ssl_internal.h 30 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782
  1. /**
  2. * \file ssl_internal.h
  3. *
  4. * \brief Internal functions shared by the SSL modules
  5. */
  6. /*
  7. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  8. * SPDX-License-Identifier: Apache-2.0
  9. *
  10. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  11. * not use this file except in compliance with the License.
  12. * You may obtain a copy of the License at
  13. *
  14. * http://www.apache.org/licenses/LICENSE-2.0
  15. *
  16. * Unless required by applicable law or agreed to in writing, software
  17. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  18. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  19. * See the License for the specific language governing permissions and
  20. * limitations under the License.
  21. *
  22. * This file is part of mbed TLS (https://tls.mbed.org)
  23. */
  24. #ifndef MBEDTLS_SSL_INTERNAL_H
  25. #define MBEDTLS_SSL_INTERNAL_H
  26. #if !defined(MBEDTLS_CONFIG_FILE)
  27. #include "config.h"
  28. #else
  29. #include MBEDTLS_CONFIG_FILE
  30. #endif
  31. #include "ssl.h"
  32. #include "cipher.h"
  33. #if defined(MBEDTLS_MD5_C)
  34. #include "md5.h"
  35. #endif
  36. #if defined(MBEDTLS_SHA1_C)
  37. #include "sha1.h"
  38. #endif
  39. #if defined(MBEDTLS_SHA256_C)
  40. #include "sha256.h"
  41. #endif
  42. #if defined(MBEDTLS_SHA512_C)
  43. #include "sha512.h"
  44. #endif
  45. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  46. #include "ecjpake.h"
  47. #endif
  48. #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
  49. !defined(inline) && !defined(__cplusplus)
  50. #define inline __inline
  51. #endif
  52. /* Determine minimum supported version */
  53. #define MBEDTLS_SSL_MIN_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3
  54. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  55. #define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_0
  56. #else
  57. #if defined(MBEDTLS_SSL_PROTO_TLS1)
  58. #define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1
  59. #else
  60. #if defined(MBEDTLS_SSL_PROTO_TLS1_1)
  61. #define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_2
  62. #else
  63. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  64. #define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_3
  65. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  66. #endif /* MBEDTLS_SSL_PROTO_TLS1_1 */
  67. #endif /* MBEDTLS_SSL_PROTO_TLS1 */
  68. #endif /* MBEDTLS_SSL_PROTO_SSL3 */
  69. #define MBEDTLS_SSL_MIN_VALID_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1
  70. #define MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3
  71. /* Determine maximum supported version */
  72. #define MBEDTLS_SSL_MAX_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3
  73. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  74. #define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_3
  75. #else
  76. #if defined(MBEDTLS_SSL_PROTO_TLS1_1)
  77. #define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_2
  78. #else
  79. #if defined(MBEDTLS_SSL_PROTO_TLS1)
  80. #define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1
  81. #else
  82. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  83. #define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_0
  84. #endif /* MBEDTLS_SSL_PROTO_SSL3 */
  85. #endif /* MBEDTLS_SSL_PROTO_TLS1 */
  86. #endif /* MBEDTLS_SSL_PROTO_TLS1_1 */
  87. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  88. /* Shorthand for restartable ECC */
  89. #if defined(MBEDTLS_ECP_RESTARTABLE) && \
  90. defined(MBEDTLS_SSL_CLI_C) && \
  91. defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  92. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  93. #define MBEDTLS_SSL__ECP_RESTARTABLE
  94. #endif
  95. #define MBEDTLS_SSL_INITIAL_HANDSHAKE 0
  96. #define MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS 1 /* In progress */
  97. #define MBEDTLS_SSL_RENEGOTIATION_DONE 2 /* Done or aborted */
  98. #define MBEDTLS_SSL_RENEGOTIATION_PENDING 3 /* Requested (server only) */
  99. /*
  100. * DTLS retransmission states, see RFC 6347 4.2.4
  101. *
  102. * The SENDING state is merged in PREPARING for initial sends,
  103. * but is distinct for resends.
  104. *
  105. * Note: initial state is wrong for server, but is not used anyway.
  106. */
  107. #define MBEDTLS_SSL_RETRANS_PREPARING 0
  108. #define MBEDTLS_SSL_RETRANS_SENDING 1
  109. #define MBEDTLS_SSL_RETRANS_WAITING 2
  110. #define MBEDTLS_SSL_RETRANS_FINISHED 3
  111. /*
  112. * Allow extra bytes for record, authentication and encryption overhead:
  113. * counter (8) + header (5) + IV(16) + MAC (16-48) + padding (0-256)
  114. * and allow for a maximum of 1024 of compression expansion if
  115. * enabled.
  116. */
  117. #if defined(MBEDTLS_ZLIB_SUPPORT)
  118. #define MBEDTLS_SSL_COMPRESSION_ADD 1024
  119. #else
  120. #define MBEDTLS_SSL_COMPRESSION_ADD 0
  121. #endif
  122. #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_MODE_CBC)
  123. /* Ciphersuites using HMAC */
  124. #if defined(MBEDTLS_SHA512_C)
  125. #define MBEDTLS_SSL_MAC_ADD 48 /* SHA-384 used for HMAC */
  126. #elif defined(MBEDTLS_SHA256_C)
  127. #define MBEDTLS_SSL_MAC_ADD 32 /* SHA-256 used for HMAC */
  128. #else
  129. #define MBEDTLS_SSL_MAC_ADD 20 /* SHA-1 used for HMAC */
  130. #endif
  131. #else
  132. /* AEAD ciphersuites: GCM and CCM use a 128 bits tag */
  133. #define MBEDTLS_SSL_MAC_ADD 16
  134. #endif
  135. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  136. #define MBEDTLS_SSL_PADDING_ADD 256
  137. #else
  138. #define MBEDTLS_SSL_PADDING_ADD 0
  139. #endif
  140. #define MBEDTLS_SSL_PAYLOAD_OVERHEAD ( MBEDTLS_SSL_COMPRESSION_ADD + \
  141. MBEDTLS_MAX_IV_LENGTH + \
  142. MBEDTLS_SSL_MAC_ADD + \
  143. MBEDTLS_SSL_PADDING_ADD \
  144. )
  145. #define MBEDTLS_SSL_IN_PAYLOAD_LEN ( MBEDTLS_SSL_PAYLOAD_OVERHEAD + \
  146. ( MBEDTLS_SSL_IN_CONTENT_LEN ) )
  147. #define MBEDTLS_SSL_OUT_PAYLOAD_LEN ( MBEDTLS_SSL_PAYLOAD_OVERHEAD + \
  148. ( MBEDTLS_SSL_OUT_CONTENT_LEN ) )
  149. /* The maximum number of buffered handshake messages. */
  150. #define MBEDTLS_SSL_MAX_BUFFERED_HS 4
  151. /* Maximum length we can advertise as our max content length for
  152. RFC 6066 max_fragment_length extension negotiation purposes
  153. (the lesser of both sizes, if they are unequal.)
  154. */
  155. #define MBEDTLS_TLS_EXT_ADV_CONTENT_LEN ( \
  156. (MBEDTLS_SSL_IN_CONTENT_LEN > MBEDTLS_SSL_OUT_CONTENT_LEN) \
  157. ? ( MBEDTLS_SSL_OUT_CONTENT_LEN ) \
  158. : ( MBEDTLS_SSL_IN_CONTENT_LEN ) \
  159. )
  160. /*
  161. * Check that we obey the standard's message size bounds
  162. */
  163. #if MBEDTLS_SSL_MAX_CONTENT_LEN > 16384
  164. #error "Bad configuration - record content too large."
  165. #endif
  166. #if MBEDTLS_SSL_IN_CONTENT_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN
  167. #error "Bad configuration - incoming record content should not be larger than MBEDTLS_SSL_MAX_CONTENT_LEN."
  168. #endif
  169. #if MBEDTLS_SSL_OUT_CONTENT_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN
  170. #error "Bad configuration - outgoing record content should not be larger than MBEDTLS_SSL_MAX_CONTENT_LEN."
  171. #endif
  172. #if MBEDTLS_SSL_IN_PAYLOAD_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN + 2048
  173. #error "Bad configuration - incoming protected record payload too large."
  174. #endif
  175. #if MBEDTLS_SSL_OUT_PAYLOAD_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN + 2048
  176. #error "Bad configuration - outgoing protected record payload too large."
  177. #endif
  178. /* Calculate buffer sizes */
  179. /* Note: Even though the TLS record header is only 5 bytes
  180. long, we're internally using 8 bytes to store the
  181. implicit sequence number. */
  182. #define MBEDTLS_SSL_HEADER_LEN 13
  183. #define MBEDTLS_SSL_IN_BUFFER_LEN \
  184. ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_IN_PAYLOAD_LEN ) )
  185. #define MBEDTLS_SSL_OUT_BUFFER_LEN \
  186. ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_OUT_PAYLOAD_LEN ) )
  187. #ifdef MBEDTLS_ZLIB_SUPPORT
  188. /* Compression buffer holds both IN and OUT buffers, so should be size of the larger */
  189. #define MBEDTLS_SSL_COMPRESS_BUFFER_LEN ( \
  190. ( MBEDTLS_SSL_IN_BUFFER_LEN > MBEDTLS_SSL_OUT_BUFFER_LEN ) \
  191. ? MBEDTLS_SSL_IN_BUFFER_LEN \
  192. : MBEDTLS_SSL_OUT_BUFFER_LEN \
  193. )
  194. #endif
  195. /*
  196. * TLS extension flags (for extensions with outgoing ServerHello content
  197. * that need it (e.g. for RENEGOTIATION_INFO the server already knows because
  198. * of state of the renegotiation flag, so no indicator is required)
  199. */
  200. #define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT (1 << 0)
  201. #define MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK (1 << 1)
  202. #ifdef __cplusplus
  203. extern "C" {
  204. #endif
  205. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  206. defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  207. /*
  208. * Abstraction for a grid of allowed signature-hash-algorithm pairs.
  209. */
  210. struct mbedtls_ssl_sig_hash_set_t
  211. {
  212. /* At the moment, we only need to remember a single suitable
  213. * hash algorithm per signature algorithm. As long as that's
  214. * the case - and we don't need a general lookup function -
  215. * we can implement the sig-hash-set as a map from signatures
  216. * to hash algorithms. */
  217. mbedtls_md_type_t rsa;
  218. mbedtls_md_type_t ecdsa;
  219. };
  220. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
  221. MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
  222. /*
  223. * This structure contains the parameters only needed during handshake.
  224. */
  225. struct mbedtls_ssl_handshake_params
  226. {
  227. /*
  228. * Handshake specific crypto variables
  229. */
  230. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  231. defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  232. mbedtls_ssl_sig_hash_set_t hash_algs; /*!< Set of suitable sig-hash pairs */
  233. #endif
  234. #if defined(MBEDTLS_DHM_C)
  235. mbedtls_dhm_context dhm_ctx; /*!< DHM key exchange */
  236. #endif
  237. #if defined(MBEDTLS_ECDH_C)
  238. mbedtls_ecdh_context ecdh_ctx; /*!< ECDH key exchange */
  239. #endif
  240. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  241. mbedtls_ecjpake_context ecjpake_ctx; /*!< EC J-PAKE key exchange */
  242. #if defined(MBEDTLS_SSL_CLI_C)
  243. unsigned char *ecjpake_cache; /*!< Cache for ClientHello ext */
  244. size_t ecjpake_cache_len; /*!< Length of cached data */
  245. #endif
  246. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  247. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  248. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  249. const mbedtls_ecp_curve_info **curves; /*!< Supported elliptic curves */
  250. #endif
  251. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  252. unsigned char *psk; /*!< PSK from the callback */
  253. size_t psk_len; /*!< Length of PSK from callback */
  254. #endif
  255. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  256. mbedtls_ssl_key_cert *key_cert; /*!< chosen key/cert pair (server) */
  257. #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
  258. int sni_authmode; /*!< authmode from SNI callback */
  259. mbedtls_ssl_key_cert *sni_key_cert; /*!< key/cert list from SNI */
  260. mbedtls_x509_crt *sni_ca_chain; /*!< trusted CAs from SNI callback */
  261. mbedtls_x509_crl *sni_ca_crl; /*!< trusted CAs CRLs from SNI */
  262. #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
  263. #endif /* MBEDTLS_X509_CRT_PARSE_C */
  264. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  265. int ecrs_enabled; /*!< Handshake supports EC restart? */
  266. mbedtls_x509_crt_restart_ctx ecrs_ctx; /*!< restart context */
  267. enum { /* this complements ssl->state with info on intra-state operations */
  268. ssl_ecrs_none = 0, /*!< nothing going on (yet) */
  269. ssl_ecrs_crt_verify, /*!< Certificate: crt_verify() */
  270. ssl_ecrs_ske_start_processing, /*!< ServerKeyExchange: pk_verify() */
  271. ssl_ecrs_cke_ecdh_calc_secret, /*!< ClientKeyExchange: ECDH step 2 */
  272. ssl_ecrs_crt_vrfy_sign, /*!< CertificateVerify: pk_sign() */
  273. } ecrs_state; /*!< current (or last) operation */
  274. size_t ecrs_n; /*!< place for saving a length */
  275. #endif
  276. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  277. unsigned int out_msg_seq; /*!< Outgoing handshake sequence number */
  278. unsigned int in_msg_seq; /*!< Incoming handshake sequence number */
  279. unsigned char *verify_cookie; /*!< Cli: HelloVerifyRequest cookie
  280. Srv: unused */
  281. unsigned char verify_cookie_len; /*!< Cli: cookie length
  282. Srv: flag for sending a cookie */
  283. uint32_t retransmit_timeout; /*!< Current value of timeout */
  284. unsigned char retransmit_state; /*!< Retransmission state */
  285. mbedtls_ssl_flight_item *flight; /*!< Current outgoing flight */
  286. mbedtls_ssl_flight_item *cur_msg; /*!< Current message in flight */
  287. unsigned char *cur_msg_p; /*!< Position in current message */
  288. unsigned int in_flight_start_seq; /*!< Minimum message sequence in the
  289. flight being received */
  290. mbedtls_ssl_transform *alt_transform_out; /*!< Alternative transform for
  291. resending messages */
  292. unsigned char alt_out_ctr[8]; /*!< Alternative record epoch/counter
  293. for resending messages */
  294. struct
  295. {
  296. size_t total_bytes_buffered; /*!< Cumulative size of heap allocated
  297. * buffers used for message buffering. */
  298. uint8_t seen_ccs; /*!< Indicates if a CCS message has
  299. * been seen in the current flight. */
  300. struct mbedtls_ssl_hs_buffer
  301. {
  302. unsigned is_valid : 1;
  303. unsigned is_fragmented : 1;
  304. unsigned is_complete : 1;
  305. unsigned char *data;
  306. size_t data_len;
  307. } hs[MBEDTLS_SSL_MAX_BUFFERED_HS];
  308. struct
  309. {
  310. unsigned char *data;
  311. size_t len;
  312. unsigned epoch;
  313. } future_record;
  314. } buffering;
  315. uint16_t mtu; /*!< Handshake mtu, used to fragment outgoing messages */
  316. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  317. /*
  318. * Checksum contexts
  319. */
  320. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  321. defined(MBEDTLS_SSL_PROTO_TLS1_1)
  322. mbedtls_md5_context fin_md5;
  323. mbedtls_sha1_context fin_sha1;
  324. #endif
  325. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  326. #if defined(MBEDTLS_SHA256_C)
  327. mbedtls_sha256_context fin_sha256;
  328. #endif
  329. #if defined(MBEDTLS_SHA512_C)
  330. mbedtls_sha512_context fin_sha512;
  331. #endif
  332. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  333. void (*update_checksum)(mbedtls_ssl_context *, const unsigned char *, size_t);
  334. void (*calc_verify)(mbedtls_ssl_context *, unsigned char *);
  335. void (*calc_finished)(mbedtls_ssl_context *, unsigned char *, int);
  336. int (*tls_prf)(const unsigned char *, size_t, const char *,
  337. const unsigned char *, size_t,
  338. unsigned char *, size_t);
  339. size_t pmslen; /*!< premaster length */
  340. unsigned char randbytes[64]; /*!< random bytes */
  341. unsigned char premaster[MBEDTLS_PREMASTER_SIZE];
  342. /*!< premaster secret */
  343. int resume; /*!< session resume indicator*/
  344. int max_major_ver; /*!< max. major version client*/
  345. int max_minor_ver; /*!< max. minor version client*/
  346. int cli_exts; /*!< client extension presence*/
  347. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  348. int new_session_ticket; /*!< use NewSessionTicket? */
  349. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  350. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  351. int extended_ms; /*!< use Extended Master Secret? */
  352. #endif
  353. #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
  354. unsigned int async_in_progress : 1; /*!< an asynchronous operation is in progress */
  355. #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
  356. #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
  357. /** Asynchronous operation context. This field is meant for use by the
  358. * asynchronous operation callbacks (mbedtls_ssl_config::f_async_sign_start,
  359. * mbedtls_ssl_config::f_async_decrypt_start,
  360. * mbedtls_ssl_config::f_async_resume, mbedtls_ssl_config::f_async_cancel).
  361. * The library does not use it internally. */
  362. void *user_async_ctx;
  363. #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
  364. };
  365. typedef struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer;
  366. /*
  367. * This structure contains a full set of runtime transform parameters
  368. * either in negotiation or active.
  369. */
  370. struct mbedtls_ssl_transform
  371. {
  372. /*
  373. * Session specific crypto layer
  374. */
  375. const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
  376. /*!< Chosen cipersuite_info */
  377. unsigned int keylen; /*!< symmetric key length (bytes) */
  378. size_t minlen; /*!< min. ciphertext length */
  379. size_t ivlen; /*!< IV length */
  380. size_t fixed_ivlen; /*!< Fixed part of IV (AEAD) */
  381. size_t maclen; /*!< MAC length */
  382. unsigned char iv_enc[16]; /*!< IV (encryption) */
  383. unsigned char iv_dec[16]; /*!< IV (decryption) */
  384. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  385. /* Needed only for SSL v3.0 secret */
  386. unsigned char mac_enc[20]; /*!< SSL v3.0 secret (enc) */
  387. unsigned char mac_dec[20]; /*!< SSL v3.0 secret (dec) */
  388. #endif /* MBEDTLS_SSL_PROTO_SSL3 */
  389. mbedtls_md_context_t md_ctx_enc; /*!< MAC (encryption) */
  390. mbedtls_md_context_t md_ctx_dec; /*!< MAC (decryption) */
  391. mbedtls_cipher_context_t cipher_ctx_enc; /*!< encryption context */
  392. mbedtls_cipher_context_t cipher_ctx_dec; /*!< decryption context */
  393. /*
  394. * Session specific compression layer
  395. */
  396. #if defined(MBEDTLS_ZLIB_SUPPORT)
  397. z_stream ctx_deflate; /*!< compression context */
  398. z_stream ctx_inflate; /*!< decompression context */
  399. #endif
  400. };
  401. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  402. /*
  403. * List of certificate + private key pairs
  404. */
  405. struct mbedtls_ssl_key_cert
  406. {
  407. mbedtls_x509_crt *cert; /*!< cert */
  408. mbedtls_pk_context *key; /*!< private key */
  409. mbedtls_ssl_key_cert *next; /*!< next key/cert pair */
  410. };
  411. #endif /* MBEDTLS_X509_CRT_PARSE_C */
  412. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  413. /*
  414. * List of handshake messages kept around for resending
  415. */
  416. struct mbedtls_ssl_flight_item
  417. {
  418. unsigned char *p; /*!< message, including handshake headers */
  419. size_t len; /*!< length of p */
  420. unsigned char type; /*!< type of the message: handshake or CCS */
  421. mbedtls_ssl_flight_item *next; /*!< next handshake message(s) */
  422. };
  423. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  424. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  425. defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  426. /* Find an entry in a signature-hash set matching a given hash algorithm. */
  427. mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
  428. mbedtls_pk_type_t sig_alg );
  429. /* Add a signature-hash-pair to a signature-hash set */
  430. void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
  431. mbedtls_pk_type_t sig_alg,
  432. mbedtls_md_type_t md_alg );
  433. /* Allow exactly one hash algorithm for each signature. */
  434. void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
  435. mbedtls_md_type_t md_alg );
  436. /* Setup an empty signature-hash set */
  437. static inline void mbedtls_ssl_sig_hash_set_init( mbedtls_ssl_sig_hash_set_t *set )
  438. {
  439. mbedtls_ssl_sig_hash_set_const_hash( set, MBEDTLS_MD_NONE );
  440. }
  441. #endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
  442. MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
  443. /**
  444. * \brief Free referenced items in an SSL transform context and clear
  445. * memory
  446. *
  447. * \param transform SSL transform context
  448. */
  449. void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform );
  450. /**
  451. * \brief Free referenced items in an SSL handshake context and clear
  452. * memory
  453. *
  454. * \param ssl SSL context
  455. */
  456. void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl );
  457. int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl );
  458. int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl );
  459. void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl );
  460. int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl );
  461. void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl );
  462. int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl );
  463. int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl );
  464. int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl );
  465. void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl );
  466. /**
  467. * \brief Update record layer
  468. *
  469. * This function roughly separates the implementation
  470. * of the logic of (D)TLS from the implementation
  471. * of the secure transport.
  472. *
  473. * \param ssl The SSL context to use.
  474. * \param update_hs_digest This indicates if the handshake digest
  475. * should be automatically updated in case
  476. * a handshake message is found.
  477. *
  478. * \return 0 or non-zero error code.
  479. *
  480. * \note A clarification on what is called 'record layer' here
  481. * is in order, as many sensible definitions are possible:
  482. *
  483. * The record layer takes as input an untrusted underlying
  484. * transport (stream or datagram) and transforms it into
  485. * a serially multiplexed, secure transport, which
  486. * conceptually provides the following:
  487. *
  488. * (1) Three datagram based, content-agnostic transports
  489. * for handshake, alert and CCS messages.
  490. * (2) One stream- or datagram-based transport
  491. * for application data.
  492. * (3) Functionality for changing the underlying transform
  493. * securing the contents.
  494. *
  495. * The interface to this functionality is given as follows:
  496. *
  497. * a Updating
  498. * [Currently implemented by mbedtls_ssl_read_record]
  499. *
  500. * Check if and on which of the four 'ports' data is pending:
  501. * Nothing, a controlling datagram of type (1), or application
  502. * data (2). In any case data is present, internal buffers
  503. * provide access to the data for the user to process it.
  504. * Consumption of type (1) datagrams is done automatically
  505. * on the next update, invalidating that the internal buffers
  506. * for previous datagrams, while consumption of application
  507. * data (2) is user-controlled.
  508. *
  509. * b Reading of application data
  510. * [Currently manual adaption of ssl->in_offt pointer]
  511. *
  512. * As mentioned in the last paragraph, consumption of data
  513. * is different from the automatic consumption of control
  514. * datagrams (1) because application data is treated as a stream.
  515. *
  516. * c Tracking availability of application data
  517. * [Currently manually through decreasing ssl->in_msglen]
  518. *
  519. * For efficiency and to retain datagram semantics for
  520. * application data in case of DTLS, the record layer
  521. * provides functionality for checking how much application
  522. * data is still available in the internal buffer.
  523. *
  524. * d Changing the transformation securing the communication.
  525. *
  526. * Given an opaque implementation of the record layer in the
  527. * above sense, it should be possible to implement the logic
  528. * of (D)TLS on top of it without the need to know anything
  529. * about the record layer's internals. This is done e.g.
  530. * in all the handshake handling functions, and in the
  531. * application data reading function mbedtls_ssl_read.
  532. *
  533. * \note The above tries to give a conceptual picture of the
  534. * record layer, but the current implementation deviates
  535. * from it in some places. For example, our implementation of
  536. * the update functionality through mbedtls_ssl_read_record
  537. * discards datagrams depending on the current state, which
  538. * wouldn't fall under the record layer's responsibility
  539. * following the above definition.
  540. *
  541. */
  542. int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl,
  543. unsigned update_hs_digest );
  544. int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want );
  545. int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context *ssl );
  546. int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush );
  547. int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl );
  548. int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl );
  549. int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl );
  550. int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl );
  551. int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl );
  552. int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl );
  553. int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl );
  554. void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
  555. const mbedtls_ssl_ciphersuite_t *ciphersuite_info );
  556. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  557. int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex );
  558. #endif
  559. #if defined(MBEDTLS_PK_C)
  560. unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk );
  561. unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type );
  562. mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig );
  563. #endif
  564. mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash );
  565. unsigned char mbedtls_ssl_hash_from_md_alg( int md );
  566. int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md );
  567. #if defined(MBEDTLS_ECP_C)
  568. int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id );
  569. #endif
  570. #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  571. int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
  572. mbedtls_md_type_t md );
  573. #endif
  574. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  575. static inline mbedtls_pk_context *mbedtls_ssl_own_key( mbedtls_ssl_context *ssl )
  576. {
  577. mbedtls_ssl_key_cert *key_cert;
  578. if( ssl->handshake != NULL && ssl->handshake->key_cert != NULL )
  579. key_cert = ssl->handshake->key_cert;
  580. else
  581. key_cert = ssl->conf->key_cert;
  582. return( key_cert == NULL ? NULL : key_cert->key );
  583. }
  584. static inline mbedtls_x509_crt *mbedtls_ssl_own_cert( mbedtls_ssl_context *ssl )
  585. {
  586. mbedtls_ssl_key_cert *key_cert;
  587. if( ssl->handshake != NULL && ssl->handshake->key_cert != NULL )
  588. key_cert = ssl->handshake->key_cert;
  589. else
  590. key_cert = ssl->conf->key_cert;
  591. return( key_cert == NULL ? NULL : key_cert->cert );
  592. }
  593. /*
  594. * Check usage of a certificate wrt extensions:
  595. * keyUsage, extendedKeyUsage (later), and nSCertType (later).
  596. *
  597. * Warning: cert_endpoint is the endpoint of the cert (ie, of our peer when we
  598. * check a cert we received from them)!
  599. *
  600. * Return 0 if everything is OK, -1 if not.
  601. */
  602. int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
  603. const mbedtls_ssl_ciphersuite_t *ciphersuite,
  604. int cert_endpoint,
  605. uint32_t *flags );
  606. #endif /* MBEDTLS_X509_CRT_PARSE_C */
  607. void mbedtls_ssl_write_version( int major, int minor, int transport,
  608. unsigned char ver[2] );
  609. void mbedtls_ssl_read_version( int *major, int *minor, int transport,
  610. const unsigned char ver[2] );
  611. static inline size_t mbedtls_ssl_hdr_len( const mbedtls_ssl_context *ssl )
  612. {
  613. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  614. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  615. return( 13 );
  616. #else
  617. ((void) ssl);
  618. #endif
  619. return( 5 );
  620. }
  621. static inline size_t mbedtls_ssl_hs_hdr_len( const mbedtls_ssl_context *ssl )
  622. {
  623. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  624. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  625. return( 12 );
  626. #else
  627. ((void) ssl);
  628. #endif
  629. return( 4 );
  630. }
  631. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  632. void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl );
  633. void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl );
  634. int mbedtls_ssl_resend( mbedtls_ssl_context *ssl );
  635. int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl );
  636. #endif
  637. /* Visible for testing purposes only */
  638. #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
  639. int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context *ssl );
  640. void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl );
  641. #endif
  642. /* constant-time buffer comparison */
  643. static inline int mbedtls_ssl_safer_memcmp( const void *a, const void *b, size_t n )
  644. {
  645. size_t i;
  646. volatile const unsigned char *A = (volatile const unsigned char *) a;
  647. volatile const unsigned char *B = (volatile const unsigned char *) b;
  648. volatile unsigned char diff = 0;
  649. for( i = 0; i < n; i++ )
  650. {
  651. /* Read volatile data in order before computing diff.
  652. * This avoids IAR compiler warning:
  653. * 'the order of volatile accesses is undefined ..' */
  654. unsigned char x = A[i], y = B[i];
  655. diff |= x ^ y;
  656. }
  657. return( diff );
  658. }
  659. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  660. defined(MBEDTLS_SSL_PROTO_TLS1_1)
  661. int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
  662. unsigned char *output,
  663. unsigned char *data, size_t data_len );
  664. #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
  665. MBEDTLS_SSL_PROTO_TLS1_1 */
  666. #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
  667. defined(MBEDTLS_SSL_PROTO_TLS1_2)
  668. int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
  669. unsigned char *hash, size_t *hashlen,
  670. unsigned char *data, size_t data_len,
  671. mbedtls_md_type_t md_alg );
  672. #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
  673. MBEDTLS_SSL_PROTO_TLS1_2 */
  674. #ifdef __cplusplus
  675. }
  676. #endif
  677. #endif /* ssl_internal.h */