params ) );
maclobdell 0:f7c60d3e7b8a 6965 }
maclobdell 0:f7c60d3e7b8a 6966
maclobdell 0:f7c60d3e7b8a 6967 void mbedtls_ssl_session_free( mbedtls_ssl_session *session )
maclobdell 0:f7c60d3e7b8a 6968 {
maclobdell 0:f7c60d3e7b8a 6969 if( session == NULL )
maclobdell 0:f7c60d3e7b8a 6970 return;
maclobdell 0:f7c60d3e7b8a 6971
maclobdell 0:f7c60d3e7b8a 6972 #if defined(MBEDTLS_X509_CRT_PARSE_C)
maclobdell 0:f7c60d3e7b8a 6973 if( session->peer_cert != NULL )
maclobdell 0:f7c60d3e7b8a 6974 {
maclobdell 0:f7c60d3e7b8a 6975 mbedtls_x509_crt_free( session->peer_cert );
maclobdell 0:f7c60d3e7b8a 6976 mbedtls_free( session->peer_cert );
maclobdell 0:f7c60d3e7b8a 6977 }
maclobdell 0:f7c60d3e7b8a 6978 #endif
maclobdell 0:f7c60d3e7b8a 6979
maclobdell 0:f7c60d3e7b8a 6980 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 6981 mbedtls_free( session->ticket );
maclobdell 0:f7c60d3e7b8a 6982 #endif
maclobdell 0:f7c60d3e7b8a 6983
maclobdell 0:f7c60d3e7b8a 6984 mbedtls_zeroize( session, sizeof( mbedtls_ssl_session ) );
maclobdell 0:f7c60d3e7b8a 6985 }
maclobdell 0:f7c60d3e7b8a 6986
maclobdell 0:f7c60d3e7b8a 6987 /*
maclobdell 0:f7c60d3e7b8a 6988 * Free an SSL context
maclobdell 0:f7c60d3e7b8a 6989 */
maclobdell 0:f7c60d3e7b8a 6990 void mbedtls_ssl_free( mbedtls_ssl_context *ssl )
maclobdell 0:f7c60d3e7b8a 6991 {
maclobdell 0:f7c60d3e7b8a 6992 if( ssl == NULL )
maclobdell 0:f7c60d3e7b8a 6993 return;
maclobdell 0:f7c60d3e7b8a 6994
maclobdell 0:f7c60d3e7b8a 6995 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> free" ) );
maclobdell 0:f7c60d3e7b8a 6996
maclobdell 0:f7c60d3e7b8a 6997 if( ssl->out_buf != NULL )
maclobdell 0:f7c60d3e7b8a 6998 {
maclobdell 0:f7c60d3e7b8a 6999 mbedtls_zeroize( ssl->out_buf, MBEDTLS_SSL_BUFFER_LEN );
maclobdell 0:f7c60d3e7b8a 7000 mbedtls_free( ssl->out_buf );
maclobdell 0:f7c60d3e7b8a 7001 }
maclobdell 0:f7c60d3e7b8a 7002
maclobdell 0:f7c60d3e7b8a 7003 if( ssl->in_buf != NULL )
maclobdell 0:f7c60d3e7b8a 7004 {
maclobdell 0:f7c60d3e7b8a 7005 mbedtls_zeroize( ssl->in_buf, MBEDTLS_SSL_BUFFER_LEN );
maclobdell 0:f7c60d3e7b8a 7006 mbedtls_free( ssl->in_buf );
maclobdell 0:f7c60d3e7b8a 7007 }
maclobdell 0:f7c60d3e7b8a 7008
maclobdell 0:f7c60d3e7b8a 7009 #if defined(MBEDTLS_ZLIB_SUPPORT)
maclobdell 0:f7c60d3e7b8a 7010 if( ssl->compress_buf != NULL )
maclobdell 0:f7c60d3e7b8a 7011 {
maclobdell 0:f7c60d3e7b8a 7012 mbedtls_zeroize( ssl->compress_buf, MBEDTLS_SSL_BUFFER_LEN );
maclobdell 0:f7c60d3e7b8a 7013 mbedtls_free( ssl->compress_buf );
maclobdell 0:f7c60d3e7b8a 7014 }
maclobdell 0:f7c60d3e7b8a 7015 #endif
maclobdell 0:f7c60d3e7b8a 7016
maclobdell 0:f7c60d3e7b8a 7017 if( ssl->transform )
maclobdell 0:f7c60d3e7b8a 7018 {
maclobdell 0:f7c60d3e7b8a 7019 mbedtls_ssl_transform_free( ssl->transform );
maclobdell 0:f7c60d3e7b8a 7020 mbedtls_free( ssl->transform );
maclobdell 0:f7c60d3e7b8a 7021 }
maclobdell 0:f7c60d3e7b8a 7022
maclobdell 0:f7c60d3e7b8a 7023 if( ssl->handshake )
maclobdell 0:f7c60d3e7b8a 7024 {
maclobdell 0:f7c60d3e7b8a 7025 mbedtls_ssl_handshake_free( ssl->handshake );
maclobdell 0:f7c60d3e7b8a 7026 mbedtls_ssl_transform_free( ssl->transform_negotiate );
maclobdell 0:f7c60d3e7b8a 7027 mbedtls_ssl_session_free( ssl->session_negotiate );
maclobdell 0:f7c60d3e7b8a 7028
maclobdell 0:f7c60d3e7b8a 7029 mbedtls_free( ssl->handshake );
maclobdell 0:f7c60d3e7b8a 7030 mbedtls_free( ssl->transform_negotiate );
maclobdell 0:f7c60d3e7b8a 7031 mbedtls_free( ssl->session_negotiate );
maclobdell 0:f7c60d3e7b8a 7032 }
maclobdell 0:f7c60d3e7b8a 7033
maclobdell 0:f7c60d3e7b8a 7034 if( ssl->session )
maclobdell 0:f7c60d3e7b8a 7035 {
maclobdell 0:f7c60d3e7b8a 7036 mbedtls_ssl_session_free( ssl->session );
maclobdell 0:f7c60d3e7b8a 7037 mbedtls_free( ssl->session );
maclobdell 0:f7c60d3e7b8a 7038 }
maclobdell 0:f7c60d3e7b8a 7039
maclobdell 0:f7c60d3e7b8a 7040 #if defined(MBEDTLS_X509_CRT_PARSE_C)
maclobdell 0:f7c60d3e7b8a 7041 if( ssl->hostname != NULL )
maclobdell 0:f7c60d3e7b8a 7042 {
maclobdell 0:f7c60d3e7b8a 7043 mbedtls_zeroize( ssl->hostname, strlen( ssl->hostname ) );
maclobdell 0:f7c60d3e7b8a 7044 mbedtls_free( ssl->hostname );
maclobdell 0:f7c60d3e7b8a 7045 }
maclobdell 0:f7c60d3e7b8a 7046 #endif
maclobdell 0:f7c60d3e7b8a 7047
maclobdell 0:f7c60d3e7b8a 7048 #if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
maclobdell 0:f7c60d3e7b8a 7049 if( mbedtls_ssl_hw_record_finish != NULL )
maclobdell 0:f7c60d3e7b8a 7050 {
maclobdell 0:f7c60d3e7b8a 7051 MBEDTLS_SSL_DEBUG_MSG( 2, ( "going for mbedtls_ssl_hw_record_finish()" ) );
maclobdell 0:f7c60d3e7b8a 7052 mbedtls_ssl_hw_record_finish( ssl );
maclobdell 0:f7c60d3e7b8a 7053 }
maclobdell 0:f7c60d3e7b8a 7054 #endif
maclobdell 0:f7c60d3e7b8a 7055
maclobdell 0:f7c60d3e7b8a 7056 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 7057 mbedtls_free( ssl->cli_id );
maclobdell 0:f7c60d3e7b8a 7058 #endif
maclobdell 0:f7c60d3e7b8a 7059
maclobdell 0:f7c60d3e7b8a 7060 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= free" ) );
maclobdell 0:f7c60d3e7b8a 7061
maclobdell 0:f7c60d3e7b8a 7062 /* Actually clear after last debug message */
maclobdell 0:f7c60d3e7b8a 7063 mbedtls_zeroize( ssl, sizeof( mbedtls_ssl_context ) );
maclobdell 0:f7c60d3e7b8a 7064 }
maclobdell 0:f7c60d3e7b8a 7065
maclobdell 0:f7c60d3e7b8a 7066 /*
maclobdell 0:f7c60d3e7b8a 7067 * Initialze mbedtls_ssl_config
maclobdell 0:f7c60d3e7b8a 7068 */
maclobdell 0:f7c60d3e7b8a 7069 void mbedtls_ssl_config_init( mbedtls_ssl_config *conf )
maclobdell 0:f7c60d3e7b8a 7070 {
maclobdell 0:f7c60d3e7b8a 7071 memset( conf, 0, sizeof( mbedtls_ssl_config ) );
maclobdell 0:f7c60d3e7b8a 7072 }
maclobdell 0:f7c60d3e7b8a 7073
maclobdell 0:f7c60d3e7b8a 7074 static int ssl_preset_suiteb_ciphersuites[] = {
maclobdell 0:f7c60d3e7b8a 7075 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
maclobdell 0:f7c60d3e7b8a 7076 MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
maclobdell 0:f7c60d3e7b8a 7077 0
maclobdell 0:f7c60d3e7b8a 7078 };
maclobdell 0:f7c60d3e7b8a 7079
maclobdell 0:f7c60d3e7b8a 7080 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
maclobdell 0:f7c60d3e7b8a 7081 static int ssl_preset_suiteb_hashes[] = {
maclobdell 0:f7c60d3e7b8a 7082 MBEDTLS_MD_SHA256,
maclobdell 0:f7c60d3e7b8a 7083 MBEDTLS_MD_SHA384,
maclobdell 0:f7c60d3e7b8a 7084 MBEDTLS_MD_NONE
maclobdell 0:f7c60d3e7b8a 7085 };
maclobdell 0:f7c60d3e7b8a 7086 #endif
maclobdell 0:f7c60d3e7b8a 7087
maclobdell 0:f7c60d3e7b8a 7088 #if defined(MBEDTLS_ECP_C)
maclobdell 0:f7c60d3e7b8a 7089 static mbedtls_ecp_group_id ssl_preset_suiteb_curves[] = {
maclobdell 0:f7c60d3e7b8a 7090 MBEDTLS_ECP_DP_SECP256R1,
maclobdell 0:f7c60d3e7b8a 7091 MBEDTLS_ECP_DP_SECP384R1,
maclobdell 0:f7c60d3e7b8a 7092 MBEDTLS_ECP_DP_NONE
maclobdell 0:f7c60d3e7b8a 7093 };
maclobdell 0:f7c60d3e7b8a 7094 #endif
maclobdell 0:f7c60d3e7b8a 7095
maclobdell 0:f7c60d3e7b8a 7096 /*
maclobdell 0:f7c60d3e7b8a 7097 * Load default in mbedtls_ssl_config
maclobdell 0:f7c60d3e7b8a 7098 */
maclobdell 0:f7c60d3e7b8a 7099 int mbedtls_ssl_config_defaults( mbedtls_ssl_config *conf,
maclobdell 0:f7c60d3e7b8a 7100 int endpoint, int transport, int preset )
maclobdell 0:f7c60d3e7b8a 7101 {
maclobdell 0:f7c60d3e7b8a 7102 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 7103 int ret;
maclobdell 0:f7c60d3e7b8a 7104 #endif
maclobdell 0:f7c60d3e7b8a 7105
maclobdell 0:f7c60d3e7b8a 7106 /* Use the functions here so that they are covered in tests,
maclobdell 0:f7c60d3e7b8a 7107 * but otherwise access member directly for efficiency */
maclobdell 0:f7c60d3e7b8a 7108 mbedtls_ssl_conf_endpoint( conf, endpoint );
maclobdell 0:f7c60d3e7b8a 7109 mbedtls_ssl_conf_transport( conf, transport );
maclobdell 0:f7c60d3e7b8a 7110
maclobdell 0:f7c60d3e7b8a 7111 /*
maclobdell 0:f7c60d3e7b8a 7112 * Things that are common to all presets
maclobdell 0:f7c60d3e7b8a 7113 */
maclobdell 0:f7c60d3e7b8a 7114 #if defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 7115 if( endpoint == MBEDTLS_SSL_IS_CLIENT )
maclobdell 0:f7c60d3e7b8a 7116 {
maclobdell 0:f7c60d3e7b8a 7117 conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
maclobdell 0:f7c60d3e7b8a 7118 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
maclobdell 0:f7c60d3e7b8a 7119 conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
maclobdell 0:f7c60d3e7b8a 7120 #endif
maclobdell 0:f7c60d3e7b8a 7121 }
maclobdell 0:f7c60d3e7b8a 7122 #endif
maclobdell 0:f7c60d3e7b8a 7123
maclobdell 0:f7c60d3e7b8a 7124 #if defined(MBEDTLS_ARC4_C)
maclobdell 0:f7c60d3e7b8a 7125 conf->arc4_disabled = MBEDTLS_SSL_ARC4_DISABLED;
maclobdell 0:f7c60d3e7b8a 7126 #endif
maclobdell 0:f7c60d3e7b8a 7127
maclobdell 0:f7c60d3e7b8a 7128 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
maclobdell 0:f7c60d3e7b8a 7129 conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
maclobdell 0:f7c60d3e7b8a 7130 #endif
maclobdell 0:f7c60d3e7b8a 7131
maclobdell 0:f7c60d3e7b8a 7132 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
maclobdell 0:f7c60d3e7b8a 7133 conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
maclobdell 0:f7c60d3e7b8a 7134 #endif
maclobdell 0:f7c60d3e7b8a 7135
maclobdell 0:f7c60d3e7b8a 7136 #if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
maclobdell 0:f7c60d3e7b8a 7137 conf->cbc_record_splitting = MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED;
maclobdell 0:f7c60d3e7b8a 7138 #endif
maclobdell 0:f7c60d3e7b8a 7139
maclobdell 0:f7c60d3e7b8a 7140 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 7141 conf->f_cookie_write = ssl_cookie_write_dummy;
maclobdell 0:f7c60d3e7b8a 7142 conf->f_cookie_check = ssl_cookie_check_dummy;
maclobdell 0:f7c60d3e7b8a 7143 #endif
maclobdell 0:f7c60d3e7b8a 7144
maclobdell 0:f7c60d3e7b8a 7145 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
maclobdell 0:f7c60d3e7b8a 7146 conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
maclobdell 0:f7c60d3e7b8a 7147 #endif
maclobdell 0:f7c60d3e7b8a 7148
maclobdell 0:f7c60d3e7b8a 7149 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 7150 conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
maclobdell 0:f7c60d3e7b8a 7151 conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
maclobdell 0:f7c60d3e7b8a 7152 #endif
maclobdell 0:f7c60d3e7b8a 7153
maclobdell 0:f7c60d3e7b8a 7154 #if defined(MBEDTLS_SSL_RENEGOTIATION)
maclobdell 0:f7c60d3e7b8a 7155 conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
maclobdell 0:f7c60d3e7b8a 7156 memset( conf->renego_period, 0xFF, 7 );
maclobdell 0:f7c60d3e7b8a 7157 conf->renego_period[7] = 0x00;
maclobdell 0:f7c60d3e7b8a 7158 #endif
maclobdell 0:f7c60d3e7b8a 7159
maclobdell 0:f7c60d3e7b8a 7160 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_SRV_C)
maclobdell 0:f7c60d3e7b8a 7161 if( endpoint == MBEDTLS_SSL_IS_SERVER )
maclobdell 0:f7c60d3e7b8a 7162 {
maclobdell 0:f7c60d3e7b8a 7163 if( ( ret = mbedtls_ssl_conf_dh_param( conf,
maclobdell 0:f7c60d3e7b8a 7164 MBEDTLS_DHM_RFC5114_MODP_2048_P,
maclobdell 0:f7c60d3e7b8a 7165 MBEDTLS_DHM_RFC5114_MODP_2048_G ) ) != 0 )
maclobdell 0:f7c60d3e7b8a 7166 {
maclobdell 0:f7c60d3e7b8a 7167 return( ret );
maclobdell 0:f7c60d3e7b8a 7168 }
maclobdell 0:f7c60d3e7b8a 7169 }
maclobdell 0:f7c60d3e7b8a 7170 #endif
maclobdell 0:f7c60d3e7b8a 7171
maclobdell 0:f7c60d3e7b8a 7172 /*
maclobdell 0:f7c60d3e7b8a 7173 * Preset-specific defaults
maclobdell 0:f7c60d3e7b8a 7174 */
maclobdell 0:f7c60d3e7b8a 7175 switch( preset )
maclobdell 0:f7c60d3e7b8a 7176 {
maclobdell 0:f7c60d3e7b8a 7177 /*
maclobdell 0:f7c60d3e7b8a 7178 * NSA Suite B
maclobdell 0:f7c60d3e7b8a 7179 */
maclobdell 0:f7c60d3e7b8a 7180 case MBEDTLS_SSL_PRESET_SUITEB:
maclobdell 0:f7c60d3e7b8a 7181 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
maclobdell 0:f7c60d3e7b8a 7182 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
maclobdell 0:f7c60d3e7b8a 7183 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
maclobdell 0:f7c60d3e7b8a 7184 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
maclobdell 0:f7c60d3e7b8a 7185
maclobdell 0:f7c60d3e7b8a 7186 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
maclobdell 0:f7c60d3e7b8a 7187 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
maclobdell 0:f7c60d3e7b8a 7188 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
maclobdell 0:f7c60d3e7b8a 7189 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
maclobdell 0:f7c60d3e7b8a 7190 ssl_preset_suiteb_ciphersuites;
maclobdell 0:f7c60d3e7b8a 7191
maclobdell 0:f7c60d3e7b8a 7192 #if defined(MBEDTLS_X509_CRT_PARSE_C)
maclobdell 0:f7c60d3e7b8a 7193 conf->cert_profile = &mbedtls_x509_crt_profile_suiteb;
maclobdell 0:f7c60d3e7b8a 7194 #endif
maclobdell 0:f7c60d3e7b8a 7195
maclobdell 0:f7c60d3e7b8a 7196 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
maclobdell 0:f7c60d3e7b8a 7197 conf->sig_hashes = ssl_preset_suiteb_hashes;
maclobdell 0:f7c60d3e7b8a 7198 #endif
maclobdell 0:f7c60d3e7b8a 7199
maclobdell 0:f7c60d3e7b8a 7200 #if defined(MBEDTLS_ECP_C)
maclobdell 0:f7c60d3e7b8a 7201 conf->curve_list = ssl_preset_suiteb_curves;
maclobdell 0:f7c60d3e7b8a 7202 #endif
maclobdell 0:f7c60d3e7b8a 7203 break;
maclobdell 0:f7c60d3e7b8a 7204
maclobdell 0:f7c60d3e7b8a 7205 /*
maclobdell 0:f7c60d3e7b8a 7206 * Default
maclobdell 0:f7c60d3e7b8a 7207 */
maclobdell 0:f7c60d3e7b8a 7208 default:
maclobdell 0:f7c60d3e7b8a 7209 conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
maclobdell 0:f7c60d3e7b8a 7210 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_1; /* TLS 1.0 */
maclobdell 0:f7c60d3e7b8a 7211 conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
maclobdell 0:f7c60d3e7b8a 7212 conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
maclobdell 0:f7c60d3e7b8a 7213
maclobdell 0:f7c60d3e7b8a 7214 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 7215 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 7216 conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
maclobdell 0:f7c60d3e7b8a 7217 #endif
maclobdell 0:f7c60d3e7b8a 7218
maclobdell 0:f7c60d3e7b8a 7219 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] =
maclobdell 0:f7c60d3e7b8a 7220 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] =
maclobdell 0:f7c60d3e7b8a 7221 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] =
maclobdell 0:f7c60d3e7b8a 7222 conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] =
maclobdell 0:f7c60d3e7b8a 7223 mbedtls_ssl_list_ciphersuites();
maclobdell 0:f7c60d3e7b8a 7224
maclobdell 0:f7c60d3e7b8a 7225 #if defined(MBEDTLS_X509_CRT_PARSE_C)
maclobdell 0:f7c60d3e7b8a 7226 conf->cert_profile = &mbedtls_x509_crt_profile_default;
maclobdell 0:f7c60d3e7b8a 7227 #endif
maclobdell 0:f7c60d3e7b8a 7228
maclobdell 0:f7c60d3e7b8a 7229 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
maclobdell 0:f7c60d3e7b8a 7230 conf->sig_hashes = mbedtls_md_list();
maclobdell 0:f7c60d3e7b8a 7231 #endif
maclobdell 0:f7c60d3e7b8a 7232
maclobdell 0:f7c60d3e7b8a 7233 #if defined(MBEDTLS_ECP_C)
maclobdell 0:f7c60d3e7b8a 7234 conf->curve_list = mbedtls_ecp_grp_id_list();
maclobdell 0:f7c60d3e7b8a 7235 #endif
maclobdell 0:f7c60d3e7b8a 7236
maclobdell 0:f7c60d3e7b8a 7237 #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
maclobdell 0:f7c60d3e7b8a 7238 conf->dhm_min_bitlen = 1024;
maclobdell 0:f7c60d3e7b8a 7239 #endif
maclobdell 0:f7c60d3e7b8a 7240 }
maclobdell 0:f7c60d3e7b8a 7241
maclobdell 0:f7c60d3e7b8a 7242 return( 0 );
maclobdell 0:f7c60d3e7b8a 7243 }
maclobdell 0:f7c60d3e7b8a 7244
maclobdell 0:f7c60d3e7b8a 7245 /*
maclobdell 0:f7c60d3e7b8a 7246 * Free mbedtls_ssl_config
maclobdell 0:f7c60d3e7b8a 7247 */
maclobdell 0:f7c60d3e7b8a 7248 void mbedtls_ssl_config_free( mbedtls_ssl_config *conf )
maclobdell 0:f7c60d3e7b8a 7249 {
maclobdell 0:f7c60d3e7b8a 7250 #if defined(MBEDTLS_DHM_C)
maclobdell 0:f7c60d3e7b8a 7251 mbedtls_mpi_free( &conf->dhm_P );
maclobdell 0:f7c60d3e7b8a 7252 mbedtls_mpi_free( &conf->dhm_G );
maclobdell 0:f7c60d3e7b8a 7253 #endif
maclobdell 0:f7c60d3e7b8a 7254
maclobdell 0:f7c60d3e7b8a 7255 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
maclobdell 0:f7c60d3e7b8a 7256 if( conf->psk != NULL )
maclobdell 0:f7c60d3e7b8a 7257 {
maclobdell 0:f7c60d3e7b8a 7258 mbedtls_zeroize( conf->psk, conf->psk_len );
maclobdell 0:f7c60d3e7b8a 7259 mbedtls_zeroize( conf->psk_identity, conf->psk_identity_len );
maclobdell 0:f7c60d3e7b8a 7260 mbedtls_free( conf->psk );
maclobdell 0:f7c60d3e7b8a 7261 mbedtls_free( conf->psk_identity );
maclobdell 0:f7c60d3e7b8a 7262 conf->psk_len = 0;
maclobdell 0:f7c60d3e7b8a 7263 conf->psk_identity_len = 0;
maclobdell 0:f7c60d3e7b8a 7264 }
maclobdell 0:f7c60d3e7b8a 7265 #endif
maclobdell 0:f7c60d3e7b8a 7266
maclobdell 0:f7c60d3e7b8a 7267 #if defined(MBEDTLS_X509_CRT_PARSE_C)
maclobdell 0:f7c60d3e7b8a 7268 ssl_key_cert_free( conf->key_cert );
maclobdell 0:f7c60d3e7b8a 7269 #endif
maclobdell 0:f7c60d3e7b8a 7270
maclobdell 0:f7c60d3e7b8a 7271 mbedtls_zeroize( conf, sizeof( mbedtls_ssl_config ) );
maclobdell 0:f7c60d3e7b8a 7272 }
maclobdell 0:f7c60d3e7b8a 7273
maclobdell 0:f7c60d3e7b8a 7274 #if defined(MBEDTLS_PK_C) && \
maclobdell 0:f7c60d3e7b8a 7275 ( defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) )
maclobdell 0:f7c60d3e7b8a 7276 /*
maclobdell 0:f7c60d3e7b8a 7277 * Convert between MBEDTLS_PK_XXX and SSL_SIG_XXX
maclobdell 0:f7c60d3e7b8a 7278 */
maclobdell 0:f7c60d3e7b8a 7279 unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk )
maclobdell 0:f7c60d3e7b8a 7280 {
maclobdell 0:f7c60d3e7b8a 7281 #if defined(MBEDTLS_RSA_C)
maclobdell 0:f7c60d3e7b8a 7282 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_RSA ) )
maclobdell 0:f7c60d3e7b8a 7283 return( MBEDTLS_SSL_SIG_RSA );
maclobdell 0:f7c60d3e7b8a 7284 #endif
maclobdell 0:f7c60d3e7b8a 7285 #if defined(MBEDTLS_ECDSA_C)
maclobdell 0:f7c60d3e7b8a 7286 if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECDSA ) )
maclobdell 0:f7c60d3e7b8a 7287 return( MBEDTLS_SSL_SIG_ECDSA );
maclobdell 0:f7c60d3e7b8a 7288 #endif
maclobdell 0:f7c60d3e7b8a 7289 return( MBEDTLS_SSL_SIG_ANON );
maclobdell 0:f7c60d3e7b8a 7290 }
maclobdell 0:f7c60d3e7b8a 7291
maclobdell 0:f7c60d3e7b8a 7292 mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig )
maclobdell 0:f7c60d3e7b8a 7293 {
maclobdell 0:f7c60d3e7b8a 7294 switch( sig )
maclobdell 0:f7c60d3e7b8a 7295 {
maclobdell 0:f7c60d3e7b8a 7296 #if defined(MBEDTLS_RSA_C)
maclobdell 0:f7c60d3e7b8a 7297 case MBEDTLS_SSL_SIG_RSA:
maclobdell 0:f7c60d3e7b8a 7298 return( MBEDTLS_PK_RSA );
maclobdell 0:f7c60d3e7b8a 7299 #endif
maclobdell 0:f7c60d3e7b8a 7300 #if defined(MBEDTLS_ECDSA_C)
maclobdell 0:f7c60d3e7b8a 7301 case MBEDTLS_SSL_SIG_ECDSA:
maclobdell 0:f7c60d3e7b8a 7302 return( MBEDTLS_PK_ECDSA );
maclobdell 0:f7c60d3e7b8a 7303 #endif
maclobdell 0:f7c60d3e7b8a 7304 default:
maclobdell 0:f7c60d3e7b8a 7305 return( MBEDTLS_PK_NONE );
maclobdell 0:f7c60d3e7b8a 7306 }
maclobdell 0:f7c60d3e7b8a 7307 }
maclobdell 0:f7c60d3e7b8a 7308 #endif /* MBEDTLS_PK_C && ( MBEDTLS_RSA_C || MBEDTLS_ECDSA_C ) */
maclobdell 0:f7c60d3e7b8a 7309
maclobdell 0:f7c60d3e7b8a 7310 /*
maclobdell 0:f7c60d3e7b8a 7311 * Convert from MBEDTLS_SSL_HASH_XXX to MBEDTLS_MD_XXX
maclobdell 0:f7c60d3e7b8a 7312 */
maclobdell 0:f7c60d3e7b8a 7313 mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
maclobdell 0:f7c60d3e7b8a 7314 {
maclobdell 0:f7c60d3e7b8a 7315 switch( hash )
maclobdell 0:f7c60d3e7b8a 7316 {
maclobdell 0:f7c60d3e7b8a 7317 #if defined(MBEDTLS_MD5_C)
maclobdell 0:f7c60d3e7b8a 7318 case MBEDTLS_SSL_HASH_MD5:
maclobdell 0:f7c60d3e7b8a 7319 return( MBEDTLS_MD_MD5 );
maclobdell 0:f7c60d3e7b8a 7320 #endif
maclobdell 0:f7c60d3e7b8a 7321 #if defined(MBEDTLS_SHA1_C)
maclobdell 0:f7c60d3e7b8a 7322 case MBEDTLS_SSL_HASH_SHA1:
maclobdell 0:f7c60d3e7b8a 7323 return( MBEDTLS_MD_SHA1 );
maclobdell 0:f7c60d3e7b8a 7324 #endif
maclobdell 0:f7c60d3e7b8a 7325 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 7326 case MBEDTLS_SSL_HASH_SHA224:
maclobdell 0:f7c60d3e7b8a 7327 return( MBEDTLS_MD_SHA224 );
maclobdell 0:f7c60d3e7b8a 7328 case MBEDTLS_SSL_HASH_SHA256:
maclobdell 0:f7c60d3e7b8a 7329 return( MBEDTLS_MD_SHA256 );
maclobdell 0:f7c60d3e7b8a 7330 #endif
maclobdell 0:f7c60d3e7b8a 7331 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 7332 case MBEDTLS_SSL_HASH_SHA384:
maclobdell 0:f7c60d3e7b8a 7333 return( MBEDTLS_MD_SHA384 );
maclobdell 0:f7c60d3e7b8a 7334 case MBEDTLS_SSL_HASH_SHA512:
maclobdell 0:f7c60d3e7b8a 7335 return( MBEDTLS_MD_SHA512 );
maclobdell 0:f7c60d3e7b8a 7336 #endif
maclobdell 0:f7c60d3e7b8a 7337 default:
maclobdell 0:f7c60d3e7b8a 7338 return( MBEDTLS_MD_NONE );
maclobdell 0:f7c60d3e7b8a 7339 }
maclobdell 0:f7c60d3e7b8a 7340 }
maclobdell 0:f7c60d3e7b8a 7341
maclobdell 0:f7c60d3e7b8a 7342 /*
maclobdell 0:f7c60d3e7b8a 7343 * Convert from MBEDTLS_MD_XXX to MBEDTLS_SSL_HASH_XXX
maclobdell 0:f7c60d3e7b8a 7344 */
maclobdell 0:f7c60d3e7b8a 7345 unsigned char mbedtls_ssl_hash_from_md_alg( int md )
maclobdell 0:f7c60d3e7b8a 7346 {
maclobdell 0:f7c60d3e7b8a 7347 switch( md )
maclobdell 0:f7c60d3e7b8a 7348 {
maclobdell 0:f7c60d3e7b8a 7349 #if defined(MBEDTLS_MD5_C)
maclobdell 0:f7c60d3e7b8a 7350 case MBEDTLS_MD_MD5:
maclobdell 0:f7c60d3e7b8a 7351 return( MBEDTLS_SSL_HASH_MD5 );
maclobdell 0:f7c60d3e7b8a 7352 #endif
maclobdell 0:f7c60d3e7b8a 7353 #if defined(MBEDTLS_SHA1_C)
maclobdell 0:f7c60d3e7b8a 7354 case MBEDTLS_MD_SHA1:
maclobdell 0:f7c60d3e7b8a 7355 return( MBEDTLS_SSL_HASH_SHA1 );
maclobdell 0:f7c60d3e7b8a 7356 #endif
maclobdell 0:f7c60d3e7b8a 7357 #if defined(MBEDTLS_SHA256_C)
maclobdell 0:f7c60d3e7b8a 7358 case MBEDTLS_MD_SHA224:
maclobdell 0:f7c60d3e7b8a 7359 return( MBEDTLS_SSL_HASH_SHA224 );
maclobdell 0:f7c60d3e7b8a 7360 case MBEDTLS_MD_SHA256:
maclobdell 0:f7c60d3e7b8a 7361 return( MBEDTLS_SSL_HASH_SHA256 );
maclobdell 0:f7c60d3e7b8a 7362 #endif
maclobdell 0:f7c60d3e7b8a 7363 #if defined(MBEDTLS_SHA512_C)
maclobdell 0:f7c60d3e7b8a 7364 case MBEDTLS_MD_SHA384:
maclobdell 0:f7c60d3e7b8a 7365 return( MBEDTLS_SSL_HASH_SHA384 );
maclobdell 0:f7c60d3e7b8a 7366 case MBEDTLS_MD_SHA512:
maclobdell 0:f7c60d3e7b8a 7367 return( MBEDTLS_SSL_HASH_SHA512 );
maclobdell 0:f7c60d3e7b8a 7368 #endif
maclobdell 0:f7c60d3e7b8a 7369 default:
maclobdell 0:f7c60d3e7b8a 7370 return( MBEDTLS_SSL_HASH_NONE );
maclobdell 0:f7c60d3e7b8a 7371 }
maclobdell 0:f7c60d3e7b8a 7372 }
maclobdell 0:f7c60d3e7b8a 7373
maclobdell 0:f7c60d3e7b8a 7374 #if defined(MBEDTLS_ECP_C)
maclobdell 0:f7c60d3e7b8a 7375 /*
maclobdell 0:f7c60d3e7b8a 7376 * Check if a curve proposed by the peer is in our list.
maclobdell 0:f7c60d3e7b8a 7377 * Return 0 if we're willing to use it, -1 otherwise.
maclobdell 0:f7c60d3e7b8a 7378 */
maclobdell 0:f7c60d3e7b8a 7379 int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id )
maclobdell 0:f7c60d3e7b8a 7380 {
maclobdell 0:f7c60d3e7b8a 7381 const mbedtls_ecp_group_id *gid;
maclobdell 0:f7c60d3e7b8a 7382
maclobdell 0:f7c60d3e7b8a 7383 if( ssl->conf->curve_list == NULL )
maclobdell 0:f7c60d3e7b8a 7384 return( -1 );
maclobdell 0:f7c60d3e7b8a 7385
maclobdell 0:f7c60d3e7b8a 7386 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
maclobdell 0:f7c60d3e7b8a 7387 if( *gid == grp_id )
maclobdell 0:f7c60d3e7b8a 7388 return( 0 );
maclobdell 0:f7c60d3e7b8a 7389
maclobdell 0:f7c60d3e7b8a 7390 return( -1 );
maclobdell 0:f7c60d3e7b8a 7391 }
maclobdell 0:f7c60d3e7b8a 7392 #endif /* MBEDTLS_ECP_C */
maclobdell 0:f7c60d3e7b8a 7393
maclobdell 0:f7c60d3e7b8a 7394 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
maclobdell 0:f7c60d3e7b8a 7395 /*
maclobdell 0:f7c60d3e7b8a 7396 * Check if a hash proposed by the peer is in our list.
maclobdell 0:f7c60d3e7b8a 7397 * Return 0 if we're willing to use it, -1 otherwise.
maclobdell 0:f7c60d3e7b8a 7398 */
maclobdell 0:f7c60d3e7b8a 7399 int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
maclobdell 0:f7c60d3e7b8a 7400 mbedtls_md_type_t md )
maclobdell 0:f7c60d3e7b8a 7401 {
maclobdell 0:f7c60d3e7b8a 7402 const int *cur;
maclobdell 0:f7c60d3e7b8a 7403
maclobdell 0:f7c60d3e7b8a 7404 if( ssl->conf->sig_hashes == NULL )
maclobdell 0:f7c60d3e7b8a 7405 return( -1 );
maclobdell 0:f7c60d3e7b8a 7406
maclobdell 0:f7c60d3e7b8a 7407 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
maclobdell 0:f7c60d3e7b8a 7408 if( *cur == (int) md )
maclobdell 0:f7c60d3e7b8a 7409 return( 0 );
maclobdell 0:f7c60d3e7b8a 7410
maclobdell 0:f7c60d3e7b8a 7411 return( -1 );
maclobdell 0:f7c60d3e7b8a 7412 }
maclobdell 0:f7c60d3e7b8a 7413 #endif /* MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
maclobdell 0:f7c60d3e7b8a 7414
maclobdell 0:f7c60d3e7b8a 7415 #if defined(MBEDTLS_X509_CRT_PARSE_C)
maclobdell 0:f7c60d3e7b8a 7416 int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
maclobdell 0:f7c60d3e7b8a 7417 const mbedtls_ssl_ciphersuite_t *ciphersuite,
maclobdell 0:f7c60d3e7b8a 7418 int cert_endpoint,
maclobdell 0:f7c60d3e7b8a 7419 uint32_t *flags )
maclobdell 0:f7c60d3e7b8a 7420 {
maclobdell 0:f7c60d3e7b8a 7421 int ret = 0;
maclobdell 0:f7c60d3e7b8a 7422 #if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
maclobdell 0:f7c60d3e7b8a 7423 int usage = 0;
maclobdell 0:f7c60d3e7b8a 7424 #endif
maclobdell 0:f7c60d3e7b8a 7425 #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
maclobdell 0:f7c60d3e7b8a 7426 const char *ext_oid;
maclobdell 0:f7c60d3e7b8a 7427 size_t ext_len;
maclobdell 0:f7c60d3e7b8a 7428 #endif
maclobdell 0:f7c60d3e7b8a 7429
maclobdell 0:f7c60d3e7b8a 7430 #if !defined(MBEDTLS_X509_CHECK_KEY_USAGE) && \
maclobdell 0:f7c60d3e7b8a 7431 !defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
maclobdell 0:f7c60d3e7b8a 7432 ((void) cert);
maclobdell 0:f7c60d3e7b8a 7433 ((void) cert_endpoint);
maclobdell 0:f7c60d3e7b8a 7434 ((void) flags);
maclobdell 0:f7c60d3e7b8a 7435 #endif
maclobdell 0:f7c60d3e7b8a 7436
maclobdell 0:f7c60d3e7b8a 7437 #if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
maclobdell 0:f7c60d3e7b8a 7438 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
maclobdell 0:f7c60d3e7b8a 7439 {
maclobdell 0:f7c60d3e7b8a 7440 /* Server part of the key exchange */
maclobdell 0:f7c60d3e7b8a 7441 switch( ciphersuite->key_exchange )
maclobdell 0:f7c60d3e7b8a 7442 {
maclobdell 0:f7c60d3e7b8a 7443 case MBEDTLS_KEY_EXCHANGE_RSA:
maclobdell 0:f7c60d3e7b8a 7444 case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
maclobdell 0:f7c60d3e7b8a 7445 usage = MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
maclobdell 0:f7c60d3e7b8a 7446 break;
maclobdell 0:f7c60d3e7b8a 7447
maclobdell 0:f7c60d3e7b8a 7448 case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
maclobdell 0:f7c60d3e7b8a 7449 case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
maclobdell 0:f7c60d3e7b8a 7450 case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
maclobdell 0:f7c60d3e7b8a 7451 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
maclobdell 0:f7c60d3e7b8a 7452 break;
maclobdell 0:f7c60d3e7b8a 7453
maclobdell 0:f7c60d3e7b8a 7454 case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
maclobdell 0:f7c60d3e7b8a 7455 case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
maclobdell 0:f7c60d3e7b8a 7456 usage = MBEDTLS_X509_KU_KEY_AGREEMENT;
maclobdell 0:f7c60d3e7b8a 7457 break;
maclobdell 0:f7c60d3e7b8a 7458
maclobdell 0:f7c60d3e7b8a 7459 /* Don't use default: we want warnings when adding new values */
maclobdell 0:f7c60d3e7b8a 7460 case MBEDTLS_KEY_EXCHANGE_NONE:
maclobdell 0:f7c60d3e7b8a 7461 case MBEDTLS_KEY_EXCHANGE_PSK:
maclobdell 0:f7c60d3e7b8a 7462 case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
maclobdell 0:f7c60d3e7b8a 7463 case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
maclobdell 0:f7c60d3e7b8a 7464 case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
maclobdell 0:f7c60d3e7b8a 7465 usage = 0;
maclobdell 0:f7c60d3e7b8a 7466 }
maclobdell 0:f7c60d3e7b8a 7467 }
maclobdell 0:f7c60d3e7b8a 7468 else
maclobdell 0:f7c60d3e7b8a 7469 {
maclobdell 0:f7c60d3e7b8a 7470 /* Client auth: we only implement rsa_sign and mbedtls_ecdsa_sign for now */
maclobdell 0:f7c60d3e7b8a 7471 usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
maclobdell 0:f7c60d3e7b8a 7472 }
maclobdell 0:f7c60d3e7b8a 7473
maclobdell 0:f7c60d3e7b8a 7474 if( mbedtls_x509_crt_check_key_usage( cert, usage ) != 0 )
maclobdell 0:f7c60d3e7b8a 7475 {
maclobdell 0:f7c60d3e7b8a 7476 *flags |= MBEDTLS_X509_BADCERT_KEY_USAGE;
maclobdell 0:f7c60d3e7b8a 7477 ret = -1;
maclobdell 0:f7c60d3e7b8a 7478 }
maclobdell 0:f7c60d3e7b8a 7479 #else
maclobdell 0:f7c60d3e7b8a 7480 ((void) ciphersuite);
maclobdell 0:f7c60d3e7b8a 7481 #endif /* MBEDTLS_X509_CHECK_KEY_USAGE */
maclobdell 0:f7c60d3e7b8a 7482
maclobdell 0:f7c60d3e7b8a 7483 #if defined(MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE)
maclobdell 0:f7c60d3e7b8a 7484 if( cert_endpoint == MBEDTLS_SSL_IS_SERVER )
maclobdell 0:f7c60d3e7b8a 7485 {
maclobdell 0:f7c60d3e7b8a 7486 ext_oid = MBEDTLS_OID_SERVER_AUTH;
maclobdell 0:f7c60d3e7b8a 7487 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH );
maclobdell 0:f7c60d3e7b8a 7488 }
maclobdell 0:f7c60d3e7b8a 7489 else
maclobdell 0:f7c60d3e7b8a 7490 {
maclobdell 0:f7c60d3e7b8a 7491 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
maclobdell 0:f7c60d3e7b8a 7492 ext_len = MBEDTLS_OID_SIZE( MBEDTLS_OID_CLIENT_AUTH );
maclobdell 0:f7c60d3e7b8a 7493 }
maclobdell 0:f7c60d3e7b8a 7494
maclobdell 0:f7c60d3e7b8a 7495 if( mbedtls_x509_crt_check_extended_key_usage( cert, ext_oid, ext_len ) != 0 )
maclobdell 0:f7c60d3e7b8a 7496 {
maclobdell 0:f7c60d3e7b8a 7497 *flags |= MBEDTLS_X509_BADCERT_EXT_KEY_USAGE;
maclobdell 0:f7c60d3e7b8a 7498 ret = -1;
maclobdell 0:f7c60d3e7b8a 7499 }
maclobdell 0:f7c60d3e7b8a 7500 #endif /* MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE */
maclobdell 0:f7c60d3e7b8a 7501
maclobdell 0:f7c60d3e7b8a 7502 return( ret );
maclobdell 0:f7c60d3e7b8a 7503 }
maclobdell 0:f7c60d3e7b8a 7504 #endif /* MBEDTLS_X509_CRT_PARSE_C */
maclobdell 0:f7c60d3e7b8a 7505
maclobdell 0:f7c60d3e7b8a 7506 /*
maclobdell 0:f7c60d3e7b8a 7507 * Convert version numbers to/from wire format
maclobdell 0:f7c60d3e7b8a 7508 * and, for DTLS, to/from TLS equivalent.
maclobdell 0:f7c60d3e7b8a 7509 *
maclobdell 0:f7c60d3e7b8a 7510 * For TLS this is the identity.
maclobdell 0:f7c60d3e7b8a 7511 * For DTLS, use one complement (v -> 255 - v, and then map as follows:
maclobdell 0:f7c60d3e7b8a 7512 * 1.0 <-> 3.2 (DTLS 1.0 is based on TLS 1.1)
maclobdell 0:f7c60d3e7b8a 7513 * 1.x <-> 3.x+1 for x != 0 (DTLS 1.2 based on TLS 1.2)
maclobdell 0:f7c60d3e7b8a 7514 */
maclobdell 0:f7c60d3e7b8a 7515 void mbedtls_ssl_write_version( int major, int minor, int transport,
maclobdell 0:f7c60d3e7b8a 7516 unsigned char ver[2] )
maclobdell 0:f7c60d3e7b8a 7517 {
maclobdell 0:f7c60d3e7b8a 7518 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 7519 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 7520 {
maclobdell 0:f7c60d3e7b8a 7521 if( minor == MBEDTLS_SSL_MINOR_VERSION_2 )
maclobdell 0:f7c60d3e7b8a 7522 --minor; /* DTLS 1.0 stored as TLS 1.1 internally */
maclobdell 0:f7c60d3e7b8a 7523
maclobdell 0:f7c60d3e7b8a 7524 ver[0] = (unsigned char)( 255 - ( major - 2 ) );
maclobdell 0:f7c60d3e7b8a 7525 ver[1] = (unsigned char)( 255 - ( minor - 1 ) );
maclobdell 0:f7c60d3e7b8a 7526 }
maclobdell 0:f7c60d3e7b8a 7527 else
maclobdell 0:f7c60d3e7b8a 7528 #else
maclobdell 0:f7c60d3e7b8a 7529 ((void) transport);
maclobdell 0:f7c60d3e7b8a 7530 #endif
maclobdell 0:f7c60d3e7b8a 7531 {
maclobdell 0:f7c60d3e7b8a 7532 ver[0] = (unsigned char) major;
maclobdell 0:f7c60d3e7b8a 7533 ver[1] = (unsigned char) minor;
maclobdell 0:f7c60d3e7b8a 7534 }
maclobdell 0:f7c60d3e7b8a 7535 }
maclobdell 0:f7c60d3e7b8a 7536
maclobdell 0:f7c60d3e7b8a 7537 void mbedtls_ssl_read_version( int *major, int *minor, int transport,
maclobdell 0:f7c60d3e7b8a 7538 const unsigned char ver[2] )
maclobdell 0:f7c60d3e7b8a 7539 {
maclobdell 0:f7c60d3e7b8a 7540 #if defined(MBEDTLS_SSL_PROTO_DTLS)
maclobdell 0:f7c60d3e7b8a 7541 if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
maclobdell 0:f7c60d3e7b8a 7542 {
maclobdell 0:f7c60d3e7b8a 7543 *major = 255 - ver[0] + 2;
maclobdell 0:f7c60d3e7b8a 7544 *minor = 255 - ver[1] + 1;
maclobdell 0:f7c60d3e7b8a 7545
maclobdell 0:f7c60d3e7b8a 7546 if( *minor == MBEDTLS_SSL_MINOR_VERSION_1 )
maclobdell 0:f7c60d3e7b8a 7547 ++*minor; /* DTLS 1.0 stored as TLS 1.1 internally */
maclobdell 0:f7c60d3e7b8a 7548 }
maclobdell 0:f7c60d3e7b8a 7549 else
maclobdell 0:f7c60d3e7b8a 7550 #else
maclobdell 0:f7c60d3e7b8a 7551 ((void) transport);
maclobdell 0:f7c60d3e7b8a 7552 #endif
maclobdell 0:f7c60d3e7b8a 7553 {
maclobdell 0:f7c60d3e7b8a 7554 *major = ver[0];
maclobdell 0:f7c60d3e7b8a 7555 *minor = ver[1];
maclobdell 0:f7c60d3e7b8a 7556 }
maclobdell 0:f7c60d3e7b8a 7557 }
maclobdell 0:f7c60d3e7b8a 7558
maclobdell 0:f7c60d3e7b8a 7559 #endif /* MBEDTLS_SSL_TLS_C */