XenevaOS
Loading...
Searching...
No Matches
ssl_misc.h
Go to the documentation of this file.
1
6/*
7 * Copyright The Mbed TLS Contributors
8 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
9 */
10#ifndef MBEDTLS_SSL_MISC_H
11#define MBEDTLS_SSL_MISC_H
12
13#include "mbedtls/build_info.h"
14#include "common.h"
15
16#include "mbedtls/error.h"
17
18#include "mbedtls/ssl.h"
19#include "mbedtls/debug.h"
20#include "debug_internal.h"
21
22#include "mbedtls/cipher.h"
23
24#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
25#include "psa/crypto.h"
26#include "psa_util_internal.h"
27#endif
28
29#if defined(MBEDTLS_MD_CAN_MD5)
30#include "mbedtls/md5.h"
31#endif
32
33#if defined(MBEDTLS_MD_CAN_SHA1)
34#include "mbedtls/sha1.h"
35#endif
36
37#if defined(MBEDTLS_MD_CAN_SHA256)
38#include "mbedtls/sha256.h"
39#endif
40
41#if defined(MBEDTLS_MD_CAN_SHA512)
42#include "mbedtls/sha512.h"
43#endif
44
45#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \
46 !defined(MBEDTLS_USE_PSA_CRYPTO)
47#include "mbedtls/ecjpake.h"
48#endif
49
50#include "mbedtls/pk.h"
51#include "ssl_ciphersuites_internal.h"
52#include "x509_internal.h"
53#include "pk_internal.h"
54
55
56/* Shorthand for restartable ECC */
57#if defined(MBEDTLS_ECP_RESTARTABLE) && \
58 defined(MBEDTLS_SSL_CLI_C) && \
59 defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
60 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
61#define MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED
62#endif
63
64#define MBEDTLS_SSL_INITIAL_HANDSHAKE 0
65#define MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS 1 /* In progress */
66#define MBEDTLS_SSL_RENEGOTIATION_DONE 2 /* Done or aborted */
67#define MBEDTLS_SSL_RENEGOTIATION_PENDING 3 /* Requested (server only) */
68
69/* Faked handshake message identity for HelloRetryRequest. */
70#define MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST (-MBEDTLS_SSL_HS_SERVER_HELLO)
71
72/*
73 * Internal identity of handshake extensions
74 */
75#define MBEDTLS_SSL_EXT_ID_UNRECOGNIZED 0
76#define MBEDTLS_SSL_EXT_ID_SERVERNAME 1
77#define MBEDTLS_SSL_EXT_ID_SERVERNAME_HOSTNAME 1
78#define MBEDTLS_SSL_EXT_ID_MAX_FRAGMENT_LENGTH 2
79#define MBEDTLS_SSL_EXT_ID_STATUS_REQUEST 3
80#define MBEDTLS_SSL_EXT_ID_SUPPORTED_GROUPS 4
81#define MBEDTLS_SSL_EXT_ID_SUPPORTED_ELLIPTIC_CURVES 4
82#define MBEDTLS_SSL_EXT_ID_SIG_ALG 5
83#define MBEDTLS_SSL_EXT_ID_USE_SRTP 6
84#define MBEDTLS_SSL_EXT_ID_HEARTBEAT 7
85#define MBEDTLS_SSL_EXT_ID_ALPN 8
86#define MBEDTLS_SSL_EXT_ID_SCT 9
87#define MBEDTLS_SSL_EXT_ID_CLI_CERT_TYPE 10
88#define MBEDTLS_SSL_EXT_ID_SERV_CERT_TYPE 11
89#define MBEDTLS_SSL_EXT_ID_PADDING 12
90#define MBEDTLS_SSL_EXT_ID_PRE_SHARED_KEY 13
91#define MBEDTLS_SSL_EXT_ID_EARLY_DATA 14
92#define MBEDTLS_SSL_EXT_ID_SUPPORTED_VERSIONS 15
93#define MBEDTLS_SSL_EXT_ID_COOKIE 16
94#define MBEDTLS_SSL_EXT_ID_PSK_KEY_EXCHANGE_MODES 17
95#define MBEDTLS_SSL_EXT_ID_CERT_AUTH 18
96#define MBEDTLS_SSL_EXT_ID_OID_FILTERS 19
97#define MBEDTLS_SSL_EXT_ID_POST_HANDSHAKE_AUTH 20
98#define MBEDTLS_SSL_EXT_ID_SIG_ALG_CERT 21
99#define MBEDTLS_SSL_EXT_ID_KEY_SHARE 22
100#define MBEDTLS_SSL_EXT_ID_TRUNCATED_HMAC 23
101#define MBEDTLS_SSL_EXT_ID_SUPPORTED_POINT_FORMATS 24
102#define MBEDTLS_SSL_EXT_ID_ENCRYPT_THEN_MAC 25
103#define MBEDTLS_SSL_EXT_ID_EXTENDED_MASTER_SECRET 26
104#define MBEDTLS_SSL_EXT_ID_SESSION_TICKET 27
105#define MBEDTLS_SSL_EXT_ID_RECORD_SIZE_LIMIT 28
106
107/* Utility for translating IANA extension type. */
108uint32_t mbedtls_ssl_get_extension_id(unsigned int extension_type);
109uint32_t mbedtls_ssl_get_extension_mask(unsigned int extension_type);
110/* Macros used to define mask constants */
111#define MBEDTLS_SSL_EXT_MASK(id) (1ULL << (MBEDTLS_SSL_EXT_ID_##id))
112/* Reset value of extension mask */
113#define MBEDTLS_SSL_EXT_MASK_NONE 0
114
115/* In messages containing extension requests, we should ignore unrecognized
116 * extensions. In messages containing extension responses, unrecognized
117 * extensions should result in handshake abortion. Messages containing
118 * extension requests include ClientHello, CertificateRequest and
119 * NewSessionTicket. Messages containing extension responses include
120 * ServerHello, HelloRetryRequest, EncryptedExtensions and Certificate.
121 *
122 * RFC 8446 section 4.1.3
123 *
124 * The ServerHello MUST only include extensions which are required to establish
125 * the cryptographic context and negotiate the protocol version.
126 *
127 * RFC 8446 section 4.2
128 *
129 * If an implementation receives an extension which it recognizes and which is
130 * not specified for the message in which it appears, it MUST abort the handshake
131 * with an "illegal_parameter" alert.
132 */
133
134/* Extensions that are not recognized by TLS 1.3 */
135#define MBEDTLS_SSL_TLS1_3_EXT_MASK_UNRECOGNIZED \
136 (MBEDTLS_SSL_EXT_MASK(SUPPORTED_POINT_FORMATS) | \
137 MBEDTLS_SSL_EXT_MASK(ENCRYPT_THEN_MAC) | \
138 MBEDTLS_SSL_EXT_MASK(EXTENDED_MASTER_SECRET) | \
139 MBEDTLS_SSL_EXT_MASK(SESSION_TICKET) | \
140 MBEDTLS_SSL_EXT_MASK(TRUNCATED_HMAC) | \
141 MBEDTLS_SSL_EXT_MASK(UNRECOGNIZED))
142
143/* RFC 8446 section 4.2. Allowed extensions for ClientHello */
144#define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CH \
145 (MBEDTLS_SSL_EXT_MASK(SERVERNAME) | \
146 MBEDTLS_SSL_EXT_MASK(MAX_FRAGMENT_LENGTH) | \
147 MBEDTLS_SSL_EXT_MASK(STATUS_REQUEST) | \
148 MBEDTLS_SSL_EXT_MASK(SUPPORTED_GROUPS) | \
149 MBEDTLS_SSL_EXT_MASK(SIG_ALG) | \
150 MBEDTLS_SSL_EXT_MASK(USE_SRTP) | \
151 MBEDTLS_SSL_EXT_MASK(HEARTBEAT) | \
152 MBEDTLS_SSL_EXT_MASK(ALPN) | \
153 MBEDTLS_SSL_EXT_MASK(SCT) | \
154 MBEDTLS_SSL_EXT_MASK(CLI_CERT_TYPE) | \
155 MBEDTLS_SSL_EXT_MASK(SERV_CERT_TYPE) | \
156 MBEDTLS_SSL_EXT_MASK(PADDING) | \
157 MBEDTLS_SSL_EXT_MASK(KEY_SHARE) | \
158 MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY) | \
159 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES) | \
160 MBEDTLS_SSL_EXT_MASK(EARLY_DATA) | \
161 MBEDTLS_SSL_EXT_MASK(COOKIE) | \
162 MBEDTLS_SSL_EXT_MASK(SUPPORTED_VERSIONS) | \
163 MBEDTLS_SSL_EXT_MASK(CERT_AUTH) | \
164 MBEDTLS_SSL_EXT_MASK(POST_HANDSHAKE_AUTH) | \
165 MBEDTLS_SSL_EXT_MASK(SIG_ALG_CERT) | \
166 MBEDTLS_SSL_EXT_MASK(RECORD_SIZE_LIMIT) | \
167 MBEDTLS_SSL_TLS1_3_EXT_MASK_UNRECOGNIZED)
168
169/* RFC 8446 section 4.2. Allowed extensions for EncryptedExtensions */
170#define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_EE \
171 (MBEDTLS_SSL_EXT_MASK(SERVERNAME) | \
172 MBEDTLS_SSL_EXT_MASK(MAX_FRAGMENT_LENGTH) | \
173 MBEDTLS_SSL_EXT_MASK(SUPPORTED_GROUPS) | \
174 MBEDTLS_SSL_EXT_MASK(USE_SRTP) | \
175 MBEDTLS_SSL_EXT_MASK(HEARTBEAT) | \
176 MBEDTLS_SSL_EXT_MASK(ALPN) | \
177 MBEDTLS_SSL_EXT_MASK(CLI_CERT_TYPE) | \
178 MBEDTLS_SSL_EXT_MASK(SERV_CERT_TYPE) | \
179 MBEDTLS_SSL_EXT_MASK(EARLY_DATA) | \
180 MBEDTLS_SSL_EXT_MASK(RECORD_SIZE_LIMIT))
181
182/* RFC 8446 section 4.2. Allowed extensions for CertificateRequest */
183#define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CR \
184 (MBEDTLS_SSL_EXT_MASK(STATUS_REQUEST) | \
185 MBEDTLS_SSL_EXT_MASK(SIG_ALG) | \
186 MBEDTLS_SSL_EXT_MASK(SCT) | \
187 MBEDTLS_SSL_EXT_MASK(CERT_AUTH) | \
188 MBEDTLS_SSL_EXT_MASK(OID_FILTERS) | \
189 MBEDTLS_SSL_EXT_MASK(SIG_ALG_CERT) | \
190 MBEDTLS_SSL_TLS1_3_EXT_MASK_UNRECOGNIZED)
191
192/* RFC 8446 section 4.2. Allowed extensions for Certificate */
193#define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CT \
194 (MBEDTLS_SSL_EXT_MASK(STATUS_REQUEST) | \
195 MBEDTLS_SSL_EXT_MASK(SCT))
196
197/* RFC 8446 section 4.2. Allowed extensions for ServerHello */
198#define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_SH \
199 (MBEDTLS_SSL_EXT_MASK(KEY_SHARE) | \
200 MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY) | \
201 MBEDTLS_SSL_EXT_MASK(SUPPORTED_VERSIONS))
202
203/* RFC 8446 section 4.2. Allowed extensions for HelloRetryRequest */
204#define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_HRR \
205 (MBEDTLS_SSL_EXT_MASK(KEY_SHARE) | \
206 MBEDTLS_SSL_EXT_MASK(COOKIE) | \
207 MBEDTLS_SSL_EXT_MASK(SUPPORTED_VERSIONS))
208
209/* RFC 8446 section 4.2. Allowed extensions for NewSessionTicket */
210#define MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_NST \
211 (MBEDTLS_SSL_EXT_MASK(EARLY_DATA) | \
212 MBEDTLS_SSL_TLS1_3_EXT_MASK_UNRECOGNIZED)
213
214/*
215 * Helper macros for function call with return check.
216 */
217/*
218 * Exit when return non-zero value
219 */
220#define MBEDTLS_SSL_PROC_CHK(f) \
221 do { \
222 ret = (f); \
223 if (ret != 0) \
224 { \
225 goto cleanup; \
226 } \
227 } while (0)
228/*
229 * Exit when return negative value
230 */
231#define MBEDTLS_SSL_PROC_CHK_NEG(f) \
232 do { \
233 ret = (f); \
234 if (ret < 0) \
235 { \
236 goto cleanup; \
237 } \
238 } while (0)
239
240/*
241 * DTLS retransmission states, see RFC 6347 4.2.4
242 *
243 * The SENDING state is merged in PREPARING for initial sends,
244 * but is distinct for resends.
245 *
246 * Note: initial state is wrong for server, but is not used anyway.
247 */
248#define MBEDTLS_SSL_RETRANS_PREPARING 0
249#define MBEDTLS_SSL_RETRANS_SENDING 1
250#define MBEDTLS_SSL_RETRANS_WAITING 2
251#define MBEDTLS_SSL_RETRANS_FINISHED 3
252
253/*
254 * Allow extra bytes for record, authentication and encryption overhead:
255 * counter (8) + header (5) + IV(16) + MAC (16-48) + padding (0-256).
256 */
257
258#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
259
260/* This macro determines whether CBC is supported. */
261#if defined(MBEDTLS_SSL_HAVE_CBC) && \
262 (defined(MBEDTLS_SSL_HAVE_AES) || \
263 defined(MBEDTLS_SSL_HAVE_CAMELLIA) || \
264 defined(MBEDTLS_SSL_HAVE_ARIA))
265#define MBEDTLS_SSL_SOME_SUITES_USE_CBC
266#endif
267
268/* This macro determines whether a ciphersuite using a
269 * stream cipher can be used. */
270#if defined(MBEDTLS_CIPHER_NULL_CIPHER)
271#define MBEDTLS_SSL_SOME_SUITES_USE_STREAM
272#endif
273
274/* This macro determines whether the CBC construct used in TLS 1.2 is supported. */
275#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) && \
276 defined(MBEDTLS_SSL_PROTO_TLS1_2)
277#define MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC
278#endif
279
280#if defined(MBEDTLS_SSL_SOME_SUITES_USE_STREAM) || \
281 defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC)
282#define MBEDTLS_SSL_SOME_SUITES_USE_MAC
283#endif
284
285/* This macro determines whether a ciphersuite uses Encrypt-then-MAC with CBC */
286#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) && \
287 defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
288#define MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM
289#endif
290
291#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
292
293#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
294/* Ciphersuites using HMAC */
295#if defined(MBEDTLS_MD_CAN_SHA384)
296#define MBEDTLS_SSL_MAC_ADD 48 /* SHA-384 used for HMAC */
297#elif defined(MBEDTLS_MD_CAN_SHA256)
298#define MBEDTLS_SSL_MAC_ADD 32 /* SHA-256 used for HMAC */
299#else
300#define MBEDTLS_SSL_MAC_ADD 20 /* SHA-1 used for HMAC */
301#endif
302#else /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
303/* AEAD ciphersuites: GCM and CCM use a 128 bits tag */
304#define MBEDTLS_SSL_MAC_ADD 16
305#endif
306
307#if defined(MBEDTLS_SSL_HAVE_CBC)
308#define MBEDTLS_SSL_PADDING_ADD 256
309#else
310#define MBEDTLS_SSL_PADDING_ADD 0
311#endif
312
313#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
314#define MBEDTLS_SSL_MAX_CID_EXPANSION MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY
315#else
316#define MBEDTLS_SSL_MAX_CID_EXPANSION 0
317#endif
318
319#define MBEDTLS_SSL_PAYLOAD_OVERHEAD (MBEDTLS_MAX_IV_LENGTH + \
320 MBEDTLS_SSL_MAC_ADD + \
321 MBEDTLS_SSL_PADDING_ADD + \
322 MBEDTLS_SSL_MAX_CID_EXPANSION \
323 )
324
325#define MBEDTLS_SSL_IN_PAYLOAD_LEN (MBEDTLS_SSL_PAYLOAD_OVERHEAD + \
326 (MBEDTLS_SSL_IN_CONTENT_LEN))
327
328#define MBEDTLS_SSL_OUT_PAYLOAD_LEN (MBEDTLS_SSL_PAYLOAD_OVERHEAD + \
329 (MBEDTLS_SSL_OUT_CONTENT_LEN))
330
331/* The maximum number of buffered handshake messages. */
332#define MBEDTLS_SSL_MAX_BUFFERED_HS 4
333
334/* Maximum length we can advertise as our max content length for
335 RFC 6066 max_fragment_length extension negotiation purposes
336 (the lesser of both sizes, if they are unequal.)
337 */
338#define MBEDTLS_TLS_EXT_ADV_CONTENT_LEN ( \
339 (MBEDTLS_SSL_IN_CONTENT_LEN > MBEDTLS_SSL_OUT_CONTENT_LEN) \
340 ? (MBEDTLS_SSL_OUT_CONTENT_LEN) \
341 : (MBEDTLS_SSL_IN_CONTENT_LEN) \
342 )
343
344/* Maximum size in bytes of list in signature algorithms ext., RFC 5246/8446 */
345#define MBEDTLS_SSL_MAX_SIG_ALG_LIST_LEN 65534
346
347/* Minimum size in bytes of list in signature algorithms ext., RFC 5246/8446 */
348#define MBEDTLS_SSL_MIN_SIG_ALG_LIST_LEN 2
349
350/* Maximum size in bytes of list in supported elliptic curve ext., RFC 4492 */
351#define MBEDTLS_SSL_MAX_CURVE_LIST_LEN 65535
352
353#define MBEDTLS_RECEIVED_SIG_ALGS_SIZE 20
354
355#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
356
357#define MBEDTLS_TLS_SIG_NONE MBEDTLS_TLS1_3_SIG_NONE
358
359#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
360#define MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(sig, hash) ((hash << 8) | sig)
361#define MBEDTLS_SSL_TLS12_SIG_ALG_FROM_SIG_AND_HASH_ALG(alg) (alg & 0xFF)
362#define MBEDTLS_SSL_TLS12_HASH_ALG_FROM_SIG_AND_HASH_ALG(alg) (alg >> 8)
363#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
364
365#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
366
367/*
368 * Check that we obey the standard's message size bounds
369 */
370
371#if MBEDTLS_SSL_IN_CONTENT_LEN > 16384
372#error "Bad configuration - incoming record content too large."
373#endif
374
375#if MBEDTLS_SSL_OUT_CONTENT_LEN > 16384
376#error "Bad configuration - outgoing record content too large."
377#endif
378
379#if MBEDTLS_SSL_IN_PAYLOAD_LEN > MBEDTLS_SSL_IN_CONTENT_LEN + 2048
380#error "Bad configuration - incoming protected record payload too large."
381#endif
382
383#if MBEDTLS_SSL_OUT_PAYLOAD_LEN > MBEDTLS_SSL_OUT_CONTENT_LEN + 2048
384#error "Bad configuration - outgoing protected record payload too large."
385#endif
386
387/* Calculate buffer sizes */
388
389/* Note: Even though the TLS record header is only 5 bytes
390 long, we're internally using 8 bytes to store the
391 implicit sequence number. */
392#define MBEDTLS_SSL_HEADER_LEN 13
393
394#if !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
395#define MBEDTLS_SSL_IN_BUFFER_LEN \
396 ((MBEDTLS_SSL_HEADER_LEN) + (MBEDTLS_SSL_IN_PAYLOAD_LEN))
397#else
398#define MBEDTLS_SSL_IN_BUFFER_LEN \
399 ((MBEDTLS_SSL_HEADER_LEN) + (MBEDTLS_SSL_IN_PAYLOAD_LEN) \
400 + (MBEDTLS_SSL_CID_IN_LEN_MAX))
401#endif
402
403#if !defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
404#define MBEDTLS_SSL_OUT_BUFFER_LEN \
405 ((MBEDTLS_SSL_HEADER_LEN) + (MBEDTLS_SSL_OUT_PAYLOAD_LEN))
406#else
407#define MBEDTLS_SSL_OUT_BUFFER_LEN \
408 ((MBEDTLS_SSL_HEADER_LEN) + (MBEDTLS_SSL_OUT_PAYLOAD_LEN) \
409 + (MBEDTLS_SSL_CID_OUT_LEN_MAX))
410#endif
411
412#define MBEDTLS_CLIENT_HELLO_RANDOM_LEN 32
413#define MBEDTLS_SERVER_HELLO_RANDOM_LEN 32
414
415#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
429size_t mbedtls_ssl_get_output_max_frag_len(const mbedtls_ssl_context *ssl);
430
445size_t mbedtls_ssl_get_input_max_frag_len(const mbedtls_ssl_context *ssl);
446#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
447
448#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
458size_t mbedtls_ssl_get_output_record_size_limit(const mbedtls_ssl_context *ssl);
459#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
460
461#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
462static inline size_t mbedtls_ssl_get_output_buflen(const mbedtls_ssl_context *ctx)
463{
464#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
465 return mbedtls_ssl_get_output_max_frag_len(ctx)
466 + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD
467 + MBEDTLS_SSL_CID_OUT_LEN_MAX;
468#else
469 return mbedtls_ssl_get_output_max_frag_len(ctx)
470 + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD;
471#endif
472}
473
474static inline size_t mbedtls_ssl_get_input_buflen(const mbedtls_ssl_context *ctx)
475{
476#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
477 return mbedtls_ssl_get_input_max_frag_len(ctx)
478 + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD
479 + MBEDTLS_SSL_CID_IN_LEN_MAX;
480#else
481 return mbedtls_ssl_get_input_max_frag_len(ctx)
482 + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD;
483#endif
484}
485#endif
486
487/*
488 * TLS extension flags (for extensions with outgoing ServerHello content
489 * that need it (e.g. for RENEGOTIATION_INFO the server already knows because
490 * of state of the renegotiation flag, so no indicator is required)
491 */
492#define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT (1 << 0)
493#define MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK (1 << 1)
494
506#if !defined(MBEDTLS_TEST_HOOKS)
507static inline int mbedtls_ssl_chk_buf_ptr(const uint8_t *cur,
508 const uint8_t *end, size_t need)
509{
510 return (cur > end) || (need > (size_t) (end - cur));
511}
512#else
513typedef struct {
514 const uint8_t *cur;
515 const uint8_t *end;
516 size_t need;
517} mbedtls_ssl_chk_buf_ptr_args;
518
519void mbedtls_ssl_set_chk_buf_ptr_fail_args(
520 const uint8_t *cur, const uint8_t *end, size_t need);
521void mbedtls_ssl_reset_chk_buf_ptr_fail_args(void);
522
523MBEDTLS_CHECK_RETURN_CRITICAL
524int mbedtls_ssl_cmp_chk_buf_ptr_fail_args(mbedtls_ssl_chk_buf_ptr_args *args);
525
526static inline int mbedtls_ssl_chk_buf_ptr(const uint8_t *cur,
527 const uint8_t *end, size_t need)
528{
529 if ((cur > end) || (need > (size_t) (end - cur))) {
530 mbedtls_ssl_set_chk_buf_ptr_fail_args(cur, end, need);
531 return 1;
532 }
533 return 0;
534}
535#endif /* MBEDTLS_TEST_HOOKS */
536
547#define MBEDTLS_SSL_CHK_BUF_PTR(cur, end, need) \
548 do { \
549 if (mbedtls_ssl_chk_buf_ptr((cur), (end), (need)) != 0) \
550 { \
551 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL; \
552 } \
553 } while (0)
554
569#define MBEDTLS_SSL_CHK_BUF_READ_PTR(cur, end, need) \
570 do { \
571 if (mbedtls_ssl_chk_buf_ptr((cur), (end), (need)) != 0) \
572 { \
573 MBEDTLS_SSL_DEBUG_MSG(1, \
574 ("missing input data in %s", __func__)); \
575 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR, \
576 MBEDTLS_ERR_SSL_DECODE_ERROR); \
577 return MBEDTLS_ERR_SSL_DECODE_ERROR; \
578 } \
579 } while (0)
580
581#ifdef __cplusplus
582extern "C" {
583#endif
584
585typedef int mbedtls_ssl_tls_prf_cb(const unsigned char *secret, size_t slen,
586 const char *label,
587 const unsigned char *random, size_t rlen,
588 unsigned char *dstbuf, size_t dlen);
589
590/* cipher.h exports the maximum IV, key and block length from
591 * all ciphers enabled in the config, regardless of whether those
592 * ciphers are actually usable in SSL/TLS. Notably, XTS is enabled
593 * in the default configuration and uses 64 Byte keys, but it is
594 * not used for record protection in SSL/TLS.
595 *
596 * In order to prevent unnecessary inflation of key structures,
597 * we introduce SSL-specific variants of the max-{key,block,IV}
598 * macros here which are meant to only take those ciphers into
599 * account which can be negotiated in SSL/TLS.
600 *
601 * Since the current definitions of MBEDTLS_MAX_{KEY|BLOCK|IV}_LENGTH
602 * in cipher.h are rough overapproximations of the real maxima, here
603 * we content ourselves with replicating those overapproximations
604 * for the maximum block and IV length, and excluding XTS from the
605 * computation of the maximum key length. */
606#define MBEDTLS_SSL_MAX_BLOCK_LENGTH 16
607#define MBEDTLS_SSL_MAX_IV_LENGTH 16
608#define MBEDTLS_SSL_MAX_KEY_LENGTH 32
609
629typedef struct mbedtls_ssl_key_set mbedtls_ssl_key_set;
630
631typedef struct {
632 unsigned char binder_key[MBEDTLS_TLS1_3_MD_MAX_SIZE];
633 unsigned char client_early_traffic_secret[MBEDTLS_TLS1_3_MD_MAX_SIZE];
634 unsigned char early_exporter_master_secret[MBEDTLS_TLS1_3_MD_MAX_SIZE];
635} mbedtls_ssl_tls13_early_secrets;
636
637typedef struct {
638 unsigned char client_handshake_traffic_secret[MBEDTLS_TLS1_3_MD_MAX_SIZE];
639 unsigned char server_handshake_traffic_secret[MBEDTLS_TLS1_3_MD_MAX_SIZE];
640} mbedtls_ssl_tls13_handshake_secrets;
641
642/*
643 * This structure contains the parameters only needed during handshake.
644 */
645struct mbedtls_ssl_handshake_params {
646 /* Frequently-used boolean or byte fields (placed early to take
647 * advantage of smaller code size for indirect access on Arm Thumb) */
648 uint8_t resume;
649 uint8_t cli_exts;
651#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
652 uint8_t sni_authmode;
653#endif
654
655#if defined(MBEDTLS_SSL_SRV_C)
656 /* Flag indicating if a CertificateRequest message has been sent
657 * to the client or not. */
658 uint8_t certificate_request_sent;
659#if defined(MBEDTLS_SSL_EARLY_DATA)
660 /* Flag indicating if the server has accepted early data or not. */
661 uint8_t early_data_accepted;
662#endif
663#endif /* MBEDTLS_SSL_SRV_C */
664
665#if defined(MBEDTLS_SSL_SESSION_TICKETS)
666 uint8_t new_session_ticket;
667#endif /* MBEDTLS_SSL_SESSION_TICKETS */
668
669#if defined(MBEDTLS_SSL_CLI_C)
688 mbedtls_ssl_protocol_version min_tls_version;
689#endif
690
691#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
692 uint8_t extended_ms;
693#endif
694
695#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
696 uint8_t async_in_progress;
697#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
698
699#if defined(MBEDTLS_SSL_PROTO_DTLS)
700 unsigned char retransmit_state;
701#endif
702
703#if !defined(MBEDTLS_DEPRECATED_REMOVED)
704 unsigned char group_list_heap_allocated;
705 unsigned char sig_algs_heap_allocated;
706#endif
707
708#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
709 uint8_t ecrs_enabled;
710 enum { /* this complements ssl->state with info on intra-state operations */
711 ssl_ecrs_none = 0,
712 ssl_ecrs_crt_verify,
713 ssl_ecrs_ske_start_processing,
714 ssl_ecrs_cke_ecdh_calc_secret,
715 ssl_ecrs_crt_vrfy_sign,
716 } ecrs_state;
717 mbedtls_x509_crt *ecrs_peer_cert;
718 size_t ecrs_n;
719#endif
720
721 mbedtls_ssl_ciphersuite_t const *ciphersuite_info;
722
723 MBEDTLS_CHECK_RETURN_CRITICAL
724 int (*update_checksum)(mbedtls_ssl_context *, const unsigned char *, size_t);
725 MBEDTLS_CHECK_RETURN_CRITICAL
726 int (*calc_verify)(const mbedtls_ssl_context *, unsigned char *, size_t *);
727 MBEDTLS_CHECK_RETURN_CRITICAL
728 int (*calc_finished)(mbedtls_ssl_context *, unsigned char *, int);
729 mbedtls_ssl_tls_prf_cb *tls_prf;
730
731 /*
732 * Handshake specific crypto variables
733 */
734#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
735 uint8_t key_exchange_mode;
742 uint8_t hello_retry_request_flag;
743
744#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
751 uint8_t ccs_sent;
752#endif
753
754#if defined(MBEDTLS_SSL_SRV_C)
755#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
756 uint8_t tls13_kex_modes;
757#endif
759 uint16_t hrr_selected_group;
760#if defined(MBEDTLS_SSL_SESSION_TICKETS)
761 uint16_t new_session_tickets_count;
762#endif
763#endif /* MBEDTLS_SSL_SRV_C */
764
765#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
766
767#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
768 uint16_t received_sig_algs[MBEDTLS_RECEIVED_SIG_ALGS_SIZE];
769#endif
770
771#if !defined(MBEDTLS_DEPRECATED_REMOVED)
772 const uint16_t *group_list;
773 const uint16_t *sig_algs;
774#endif
775
776#if defined(MBEDTLS_DHM_C)
777 mbedtls_dhm_context dhm_ctx;
778#endif
779
780#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
781 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED)
782 mbedtls_ecdh_context ecdh_ctx;
783#endif /* !MBEDTLS_USE_PSA_CRYPTO &&
784 MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED */
785
786#if defined(MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED)
787 psa_key_type_t xxdh_psa_type;
788 size_t xxdh_psa_bits;
789 mbedtls_svc_key_id_t xxdh_psa_privkey;
790 uint8_t xxdh_psa_privkey_is_external;
791 unsigned char xxdh_psa_peerkey[PSA_EXPORT_PUBLIC_KEY_MAX_SIZE];
792 size_t xxdh_psa_peerkey_len;
793#endif /* MBEDTLS_KEY_EXCHANGE_SOME_XXDH_PSA_ANY_ENABLED */
794
795#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
796#if defined(MBEDTLS_USE_PSA_CRYPTO)
797 psa_pake_operation_t psa_pake_ctx;
798 mbedtls_svc_key_id_t psa_pake_password;
799 uint8_t psa_pake_ctx_is_ok;
800#else
801 mbedtls_ecjpake_context ecjpake_ctx;
802#endif /* MBEDTLS_USE_PSA_CRYPTO */
803#if defined(MBEDTLS_SSL_CLI_C)
804 unsigned char *ecjpake_cache;
805 size_t ecjpake_cache_len;
806#endif
807#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
808
809#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED) || \
810 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ANY_ALLOWED_ENABLED) || \
811 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
812 uint16_t *curves_tls_id;
813#endif
814
815#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
816#if defined(MBEDTLS_USE_PSA_CRYPTO)
817 mbedtls_svc_key_id_t psk_opaque;
818 uint8_t psk_opaque_is_internal;
819#else
820 unsigned char *psk;
821 size_t psk_len;
822#endif /* MBEDTLS_USE_PSA_CRYPTO */
823 uint16_t selected_identity;
824#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
825
826#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
827 mbedtls_x509_crt_restart_ctx ecrs_ctx;
828#endif
829
830#if defined(MBEDTLS_X509_CRT_PARSE_C)
831 mbedtls_ssl_key_cert *key_cert;
832#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
833 mbedtls_ssl_key_cert *sni_key_cert;
834 mbedtls_x509_crt *sni_ca_chain;
835 mbedtls_x509_crl *sni_ca_crl;
836#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
837#endif /* MBEDTLS_X509_CRT_PARSE_C */
838
839#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
840 !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
841 mbedtls_pk_context peer_pubkey;
842#endif /* MBEDTLS_X509_CRT_PARSE_C && !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
843
844 struct {
845 size_t total_bytes_buffered;
848 uint8_t seen_ccs;
851 struct mbedtls_ssl_hs_buffer {
852 unsigned is_valid : 1;
853 unsigned is_fragmented : 1;
854 unsigned is_complete : 1;
855 unsigned char *data;
856 size_t data_len;
857 } hs[MBEDTLS_SSL_MAX_BUFFERED_HS];
858
859 struct {
860 unsigned char *data;
861 size_t len;
862 unsigned epoch;
863 } future_record;
864
865 } buffering;
866
867#if defined(MBEDTLS_SSL_CLI_C) && \
868 (defined(MBEDTLS_SSL_PROTO_DTLS) || \
869 defined(MBEDTLS_SSL_PROTO_TLS1_3))
870 unsigned char *cookie;
872#if !defined(MBEDTLS_SSL_PROTO_TLS1_3)
873 /* RFC 6347 page 15
874 ...
875 opaque cookie<0..2^8-1>;
876 ...
877 */
878 uint8_t cookie_len;
879#else
880 /* RFC 8446 page 39
881 ...
882 opaque cookie<0..2^16-1>;
883 ...
884 If TLS1_3 is enabled, the max length is 2^16 - 1
885 */
886 uint16_t cookie_len;
888#endif
889#endif /* MBEDTLS_SSL_CLI_C &&
890 ( MBEDTLS_SSL_PROTO_DTLS ||
891 MBEDTLS_SSL_PROTO_TLS1_3 ) */
892#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_DTLS)
893 unsigned char cookie_verify_result;
894#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_DTLS */
895
896#if defined(MBEDTLS_SSL_PROTO_DTLS)
897 unsigned int out_msg_seq;
898 unsigned int in_msg_seq;
900 uint32_t retransmit_timeout;
901 mbedtls_ssl_flight_item *flight;
902 mbedtls_ssl_flight_item *cur_msg;
903 unsigned char *cur_msg_p;
904 unsigned int in_flight_start_seq;
906 mbedtls_ssl_transform *alt_transform_out;
908 unsigned char alt_out_ctr[MBEDTLS_SSL_SEQUENCE_NUMBER_LEN];
911#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
912 /* The state of CID configuration in this handshake. */
913
914 uint8_t cid_in_use;
918 unsigned char peer_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX];
919 uint8_t peer_cid_len;
921#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
922
923 uint16_t mtu;
924#endif /* MBEDTLS_SSL_PROTO_DTLS */
925
926 /*
927 * Checksum contexts
928 */
929#if defined(MBEDTLS_MD_CAN_SHA256)
930#if defined(MBEDTLS_USE_PSA_CRYPTO)
931 psa_hash_operation_t fin_sha256_psa;
932#else
933 mbedtls_md_context_t fin_sha256;
934#endif
935#endif
936#if defined(MBEDTLS_MD_CAN_SHA384)
937#if defined(MBEDTLS_USE_PSA_CRYPTO)
938 psa_hash_operation_t fin_sha384_psa;
939#else
940 mbedtls_md_context_t fin_sha384;
941#endif
942#endif
943
944#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
945 uint16_t offered_group_id; /* The NamedGroup value for the group
946 * that is being used for ephemeral
947 * key exchange.
948 *
949 * On the client: Defaults to the first
950 * entry in the client's group list,
951 * but can be overwritten by the HRR. */
952#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
953
954#if defined(MBEDTLS_SSL_CLI_C)
955 uint8_t client_auth;
959#endif /* MBEDTLS_SSL_CLI_C */
960 /*
961 * State-local variables used during the processing
962 * of a specific handshake state.
963 */
964 union {
965 /* Outgoing Finished message */
966 struct {
967 uint8_t preparation_done;
968
969 /* Buffer holding digest of the handshake up to
970 * but excluding the outgoing finished message. */
971 unsigned char digest[MBEDTLS_TLS1_3_MD_MAX_SIZE];
972 size_t digest_len;
973 } finished_out;
974
975 /* Incoming Finished message */
976 struct {
977 uint8_t preparation_done;
978
979 /* Buffer holding digest of the handshake up to but
980 * excluding the peer's incoming finished message. */
981 unsigned char digest[MBEDTLS_TLS1_3_MD_MAX_SIZE];
982 size_t digest_len;
983 } finished_in;
984
985 } state_local;
986
987 /* End of state-local variables. */
988
989 unsigned char randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN +
990 MBEDTLS_SERVER_HELLO_RANDOM_LEN];
992#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
993 unsigned char premaster[MBEDTLS_PREMASTER_SIZE];
995 size_t pmslen;
996#endif
997
998#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
999 uint32_t sent_extensions;
1000 uint32_t received_extensions;
1002#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
1003 unsigned char certificate_request_context_len;
1004 unsigned char *certificate_request_context;
1005#endif
1006
1008 mbedtls_ssl_transform *transform_handshake;
1009 union {
1010 unsigned char early[MBEDTLS_TLS1_3_MD_MAX_SIZE];
1011 unsigned char handshake[MBEDTLS_TLS1_3_MD_MAX_SIZE];
1012 unsigned char app[MBEDTLS_TLS1_3_MD_MAX_SIZE];
1013 } tls13_master_secrets;
1014
1015 mbedtls_ssl_tls13_handshake_secrets tls13_hs_secrets;
1016#if defined(MBEDTLS_SSL_EARLY_DATA)
1018 mbedtls_ssl_transform *transform_earlydata;
1019#endif
1020#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
1021
1022#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
1028 void *user_async_ctx;
1029#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
1030
1031#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1032 const unsigned char *sni_name;
1033 size_t sni_name_len;
1034#if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
1035 const mbedtls_x509_crt *dn_hints;
1036#endif
1037#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1038};
1039
1040typedef struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer;
1041
1042/*
1043 * Representation of decryption/encryption transformations on records
1044 *
1045 * There are the following general types of record transformations:
1046 * - Stream transformations (TLS versions == 1.2 only)
1047 * Transformation adding a MAC and applying a stream-cipher
1048 * to the authenticated message.
1049 * - CBC block cipher transformations ([D]TLS versions == 1.2 only)
1050 * For TLS 1.2, no IV is generated at key extraction time, but every
1051 * encrypted record is explicitly prefixed by the IV with which it was
1052 * encrypted.
1053 * - AEAD transformations ([D]TLS versions == 1.2 only)
1054 * These come in two fundamentally different versions, the first one
1055 * used in TLS 1.2, excluding ChaChaPoly ciphersuites, and the second
1056 * one used for ChaChaPoly ciphersuites in TLS 1.2 as well as for TLS 1.3.
1057 * In the first transformation, the IV to be used for a record is obtained
1058 * as the concatenation of an explicit, static 4-byte IV and the 8-byte
1059 * record sequence number, and explicitly prepending this sequence number
1060 * to the encrypted record. In contrast, in the second transformation
1061 * the IV is obtained by XOR'ing a static IV obtained at key extraction
1062 * time with the 8-byte record sequence number, without prepending the
1063 * latter to the encrypted record.
1064 *
1065 * Additionally, DTLS 1.2 + CID as well as TLS 1.3 use an inner plaintext
1066 * which allows to add flexible length padding and to hide a record's true
1067 * content type.
1068 *
1069 * In addition to type and version, the following parameters are relevant:
1070 * - The symmetric cipher algorithm to be used.
1071 * - The (static) encryption/decryption keys for the cipher.
1072 * - For stream/CBC, the type of message digest to be used.
1073 * - For stream/CBC, (static) encryption/decryption keys for the digest.
1074 * - For AEAD transformations, the size (potentially 0) of an explicit,
1075 * random initialization vector placed in encrypted records.
1076 * - For some transformations (currently AEAD) an implicit IV. It is static
1077 * and (if present) is combined with the explicit IV in a transformation-
1078 * -dependent way (e.g. appending in TLS 1.2 and XOR'ing in TLS 1.3).
1079 * - For stream/CBC, a flag determining the order of encryption and MAC.
1080 * - The details of the transformation depend on the SSL/TLS version.
1081 * - The length of the authentication tag.
1082 *
1083 * The struct below refines this abstract view as follows:
1084 * - The cipher underlying the transformation is managed in
1085 * cipher contexts cipher_ctx_{enc/dec}, which must have the
1086 * same cipher type. The mode of these cipher contexts determines
1087 * the type of the transformation in the sense above: e.g., if
1088 * the type is MBEDTLS_CIPHER_AES_256_CBC resp. MBEDTLS_CIPHER_AES_192_GCM
1089 * then the transformation has type CBC resp. AEAD.
1090 * - The cipher keys are never stored explicitly but
1091 * are maintained within cipher_ctx_{enc/dec}.
1092 * - For stream/CBC transformations, the message digest contexts
1093 * used for the MAC's are stored in md_ctx_{enc/dec}. These contexts
1094 * are unused for AEAD transformations.
1095 * - For stream/CBC transformations, the MAC keys are not stored explicitly
1096 * but maintained within md_ctx_{enc/dec}.
1097 * - The mac_enc and mac_dec fields are unused for EAD transformations.
1098 * - For transformations using an implicit IV maintained within
1099 * the transformation context, its contents are stored within
1100 * iv_{enc/dec}.
1101 * - The value of ivlen indicates the length of the IV.
1102 * This is redundant in case of stream/CBC transformations
1103 * which always use 0 resp. the cipher's block length as the
1104 * IV length, but is needed for AEAD ciphers and may be
1105 * different from the underlying cipher's block length
1106 * in this case.
1107 * - The field fixed_ivlen is nonzero for AEAD transformations only
1108 * and indicates the length of the static part of the IV which is
1109 * constant throughout the communication, and which is stored in
1110 * the first fixed_ivlen bytes of the iv_{enc/dec} arrays.
1111 * - tls_version denotes the 2-byte TLS version
1112 * - For stream/CBC transformations, maclen denotes the length of the
1113 * authentication tag, while taglen is unused and 0.
1114 * - For AEAD transformations, taglen denotes the length of the
1115 * authentication tag, while maclen is unused and 0.
1116 * - For CBC transformations, encrypt_then_mac determines the
1117 * order of encryption and authentication. This field is unused
1118 * in other transformations.
1119 *
1120 */
1121struct mbedtls_ssl_transform {
1122 /*
1123 * Session specific crypto layer
1124 */
1125 size_t minlen;
1126 size_t ivlen;
1127 size_t fixed_ivlen;
1128 size_t maclen;
1129 size_t taglen;
1131 unsigned char iv_enc[16];
1132 unsigned char iv_dec[16];
1134#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
1135
1136#if defined(MBEDTLS_USE_PSA_CRYPTO)
1137 mbedtls_svc_key_id_t psa_mac_enc;
1138 mbedtls_svc_key_id_t psa_mac_dec;
1139 psa_algorithm_t psa_mac_alg;
1140#else
1141 mbedtls_md_context_t md_ctx_enc;
1142 mbedtls_md_context_t md_ctx_dec;
1143#endif /* MBEDTLS_USE_PSA_CRYPTO */
1144
1145#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1146 int encrypt_then_mac;
1147#endif
1148
1149#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
1150
1151 mbedtls_ssl_protocol_version tls_version;
1152
1153#if defined(MBEDTLS_USE_PSA_CRYPTO)
1154 mbedtls_svc_key_id_t psa_key_enc;
1155 mbedtls_svc_key_id_t psa_key_dec;
1156 psa_algorithm_t psa_alg;
1157#else
1158 mbedtls_cipher_context_t cipher_ctx_enc;
1159 mbedtls_cipher_context_t cipher_ctx_dec;
1160#endif /* MBEDTLS_USE_PSA_CRYPTO */
1161
1162#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
1163 uint8_t in_cid_len;
1164 uint8_t out_cid_len;
1165 unsigned char in_cid[MBEDTLS_SSL_CID_IN_LEN_MAX];
1166 unsigned char out_cid[MBEDTLS_SSL_CID_OUT_LEN_MAX];
1167#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
1168
1169#if defined(MBEDTLS_SSL_KEEP_RANDBYTES)
1170 /* We need the Hello random bytes in order to re-derive keys from the
1171 * Master Secret and other session info and for the keying material
1172 * exporter in TLS 1.2.
1173 * See ssl_tls12_populate_transform() */
1174 unsigned char randbytes[MBEDTLS_SERVER_HELLO_RANDOM_LEN +
1175 MBEDTLS_CLIENT_HELLO_RANDOM_LEN];
1177#endif /* defined(MBEDTLS_SSL_KEEP_RANDBYTES) */
1178};
1179
1180/*
1181 * Return 1 if the transform uses an AEAD cipher, 0 otherwise.
1182 * Equivalently, return 0 if a separate MAC is used, 1 otherwise.
1183 */
1184static inline int mbedtls_ssl_transform_uses_aead(
1185 const mbedtls_ssl_transform *transform)
1186{
1187#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
1188 return transform->maclen == 0 && transform->taglen != 0;
1189#else
1190 (void) transform;
1191 return 1;
1192#endif
1193}
1194
1195/*
1196 * Internal representation of record frames
1197 *
1198 * Instances come in two flavors:
1199 * (1) Encrypted
1200 * These always have data_offset = 0
1201 * (2) Unencrypted
1202 * These have data_offset set to the amount of
1203 * pre-expansion during record protection. Concretely,
1204 * this is the length of the fixed part of the explicit IV
1205 * used for encryption, or 0 if no explicit IV is used
1206 * (e.g. for stream ciphers).
1207 *
1208 * The reason for the data_offset in the unencrypted case
1209 * is to allow for in-place conversion of an unencrypted to
1210 * an encrypted record. If the offset wasn't included, the
1211 * encrypted content would need to be shifted afterwards to
1212 * make space for the fixed IV.
1213 *
1214 */
1215#if MBEDTLS_SSL_CID_OUT_LEN_MAX > MBEDTLS_SSL_CID_IN_LEN_MAX
1216#define MBEDTLS_SSL_CID_LEN_MAX MBEDTLS_SSL_CID_OUT_LEN_MAX
1217#else
1218#define MBEDTLS_SSL_CID_LEN_MAX MBEDTLS_SSL_CID_IN_LEN_MAX
1219#endif
1220
1221typedef struct {
1222 uint8_t ctr[MBEDTLS_SSL_SEQUENCE_NUMBER_LEN]; /* In TLS: The implicit record sequence number.
1223 * In DTLS: The 2-byte epoch followed by
1224 * the 6-byte sequence number.
1225 * This is stored as a raw big endian byte array
1226 * as opposed to a uint64_t because we rarely
1227 * need to perform arithmetic on this, but do
1228 * need it as a Byte array for the purpose of
1229 * MAC computations. */
1230 uint8_t type; /* The record content type. */
1231 uint8_t ver[2]; /* SSL/TLS version as present on the wire.
1232 * Convert to internal presentation of versions
1233 * using mbedtls_ssl_read_version() and
1234 * mbedtls_ssl_write_version().
1235 * Keep wire-format for MAC computations. */
1236
1237 unsigned char *buf; /* Memory buffer enclosing the record content */
1238 size_t buf_len; /* Buffer length */
1239 size_t data_offset; /* Offset of record content */
1240 size_t data_len; /* Length of record content */
1241
1242#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
1243 uint8_t cid_len; /* Length of the CID (0 if not present) */
1244 unsigned char cid[MBEDTLS_SSL_CID_LEN_MAX]; /* The CID */
1245#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
1246} mbedtls_record;
1247
1248#if defined(MBEDTLS_X509_CRT_PARSE_C)
1249/*
1250 * List of certificate + private key pairs
1251 */
1252struct mbedtls_ssl_key_cert {
1253 mbedtls_x509_crt *cert;
1254 mbedtls_pk_context *key;
1255 mbedtls_ssl_key_cert *next;
1256};
1257#endif /* MBEDTLS_X509_CRT_PARSE_C */
1258
1259#if defined(MBEDTLS_SSL_PROTO_DTLS)
1260/*
1261 * List of handshake messages kept around for resending
1262 */
1263struct mbedtls_ssl_flight_item {
1264 unsigned char *p;
1265 size_t len;
1266 unsigned char type;
1267 mbedtls_ssl_flight_item *next;
1268};
1269#endif /* MBEDTLS_SSL_PROTO_DTLS */
1270
1271#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1283MBEDTLS_CHECK_RETURN_CRITICAL
1284int mbedtls_ssl_tls12_write_client_hello_exts(mbedtls_ssl_context *ssl,
1285 unsigned char *buf,
1286 const unsigned char *end,
1287 int uses_ec,
1288 size_t *out_len);
1289#endif
1290
1291#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1292 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1293
1304unsigned int mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
1305 mbedtls_ssl_context *ssl,
1306 unsigned int sig_alg);
1307
1308#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
1309 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1310
1317void mbedtls_ssl_transform_free(mbedtls_ssl_transform *transform);
1318
1325void mbedtls_ssl_handshake_free(mbedtls_ssl_context *ssl);
1326
1327/* set inbound transform of ssl context */
1328void mbedtls_ssl_set_inbound_transform(mbedtls_ssl_context *ssl,
1329 mbedtls_ssl_transform *transform);
1330
1331/* set outbound transform of ssl context */
1332void mbedtls_ssl_set_outbound_transform(mbedtls_ssl_context *ssl,
1333 mbedtls_ssl_transform *transform);
1334
1335MBEDTLS_CHECK_RETURN_CRITICAL
1336int mbedtls_ssl_handshake_client_step(mbedtls_ssl_context *ssl);
1337MBEDTLS_CHECK_RETURN_CRITICAL
1338int mbedtls_ssl_handshake_server_step(mbedtls_ssl_context *ssl);
1339void mbedtls_ssl_handshake_wrapup(mbedtls_ssl_context *ssl);
1340
1341#if defined(MBEDTLS_DEBUG_C)
1342/* Declared in "ssl_debug_helpers.h". We can't include this file from
1343 * "ssl_misc.h" because it includes "ssl_misc.h" because it needs some
1344 * type definitions. TODO: split the type definitions and the helper
1345 * functions into different headers.
1346 */
1347const char *mbedtls_ssl_states_str(mbedtls_ssl_states state);
1348#endif
1349
1350static inline void mbedtls_ssl_handshake_set_state(mbedtls_ssl_context *ssl,
1351 mbedtls_ssl_states state)
1352{
1353 MBEDTLS_SSL_DEBUG_MSG(3, ("handshake state: %d (%s) -> %d (%s)",
1354 ssl->state, mbedtls_ssl_states_str(ssl->state),
1355 (int) state, mbedtls_ssl_states_str(state)));
1356 ssl->state = (int) state;
1357}
1358
1359static inline void mbedtls_ssl_handshake_increment_state(mbedtls_ssl_context *ssl)
1360{
1361 mbedtls_ssl_handshake_set_state(ssl, ssl->state + 1);
1362}
1363
1364MBEDTLS_CHECK_RETURN_CRITICAL
1365int mbedtls_ssl_send_fatal_handshake_failure(mbedtls_ssl_context *ssl);
1366
1367MBEDTLS_CHECK_RETURN_CRITICAL
1368int mbedtls_ssl_reset_checksum(mbedtls_ssl_context *ssl);
1369
1370#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1371MBEDTLS_CHECK_RETURN_CRITICAL
1372int mbedtls_ssl_derive_keys(mbedtls_ssl_context *ssl);
1373#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1374
1375MBEDTLS_CHECK_RETURN_CRITICAL
1376int mbedtls_ssl_handle_message_type(mbedtls_ssl_context *ssl);
1377MBEDTLS_CHECK_RETURN_CRITICAL
1378int mbedtls_ssl_prepare_handshake_record(mbedtls_ssl_context *ssl);
1379MBEDTLS_CHECK_RETURN_CRITICAL
1380int mbedtls_ssl_update_handshake_status(mbedtls_ssl_context *ssl);
1381
1458MBEDTLS_CHECK_RETURN_CRITICAL
1459int mbedtls_ssl_read_record(mbedtls_ssl_context *ssl,
1460 unsigned update_hs_digest);
1461MBEDTLS_CHECK_RETURN_CRITICAL
1462int mbedtls_ssl_fetch_input(mbedtls_ssl_context *ssl, size_t nb_want);
1463
1464/*
1465 * Write handshake message header
1466 */
1467MBEDTLS_CHECK_RETURN_CRITICAL
1468int mbedtls_ssl_start_handshake_msg(mbedtls_ssl_context *ssl, unsigned char hs_type,
1469 unsigned char **buf, size_t *buf_len);
1470
1471MBEDTLS_CHECK_RETURN_CRITICAL
1472int mbedtls_ssl_write_handshake_msg_ext(mbedtls_ssl_context *ssl,
1473 int update_checksum,
1474 int force_flush);
1475static inline int mbedtls_ssl_write_handshake_msg(mbedtls_ssl_context *ssl)
1476{
1477 return mbedtls_ssl_write_handshake_msg_ext(ssl, 1 /* update checksum */, 1 /* force flush */);
1478}
1479
1480/*
1481 * Write handshake message tail
1482 */
1483MBEDTLS_CHECK_RETURN_CRITICAL
1484int mbedtls_ssl_finish_handshake_msg(mbedtls_ssl_context *ssl,
1485 size_t buf_len, size_t msg_len);
1486
1487MBEDTLS_CHECK_RETURN_CRITICAL
1488int mbedtls_ssl_write_record(mbedtls_ssl_context *ssl, int force_flush);
1489MBEDTLS_CHECK_RETURN_CRITICAL
1490int mbedtls_ssl_flush_output(mbedtls_ssl_context *ssl);
1491
1492MBEDTLS_CHECK_RETURN_CRITICAL
1493int mbedtls_ssl_parse_certificate(mbedtls_ssl_context *ssl);
1494MBEDTLS_CHECK_RETURN_CRITICAL
1495int mbedtls_ssl_write_certificate(mbedtls_ssl_context *ssl);
1496
1497MBEDTLS_CHECK_RETURN_CRITICAL
1498int mbedtls_ssl_parse_change_cipher_spec(mbedtls_ssl_context *ssl);
1499MBEDTLS_CHECK_RETURN_CRITICAL
1500int mbedtls_ssl_write_change_cipher_spec(mbedtls_ssl_context *ssl);
1501
1502MBEDTLS_CHECK_RETURN_CRITICAL
1503int mbedtls_ssl_parse_finished(mbedtls_ssl_context *ssl);
1504MBEDTLS_CHECK_RETURN_CRITICAL
1505int mbedtls_ssl_write_finished(mbedtls_ssl_context *ssl);
1506
1507void mbedtls_ssl_optimize_checksum(mbedtls_ssl_context *ssl,
1508 const mbedtls_ssl_ciphersuite_t *ciphersuite_info);
1509
1510/*
1511 * Update checksum of handshake messages.
1512 */
1513MBEDTLS_CHECK_RETURN_CRITICAL
1514int mbedtls_ssl_add_hs_msg_to_checksum(mbedtls_ssl_context *ssl,
1515 unsigned hs_type,
1516 unsigned char const *msg,
1517 size_t msg_len);
1518
1519MBEDTLS_CHECK_RETURN_CRITICAL
1520int mbedtls_ssl_add_hs_hdr_to_checksum(mbedtls_ssl_context *ssl,
1521 unsigned hs_type,
1522 size_t total_hs_len);
1523
1524#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
1525#if !defined(MBEDTLS_USE_PSA_CRYPTO)
1526MBEDTLS_CHECK_RETURN_CRITICAL
1527int mbedtls_ssl_psk_derive_premaster(mbedtls_ssl_context *ssl,
1528 mbedtls_key_exchange_type_t key_ex);
1529#endif /* !MBEDTLS_USE_PSA_CRYPTO */
1530#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
1531
1532#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED)
1533#if defined(MBEDTLS_SSL_CLI_C) || defined(MBEDTLS_SSL_SRV_C)
1534MBEDTLS_CHECK_RETURN_CRITICAL
1535int mbedtls_ssl_conf_has_static_psk(mbedtls_ssl_config const *conf);
1536#endif
1537#if defined(MBEDTLS_USE_PSA_CRYPTO)
1545static inline mbedtls_svc_key_id_t mbedtls_ssl_get_opaque_psk(
1546 const mbedtls_ssl_context *ssl)
1547{
1548 if (!mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque)) {
1549 return ssl->handshake->psk_opaque;
1550 }
1551
1552 if (!mbedtls_svc_key_id_is_null(ssl->conf->psk_opaque)) {
1553 return ssl->conf->psk_opaque;
1554 }
1555
1556 return MBEDTLS_SVC_KEY_ID_INIT;
1557}
1558#else
1565static inline int mbedtls_ssl_get_psk(const mbedtls_ssl_context *ssl,
1566 const unsigned char **psk, size_t *psk_len)
1567{
1568 if (ssl->handshake->psk != NULL && ssl->handshake->psk_len > 0) {
1569 *psk = ssl->handshake->psk;
1570 *psk_len = ssl->handshake->psk_len;
1571 } else if (ssl->conf->psk != NULL && ssl->conf->psk_len > 0) {
1572 *psk = ssl->conf->psk;
1573 *psk_len = ssl->conf->psk_len;
1574 } else {
1575 *psk = NULL;
1576 *psk_len = 0;
1577 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED;
1578 }
1579
1580 return 0;
1581}
1582#endif /* MBEDTLS_USE_PSA_CRYPTO */
1583
1584#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED */
1585
1586#if defined(MBEDTLS_PK_C)
1587unsigned char mbedtls_ssl_sig_from_pk(mbedtls_pk_context *pk);
1588unsigned char mbedtls_ssl_sig_from_pk_alg(mbedtls_pk_type_t type);
1589mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig(unsigned char sig);
1590#endif
1591
1592mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash(unsigned char hash);
1593unsigned char mbedtls_ssl_hash_from_md_alg(int md);
1594
1595#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1596MBEDTLS_CHECK_RETURN_CRITICAL
1597int mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context *ssl, int md);
1598#endif
1599
1600MBEDTLS_CHECK_RETURN_CRITICAL
1601int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_id);
1602#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
1603MBEDTLS_CHECK_RETURN_CRITICAL
1604int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id);
1605#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */
1606
1623int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id,
1624 psa_key_type_t *type,
1625 size_t *bits);
1626
1634mbedtls_ecp_group_id mbedtls_ssl_get_ecp_group_id_from_tls_id(uint16_t tls_id);
1635
1643uint16_t mbedtls_ssl_get_tls_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id);
1644
1645#if defined(MBEDTLS_DEBUG_C)
1653const char *mbedtls_ssl_get_curve_name_from_tls_id(uint16_t tls_id);
1654#endif
1655
1656#if defined(MBEDTLS_SSL_DTLS_SRTP)
1657static inline mbedtls_ssl_srtp_profile mbedtls_ssl_check_srtp_profile_value
1658 (const uint16_t srtp_profile_value)
1659{
1660 switch (srtp_profile_value) {
1661 case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80:
1662 case MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32:
1663 case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80:
1664 case MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32:
1665 return srtp_profile_value;
1666 default: break;
1667 }
1668 return MBEDTLS_TLS_SRTP_UNSET;
1669}
1670#endif
1671
1672#if defined(MBEDTLS_X509_CRT_PARSE_C)
1673static inline mbedtls_pk_context *mbedtls_ssl_own_key(mbedtls_ssl_context *ssl)
1674{
1675 mbedtls_ssl_key_cert *key_cert;
1676
1677 if (ssl->handshake != NULL && ssl->handshake->key_cert != NULL) {
1678 key_cert = ssl->handshake->key_cert;
1679 } else {
1680 key_cert = ssl->conf->key_cert;
1681 }
1682
1683 return key_cert == NULL ? NULL : key_cert->key;
1684}
1685
1686static inline mbedtls_x509_crt *mbedtls_ssl_own_cert(mbedtls_ssl_context *ssl)
1687{
1688 mbedtls_ssl_key_cert *key_cert;
1689
1690 if (ssl->handshake != NULL && ssl->handshake->key_cert != NULL) {
1691 key_cert = ssl->handshake->key_cert;
1692 } else {
1693 key_cert = ssl->conf->key_cert;
1694 }
1695
1696 return key_cert == NULL ? NULL : key_cert->cert;
1697}
1698
1699/*
1700 * Verify a certificate.
1701 *
1702 * [in/out] ssl: misc. things read
1703 * ssl->session_negotiate->verify_result updated
1704 * [in] authmode: one of MBEDTLS_SSL_VERIFY_{NONE,OPTIONAL,REQUIRED}
1705 * [in] chain: the certificate chain to verify (ie the peer's chain)
1706 * [in] ciphersuite_info: For TLS 1.2, this session's ciphersuite;
1707 * for TLS 1.3, may be left NULL.
1708 * [in] rs_ctx: restart context if restartable ECC is in use;
1709 * leave NULL for no restartable behaviour.
1710 *
1711 * Return:
1712 * - 0 if the handshake should continue. Depending on the
1713 * authmode it means:
1714 * - REQUIRED: the certificate was found to be valid, trusted & acceptable.
1715 * ssl->session_negotiate->verify_result is 0.
1716 * - OPTIONAL: the certificate may or may not be acceptable, but
1717 * ssl->session_negotiate->verify_result was updated with the result.
1718 * - NONE: the certificate wasn't even checked.
1719 * - MBEDTLS_ERR_X509_CERT_VERIFY_FAILED or MBEDTLS_ERR_SSL_BAD_CERTIFICATE if
1720 * the certificate was found to be invalid/untrusted/unacceptable and the
1721 * handshake should be aborted (can only happen with REQUIRED).
1722 * - another error code if another error happened (out-of-memory, etc.)
1723 */
1724MBEDTLS_CHECK_RETURN_CRITICAL
1725int mbedtls_ssl_verify_certificate(mbedtls_ssl_context *ssl,
1726 int authmode,
1727 mbedtls_x509_crt *chain,
1728 const mbedtls_ssl_ciphersuite_t *ciphersuite_info,
1729 void *rs_ctx);
1730
1731/*
1732 * Check usage of a certificate wrt usage extensions:
1733 * keyUsage and extendedKeyUsage.
1734 * (Note: nSCertType is deprecated and not standard, we don't check it.)
1735 *
1736 * Note: if tls_version is 1.3, ciphersuite is ignored and can be NULL.
1737 *
1738 * Note: recv_endpoint is the receiver's endpoint.
1739 *
1740 * Return 0 if everything is OK, -1 if not.
1741 */
1742MBEDTLS_CHECK_RETURN_CRITICAL
1743int mbedtls_ssl_check_cert_usage(const mbedtls_x509_crt *cert,
1744 const mbedtls_ssl_ciphersuite_t *ciphersuite,
1745 int recv_endpoint,
1746 mbedtls_ssl_protocol_version tls_version,
1747 uint32_t *flags);
1748#endif /* MBEDTLS_X509_CRT_PARSE_C */
1749
1750void mbedtls_ssl_write_version(unsigned char version[2], int transport,
1751 mbedtls_ssl_protocol_version tls_version);
1752uint16_t mbedtls_ssl_read_version(const unsigned char version[2],
1753 int transport);
1754
1755static inline size_t mbedtls_ssl_in_hdr_len(const mbedtls_ssl_context *ssl)
1756{
1757#if !defined(MBEDTLS_SSL_PROTO_DTLS)
1758 ((void) ssl);
1759#endif
1760
1761#if defined(MBEDTLS_SSL_PROTO_DTLS)
1762 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1763 return 13;
1764 } else
1765#endif /* MBEDTLS_SSL_PROTO_DTLS */
1766 {
1767 return 5;
1768 }
1769}
1770
1771static inline size_t mbedtls_ssl_out_hdr_len(const mbedtls_ssl_context *ssl)
1772{
1773 return (size_t) (ssl->out_iv - ssl->out_hdr);
1774}
1775
1776static inline size_t mbedtls_ssl_hs_hdr_len(const mbedtls_ssl_context *ssl)
1777{
1778#if defined(MBEDTLS_SSL_PROTO_DTLS)
1779 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1780 return 12;
1781 }
1782#else
1783 ((void) ssl);
1784#endif
1785 return 4;
1786}
1787
1788#if defined(MBEDTLS_SSL_PROTO_DTLS)
1789void mbedtls_ssl_send_flight_completed(mbedtls_ssl_context *ssl);
1790void mbedtls_ssl_recv_flight_completed(mbedtls_ssl_context *ssl);
1791MBEDTLS_CHECK_RETURN_CRITICAL
1792int mbedtls_ssl_resend(mbedtls_ssl_context *ssl);
1793MBEDTLS_CHECK_RETURN_CRITICAL
1794int mbedtls_ssl_flight_transmit(mbedtls_ssl_context *ssl);
1795#endif
1796
1797/* Visible for testing purposes only */
1798#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1799MBEDTLS_CHECK_RETURN_CRITICAL
1800int mbedtls_ssl_dtls_replay_check(mbedtls_ssl_context const *ssl);
1801void mbedtls_ssl_dtls_replay_update(mbedtls_ssl_context *ssl);
1802#endif
1803
1804MBEDTLS_CHECK_RETURN_CRITICAL
1805int mbedtls_ssl_session_copy(mbedtls_ssl_session *dst,
1806 const mbedtls_ssl_session *src);
1807
1808#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1809/* The hash buffer must have at least MBEDTLS_MD_MAX_SIZE bytes of length. */
1810MBEDTLS_CHECK_RETURN_CRITICAL
1811int mbedtls_ssl_get_key_exchange_md_tls1_2(mbedtls_ssl_context *ssl,
1812 unsigned char *hash, size_t *hashlen,
1813 unsigned char *data, size_t data_len,
1814 mbedtls_md_type_t md_alg);
1815#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1816
1817#ifdef __cplusplus
1818}
1819#endif
1820
1821void mbedtls_ssl_transform_init(mbedtls_ssl_transform *transform);
1822MBEDTLS_CHECK_RETURN_CRITICAL
1823int mbedtls_ssl_encrypt_buf(mbedtls_ssl_context *ssl,
1824 mbedtls_ssl_transform *transform,
1825 mbedtls_record *rec,
1826 int (*f_rng)(void *, unsigned char *, size_t),
1827 void *p_rng);
1828MBEDTLS_CHECK_RETURN_CRITICAL
1829int mbedtls_ssl_decrypt_buf(mbedtls_ssl_context const *ssl,
1830 mbedtls_ssl_transform *transform,
1831 mbedtls_record *rec);
1832
1833/* Length of the "epoch" field in the record header */
1834static inline size_t mbedtls_ssl_ep_len(const mbedtls_ssl_context *ssl)
1835{
1836#if defined(MBEDTLS_SSL_PROTO_DTLS)
1837 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1838 return 2;
1839 }
1840#else
1841 ((void) ssl);
1842#endif
1843 return 0;
1844}
1845
1846#if defined(MBEDTLS_SSL_PROTO_DTLS)
1847MBEDTLS_CHECK_RETURN_CRITICAL
1848int mbedtls_ssl_resend_hello_request(mbedtls_ssl_context *ssl);
1849#endif /* MBEDTLS_SSL_PROTO_DTLS */
1850
1851void mbedtls_ssl_set_timer(mbedtls_ssl_context *ssl, uint32_t millisecs);
1852MBEDTLS_CHECK_RETURN_CRITICAL
1853int mbedtls_ssl_check_timer(mbedtls_ssl_context *ssl);
1854
1855void mbedtls_ssl_reset_in_pointers(mbedtls_ssl_context *ssl);
1856void mbedtls_ssl_update_in_pointers(mbedtls_ssl_context *ssl);
1857void mbedtls_ssl_reset_out_pointers(mbedtls_ssl_context *ssl);
1858void mbedtls_ssl_update_out_pointers(mbedtls_ssl_context *ssl,
1859 mbedtls_ssl_transform *transform);
1860
1861MBEDTLS_CHECK_RETURN_CRITICAL
1862int mbedtls_ssl_session_reset_int(mbedtls_ssl_context *ssl, int partial);
1863void mbedtls_ssl_session_reset_msg_layer(mbedtls_ssl_context *ssl,
1864 int partial);
1865
1866/*
1867 * Send pending alert
1868 */
1869MBEDTLS_CHECK_RETURN_CRITICAL
1870int mbedtls_ssl_handle_pending_alert(mbedtls_ssl_context *ssl);
1871
1872/*
1873 * Set pending fatal alert flag.
1874 */
1875void mbedtls_ssl_pend_fatal_alert(mbedtls_ssl_context *ssl,
1876 unsigned char alert_type,
1877 int alert_reason);
1878
1879/* Alias of mbedtls_ssl_pend_fatal_alert */
1880#define MBEDTLS_SSL_PEND_FATAL_ALERT(type, user_return_value) \
1881 mbedtls_ssl_pend_fatal_alert(ssl, type, user_return_value)
1882
1883#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1884void mbedtls_ssl_dtls_replay_reset(mbedtls_ssl_context *ssl);
1885#endif
1886
1887void mbedtls_ssl_handshake_wrapup_free_hs_transform(mbedtls_ssl_context *ssl);
1888
1889#if defined(MBEDTLS_SSL_RENEGOTIATION)
1890MBEDTLS_CHECK_RETURN_CRITICAL
1891int mbedtls_ssl_start_renegotiation(mbedtls_ssl_context *ssl);
1892#endif /* MBEDTLS_SSL_RENEGOTIATION */
1893
1894#if defined(MBEDTLS_SSL_PROTO_DTLS)
1895size_t mbedtls_ssl_get_current_mtu(const mbedtls_ssl_context *ssl);
1896void mbedtls_ssl_buffering_free(mbedtls_ssl_context *ssl);
1897void mbedtls_ssl_flight_free(mbedtls_ssl_flight_item *flight);
1898#endif /* MBEDTLS_SSL_PROTO_DTLS */
1899
1904#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1905static inline int mbedtls_ssl_conf_is_tls13_only(const mbedtls_ssl_config *conf)
1906{
1907 return conf->min_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
1908 conf->max_tls_version == MBEDTLS_SSL_VERSION_TLS1_3;
1909}
1910
1911#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
1912
1913#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1914static inline int mbedtls_ssl_conf_is_tls12_only(const mbedtls_ssl_config *conf)
1915{
1916 return conf->min_tls_version == MBEDTLS_SSL_VERSION_TLS1_2 &&
1917 conf->max_tls_version == MBEDTLS_SSL_VERSION_TLS1_2;
1918}
1919
1920#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
1921
1922static inline int mbedtls_ssl_conf_is_tls13_enabled(const mbedtls_ssl_config *conf)
1923{
1924#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1925 return conf->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_3 &&
1926 conf->max_tls_version >= MBEDTLS_SSL_VERSION_TLS1_3;
1927#else
1928 ((void) conf);
1929 return 0;
1930#endif
1931}
1932
1933static inline int mbedtls_ssl_conf_is_tls12_enabled(const mbedtls_ssl_config *conf)
1934{
1935#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
1936 return conf->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_2 &&
1937 conf->max_tls_version >= MBEDTLS_SSL_VERSION_TLS1_2;
1938#else
1939 ((void) conf);
1940 return 0;
1941#endif
1942}
1943
1944#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
1945static inline int mbedtls_ssl_conf_is_hybrid_tls12_tls13(const mbedtls_ssl_config *conf)
1946{
1947 return conf->min_tls_version == MBEDTLS_SSL_VERSION_TLS1_2 &&
1948 conf->max_tls_version == MBEDTLS_SSL_VERSION_TLS1_3;
1949}
1950#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_TLS1_3 */
1951
1952#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
1953
1971int mbedtls_ssl_tls13_crypto_init(mbedtls_ssl_context *ssl);
1972
1973extern const uint8_t mbedtls_ssl_tls13_hello_retry_request_magic[
1974 MBEDTLS_SERVER_HELLO_RANDOM_LEN];
1975MBEDTLS_CHECK_RETURN_CRITICAL
1976int mbedtls_ssl_tls13_process_finished_message(mbedtls_ssl_context *ssl);
1977MBEDTLS_CHECK_RETURN_CRITICAL
1978int mbedtls_ssl_tls13_write_finished_message(mbedtls_ssl_context *ssl);
1979void mbedtls_ssl_tls13_handshake_wrapup(mbedtls_ssl_context *ssl);
1980
1990MBEDTLS_CHECK_RETURN_CRITICAL
1991int mbedtls_ssl_tls13_write_client_hello_exts(mbedtls_ssl_context *ssl,
1992 unsigned char *buf,
1993 unsigned char *end,
1994 size_t *out_len);
1995
2001MBEDTLS_CHECK_RETURN_CRITICAL
2002int mbedtls_ssl_tls13_handshake_client_step(mbedtls_ssl_context *ssl);
2003
2009MBEDTLS_CHECK_RETURN_CRITICAL
2010int mbedtls_ssl_tls13_handshake_server_step(mbedtls_ssl_context *ssl);
2011
2012
2013/*
2014 * Helper functions around key exchange modes.
2015 */
2016static inline int mbedtls_ssl_conf_tls13_is_kex_mode_enabled(mbedtls_ssl_context *ssl,
2017 int kex_mode_mask)
2018{
2019 return (ssl->conf->tls13_kex_modes & kex_mode_mask) != 0;
2020}
2021
2022static inline int mbedtls_ssl_conf_tls13_is_psk_enabled(mbedtls_ssl_context *ssl)
2023{
2024 return mbedtls_ssl_conf_tls13_is_kex_mode_enabled(ssl,
2025 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK);
2026}
2027
2028static inline int mbedtls_ssl_conf_tls13_is_psk_ephemeral_enabled(mbedtls_ssl_context *ssl)
2029{
2030 return mbedtls_ssl_conf_tls13_is_kex_mode_enabled(ssl,
2031 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL);
2032}
2033
2034static inline int mbedtls_ssl_conf_tls13_is_ephemeral_enabled(mbedtls_ssl_context *ssl)
2035{
2036 return mbedtls_ssl_conf_tls13_is_kex_mode_enabled(ssl,
2037 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL);
2038}
2039
2040static inline int mbedtls_ssl_conf_tls13_is_some_ephemeral_enabled(mbedtls_ssl_context *ssl)
2041{
2042 return mbedtls_ssl_conf_tls13_is_kex_mode_enabled(ssl,
2043 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL);
2044}
2045
2046static inline int mbedtls_ssl_conf_tls13_is_some_psk_enabled(mbedtls_ssl_context *ssl)
2047{
2048 return mbedtls_ssl_conf_tls13_is_kex_mode_enabled(ssl,
2049 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL);
2050}
2051
2052#if defined(MBEDTLS_SSL_SRV_C) && \
2053 defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
2064static inline int mbedtls_ssl_tls13_is_kex_mode_supported(mbedtls_ssl_context *ssl,
2065 int kex_modes_mask)
2066{
2067 return (ssl->handshake->tls13_kex_modes & kex_modes_mask) != 0;
2068}
2069
2070static inline int mbedtls_ssl_tls13_is_psk_supported(mbedtls_ssl_context *ssl)
2071{
2072 return mbedtls_ssl_tls13_is_kex_mode_supported(ssl,
2073 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK);
2074}
2075
2076static inline int mbedtls_ssl_tls13_is_psk_ephemeral_supported(
2077 mbedtls_ssl_context *ssl)
2078{
2079 return mbedtls_ssl_tls13_is_kex_mode_supported(ssl,
2080 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL);
2081}
2082
2083static inline int mbedtls_ssl_tls13_is_ephemeral_supported(mbedtls_ssl_context *ssl)
2084{
2085 return mbedtls_ssl_tls13_is_kex_mode_supported(ssl,
2086 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL);
2087}
2088
2089static inline int mbedtls_ssl_tls13_is_some_ephemeral_supported(mbedtls_ssl_context *ssl)
2090{
2091 return mbedtls_ssl_tls13_is_kex_mode_supported(ssl,
2092 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL);
2093}
2094
2095static inline int mbedtls_ssl_tls13_is_some_psk_supported(mbedtls_ssl_context *ssl)
2096{
2097 return mbedtls_ssl_tls13_is_kex_mode_supported(ssl,
2098 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL);
2099}
2100#endif /* MBEDTLS_SSL_SRV_C &&
2101 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
2102
2103/*
2104 * Helper functions for extensions checking.
2105 */
2106
2107MBEDTLS_CHECK_RETURN_CRITICAL
2108int mbedtls_ssl_tls13_check_received_extension(
2109 mbedtls_ssl_context *ssl,
2110 int hs_msg_type,
2111 unsigned int received_extension_type,
2112 uint32_t hs_msg_allowed_extensions_mask);
2113
2114static inline void mbedtls_ssl_tls13_set_hs_sent_ext_mask(
2115 mbedtls_ssl_context *ssl, unsigned int extension_type)
2116{
2117 ssl->handshake->sent_extensions |=
2118 mbedtls_ssl_get_extension_mask(extension_type);
2119}
2120
2121/*
2122 * Helper functions to check the selected key exchange mode.
2123 */
2124static inline int mbedtls_ssl_tls13_key_exchange_mode_check(
2125 mbedtls_ssl_context *ssl, int kex_mask)
2126{
2127 return (ssl->handshake->key_exchange_mode & kex_mask) != 0;
2128}
2129
2130static inline int mbedtls_ssl_tls13_key_exchange_mode_with_psk(
2131 mbedtls_ssl_context *ssl)
2132{
2133 return mbedtls_ssl_tls13_key_exchange_mode_check(ssl,
2134 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL);
2135}
2136
2137static inline int mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(
2138 mbedtls_ssl_context *ssl)
2139{
2140 return mbedtls_ssl_tls13_key_exchange_mode_check(ssl,
2141 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL);
2142}
2143
2144/*
2145 * Fetch TLS 1.3 handshake message header
2146 */
2147MBEDTLS_CHECK_RETURN_CRITICAL
2148int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl,
2149 unsigned hs_type,
2150 unsigned char **buf,
2151 size_t *buf_len);
2152
2173MBEDTLS_CHECK_RETURN_CRITICAL
2174int mbedtls_ssl_tls13_is_supported_versions_ext_present_in_exts(
2175 mbedtls_ssl_context *ssl,
2176 const unsigned char *buf, const unsigned char *end,
2177 const unsigned char **supported_versions_data,
2178 const unsigned char **supported_versions_data_end);
2179
2180/*
2181 * Handler of TLS 1.3 server certificate message
2182 */
2183MBEDTLS_CHECK_RETURN_CRITICAL
2184int mbedtls_ssl_tls13_process_certificate(mbedtls_ssl_context *ssl);
2185
2186#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
2187/*
2188 * Handler of TLS 1.3 write Certificate message
2189 */
2190MBEDTLS_CHECK_RETURN_CRITICAL
2191int mbedtls_ssl_tls13_write_certificate(mbedtls_ssl_context *ssl);
2192
2193/*
2194 * Handler of TLS 1.3 write Certificate Verify message
2195 */
2196MBEDTLS_CHECK_RETURN_CRITICAL
2197int mbedtls_ssl_tls13_write_certificate_verify(mbedtls_ssl_context *ssl);
2198
2199#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
2200
2201/*
2202 * Generic handler of Certificate Verify
2203 */
2204MBEDTLS_CHECK_RETURN_CRITICAL
2205int mbedtls_ssl_tls13_process_certificate_verify(mbedtls_ssl_context *ssl);
2206
2207/*
2208 * Write of dummy-CCS's for middlebox compatibility
2209 */
2210MBEDTLS_CHECK_RETURN_CRITICAL
2211int mbedtls_ssl_tls13_write_change_cipher_spec(mbedtls_ssl_context *ssl);
2212
2213MBEDTLS_CHECK_RETURN_CRITICAL
2214int mbedtls_ssl_reset_transcript_for_hrr(mbedtls_ssl_context *ssl);
2215
2216#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
2217MBEDTLS_CHECK_RETURN_CRITICAL
2218int mbedtls_ssl_tls13_generate_and_write_xxdh_key_exchange(
2219 mbedtls_ssl_context *ssl,
2220 uint16_t named_group,
2221 unsigned char *buf,
2222 unsigned char *end,
2223 size_t *out_len);
2224#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */
2225
2226#if defined(MBEDTLS_SSL_EARLY_DATA)
2227int mbedtls_ssl_tls13_write_early_data_ext(mbedtls_ssl_context *ssl,
2228 int in_new_session_ticket,
2229 unsigned char *buf,
2230 const unsigned char *end,
2231 size_t *out_len);
2232
2233int mbedtls_ssl_tls13_check_early_data_len(mbedtls_ssl_context *ssl,
2234 size_t early_data_len);
2235
2236typedef enum {
2237/*
2238 * The client has not sent the first ClientHello yet, the negotiation of early
2239 * data has not started yet.
2240 */
2241 MBEDTLS_SSL_EARLY_DATA_STATE_IDLE,
2242
2243/*
2244 * In its ClientHello, the client has not included an early data indication
2245 * extension.
2246 */
2247 MBEDTLS_SSL_EARLY_DATA_STATE_NO_IND_SENT,
2248
2249/*
2250 * The client has sent an early data indication extension in its first
2251 * ClientHello, it has not received the response (ServerHello or
2252 * HelloRetryRequest) from the server yet. The transform to protect early data
2253 * is not set either as for middlebox compatibility a dummy CCS may have to be
2254 * sent in clear. Early data cannot be sent to the server yet.
2255 */
2256 MBEDTLS_SSL_EARLY_DATA_STATE_IND_SENT,
2257
2258/*
2259 * The client has sent an early data indication extension in its first
2260 * ClientHello, it has not received the response (ServerHello or
2261 * HelloRetryRequest) from the server yet. The transform to protect early data
2262 * has been set and early data can be written now.
2263 */
2264 MBEDTLS_SSL_EARLY_DATA_STATE_CAN_WRITE,
2265
2266/*
2267 * The client has indicated the use of early data and the server has accepted
2268 * it.
2269 */
2270 MBEDTLS_SSL_EARLY_DATA_STATE_ACCEPTED,
2271
2272/*
2273 * The client has indicated the use of early data but the server has rejected
2274 * it.
2275 */
2276 MBEDTLS_SSL_EARLY_DATA_STATE_REJECTED,
2277
2278/*
2279 * The client has sent an early data indication extension in its first
2280 * ClientHello, the server has accepted them and the client has received the
2281 * server Finished message. It cannot send early data to the server anymore.
2282 */
2283 MBEDTLS_SSL_EARLY_DATA_STATE_SERVER_FINISHED_RECEIVED,
2284
2285} mbedtls_ssl_early_data_state;
2286#endif /* MBEDTLS_SSL_EARLY_DATA */
2287
2288#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
2289
2290#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
2291/*
2292 * Write Signature Algorithm extension
2293 */
2294MBEDTLS_CHECK_RETURN_CRITICAL
2295int mbedtls_ssl_write_sig_alg_ext(mbedtls_ssl_context *ssl, unsigned char *buf,
2296 const unsigned char *end, size_t *out_len);
2297/*
2298 * Parse TLS Signature Algorithm extension
2299 */
2300MBEDTLS_CHECK_RETURN_CRITICAL
2301int mbedtls_ssl_parse_sig_alg_ext(mbedtls_ssl_context *ssl,
2302 const unsigned char *buf,
2303 const unsigned char *end);
2304#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
2305
2306/* Get handshake transcript */
2307MBEDTLS_CHECK_RETURN_CRITICAL
2308int mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context *ssl,
2309 const mbedtls_md_type_t md,
2310 unsigned char *dst,
2311 size_t dst_len,
2312 size_t *olen);
2313
2314/*
2315 * Return supported groups.
2316 *
2317 * In future, invocations can be changed to ssl->conf->group_list
2318 * when mbedtls_ssl_conf_curves() is deleted.
2319 *
2320 * ssl->handshake->group_list is either a translation of curve_list to IANA TLS group
2321 * identifiers when mbedtls_ssl_conf_curves() has been used, or a pointer to
2322 * ssl->conf->group_list when mbedtls_ssl_conf_groups() has been more recently invoked.
2323 *
2324 */
2325static inline const void *mbedtls_ssl_get_groups(const mbedtls_ssl_context *ssl)
2326{
2327 #if defined(MBEDTLS_DEPRECATED_REMOVED) || !defined(MBEDTLS_ECP_C)
2328 return ssl->conf->group_list;
2329 #else
2330 if ((ssl->handshake != NULL) && (ssl->handshake->group_list != NULL)) {
2331 return ssl->handshake->group_list;
2332 } else {
2333 return ssl->conf->group_list;
2334 }
2335 #endif
2336}
2337
2338/*
2339 * Helper functions for NamedGroup.
2340 */
2341static inline int mbedtls_ssl_tls12_named_group_is_ecdhe(uint16_t named_group)
2342{
2343 /*
2344 * RFC 8422 section 5.1.1
2345 */
2346 return named_group == MBEDTLS_SSL_IANA_TLS_GROUP_X25519 ||
2347 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1 ||
2348 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1 ||
2349 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1 ||
2350 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_X448 ||
2351 /* Below deprecated curves should be removed with notice to users */
2352 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1 ||
2353 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1 ||
2354 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1 ||
2355 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1 ||
2356 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1 ||
2357 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1 ||
2358 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1 ||
2359 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1;
2360}
2361
2362static inline int mbedtls_ssl_tls13_named_group_is_ecdhe(uint16_t named_group)
2363{
2364 return named_group == MBEDTLS_SSL_IANA_TLS_GROUP_X25519 ||
2365 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1 ||
2366 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1 ||
2367 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1 ||
2368 named_group == MBEDTLS_SSL_IANA_TLS_GROUP_X448;
2369}
2370
2371static inline int mbedtls_ssl_tls13_named_group_is_ffdh(uint16_t named_group)
2372{
2373 return named_group >= MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048 &&
2374 named_group <= MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192;
2375}
2376
2377static inline int mbedtls_ssl_named_group_is_offered(
2378 const mbedtls_ssl_context *ssl, uint16_t named_group)
2379{
2380 const uint16_t *group_list = mbedtls_ssl_get_groups(ssl);
2381
2382 if (group_list == NULL) {
2383 return 0;
2384 }
2385
2386 for (; *group_list != 0; group_list++) {
2387 if (*group_list == named_group) {
2388 return 1;
2389 }
2390 }
2391
2392 return 0;
2393}
2394
2395static inline int mbedtls_ssl_named_group_is_supported(uint16_t named_group)
2396{
2397#if defined(PSA_WANT_ALG_ECDH)
2398 if (mbedtls_ssl_tls13_named_group_is_ecdhe(named_group)) {
2399 if (mbedtls_ssl_get_ecp_group_id_from_tls_id(named_group) !=
2400 MBEDTLS_ECP_DP_NONE) {
2401 return 1;
2402 }
2403 }
2404#endif
2405#if defined(PSA_WANT_ALG_FFDH)
2406 if (mbedtls_ssl_tls13_named_group_is_ffdh(named_group)) {
2407 return 1;
2408 }
2409#endif
2410#if !defined(PSA_WANT_ALG_ECDH) && !defined(PSA_WANT_ALG_FFDH)
2411 (void) named_group;
2412#endif
2413 return 0;
2414}
2415
2416/*
2417 * Return supported signature algorithms.
2418 *
2419 * In future, invocations can be changed to ssl->conf->sig_algs when
2420 * mbedtls_ssl_conf_sig_hashes() is deleted.
2421 *
2422 * ssl->handshake->sig_algs is either a translation of sig_hashes to IANA TLS
2423 * signature algorithm identifiers when mbedtls_ssl_conf_sig_hashes() has been
2424 * used, or a pointer to ssl->conf->sig_algs when mbedtls_ssl_conf_sig_algs() has
2425 * been more recently invoked.
2426 *
2427 */
2428static inline const void *mbedtls_ssl_get_sig_algs(
2429 const mbedtls_ssl_context *ssl)
2430{
2431#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
2432
2433#if !defined(MBEDTLS_DEPRECATED_REMOVED)
2434 if (ssl->handshake != NULL &&
2435 ssl->handshake->sig_algs_heap_allocated == 1 &&
2436 ssl->handshake->sig_algs != NULL) {
2437 return ssl->handshake->sig_algs;
2438 }
2439#endif
2440 return ssl->conf->sig_algs;
2441
2442#else /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
2443
2444 ((void) ssl);
2445 return NULL;
2446#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
2447}
2448
2449#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
2450static inline int mbedtls_ssl_sig_alg_is_received(const mbedtls_ssl_context *ssl,
2451 uint16_t own_sig_alg)
2452{
2453 const uint16_t *sig_alg = ssl->handshake->received_sig_algs;
2454 if (sig_alg == NULL) {
2455 return 0;
2456 }
2457
2458 for (; *sig_alg != MBEDTLS_TLS_SIG_NONE; sig_alg++) {
2459 if (*sig_alg == own_sig_alg) {
2460 return 1;
2461 }
2462 }
2463 return 0;
2464}
2465
2466static inline int mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(
2467 const uint16_t sig_alg)
2468{
2469 switch (sig_alg) {
2470#if defined(MBEDTLS_PK_CAN_ECDSA_SOME)
2471#if defined(PSA_WANT_ALG_SHA_256) && defined(PSA_WANT_ECC_SECP_R1_256)
2472 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256:
2473 break;
2474#endif /* PSA_WANT_ALG_SHA_256 && MBEDTLS_ECP_DP_SECP256R1_ENABLED */
2475#if defined(PSA_WANT_ALG_SHA_384) && defined(PSA_WANT_ECC_SECP_R1_384)
2476 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384:
2477 break;
2478#endif /* PSA_WANT_ALG_SHA_384 && MBEDTLS_ECP_DP_SECP384R1_ENABLED */
2479#if defined(PSA_WANT_ALG_SHA_512) && defined(PSA_WANT_ECC_SECP_R1_521)
2480 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512:
2481 break;
2482#endif /* PSA_WANT_ALG_SHA_512 && MBEDTLS_ECP_DP_SECP521R1_ENABLED */
2483#endif /* MBEDTLS_PK_CAN_ECDSA_SOME */
2484
2485#if defined(MBEDTLS_PKCS1_V21)
2486#if defined(PSA_WANT_ALG_SHA_256)
2487 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
2488 break;
2489#endif /* PSA_WANT_ALG_SHA_256 */
2490#if defined(PSA_WANT_ALG_SHA_384)
2491 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:
2492 break;
2493#endif /* PSA_WANT_ALG_SHA_384 */
2494#if defined(PSA_WANT_ALG_SHA_512)
2495 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
2496 break;
2497#endif /* PSA_WANT_ALG_SHA_512 */
2498#endif /* MBEDTLS_PKCS1_V21 */
2499 default:
2500 return 0;
2501 }
2502 return 1;
2503
2504}
2505
2506static inline int mbedtls_ssl_tls13_sig_alg_is_supported(
2507 const uint16_t sig_alg)
2508{
2509 switch (sig_alg) {
2510#if defined(MBEDTLS_PKCS1_V15)
2511#if defined(MBEDTLS_MD_CAN_SHA256)
2512 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256:
2513 break;
2514#endif /* MBEDTLS_MD_CAN_SHA256 */
2515#if defined(MBEDTLS_MD_CAN_SHA384)
2516 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384:
2517 break;
2518#endif /* MBEDTLS_MD_CAN_SHA384 */
2519#if defined(MBEDTLS_MD_CAN_SHA512)
2520 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512:
2521 break;
2522#endif /* MBEDTLS_MD_CAN_SHA512 */
2523#endif /* MBEDTLS_PKCS1_V15 */
2524 default:
2525 return mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(
2526 sig_alg);
2527 }
2528 return 1;
2529}
2530
2531MBEDTLS_CHECK_RETURN_CRITICAL
2532int mbedtls_ssl_tls13_check_sig_alg_cert_key_match(uint16_t sig_alg,
2533 mbedtls_pk_context *key);
2534#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
2535
2536#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
2537static inline int mbedtls_ssl_sig_alg_is_offered(const mbedtls_ssl_context *ssl,
2538 uint16_t proposed_sig_alg)
2539{
2540 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs(ssl);
2541 if (sig_alg == NULL) {
2542 return 0;
2543 }
2544
2545 for (; *sig_alg != MBEDTLS_TLS_SIG_NONE; sig_alg++) {
2546 if (*sig_alg == proposed_sig_alg) {
2547 return 1;
2548 }
2549 }
2550 return 0;
2551}
2552
2553static inline int mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg(
2554 uint16_t sig_alg, mbedtls_pk_type_t *pk_type, mbedtls_md_type_t *md_alg)
2555{
2556 *pk_type = mbedtls_ssl_pk_alg_from_sig(sig_alg & 0xff);
2557 *md_alg = mbedtls_ssl_md_alg_from_hash((sig_alg >> 8) & 0xff);
2558
2559 if (*pk_type != MBEDTLS_PK_NONE && *md_alg != MBEDTLS_MD_NONE) {
2560 return 0;
2561 }
2562
2563 switch (sig_alg) {
2564#if defined(MBEDTLS_PKCS1_V21)
2565#if defined(MBEDTLS_MD_CAN_SHA256)
2566 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
2567 *md_alg = MBEDTLS_MD_SHA256;
2568 *pk_type = MBEDTLS_PK_RSASSA_PSS;
2569 break;
2570#endif /* MBEDTLS_MD_CAN_SHA256 */
2571#if defined(MBEDTLS_MD_CAN_SHA384)
2572 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:
2573 *md_alg = MBEDTLS_MD_SHA384;
2574 *pk_type = MBEDTLS_PK_RSASSA_PSS;
2575 break;
2576#endif /* MBEDTLS_MD_CAN_SHA384 */
2577#if defined(MBEDTLS_MD_CAN_SHA512)
2578 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
2579 *md_alg = MBEDTLS_MD_SHA512;
2580 *pk_type = MBEDTLS_PK_RSASSA_PSS;
2581 break;
2582#endif /* MBEDTLS_MD_CAN_SHA512 */
2583#endif /* MBEDTLS_PKCS1_V21 */
2584 default:
2585 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2586 }
2587 return 0;
2588}
2589
2590#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2591static inline int mbedtls_ssl_tls12_sig_alg_is_supported(
2592 const uint16_t sig_alg)
2593{
2594 /* High byte is hash */
2595 unsigned char hash = MBEDTLS_BYTE_1(sig_alg);
2596 unsigned char sig = MBEDTLS_BYTE_0(sig_alg);
2597
2598 switch (hash) {
2599#if defined(MBEDTLS_MD_CAN_MD5)
2600 case MBEDTLS_SSL_HASH_MD5:
2601 break;
2602#endif
2603
2604#if defined(MBEDTLS_MD_CAN_SHA1)
2605 case MBEDTLS_SSL_HASH_SHA1:
2606 break;
2607#endif
2608
2609#if defined(MBEDTLS_MD_CAN_SHA224)
2610 case MBEDTLS_SSL_HASH_SHA224:
2611 break;
2612#endif
2613
2614#if defined(MBEDTLS_MD_CAN_SHA256)
2615 case MBEDTLS_SSL_HASH_SHA256:
2616 break;
2617#endif
2618
2619#if defined(MBEDTLS_MD_CAN_SHA384)
2620 case MBEDTLS_SSL_HASH_SHA384:
2621 break;
2622#endif
2623
2624#if defined(MBEDTLS_MD_CAN_SHA512)
2625 case MBEDTLS_SSL_HASH_SHA512:
2626 break;
2627#endif
2628
2629 default:
2630 return 0;
2631 }
2632
2633 switch (sig) {
2634#if defined(MBEDTLS_RSA_C)
2635 case MBEDTLS_SSL_SIG_RSA:
2636 break;
2637#endif
2638
2639#if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
2640 case MBEDTLS_SSL_SIG_ECDSA:
2641 break;
2642#endif
2643
2644 default:
2645 return 0;
2646 }
2647
2648 return 1;
2649}
2650#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2651
2652static inline int mbedtls_ssl_sig_alg_is_supported(
2653 const mbedtls_ssl_context *ssl,
2654 const uint16_t sig_alg)
2655{
2656
2657#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2658 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2) {
2659 return mbedtls_ssl_tls12_sig_alg_is_supported(sig_alg);
2660 }
2661#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2662
2663#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
2664 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
2665 return mbedtls_ssl_tls13_sig_alg_is_supported(sig_alg);
2666 }
2667#endif
2668 ((void) ssl);
2669 ((void) sig_alg);
2670 return 0;
2671}
2672#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
2673
2674#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
2675/* Corresponding PSA algorithm for MBEDTLS_CIPHER_NULL.
2676 * Same value is used for PSA_ALG_CATEGORY_CIPHER, hence it is
2677 * guaranteed to not be a valid PSA algorithm identifier.
2678 */
2679#define MBEDTLS_SSL_NULL_CIPHER 0x04000000
2680
2699psa_status_t mbedtls_ssl_cipher_to_psa(mbedtls_cipher_type_t mbedtls_cipher_type,
2700 size_t taglen,
2701 psa_algorithm_t *alg,
2702 psa_key_type_t *key_type,
2703 size_t *key_size);
2704
2705#if !defined(MBEDTLS_DEPRECATED_REMOVED)
2713static inline MBEDTLS_DEPRECATED int psa_ssl_status_to_mbedtls(psa_status_t status)
2714{
2715 switch (status) {
2716 case PSA_SUCCESS:
2717 return 0;
2718 case PSA_ERROR_INSUFFICIENT_MEMORY:
2719 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
2720 case PSA_ERROR_NOT_SUPPORTED:
2721 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2722 case PSA_ERROR_INVALID_SIGNATURE:
2723 return MBEDTLS_ERR_SSL_INVALID_MAC;
2724 case PSA_ERROR_INVALID_ARGUMENT:
2725 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2726 case PSA_ERROR_BAD_STATE:
2727 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2728 case PSA_ERROR_BUFFER_TOO_SMALL:
2729 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
2730 default:
2731 return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
2732 }
2733}
2734#endif /* !MBEDTLS_DEPRECATED_REMOVED */
2735#endif /* MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3 */
2736
2737#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \
2738 defined(MBEDTLS_USE_PSA_CRYPTO)
2739
2740typedef enum {
2741 MBEDTLS_ECJPAKE_ROUND_ONE,
2742 MBEDTLS_ECJPAKE_ROUND_TWO
2743} mbedtls_ecjpake_rounds_t;
2744
2757int mbedtls_psa_ecjpake_read_round(
2758 psa_pake_operation_t *pake_ctx,
2759 const unsigned char *buf,
2760 size_t len, mbedtls_ecjpake_rounds_t round);
2761
2775int mbedtls_psa_ecjpake_write_round(
2776 psa_pake_operation_t *pake_ctx,
2777 unsigned char *buf,
2778 size_t len, size_t *olen,
2779 mbedtls_ecjpake_rounds_t round);
2780
2781#endif //MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED && MBEDTLS_USE_PSA_CRYPTO
2782
2792
2793mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_transform(
2794 const mbedtls_ssl_transform *transform);
2795
2796#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
2797mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite(
2798 int encrypt_then_mac,
2799 const mbedtls_ssl_ciphersuite_t *suite);
2800#else
2801mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite(
2802 const mbedtls_ssl_ciphersuite_t *suite);
2803#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
2804
2805#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
2806
2807MBEDTLS_CHECK_RETURN_CRITICAL
2808int mbedtls_ssl_tls13_read_public_xxdhe_share(mbedtls_ssl_context *ssl,
2809 const unsigned char *buf,
2810 size_t buf_len);
2811
2812#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */
2813
2814static inline int mbedtls_ssl_tls13_cipher_suite_is_offered(
2815 mbedtls_ssl_context *ssl, int cipher_suite)
2816{
2817 const int *ciphersuite_list = ssl->conf->ciphersuite_list;
2818
2819 /* Check whether we have offered this ciphersuite */
2820 for (size_t i = 0; ciphersuite_list[i] != 0; i++) {
2821 if (ciphersuite_list[i] == cipher_suite) {
2822 return 1;
2823 }
2824 }
2825 return 0;
2826}
2827
2838MBEDTLS_CHECK_RETURN_CRITICAL
2839int mbedtls_ssl_validate_ciphersuite(
2840 const mbedtls_ssl_context *ssl,
2841 const mbedtls_ssl_ciphersuite_t *suite_info,
2842 mbedtls_ssl_protocol_version min_tls_version,
2843 mbedtls_ssl_protocol_version max_tls_version);
2844
2845#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2846MBEDTLS_CHECK_RETURN_CRITICAL
2847int mbedtls_ssl_parse_server_name_ext(mbedtls_ssl_context *ssl,
2848 const unsigned char *buf,
2849 const unsigned char *end);
2850#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
2851
2852#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
2853#define MBEDTLS_SSL_RECORD_SIZE_LIMIT_EXTENSION_DATA_LENGTH (2)
2854#define MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN (64) /* As defined in RFC 8449 */
2855
2856MBEDTLS_CHECK_RETURN_CRITICAL
2857int mbedtls_ssl_tls13_parse_record_size_limit_ext(mbedtls_ssl_context *ssl,
2858 const unsigned char *buf,
2859 const unsigned char *end);
2860
2861MBEDTLS_CHECK_RETURN_CRITICAL
2862int mbedtls_ssl_tls13_write_record_size_limit_ext(mbedtls_ssl_context *ssl,
2863 unsigned char *buf,
2864 const unsigned char *end,
2865 size_t *out_len);
2866#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
2867
2868#if defined(MBEDTLS_SSL_ALPN)
2869MBEDTLS_CHECK_RETURN_CRITICAL
2870int mbedtls_ssl_parse_alpn_ext(mbedtls_ssl_context *ssl,
2871 const unsigned char *buf,
2872 const unsigned char *end);
2873
2874
2875MBEDTLS_CHECK_RETURN_CRITICAL
2876int mbedtls_ssl_write_alpn_ext(mbedtls_ssl_context *ssl,
2877 unsigned char *buf,
2878 unsigned char *end,
2879 size_t *out_len);
2880#endif /* MBEDTLS_SSL_ALPN */
2881
2882#if defined(MBEDTLS_TEST_HOOKS)
2883int mbedtls_ssl_check_dtls_clihlo_cookie(
2884 mbedtls_ssl_context *ssl,
2885 const unsigned char *cli_id, size_t cli_id_len,
2886 const unsigned char *in, size_t in_len,
2887 unsigned char *obuf, size_t buf_len, size_t *olen);
2888#endif
2889
2890#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
2904MBEDTLS_CHECK_RETURN_CRITICAL
2905int mbedtls_ssl_tls13_write_identities_of_pre_shared_key_ext(
2906 mbedtls_ssl_context *ssl,
2907 unsigned char *buf, unsigned char *end,
2908 size_t *out_len, size_t *binders_len);
2909
2919MBEDTLS_CHECK_RETURN_CRITICAL
2920int mbedtls_ssl_tls13_write_binders_of_pre_shared_key_ext(
2921 mbedtls_ssl_context *ssl,
2922 unsigned char *buf, unsigned char *end);
2923#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
2924
2925#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2934const char *mbedtls_ssl_get_hostname_pointer(const mbedtls_ssl_context *ssl);
2935#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
2936
2937#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
2938 defined(MBEDTLS_SSL_SESSION_TICKETS) && \
2939 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \
2940 defined(MBEDTLS_SSL_CLI_C)
2941MBEDTLS_CHECK_RETURN_CRITICAL
2942int mbedtls_ssl_session_set_hostname(mbedtls_ssl_session *session,
2943 const char *hostname);
2944#endif
2945
2946#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_EARLY_DATA) && \
2947 defined(MBEDTLS_SSL_ALPN)
2948MBEDTLS_CHECK_RETURN_CRITICAL
2949int mbedtls_ssl_session_set_ticket_alpn(mbedtls_ssl_session *session,
2950 const char *alpn);
2951#endif
2952
2953#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS)
2954
2955#define MBEDTLS_SSL_TLS1_3_MAX_ALLOWED_TICKET_LIFETIME (604800)
2956
2957static inline unsigned int mbedtls_ssl_tls13_session_get_ticket_flags(
2958 mbedtls_ssl_session *session, unsigned int flags)
2959{
2960 return session->ticket_flags &
2961 (flags & MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK);
2962}
2963
2970static inline int mbedtls_ssl_tls13_session_ticket_has_flags(
2971 mbedtls_ssl_session *session, unsigned int flags)
2972{
2973 return mbedtls_ssl_tls13_session_get_ticket_flags(session, flags) != 0;
2974}
2975
2976static inline int mbedtls_ssl_tls13_session_ticket_allow_psk(
2977 mbedtls_ssl_session *session)
2978{
2979 return mbedtls_ssl_tls13_session_ticket_has_flags(
2980 session, MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_RESUMPTION);
2981}
2982
2983static inline int mbedtls_ssl_tls13_session_ticket_allow_psk_ephemeral(
2984 mbedtls_ssl_session *session)
2985{
2986 return mbedtls_ssl_tls13_session_ticket_has_flags(
2987 session, MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_PSK_EPHEMERAL_RESUMPTION);
2988}
2989
2990static inline unsigned int mbedtls_ssl_tls13_session_ticket_allow_early_data(
2991 mbedtls_ssl_session *session)
2992{
2993 return mbedtls_ssl_tls13_session_ticket_has_flags(
2994 session, MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA);
2995}
2996
2997static inline void mbedtls_ssl_tls13_session_set_ticket_flags(
2998 mbedtls_ssl_session *session, unsigned int flags)
2999{
3000 session->ticket_flags |= (flags & MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK);
3001}
3002
3003static inline void mbedtls_ssl_tls13_session_clear_ticket_flags(
3004 mbedtls_ssl_session *session, unsigned int flags)
3005{
3006 session->ticket_flags &= ~(flags & MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK);
3007}
3008
3009#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_SSL_SESSION_TICKETS */
3010
3011#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
3012#define MBEDTLS_SSL_SESSION_TICKETS_TLS1_2_BIT 0
3013#define MBEDTLS_SSL_SESSION_TICKETS_TLS1_3_BIT 1
3014
3015#define MBEDTLS_SSL_SESSION_TICKETS_TLS1_2_MASK \
3016 (1 << MBEDTLS_SSL_SESSION_TICKETS_TLS1_2_BIT)
3017#define MBEDTLS_SSL_SESSION_TICKETS_TLS1_3_MASK \
3018 (1 << MBEDTLS_SSL_SESSION_TICKETS_TLS1_3_BIT)
3019
3020#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3021static inline int mbedtls_ssl_conf_get_session_tickets(
3022 const mbedtls_ssl_config *conf)
3023{
3024 return conf->session_tickets & MBEDTLS_SSL_SESSION_TICKETS_TLS1_2_MASK ?
3025 MBEDTLS_SSL_SESSION_TICKETS_ENABLED :
3026 MBEDTLS_SSL_SESSION_TICKETS_DISABLED;
3027}
3028#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3029
3030#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
3031static inline int mbedtls_ssl_conf_is_signal_new_session_tickets_enabled(
3032 const mbedtls_ssl_config *conf)
3033{
3034 return conf->session_tickets & MBEDTLS_SSL_SESSION_TICKETS_TLS1_3_MASK ?
3035 MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED :
3036 MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED;
3037}
3038#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
3039#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
3040
3041#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
3042int mbedtls_ssl_tls13_finalize_client_hello(mbedtls_ssl_context *ssl);
3043#endif
3044
3045#if defined(MBEDTLS_TEST_HOOKS) && defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
3046
3083#if defined(MBEDTLS_USE_PSA_CRYPTO)
3084int mbedtls_ct_hmac(mbedtls_svc_key_id_t key,
3085 psa_algorithm_t mac_alg,
3086 const unsigned char *add_data,
3087 size_t add_data_len,
3088 const unsigned char *data,
3089 size_t data_len_secret,
3090 size_t min_data_len,
3091 size_t max_data_len,
3092 unsigned char *output);
3093#else
3094int mbedtls_ct_hmac(mbedtls_md_context_t *ctx,
3095 const unsigned char *add_data,
3096 size_t add_data_len,
3097 const unsigned char *data,
3098 size_t data_len_secret,
3099 size_t min_data_len,
3100 size_t max_data_len,
3101 unsigned char *output);
3102#endif /* defined(MBEDTLS_USE_PSA_CRYPTO) */
3103#endif /* MBEDTLS_TEST_HOOKS && defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) */
3104
3105#endif /* ssl_misc.h */
size_t
uint64_t size_t
Definition stdint.h:104
flags
uint8_t flags
Definition virtio.h:0
debug.h
Functions for controlling and providing debug output from the library.
MBEDTLS_SSL_DEBUG_MSG
#define MBEDTLS_SSL_DEBUG_MSG(level, args)
Definition debug.h:61
sha1.h
This file contains SHA-1 definitions and functions.
crypto.h
Platform Security Architecture cryptography module.
app
ChitralekhaApp * app
Definition main.cpp:57
uint32_t
unsigned int uint32_t
Definition acefiex.h:163
uint8_t
unsigned char uint8_t
Definition acefiex.h:161
uint16_t
unsigned short int uint16_t
Definition acefiex.h:162
NULL
#define NULL
Definition actypes.h:561
MBEDTLS_BYTE_1
#define MBEDTLS_BYTE_1(x)
Definition alignment.h:269
MBEDTLS_BYTE_0
#define MBEDTLS_BYTE_0(x)
Definition alignment.h:268
cipher.h
This file contains an abstraction interface for use with the cipher primitives provided by the librar...
mbedtls_cipher_type_t
mbedtls_cipher_type_t
Supported {cipher type, cipher mode} pairs.
Definition cipher.h:84
common.h
Utility macros for internal use in the library.
PSA_EXPORT_PUBLIC_KEY_MAX_SIZE
#define PSA_EXPORT_PUBLIC_KEY_MAX_SIZE
Definition crypto_sizes.h:1017
version
GameVersion_t version
Definition d_main.c:943
debug_internal.h
Internal part of the public "debug.h".
ecjpake.h
Elliptic curve J-PAKE.
mbedtls_ecp_group_id
mbedtls_ecp_group_id
Definition ecp.h:102
MBEDTLS_ECP_DP_NONE
@ MBEDTLS_ECP_DP_NONE
Definition ecp.h:103
error.h
Error to string translation.
MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED
#define MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED
Definition error.h:103
psa_key_type_t
uint16_t psa_key_type_t
Encoding of a key type.
Definition crypto_types.h:78
psa_algorithm_t
uint32_t psa_algorithm_t
Encoding of a cryptographic algorithm.
Definition crypto_types.h:134
psa_status_t
int32_t psa_status_t
Function return status.
Definition crypto_types.h:59
PSA_ERROR_NOT_SUPPORTED
#define PSA_ERROR_NOT_SUPPORTED
Definition crypto_values.h:73
PSA_ERROR_INVALID_SIGNATURE
#define PSA_ERROR_INVALID_SIGNATURE
Definition crypto_values.h:260
PSA_SUCCESS
#define PSA_SUCCESS
Definition crypto_values.h:57
PSA_ERROR_BUFFER_TOO_SMALL
#define PSA_ERROR_BUFFER_TOO_SMALL
Definition crypto_values.h:98
PSA_ERROR_INVALID_ARGUMENT
#define PSA_ERROR_INVALID_ARGUMENT
Definition crypto_values.h:137
PSA_ERROR_INSUFFICIENT_MEMORY
#define PSA_ERROR_INSUFFICIENT_MEMORY
Definition crypto_values.h:143
PSA_ERROR_BAD_STATE
#define PSA_ERROR_BAD_STATE
Definition crypto_values.h:126
MBEDTLS_SVC_KEY_ID_INIT
#define MBEDTLS_SVC_KEY_ID_INIT
Definition crypto_values.h:2438
mbedtls_svc_key_id_t
psa_key_id_t mbedtls_svc_key_id_t
Definition crypto_types.h:292
mbedtls_x509_crt_restart_ctx
void mbedtls_x509_crt_restart_ctx
Definition x509_crt.h:306
len
size_t len
Definition initial.c:23
data
void * data
Definition kthread.h:30
round
double round(double x)
Definition libm.c:95
end
char end[]
build_info.h
Build-time configuration info.
md5.h
MD5 message digest algorithm (hash function)
mbedtls_md_type_t
mbedtls_md_type_t
Supported message digests.
Definition md.h:47
MBEDTLS_MD_SHA512
@ MBEDTLS_MD_SHA512
Definition md.h:55
MBEDTLS_MD_SHA384
@ MBEDTLS_MD_SHA384
Definition md.h:54
MBEDTLS_MD_NONE
@ MBEDTLS_MD_NONE
Definition md.h:48
MBEDTLS_MD_SHA256
@ MBEDTLS_MD_SHA256
Definition md.h:53
pk.h
Public Key abstraction layer.
mbedtls_pk_type_t
mbedtls_pk_type_t
Public key types.
Definition pk.h:73
MBEDTLS_PK_NONE
@ MBEDTLS_PK_NONE
Definition pk.h:74
MBEDTLS_PK_RSASSA_PSS
@ MBEDTLS_PK_RSASSA_PSS
Definition pk.h:80
pk_internal.h
Public Key abstraction layer: internal (i.e. library only) functions and definitions.
MBEDTLS_DEPRECATED
#define MBEDTLS_DEPRECATED
Definition platform_util.h:37
MBEDTLS_CHECK_RETURN_CRITICAL
#define MBEDTLS_CHECK_RETURN_CRITICAL
Definition platform_util.h:77
psa_util_internal.h
Internal utility functions for use of PSA Crypto.
args
const char const char va_list args
Definition seq_buf.h:182
sha256.h
This file contains SHA-224 and SHA-256 definitions and functions.
sha512.h
This file contains SHA-384 and SHA-512 definitions and functions.
ssl.h
SSL/TLS functions.
MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED
#define MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED
Definition ssl.h:361
MBEDTLS_SSL_CID_OUT_LEN_MAX
#define MBEDTLS_SSL_CID_OUT_LEN_MAX
Definition ssl.h:455
MBEDTLS_SSL_IANA_TLS_GROUP_X25519
#define MBEDTLS_SSL_IANA_TLS_GROUP_X25519
Definition ssl.h:247
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL
#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL
Definition ssl.h:278
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256
#define MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256
Definition ssl.h:530
MBEDTLS_SSL_SIG_RSA
#define MBEDTLS_SSL_SIG_RSA
Definition ssl.h:511
MBEDTLS_SSL_HASH_SHA1
#define MBEDTLS_SSL_HASH_SHA1
Definition ssl.h:504
MBEDTLS_SSL_CID_IN_LEN_MAX
#define MBEDTLS_SSL_CID_IN_LEN_MAX
Definition ssl.h:451
MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1
#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1
Definition ssl.h:239
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384
#define MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384
Definition ssl.h:531
mbedtls_ssl_states
mbedtls_ssl_states
Definition ssl.h:747
MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256
#define MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256
Definition ssl.h:525
mbedtls_ssl_protocol_version
mbedtls_ssl_protocol_version
Definition ssl.h:1258
MBEDTLS_SSL_VERSION_TLS1_2
@ MBEDTLS_SSL_VERSION_TLS1_2
Definition ssl.h:1260
MBEDTLS_SSL_VERSION_TLS1_3
@ MBEDTLS_SSL_VERSION_TLS1_3
Definition ssl.h:1261
MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED
#define MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED
Definition ssl.h:70
MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1
#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1
Definition ssl.h:243
MBEDTLS_SSL_SEQUENCE_NUMBER_LEN
#define MBEDTLS_SSL_SEQUENCE_NUMBER_LEN
Definition ssl.h:730
MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1
#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1
Definition ssl.h:242
MBEDTLS_SSL_HASH_SHA224
#define MBEDTLS_SSL_HASH_SHA224
Definition ssl.h:505
MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1
#define MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1
Definition ssl.h:246
MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED
#define MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED
Definition ssl.h:360
MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1
#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1
Definition ssl.h:236
MBEDTLS_SSL_SESSION_TICKETS_ENABLED
#define MBEDTLS_SSL_SESSION_TICKETS_ENABLED
Definition ssl.h:358
MBEDTLS_ERR_SSL_BAD_INPUT_DATA
#define MBEDTLS_ERR_SSL_BAD_INPUT_DATA
Definition ssl.h:51
MBEDTLS_SSL_HASH_SHA256
#define MBEDTLS_SSL_HASH_SHA256
Definition ssl.h:506
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512
#define MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512
Definition ssl.h:522
MBEDTLS_ERR_SSL_ALLOC_FAILED
#define MBEDTLS_ERR_SSL_ALLOC_FAILED
Definition ssl.h:109
MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1
#define MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1
Definition ssl.h:244
MBEDTLS_SSL_HASH_MD5
#define MBEDTLS_SSL_HASH_MD5
Definition ssl.h:503
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL
#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ALL
Definition ssl.h:281
MBEDTLS_SSL_SESSION_TICKETS_DISABLED
#define MBEDTLS_SSL_SESSION_TICKETS_DISABLED
Definition ssl.h:357
MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384
#define MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384
Definition ssl.h:526
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL
#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL
Definition ssl.h:266
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384
#define MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384
Definition ssl.h:521
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK
#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK
Definition ssl.h:263
MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1
#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1
Definition ssl.h:237
MBEDTLS_SSL_IANA_TLS_GROUP_X448
#define MBEDTLS_SSL_IANA_TLS_GROUP_X448
Definition ssl.h:248
MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1
#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1
Definition ssl.h:241
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256
#define MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256
Definition ssl.h:520
MBEDTLS_SSL_SIG_ECDSA
#define MBEDTLS_SSL_SIG_ECDSA
Definition ssl.h:512
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512
#define MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512
Definition ssl.h:532
MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1
#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1
Definition ssl.h:240
MBEDTLS_TLS1_3_MD_MAX_SIZE
#define MBEDTLS_TLS1_3_MD_MAX_SIZE
Definition ssl.h:726
MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1
#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1
Definition ssl.h:238
MBEDTLS_SSL_HASH_SHA384
#define MBEDTLS_SSL_HASH_SHA384
Definition ssl.h:507
MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192
#define MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192
Definition ssl.h:254
MBEDTLS_SSL_TRANSPORT_DATAGRAM
#define MBEDTLS_SSL_TRANSPORT_DATAGRAM
Definition ssl.h:302
MBEDTLS_ERR_SSL_INVALID_MAC
#define MBEDTLS_ERR_SSL_INVALID_MAC
Definition ssl.h:53
MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL
#define MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL
Definition ssl.h:133
MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048
#define MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048
Definition ssl.h:250
MBEDTLS_PREMASTER_SIZE
#define MBEDTLS_PREMASTER_SIZE
Definition ssl.h:724
MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1
#define MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1
Definition ssl.h:245
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL
#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL
Definition ssl.h:269
MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE
#define MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE
Definition ssl.h:49
MBEDTLS_SSL_HASH_SHA512
#define MBEDTLS_SSL_HASH_SHA512
Definition ssl.h:508
MBEDTLS_ERR_SSL_INTERNAL_ERROR
#define MBEDTLS_ERR_SSL_INTERNAL_ERROR
Definition ssl.h:125
MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512
#define MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512
Definition ssl.h:527
mbedtls_key_exchange_type_t
mbedtls_key_exchange_type_t
Definition ssl_ciphersuites.h:257
ssl_ciphersuites_internal.h
Internal part of the public "ssl_ciphersuites.h".
mbedtls_ssl_read_version
uint16_t mbedtls_ssl_read_version(const unsigned char version[2], int transport)
MBEDTLS_CLIENT_HELLO_RANDOM_LEN
#define MBEDTLS_CLIENT_HELLO_RANDOM_LEN
Definition ssl_misc.h:412
mbedtls_ssl_transform_init
void mbedtls_ssl_transform_init(mbedtls_ssl_transform *transform)
mbedtls_ssl_validate_ciphersuite
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_validate_ciphersuite(const mbedtls_ssl_context *ssl, const mbedtls_ssl_ciphersuite_t *suite_info, mbedtls_ssl_protocol_version min_tls_version, mbedtls_ssl_protocol_version max_tls_version)
Validate cipher suite against config in SSL context.
mbedtls_ssl_write_version
void mbedtls_ssl_write_version(unsigned char version[2], int transport, mbedtls_ssl_protocol_version tls_version)
mbedtls_ssl_finish_handshake_msg
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_finish_handshake_msg(mbedtls_ssl_context *ssl, size_t buf_len, size_t msg_len)
MBEDTLS_SSL_MAX_BUFFERED_HS
#define MBEDTLS_SSL_MAX_BUFFERED_HS
Definition ssl_misc.h:332
mbedtls_ssl_handshake_free
void mbedtls_ssl_handshake_free(mbedtls_ssl_context *ssl)
Free referenced items in an SSL handshake context and clear memory.
mbedtls_ssl_session_reset_msg_layer
void mbedtls_ssl_session_reset_msg_layer(mbedtls_ssl_context *ssl, int partial)
mbedtls_ssl_parse_certificate
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_parse_certificate(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_CID_LEN_MAX
#define MBEDTLS_SSL_CID_LEN_MAX
Definition ssl_misc.h:1218
mbedtls_ssl_handshake_client_step
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_handshake_client_step(mbedtls_ssl_context *ssl)
mbedtls_ssl_handle_message_type
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_handle_message_type(mbedtls_ssl_context *ssl)
mbedtls_ssl_read_record
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_read_record(mbedtls_ssl_context *ssl, unsigned update_hs_digest)
Update record layer.
mbedtls_ssl_update_out_pointers
void mbedtls_ssl_update_out_pointers(mbedtls_ssl_context *ssl, mbedtls_ssl_transform *transform)
mbedtls_ssl_update_in_pointers
void mbedtls_ssl_update_in_pointers(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_HEADER_LEN
#define MBEDTLS_SSL_HEADER_LEN
Definition ssl_misc.h:392
mbedtls_ssl_set_outbound_transform
void mbedtls_ssl_set_outbound_transform(mbedtls_ssl_context *ssl, mbedtls_ssl_transform *transform)
mbedtls_ssl_transform_free
void mbedtls_ssl_transform_free(mbedtls_ssl_transform *transform)
Free referenced items in an SSL transform context and clear memory.
MBEDTLS_SERVER_HELLO_RANDOM_LEN
#define MBEDTLS_SERVER_HELLO_RANDOM_LEN
Definition ssl_misc.h:413
mbedtls_ssl_write_handshake_msg_ext
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_write_handshake_msg_ext(mbedtls_ssl_context *ssl, int update_checksum, int force_flush)
mbedtls_ssl_md_alg_from_hash
mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash(unsigned char hash)
mbedtls_ssl_reset_in_pointers
void mbedtls_ssl_reset_in_pointers(mbedtls_ssl_context *ssl)
mbedtls_ssl_handshake_wrapup
void mbedtls_ssl_handshake_wrapup(mbedtls_ssl_context *ssl)
mbedtls_ssl_get_mode_from_transform
mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_transform(const mbedtls_ssl_transform *transform)
mbedtls_ssl_start_handshake_msg
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_start_handshake_msg(mbedtls_ssl_context *ssl, unsigned char hs_type, unsigned char **buf, size_t *buf_len)
mbedtls_ssl_handshake_server_step
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_handshake_server_step(mbedtls_ssl_context *ssl)
mbedtls_ssl_decrypt_buf
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_decrypt_buf(mbedtls_ssl_context const *ssl, mbedtls_ssl_transform *transform, mbedtls_record *rec)
mbedtls_ssl_flush_output
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_flush_output(mbedtls_ssl_context *ssl)
mbedtls_ssl_get_extension_id
uint32_t mbedtls_ssl_get_extension_id(unsigned int extension_type)
mbedtls_ssl_add_hs_hdr_to_checksum
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_add_hs_hdr_to_checksum(mbedtls_ssl_context *ssl, unsigned hs_type, size_t total_hs_len)
mbedtls_ssl_get_extension_mask
uint32_t mbedtls_ssl_get_extension_mask(unsigned int extension_type)
mbedtls_ssl_write_record
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_write_record(mbedtls_ssl_context *ssl, int force_flush)
mbedtls_ssl_write_change_cipher_spec
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_write_change_cipher_spec(mbedtls_ssl_context *ssl)
mbedtls_ssl_session_reset_int
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_session_reset_int(mbedtls_ssl_context *ssl, int partial)
mbedtls_ssl_handle_pending_alert
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_handle_pending_alert(mbedtls_ssl_context *ssl)
mbedtls_ssl_handshake_wrapup_free_hs_transform
void mbedtls_ssl_handshake_wrapup_free_hs_transform(mbedtls_ssl_context *ssl)
mbedtls_ssl_get_psa_curve_info_from_tls_id
int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id, psa_key_type_t *type, size_t *bits)
Return PSA EC info for the specified TLS ID.
mbedtls_ssl_session_copy
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_session_copy(mbedtls_ssl_session *dst, const mbedtls_ssl_session *src)
MBEDTLS_SSL_MAX_KEY_LENGTH
#define MBEDTLS_SSL_MAX_KEY_LENGTH
Definition ssl_misc.h:608
mbedtls_ssl_prepare_handshake_record
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_prepare_handshake_record(mbedtls_ssl_context *ssl)
mbedtls_ssl_set_inbound_transform
void mbedtls_ssl_set_inbound_transform(mbedtls_ssl_context *ssl, mbedtls_ssl_transform *transform)
mbedtls_ssl_reset_out_pointers
void mbedtls_ssl_reset_out_pointers(mbedtls_ssl_context *ssl)
mbedtls_ssl_reset_checksum
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_reset_checksum(mbedtls_ssl_context *ssl)
mbedtls_ssl_get_ecp_group_id_from_tls_id
mbedtls_ecp_group_id mbedtls_ssl_get_ecp_group_id_from_tls_id(uint16_t tls_id)
Return mbedtls_ecp_group_id for the specified TLS ID.
mbedtls_ssl_optimize_checksum
void mbedtls_ssl_optimize_checksum(mbedtls_ssl_context *ssl, const mbedtls_ssl_ciphersuite_t *ciphersuite_info)
mbedtls_ssl_fetch_input
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_fetch_input(mbedtls_ssl_context *ssl, size_t nb_want)
mbedtls_ssl_update_handshake_status
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_update_handshake_status(mbedtls_ssl_context *ssl)
mbedtls_ssl_get_tls_id_from_ecp_group_id
uint16_t mbedtls_ssl_get_tls_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id)
Return TLS ID for the specified mbedtls_ecp_group_id.
mbedtls_ssl_hash_from_md_alg
unsigned char mbedtls_ssl_hash_from_md_alg(int md)
mbedtls_ssl_check_timer
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_check_timer(mbedtls_ssl_context *ssl)
mbedtls_ssl_tls_prf_cb
int mbedtls_ssl_tls_prf_cb(const unsigned char *secret, size_t slen, const char *label, const unsigned char *random, size_t rlen, unsigned char *dstbuf, size_t dlen)
Definition ssl_misc.h:585
mbedtls_ssl_encrypt_buf
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_encrypt_buf(mbedtls_ssl_context *ssl, mbedtls_ssl_transform *transform, mbedtls_record *rec, int(*f_rng)(void *, unsigned char *, size_t), void *p_rng)
mbedtls_ssl_send_fatal_handshake_failure
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_send_fatal_handshake_failure(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_MAX_IV_LENGTH
#define MBEDTLS_SSL_MAX_IV_LENGTH
Definition ssl_misc.h:607
MBEDTLS_SSL_PAYLOAD_OVERHEAD
#define MBEDTLS_SSL_PAYLOAD_OVERHEAD
Definition ssl_misc.h:319
mbedtls_ssl_add_hs_msg_to_checksum
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_add_hs_msg_to_checksum(mbedtls_ssl_context *ssl, unsigned hs_type, unsigned char const *msg, size_t msg_len)
mbedtls_ssl_write_certificate
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_write_certificate(mbedtls_ssl_context *ssl)
mbedtls_ssl_get_mode_from_ciphersuite
mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite(const mbedtls_ssl_ciphersuite_t *suite)
mbedtls_ssl_parse_finished
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_parse_finished(mbedtls_ssl_context *ssl)
mbedtls_ssl_get_handshake_transcript
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_get_handshake_transcript(mbedtls_ssl_context *ssl, const mbedtls_md_type_t md, unsigned char *dst, size_t dst_len, size_t *olen)
mbedtls_ssl_write_finished
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_write_finished(mbedtls_ssl_context *ssl)
mbedtls_ssl_parse_change_cipher_spec
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_parse_change_cipher_spec(mbedtls_ssl_context *ssl)
MBEDTLS_RECEIVED_SIG_ALGS_SIZE
#define MBEDTLS_RECEIVED_SIG_ALGS_SIZE
Definition ssl_misc.h:353
mbedtls_ssl_set_timer
void mbedtls_ssl_set_timer(mbedtls_ssl_context *ssl, uint32_t millisecs)
mbedtls_ssl_hs_buffer
struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer
Definition ssl_misc.h:1040
mbedtls_ssl_check_curve_tls_id
MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_id)
mbedtls_ssl_mode_t
mbedtls_ssl_mode_t
TLS record protection modes.
Definition ssl_misc.h:2786
MBEDTLS_SSL_MODE_AEAD
@ MBEDTLS_SSL_MODE_AEAD
Definition ssl_misc.h:2790
MBEDTLS_SSL_MODE_STREAM
@ MBEDTLS_SSL_MODE_STREAM
Definition ssl_misc.h:2787
MBEDTLS_SSL_MODE_CBC
@ MBEDTLS_SSL_MODE_CBC
Definition ssl_misc.h:2788
MBEDTLS_SSL_MODE_CBC_ETM
@ MBEDTLS_SSL_MODE_CBC_ETM
Definition ssl_misc.h:2789
mbedtls_ssl_pend_fatal_alert
void mbedtls_ssl_pend_fatal_alert(mbedtls_ssl_context *ssl, unsigned char alert_type, int alert_reason)
random
#define random()
Definition stdlib.h:68
mbedtls_cipher_context_t
Definition cipher.h:316
mbedtls_dhm_context
The DHM context structure.
Definition dhm.h:101
mbedtls_ecdh_context
The ECDH context structure.
Definition ecdh.h:105
mbedtls_ecjpake_context
Definition ecjpake.h:60
mbedtls_md_context_t
Definition md.h:121
mbedtls_pk_context
Public key container.
Definition pk.h:220
mbedtls_record
Definition ssl_misc.h:1221
mbedtls_record::type
uint8_t type
Definition ssl_misc.h:1230
mbedtls_record::data_offset
size_t data_offset
Definition ssl_misc.h:1239
mbedtls_record::data_len
size_t data_len
Definition ssl_misc.h:1240
mbedtls_record::buf_len
size_t buf_len
Definition ssl_misc.h:1238
mbedtls_record::buf
unsigned char * buf
Definition ssl_misc.h:1237
mbedtls_ssl_ciphersuite_t
This structure is used for storing ciphersuite information.
Definition ssl_ciphersuites.h:448
mbedtls_ssl_config
Definition ssl.h:1455
mbedtls_ssl_context
Definition ssl.h:1731
mbedtls_ssl_handshake_params
Definition ssl_misc.h:645
mbedtls_ssl_handshake_params::update_checksum
MBEDTLS_CHECK_RETURN_CRITICAL int(* update_checksum)(mbedtls_ssl_context *, const unsigned char *, size_t)
Definition ssl_misc.h:724
mbedtls_ssl_handshake_params::calc_verify
MBEDTLS_CHECK_RETURN_CRITICAL int(* calc_verify)(const mbedtls_ssl_context *, unsigned char *, size_t *)
Definition ssl_misc.h:726
mbedtls_ssl_handshake_params::is_valid
unsigned is_valid
Definition ssl_misc.h:852
mbedtls_ssl_handshake_params::finished_in
struct mbedtls_ssl_handshake_params::@904::@907 finished_in
mbedtls_ssl_handshake_params::calc_finished
MBEDTLS_CHECK_RETURN_CRITICAL int(* calc_finished)(mbedtls_ssl_context *, unsigned char *, int)
Definition ssl_misc.h:728
mbedtls_ssl_handshake_params::len
size_t len
Definition ssl_misc.h:861
mbedtls_ssl_handshake_params::hs
struct mbedtls_ssl_handshake_params::@903::mbedtls_ssl_hs_buffer hs[MBEDTLS_SSL_MAX_BUFFERED_HS]
mbedtls_ssl_handshake_params::resume
uint8_t resume
Definition ssl_misc.h:648
mbedtls_ssl_handshake_params::sig_algs_heap_allocated
unsigned char sig_algs_heap_allocated
Definition ssl_misc.h:705
mbedtls_ssl_handshake_params::data_len
size_t data_len
Definition ssl_misc.h:856
mbedtls_ssl_handshake_params::data
unsigned char * data
Definition ssl_misc.h:855
mbedtls_ssl_handshake_params::preparation_done
uint8_t preparation_done
Definition ssl_misc.h:967
mbedtls_ssl_handshake_params::seen_ccs
uint8_t seen_ccs
Definition ssl_misc.h:848
mbedtls_ssl_handshake_params::total_bytes_buffered
size_t total_bytes_buffered
Definition ssl_misc.h:845
mbedtls_ssl_handshake_params::future_record
struct mbedtls_ssl_handshake_params::@903::@905 future_record
mbedtls_ssl_handshake_params::state_local
union mbedtls_ssl_handshake_params::@904 state_local
mbedtls_ssl_handshake_params::cli_exts
uint8_t cli_exts
Definition ssl_misc.h:649
mbedtls_ssl_handshake_params::ciphersuite_info
mbedtls_ssl_ciphersuite_t const * ciphersuite_info
Definition ssl_misc.h:721
mbedtls_ssl_handshake_params::digest_len
size_t digest_len
Definition ssl_misc.h:972
mbedtls_ssl_handshake_params::tls_prf
mbedtls_ssl_tls_prf_cb * tls_prf
Definition ssl_misc.h:729
mbedtls_ssl_handshake_params::sig_algs
const uint16_t * sig_algs
Definition ssl_misc.h:773
mbedtls_ssl_handshake_params::group_list
const uint16_t * group_list
Definition ssl_misc.h:772
mbedtls_ssl_handshake_params::is_fragmented
unsigned is_fragmented
Definition ssl_misc.h:853
mbedtls_ssl_handshake_params::group_list_heap_allocated
unsigned char group_list_heap_allocated
Definition ssl_misc.h:704
mbedtls_ssl_handshake_params::randbytes
unsigned char randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN+MBEDTLS_SERVER_HELLO_RANDOM_LEN]
Definition ssl_misc.h:990
mbedtls_ssl_handshake_params::buffering
struct mbedtls_ssl_handshake_params::@903 buffering
mbedtls_ssl_handshake_params::epoch
unsigned epoch
Definition ssl_misc.h:862
mbedtls_ssl_handshake_params::finished_out
struct mbedtls_ssl_handshake_params::@904::@906 finished_out
mbedtls_ssl_handshake_params::digest
unsigned char digest[MBEDTLS_TLS1_3_MD_MAX_SIZE]
Definition ssl_misc.h:971
mbedtls_ssl_handshake_params::is_complete
unsigned is_complete
Definition ssl_misc.h:854
mbedtls_ssl_key_set
The data structure holding the cryptographic material (key and IV) used for record protection in TLS ...
Definition ssl_misc.h:614
mbedtls_ssl_key_set::server_write_key
unsigned char server_write_key[MBEDTLS_SSL_MAX_KEY_LENGTH]
Definition ssl_misc.h:618
mbedtls_ssl_key_set::client_write_key
unsigned char client_write_key[MBEDTLS_SSL_MAX_KEY_LENGTH]
Definition ssl_misc.h:616
mbedtls_ssl_key_set::server_write_iv
unsigned char server_write_iv[MBEDTLS_SSL_MAX_IV_LENGTH]
Definition ssl_misc.h:622
mbedtls_ssl_key_set::iv_len
size_t iv_len
Definition ssl_misc.h:626
mbedtls_ssl_key_set::key_len
size_t key_len
Definition ssl_misc.h:624
mbedtls_ssl_key_set::client_write_iv
unsigned char client_write_iv[MBEDTLS_SSL_MAX_IV_LENGTH]
Definition ssl_misc.h:620
mbedtls_ssl_session
Definition ssl.h:1275
mbedtls_ssl_tls13_early_secrets
Definition ssl_misc.h:631
mbedtls_ssl_tls13_handshake_secrets
Definition ssl_misc.h:637
mbedtls_ssl_transform
Definition ssl_misc.h:1121
mbedtls_ssl_transform::maclen
size_t maclen
Definition ssl_misc.h:1128
mbedtls_ssl_transform::cipher_ctx_enc
mbedtls_cipher_context_t cipher_ctx_enc
Definition ssl_misc.h:1158
mbedtls_ssl_transform::iv_enc
unsigned char iv_enc[16]
Definition ssl_misc.h:1131
mbedtls_ssl_transform::cipher_ctx_dec
mbedtls_cipher_context_t cipher_ctx_dec
Definition ssl_misc.h:1159
mbedtls_ssl_transform::taglen
size_t taglen
Definition ssl_misc.h:1129
mbedtls_ssl_transform::minlen
size_t minlen
Definition ssl_misc.h:1125
mbedtls_ssl_transform::ivlen
size_t ivlen
Definition ssl_misc.h:1126
mbedtls_ssl_transform::iv_dec
unsigned char iv_dec[16]
Definition ssl_misc.h:1132
mbedtls_ssl_transform::tls_version
mbedtls_ssl_protocol_version tls_version
Definition ssl_misc.h:1151
mbedtls_ssl_transform::fixed_ivlen
size_t fixed_ivlen
Definition ssl_misc.h:1127
mbedtls_x509_crl
Definition x509_crl.h:64
mbedtls_x509_crt
Definition x509_crt.h:41
psa_hash_operation_s
Definition crypto_struct.h:70
psa_pake_operation_s
Definition crypto_extra.h:1121
state
#define state(x)
x509_internal.h
Generated by doxygen 1.9.8