ssl_internal.h 25 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665
  1. /**
  2. * \file ssl_internal.h
  3. *
  4. * \brief Internal functions shared by the SSL modules
  5. */
  6. /*
  7. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  8. * SPDX-License-Identifier: Apache-2.0
  9. *
  10. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  11. * not use this file except in compliance with the License.
  12. * You may obtain a copy of the License at
  13. *
  14. * http://www.apache.org/licenses/LICENSE-2.0
  15. *
  16. * Unless required by applicable law or agreed to in writing, software
  17. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  18. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  19. * See the License for the specific language governing permissions and
  20. * limitations under the License.
  21. *
  22. * This file is part of mbed TLS (https://tls.mbed.org)
  23. */
  24. #ifndef MBEDTLS_SSL_INTERNAL_H
  25. #define MBEDTLS_SSL_INTERNAL_H
  26. #include "ssl.h"
  27. #include "cipher.h"
  28. #if defined(MBEDTLS_MD5_C)
  29. #include "md5.h"
  30. #endif
  31. #if defined(MBEDTLS_SHA1_C)
  32. #include "sha1.h"
  33. #endif
  34. #if defined(MBEDTLS_SHA256_C)
  35. #include "sha256.h"
  36. #endif
  37. #if defined(MBEDTLS_SHA512_C)
  38. #include "sha512.h"
  39. #endif
  40. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  41. #include "ecjpake.h"
  42. #endif
  43. #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
  44. !defined(inline) && !defined(__cplusplus)
  45. #define inline __inline
  46. #endif
  47. /* Determine minimum supported version */
  48. #define MBEDTLS_SSL_MIN_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3
  49. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  50. #define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_0
  51. #else
  52. #if defined(MBEDTLS_SSL_PROTO_TLS1)
  53. #define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1
  54. #else
  55. #if defined(MBEDTLS_SSL_PROTO_TLS1_1)
  56. #define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_2
  57. #else
  58. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  59. #define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_3
  60. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  61. #endif /* MBEDTLS_SSL_PROTO_TLS1_1 */
  62. #endif /* MBEDTLS_SSL_PROTO_TLS1 */
  63. #endif /* MBEDTLS_SSL_PROTO_SSL3 */
  64. #define MBEDTLS_SSL_MIN_VALID_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1
  65. #define MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3
  66. /* Determine maximum supported version */
  67. #define MBEDTLS_SSL_MAX_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3
  68. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  69. #define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_3
  70. #else
  71. #if defined(MBEDTLS_SSL_PROTO_TLS1_1)
  72. #define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_2
  73. #else
  74. #if defined(MBEDTLS_SSL_PROTO_TLS1)
  75. #define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1
  76. #else
  77. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  78. #define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_0
  79. #endif /* MBEDTLS_SSL_PROTO_SSL3 */
  80. #endif /* MBEDTLS_SSL_PROTO_TLS1 */
  81. #endif /* MBEDTLS_SSL_PROTO_TLS1_1 */
  82. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  83. #define MBEDTLS_SSL_INITIAL_HANDSHAKE 0
  84. #define MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS 1 /* In progress */
  85. #define MBEDTLS_SSL_RENEGOTIATION_DONE 2 /* Done or aborted */
  86. #define MBEDTLS_SSL_RENEGOTIATION_PENDING 3 /* Requested (server only) */
  87. /*
  88. * DTLS retransmission states, see RFC 6347 4.2.4
  89. *
  90. * The SENDING state is merged in PREPARING for initial sends,
  91. * but is distinct for resends.
  92. *
  93. * Note: initial state is wrong for server, but is not used anyway.
  94. */
  95. #define MBEDTLS_SSL_RETRANS_PREPARING 0
  96. #define MBEDTLS_SSL_RETRANS_SENDING 1
  97. #define MBEDTLS_SSL_RETRANS_WAITING 2
  98. #define MBEDTLS_SSL_RETRANS_FINISHED 3
  99. /*
  100. * Allow extra bytes for record, authentication and encryption overhead:
  101. * counter (8) + header (5) + IV(16) + MAC (16-48) + padding (0-256)
  102. * and allow for a maximum of 1024 of compression expansion if
  103. * enabled.
  104. */
  105. #if defined(MBEDTLS_ZLIB_SUPPORT)
  106. #define MBEDTLS_SSL_COMPRESSION_ADD 1024
  107. #else
  108. #define MBEDTLS_SSL_COMPRESSION_ADD 0
  109. #endif
  110. #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_MODE_CBC)
  111. /* Ciphersuites using HMAC */
  112. #if defined(MBEDTLS_SHA512_C)
  113. #define MBEDTLS_SSL_MAC_ADD 48 /* SHA-384 used for HMAC */
  114. #elif defined(MBEDTLS_SHA256_C)
  115. #define MBEDTLS_SSL_MAC_ADD 32 /* SHA-256 used for HMAC */
  116. #else
  117. #define MBEDTLS_SSL_MAC_ADD 20 /* SHA-1 used for HMAC */
  118. #endif
  119. #else
  120. /* AEAD ciphersuites: GCM and CCM use a 128 bits tag */
  121. #define MBEDTLS_SSL_MAC_ADD 16
  122. #endif
  123. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  124. #define MBEDTLS_SSL_PADDING_ADD 256
  125. #else
  126. #define MBEDTLS_SSL_PADDING_ADD 0
  127. #endif
  128. #define MBEDTLS_SSL_PAYLOAD_LEN ( MBEDTLS_SSL_MAX_CONTENT_LEN \
  129. + MBEDTLS_SSL_COMPRESSION_ADD \
  130. + MBEDTLS_MAX_IV_LENGTH \
  131. + MBEDTLS_SSL_MAC_ADD \
  132. + MBEDTLS_SSL_PADDING_ADD \
  133. )
  134. /*
  135. * Check that we obey the standard's message size bounds
  136. */
  137. #if MBEDTLS_SSL_MAX_CONTENT_LEN > 16384
  138. #error Bad configuration - record content too large.
  139. #endif
  140. #if MBEDTLS_SSL_PAYLOAD_LEN > 16384 + 2048
  141. #error Bad configuration - protected record payload too large.
  142. #endif
  143. /* Note: Even though the TLS record header is only 5 bytes
  144. long, we're internally using 8 bytes to store the
  145. implicit sequence number. */
  146. #define MBEDTLS_SSL_HEADER_LEN 13
  147. #define MBEDTLS_SSL_BUFFER_LEN \
  148. ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_PAYLOAD_LEN ) )
  149. /*
  150. * TLS extension flags (for extensions with outgoing ServerHello content
  151. * that need it (e.g. for RENEGOTIATION_INFO the server already knows because
  152. * of state of the renegotiation flag, so no indicator is required)
  153. */
  154. #define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT (1 << 0)
  155. #define MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK (1 << 1)
  156. #ifdef __cplusplus
  157. extern "C" {
  158. #endif
  159. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  160. defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  161. /*
  162. * Abstraction for a grid of allowed signature-hash-algorithm pairs.
  163. */
  164. struct mbedtls_ssl_sig_hash_set_t
  165. {
  166. /* At the moment, we only need to remember a single suitable
  167. * hash algorithm per signature algorithm. As long as that's
  168. * the case - and we don't need a general lookup function -
  169. * we can implement the sig-hash-set as a map from signatures
  170. * to hash algorithms. */
  171. mbedtls_md_type_t rsa;
  172. mbedtls_md_type_t ecdsa;
  173. };
  174. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
  175. MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
  176. /*
  177. * This structure contains the parameters only needed during handshake.
  178. */
  179. struct mbedtls_ssl_handshake_params
  180. {
  181. /*
  182. * Handshake specific crypto variables
  183. */
  184. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  185. defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  186. mbedtls_ssl_sig_hash_set_t hash_algs; /*!< Set of suitable sig-hash pairs */
  187. #endif
  188. #if defined(MBEDTLS_DHM_C)
  189. mbedtls_dhm_context dhm_ctx; /*!< DHM key exchange */
  190. #endif
  191. #if defined(MBEDTLS_ECDH_C)
  192. mbedtls_ecdh_context ecdh_ctx; /*!< ECDH key exchange */
  193. #endif
  194. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  195. mbedtls_ecjpake_context ecjpake_ctx; /*!< EC J-PAKE key exchange */
  196. #if defined(MBEDTLS_SSL_CLI_C)
  197. unsigned char *ecjpake_cache; /*!< Cache for ClientHello ext */
  198. size_t ecjpake_cache_len; /*!< Length of cached data */
  199. #endif
  200. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  201. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  202. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  203. const mbedtls_ecp_curve_info **curves; /*!< Supported elliptic curves */
  204. #endif
  205. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  206. unsigned char *psk; /*!< PSK from the callback */
  207. size_t psk_len; /*!< Length of PSK from callback */
  208. #endif
  209. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  210. mbedtls_ssl_key_cert *key_cert; /*!< chosen key/cert pair (server) */
  211. #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
  212. int sni_authmode; /*!< authmode from SNI callback */
  213. mbedtls_ssl_key_cert *sni_key_cert; /*!< key/cert list from SNI */
  214. mbedtls_x509_crt *sni_ca_chain; /*!< trusted CAs from SNI callback */
  215. mbedtls_x509_crl *sni_ca_crl; /*!< trusted CAs CRLs from SNI */
  216. #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
  217. #endif /* MBEDTLS_X509_CRT_PARSE_C */
  218. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  219. unsigned int out_msg_seq; /*!< Outgoing handshake sequence number */
  220. unsigned int in_msg_seq; /*!< Incoming handshake sequence number */
  221. unsigned char *verify_cookie; /*!< Cli: HelloVerifyRequest cookie
  222. Srv: unused */
  223. unsigned char verify_cookie_len; /*!< Cli: cookie length
  224. Srv: flag for sending a cookie */
  225. unsigned char *hs_msg; /*!< Reassembled handshake message */
  226. uint32_t retransmit_timeout; /*!< Current value of timeout */
  227. unsigned char retransmit_state; /*!< Retransmission state */
  228. mbedtls_ssl_flight_item *flight; /*!< Current outgoing flight */
  229. mbedtls_ssl_flight_item *cur_msg; /*!< Current message in flight */
  230. unsigned int in_flight_start_seq; /*!< Minimum message sequence in the
  231. flight being received */
  232. mbedtls_ssl_transform *alt_transform_out; /*!< Alternative transform for
  233. resending messages */
  234. unsigned char alt_out_ctr[8]; /*!< Alternative record epoch/counter
  235. for resending messages */
  236. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  237. /*
  238. * Checksum contexts
  239. */
  240. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  241. defined(MBEDTLS_SSL_PROTO_TLS1_1)
  242. mbedtls_md5_context fin_md5;
  243. mbedtls_sha1_context fin_sha1;
  244. #endif
  245. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  246. #if defined(MBEDTLS_SHA256_C)
  247. mbedtls_sha256_context fin_sha256;
  248. #endif
  249. #if defined(MBEDTLS_SHA512_C)
  250. mbedtls_sha512_context fin_sha512;
  251. #endif
  252. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  253. void (*update_checksum)(mbedtls_ssl_context *, const unsigned char *, size_t);
  254. void (*calc_verify)(mbedtls_ssl_context *, unsigned char *);
  255. void (*calc_finished)(mbedtls_ssl_context *, unsigned char *, int);
  256. int (*tls_prf)(const unsigned char *, size_t, const char *,
  257. const unsigned char *, size_t,
  258. unsigned char *, size_t);
  259. size_t pmslen; /*!< premaster length */
  260. unsigned char randbytes[64]; /*!< random bytes */
  261. unsigned char premaster[MBEDTLS_PREMASTER_SIZE];
  262. /*!< premaster secret */
  263. int resume; /*!< session resume indicator*/
  264. int max_major_ver; /*!< max. major version client*/
  265. int max_minor_ver; /*!< max. minor version client*/
  266. int cli_exts; /*!< client extension presence*/
  267. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  268. int new_session_ticket; /*!< use NewSessionTicket? */
  269. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  270. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  271. int extended_ms; /*!< use Extended Master Secret? */
  272. #endif
  273. };
  274. /*
  275. * This structure contains a full set of runtime transform parameters
  276. * either in negotiation or active.
  277. */
  278. struct mbedtls_ssl_transform
  279. {
  280. /*
  281. * Session specific crypto layer
  282. */
  283. const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
  284. /*!< Chosen cipersuite_info */
  285. unsigned int keylen; /*!< symmetric key length (bytes) */
  286. size_t minlen; /*!< min. ciphertext length */
  287. size_t ivlen; /*!< IV length */
  288. size_t fixed_ivlen; /*!< Fixed part of IV (AEAD) */
  289. size_t maclen; /*!< MAC length */
  290. unsigned char iv_enc[16]; /*!< IV (encryption) */
  291. unsigned char iv_dec[16]; /*!< IV (decryption) */
  292. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  293. /* Needed only for SSL v3.0 secret */
  294. unsigned char mac_enc[20]; /*!< SSL v3.0 secret (enc) */
  295. unsigned char mac_dec[20]; /*!< SSL v3.0 secret (dec) */
  296. #endif /* MBEDTLS_SSL_PROTO_SSL3 */
  297. mbedtls_md_context_t md_ctx_enc; /*!< MAC (encryption) */
  298. mbedtls_md_context_t md_ctx_dec; /*!< MAC (decryption) */
  299. mbedtls_cipher_context_t cipher_ctx_enc; /*!< encryption context */
  300. mbedtls_cipher_context_t cipher_ctx_dec; /*!< decryption context */
  301. /*
  302. * Session specific compression layer
  303. */
  304. #if defined(MBEDTLS_ZLIB_SUPPORT)
  305. z_stream ctx_deflate; /*!< compression context */
  306. z_stream ctx_inflate; /*!< decompression context */
  307. #endif
  308. };
  309. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  310. /*
  311. * List of certificate + private key pairs
  312. */
  313. struct mbedtls_ssl_key_cert
  314. {
  315. mbedtls_x509_crt *cert; /*!< cert */
  316. mbedtls_pk_context *key; /*!< private key */
  317. mbedtls_ssl_key_cert *next; /*!< next key/cert pair */
  318. };
  319. #endif /* MBEDTLS_X509_CRT_PARSE_C */
  320. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  321. /*
  322. * List of handshake messages kept around for resending
  323. */
  324. struct mbedtls_ssl_flight_item
  325. {
  326. unsigned char *p; /*!< message, including handshake headers */
  327. size_t len; /*!< length of p */
  328. unsigned char type; /*!< type of the message: handshake or CCS */
  329. mbedtls_ssl_flight_item *next; /*!< next handshake message(s) */
  330. };
  331. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  332. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  333. defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  334. /* Find an entry in a signature-hash set matching a given hash algorithm. */
  335. mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
  336. mbedtls_pk_type_t sig_alg );
  337. /* Add a signature-hash-pair to a signature-hash set */
  338. void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
  339. mbedtls_pk_type_t sig_alg,
  340. mbedtls_md_type_t md_alg );
  341. /* Allow exactly one hash algorithm for each signature. */
  342. void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
  343. mbedtls_md_type_t md_alg );
  344. /* Setup an empty signature-hash set */
  345. static inline void mbedtls_ssl_sig_hash_set_init( mbedtls_ssl_sig_hash_set_t *set )
  346. {
  347. mbedtls_ssl_sig_hash_set_const_hash( set, MBEDTLS_MD_NONE );
  348. }
  349. #endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
  350. MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
  351. /**
  352. * \brief Free referenced items in an SSL transform context and clear
  353. * memory
  354. *
  355. * \param transform SSL transform context
  356. */
  357. void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform );
  358. /**
  359. * \brief Free referenced items in an SSL handshake context and clear
  360. * memory
  361. *
  362. * \param handshake SSL handshake context
  363. */
  364. void mbedtls_ssl_handshake_free( mbedtls_ssl_handshake_params *handshake );
  365. int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl );
  366. int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl );
  367. void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl );
  368. int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl );
  369. void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl );
  370. int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl );
  371. int mbedtls_ssl_read_record_layer( mbedtls_ssl_context *ssl );
  372. int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl );
  373. int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl );
  374. void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl );
  375. /**
  376. * \brief Update record layer
  377. *
  378. * This function roughly separates the implementation
  379. * of the logic of (D)TLS from the implementation
  380. * of the secure transport.
  381. *
  382. * \param ssl SSL context to use
  383. *
  384. * \return 0 or non-zero error code.
  385. *
  386. * \note A clarification on what is called 'record layer' here
  387. * is in order, as many sensible definitions are possible:
  388. *
  389. * The record layer takes as input an untrusted underlying
  390. * transport (stream or datagram) and transforms it into
  391. * a serially multiplexed, secure transport, which
  392. * conceptually provides the following:
  393. *
  394. * (1) Three datagram based, content-agnostic transports
  395. * for handshake, alert and CCS messages.
  396. * (2) One stream- or datagram-based transport
  397. * for application data.
  398. * (3) Functionality for changing the underlying transform
  399. * securing the contents.
  400. *
  401. * The interface to this functionality is given as follows:
  402. *
  403. * a Updating
  404. * [Currently implemented by mbedtls_ssl_read_record]
  405. *
  406. * Check if and on which of the four 'ports' data is pending:
  407. * Nothing, a controlling datagram of type (1), or application
  408. * data (2). In any case data is present, internal buffers
  409. * provide access to the data for the user to process it.
  410. * Consumption of type (1) datagrams is done automatically
  411. * on the next update, invalidating that the internal buffers
  412. * for previous datagrams, while consumption of application
  413. * data (2) is user-controlled.
  414. *
  415. * b Reading of application data
  416. * [Currently manual adaption of ssl->in_offt pointer]
  417. *
  418. * As mentioned in the last paragraph, consumption of data
  419. * is different from the automatic consumption of control
  420. * datagrams (1) because application data is treated as a stream.
  421. *
  422. * c Tracking availability of application data
  423. * [Currently manually through decreasing ssl->in_msglen]
  424. *
  425. * For efficiency and to retain datagram semantics for
  426. * application data in case of DTLS, the record layer
  427. * provides functionality for checking how much application
  428. * data is still available in the internal buffer.
  429. *
  430. * d Changing the transformation securing the communication.
  431. *
  432. * Given an opaque implementation of the record layer in the
  433. * above sense, it should be possible to implement the logic
  434. * of (D)TLS on top of it without the need to know anything
  435. * about the record layer's internals. This is done e.g.
  436. * in all the handshake handling functions, and in the
  437. * application data reading function mbedtls_ssl_read.
  438. *
  439. * \note The above tries to give a conceptual picture of the
  440. * record layer, but the current implementation deviates
  441. * from it in some places. For example, our implementation of
  442. * the update functionality through mbedtls_ssl_read_record
  443. * discards datagrams depending on the current state, which
  444. * wouldn't fall under the record layer's responsibility
  445. * following the above definition.
  446. *
  447. */
  448. int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl );
  449. int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want );
  450. int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl );
  451. int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl );
  452. int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl );
  453. int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl );
  454. int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl );
  455. int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl );
  456. int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl );
  457. int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl );
  458. void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
  459. const mbedtls_ssl_ciphersuite_t *ciphersuite_info );
  460. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  461. int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex );
  462. #endif
  463. #if defined(MBEDTLS_PK_C)
  464. unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk );
  465. unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type );
  466. mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig );
  467. #endif
  468. mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash );
  469. unsigned char mbedtls_ssl_hash_from_md_alg( int md );
  470. int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md );
  471. #if defined(MBEDTLS_ECP_C)
  472. int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id );
  473. #endif
  474. #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  475. int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
  476. mbedtls_md_type_t md );
  477. #endif
  478. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  479. static inline mbedtls_pk_context *mbedtls_ssl_own_key( mbedtls_ssl_context *ssl )
  480. {
  481. mbedtls_ssl_key_cert *key_cert;
  482. if( ssl->handshake != NULL && ssl->handshake->key_cert != NULL )
  483. key_cert = ssl->handshake->key_cert;
  484. else
  485. key_cert = ssl->conf->key_cert;
  486. return( key_cert == NULL ? NULL : key_cert->key );
  487. }
  488. static inline mbedtls_x509_crt *mbedtls_ssl_own_cert( mbedtls_ssl_context *ssl )
  489. {
  490. mbedtls_ssl_key_cert *key_cert;
  491. if( ssl->handshake != NULL && ssl->handshake->key_cert != NULL )
  492. key_cert = ssl->handshake->key_cert;
  493. else
  494. key_cert = ssl->conf->key_cert;
  495. return( key_cert == NULL ? NULL : key_cert->cert );
  496. }
  497. /*
  498. * Check usage of a certificate wrt extensions:
  499. * keyUsage, extendedKeyUsage (later), and nSCertType (later).
  500. *
  501. * Warning: cert_endpoint is the endpoint of the cert (ie, of our peer when we
  502. * check a cert we received from them)!
  503. *
  504. * Return 0 if everything is OK, -1 if not.
  505. */
  506. int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
  507. const mbedtls_ssl_ciphersuite_t *ciphersuite,
  508. int cert_endpoint,
  509. uint32_t *flags );
  510. #endif /* MBEDTLS_X509_CRT_PARSE_C */
  511. void mbedtls_ssl_write_version( int major, int minor, int transport,
  512. unsigned char ver[2] );
  513. void mbedtls_ssl_read_version( int *major, int *minor, int transport,
  514. const unsigned char ver[2] );
  515. static inline size_t mbedtls_ssl_hdr_len( const mbedtls_ssl_context *ssl )
  516. {
  517. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  518. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  519. return( 13 );
  520. #else
  521. ((void) ssl);
  522. #endif
  523. return( 5 );
  524. }
  525. static inline size_t mbedtls_ssl_hs_hdr_len( const mbedtls_ssl_context *ssl )
  526. {
  527. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  528. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  529. return( 12 );
  530. #else
  531. ((void) ssl);
  532. #endif
  533. return( 4 );
  534. }
  535. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  536. void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl );
  537. void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl );
  538. int mbedtls_ssl_resend( mbedtls_ssl_context *ssl );
  539. #endif
  540. /* Visible for testing purposes only */
  541. #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
  542. int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context *ssl );
  543. void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl );
  544. #endif
  545. /* constant-time buffer comparison */
  546. static inline int mbedtls_ssl_safer_memcmp( const void *a, const void *b, size_t n )
  547. {
  548. size_t i;
  549. volatile const unsigned char *A = (volatile const unsigned char *) a;
  550. volatile const unsigned char *B = (volatile const unsigned char *) b;
  551. volatile unsigned char diff = 0;
  552. for( i = 0; i < n; i++ )
  553. {
  554. /* Read volatile data in order before computing diff.
  555. * This avoids IAR compiler warning:
  556. * 'the order of volatile accesses is undefined ..' */
  557. unsigned char x = A[i], y = B[i];
  558. diff |= x ^ y;
  559. }
  560. return( diff );
  561. }
  562. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  563. defined(MBEDTLS_SSL_PROTO_TLS1_1)
  564. int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
  565. unsigned char *output,
  566. unsigned char *data, size_t data_len );
  567. #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
  568. MBEDTLS_SSL_PROTO_TLS1_1 */
  569. #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
  570. defined(MBEDTLS_SSL_PROTO_TLS1_2)
  571. int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
  572. unsigned char *output,
  573. unsigned char *data, size_t data_len,
  574. mbedtls_md_type_t md_alg );
  575. #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
  576. MBEDTLS_SSL_PROTO_TLS1_2 */
  577. #ifdef __cplusplus
  578. }
  579. #endif
  580. #endif /* ssl_internal.h */